Overview

These Terms form the general contractual framework for Ductio’s executive intelligence platform. They operate with the accepted Order and the identified versions of the applicable service, usage, intelligence-licensing, acceptable-use and data-processing documents. They distinguish Ductio’s independently sourced intelligence from private Customer Content. 

1 About these terms

1.1 These Customer Terms and Conditions govern access to and use of Ductio's executive intelligence platform and related subscribed services. Ductio supports executive research, recruitment, assessment, succession, investment, governance and organisational decision making. The services are supplied for business purposes only and are not consumer services.

1.2 The supplier is DUCTIO LTD, incorporated in England and Wales under company number 17303286 ('Ductio', 'we', 'us'). Our registered office is the address recorded for DUCTIO LTD at Companies House. 'Customer' or 'you' means the organisation or business identified in the accepted Order. A person accepting an Order for an organisation confirms that they are authorised to bind it.

1.3 An “Order” is an order form, subscription checkout, trial registration or other written order accepted by both parties, including recorded electronic acceptance. The Agreement consists of the Order, these Customer Terms and the identified versions of the Product and Usage Schedule, Data and Intelligence Licence Schedule and Acceptable Use Policy supplied and expressly incorporated at acceptance; the Data Processing Agreement (“DPA”) applies to processing on the Customer’s behalf. Product Specific Terms and other schedules apply only where supplied, identified and expressly incorporated. Visiting the website, joining a waitlist or possessing a payment method does not create a paid subscription. Ductio will make the complete applicable contract set available before acceptance and retain its version record.

1.4 'Services' means the services purchased or enabled under an Order. 'Authorised Users' means named individuals permitted by the Customer to use them within the purchased user allowance. 'Customer Content' means information uploaded, submitted or connected by the Customer or its users, including CVs, documents, notes, recordings, transcripts, project requirements and confidential project outputs. 'Ductio Intelligence' means professional profiles, licensed or public-source information, datasets and research supplied by Ductio independently of Customer Content. 'Outputs' means analyses, summaries, comparisons, scores and other results generated through the Services.

1.5 Mandatory law and mandatory international-transfer clauses prevail for the matters they govern, followed by the DPA for personal-data processing. Next, expressly agreed variations in the Order prevail only for that Order and only where they identify the provision varied. Product Specific Terms govern enabled service-specific matters; the Product and Usage Schedule governs measurement and purchased entitlements; the Data and Intelligence Licence Schedule governs licensed use and distribution; the AUP governs acceptable use and proportionate enforcement. These Customer Terms govern remaining matters, including payment, warranties, liability, indemnities, suspension, termination and disputes. This hierarchy controls a conflicting precedence statement in a schedule. A schedule does not vary those general commercial provisions unless an expressly accepted variation identifies the affected clause. An Order may vary the DPA only through an express lawful variation consistent with mandatory transfer provisions. Customer procurement terms do not vary the Agreement unless Ductio expressly accepts them in writing.

1.6 The Privacy Policy at https://www.ductio.co.uk/privacy-policy and the applicable Cookie Policy explain relevant processing and tracking. They are notices, not blanket consent, a licence to repurpose Customer Content or a replacement for the DPA. Internal governance, security and AI policies support Ductio’s operations; they do not become additional customer warranties merely because they appear in the corporate directory. A policy or statement creates a contractual commitment only to the extent expressly incorporated or required by law.

1.7 Ductio’s public legal directory shall identify the approved Customer Terms, Product Specific Terms where available, DPA and its relevant schedules, AUP, Product and Usage Schedule, Data and Intelligence Licence Schedule, Privacy Policy, Cookie Policy and any incorporated support schedule. The Order shall provide direct access to its applicable versions.

2 Orders and access

2.1 The Order must identify the Customer’s legal entity and authorised contact; enabled Services and permitted purposes; start date, commitment and billing periods; fees, currency and taxes; seat and usage entitlements; pooling and reset rules; renewal arrangement; and the titles and versions of incorporated documents. Relevant entitlement and licence annexes must be completed. State “not included”, “not applicable” or an expressly scoped “unlimited” where appropriate: a blank grants neither unlimited access nor approval for a charge. Ductio will provide confirmation and access to the accepted documents. You must provide accurate eligibility, business and billing information and keep it current.

2.2 Subject to the Agreement and payment of fees, Ductio grants a limited, non-exclusive, non-transferable right for Authorised Users to access the Services during the agreed term for the Customer's permitted business activities. Affiliates, outside contractors and clients receive access only if the Order permits it and within the applicable allowances.

2.3 Accounts are for named individuals. Do not share passwords, sessions, authentication codes or personal API credentials, lend an account to a client, or rotate one seat among multiple active users. A seat may be reassigned to a genuine replacement when the previous user loses access. Service accounts, guest access and API integrations require their recorded scope and controls; an integration credential does not grant extra user seats or extraction rights. You must manage permissions, protect credentials, remove departed users and promptly report suspected compromise. You are responsible for activity you authorise and for failures to take reasonable account-security measures, but this does not transfer responsibility for a breach caused by Ductio or its delivery chain.

2.4 Administrators may manage users, integrations and chargeable features within their authority. You must ensure they understand that authority. Ductio will not charge for additional paid usage merely because an allowance is reached; section 5 requires an approved purchase or a previously authorised spending arrangement.

3 Free trials

3.1 Unless the accepted trial Order expressly states otherwise, a trial lasts seven consecutive days from activation, covers one executive-search Project and one AI Run, with a second Run only on Ductio’s express approval. It excludes integrations and Voice. Storage, export and any paid-client delivery permissions must be stated at registration; trial access alone does not authorise commercial client delivery. The activation confirmation identifies the start, expiry and allowances. Joining a waitlist does not start the trial. The Product and Usage Schedule governs counting and failure treatment.

3.2 A trial is for genuine evaluation by one business. Duplicate accounts, repeated registrations, fabricated projects or other steps to obtain extra trials or extract data beyond the evaluation allowance are prohibited. Ductio may decline or suspend a trial for reasonable evidence of misuse.

3.3 A free trial ends automatically without a charge and does not convert into a paid subscription. A paid subscription requires a separately accepted paid Order and payment authorisation. We may contact you about your evaluation subject to applicable communications rules.

3.4 Trials have the same applicable data-protection safeguards as paid Services. Access may end at expiry. Export Customer Content or request assistance before expiry where practicable; the return and deletion rights in section 17 and the DPA remain available. Trial content and outputs transfer to a paid subscription only where confirmed, without counting the same existing Project again merely because of conversion. Limited support and functionality must be disclosed at registration; mandatory duties and section 15.1 remain unaffected.

4 Subscription periods and renewal

4.1 The subscription runs for the commitment period stated in the Order. Monthly billing does not mean that an annual commitment can be cancelled monthly. Stopping use, removing users or cancelling a payment instruction does not terminate the Agreement.

4.2 Automatic renewal applies only where the accepted Order expressly states the renewal period. If it does not expressly provide for automatic renewal, the subscription expires unless a renewal is agreed. The Order must state the non-renewal deadline. If automatic renewal is selected but that deadline is omitted, either party may give notice at least 30 days before the term ends for a term longer than 30 days; for a term of 30 days or less, notice may be given until the current term ends. A notice deadline must not expire before the Customer has accepted that subscription.

4.3 Give non-renewal notice using an available account cancellation function, the contractual contact identified in the Order, or a dated written notice to Ductio's registered office. Ductio will acknowledge receipt. A support request clearly identifying the account and intention not to renew is sufficient; cancellation is not conditional on attending a sales call.

4.4 A proposed renewal fee increase requires at least 60 days’ written notice and, in all cases, notice before the applicable non-renewal deadline. A late-notified increase does not apply to an automatic renewal unless you expressly accept it; otherwise the existing rate applies for that renewal. You may instead decline renewal within 30 days of the late notice, including ending a renewal already begun during that choice period, owing only the existing rate for the period supplied and receiving any unused prepayment back. Fees and allowances do not change during a committed term except through an agreed amendment or a narrowly necessary lawful change under section 18.

5 Usage allowances and additional purchases

5.1 The completed Order and Product and Usage Schedule identify seats, new and concurrent Projects, AI Runs or credits, storage, report and record exports, API delivery, integrations and Voice. The Schedule governs counting, reservations, failures, corrections, reset anchors, rollover and upgrades. Storage is a capacity allowance, not a replenishing monthly quantity. Purchased quantities do not expand permitted licence purposes. “Unlimited” in one category does not remove other disclosed constraints. An updated website catalogue does not change accepted entitlements.

5.2 A Project is a distinct business assignment, such as a search for a specified role and employer or a defined succession or leadership assessment. Renaming a Project does not turn an unrelated assignment into the same Project. An AI Run is one user-confirmed execution of the purchased analysis workflow, including a confirmed rerun. Internal model calls and retries needed for that execution are included unless a different measurement was expressly agreed. Browsing saved results and editing notes do not themselves count as Runs. Detailed activation, reopening and counting rules follow the incorporated Product and Usage Schedule.

5.3 Ductio will disclose the applicable unit before execution and maintain usage records sufficient to explain consumption and corrections. A failure within Ductio’s delivery chain producing no usable result consumes no allowance or is restored, including qualifying upstream failures; internal retries are not additional Runs. The Schedule governs partial results, cancellation and replacement-use periods. A completed search finding no suitable candidates is not automatically a failure. Usage records are open to reasonable challenge and are not conclusive evidence in a dispute.

5.4 At a purchased limit, Ductio may prevent new affected processing, uploads, exports or invitations while preserving access to existing content within the enabled Services and contractual data-return rights. There is no automatic plan upgrade or unapproved overage charge. An authorised representative must accept the price, quantity, effective date, expiry and any recurring commitment. Automatic top-ups remain off until expressly enabled with defined prices, triggers and enforceable spending caps. Future top-ups can be disabled without cancelling validly incurred purchases.

5.5 Separately chargeable functions, including Voice, remain off until an authorised user enables the agreed functions and accepts their activation record. Enabling calling does not automatically enable recording, transcription or other charges. An enabled recurring add-on remains chargeable until cancelled under its accepted terms even if unused. Disabling a function does not necessarily cancel number rental; the activation record must explain the distinction and cancellation route. Upgrades do not restart usage or extend commitments except as expressly agreed; downgrades normally apply at renewal.

5.6 Storage is for material relevant to the purchased Services, rather than general file storage. We may reject unsupported files, malware or uploads beyond the agreed allowance. Reasonable technical rate limits may protect service stability, but will not be used to impose undisclosed paid allowances or materially reduce the contracted entitlement.

6 Fees payment and refunds

6.1 Fees, currency, billing dates and payment method are stated in the Order. Fees exclude VAT and similar transaction taxes unless expressly stated otherwise. You must pay applicable taxes, excluding taxes on Ductio's income. Where a legally required withholding applies, provide the supporting evidence and cooperate on available relief; no additional gross-up is imposed unless expressly agreed.

6.2 Recurring card or bank charges require your authorisation and apply only to agreed fees, valid renewals and approved additions. Payment providers handle payment credentials under their own applicable terms. An expired payment method does not cancel a subscription.

6.3 Unless the Order states otherwise, invoiced fees are due within 30 days. Raise a disputed invoice promptly with reasons and pay the undisputed portion on time. Ductio will investigate, explain the outcome and correct an error. Good-faith disputed amounts are not grounds for suspension while that investigation and a reasonable opportunity to resolve the outcome remain ongoing. We may recover statutory late-payment interest and statutory recovery costs on sums properly overdue where applicable, without duplicate recovery.

6.4 Except for an express contractual or legal entitlement, prepaid fees are non-refundable and committed fees remain payable if you stop using the Services or cancel for convenience. Refund rights include overpayments, duplicate charges, valid termination for Ductio’s uncured material breach, material loss of purchased functionality or rights under sections 13 or 18, qualifying prolonged force majeure, and an affected-service exit expressly provided in the DPA, including unresolved subprocessor or unlawful-transfer issues. An affected-service refund is pro rata for prepaid unused service after the effective exit date; future fees for that service cease unless lawfully and expressly payable under the applicable exit provision. Ductio will pay an established refund within 30 days, using the original payment route where practicable, rather than require acceptance of account credit. Section 16 governs other termination consequences.

6.5 Discounts and eligibility conditions must be stated in the Order. If a material misrepresentation secured a discount, we may withdraw it prospectively after notice and recover an earlier discount only where the Order expressly permits that recovery or applicable law otherwise provides a remedy. We will explain the grounds and allow a reasonable opportunity to correct an error.

7 Permitted intelligence and report use

7.1 The accepted Order and Data and Intelligence Licence Schedule grant limited intelligence and Report rights. Ordinary professional use includes researching, comparing, annotating and analysing enabled information for the purchased purpose. Executive-search and advisory customers may share a proportionate Assignment Report, shortlist and permitted extracts with the identified Commissioning Client and its necessary personnel and professional advisers for that Assignment. Bind voluntary recipients in writing to purpose, confidentiality, lawful retention, correction and deletion, and onward-use restrictions; an engagement agreement may do this, but a footer alone is insufficient. Keep reasonable delivery records and take reasonable remedial steps on learning of misuse. Charging for the underlying professional Assignment is permitted. It does not permit standalone dataset sale or unrestricted access. Longlists, client portals, white-label delivery and guest access require their recorded permissions. This clause does not create an additional indemnity or strict liability for every recipient act.

7.2 You must preserve material source references, confidence information and qualifications when sharing results, and distinguish analysis from verified facts. Do not present an AI score, inferred association or uncertain statement as an established fact. Verify material findings against appropriate evidence before relying on or publishing them.

7.3 Access and export allowances do not permit scraping, harvesting, systematic manual collection, bulk extraction, database reconstruction, resale, sublicensing, recurring feeds or a substitute intelligence product. This includes combining repeated small exports, screenshots, queries or requests across accounts, Projects or periods, and deriving a reusable profile library or shared retrieval corpus from supplied material. API access is a delivery channel, not permission for bulk use or resale. Bulk delivery, model training or evaluation, external AI processing, embedding in another product and onward licensing each require express recorded rights, approved destinations and applicable source permissions. Source Conditions materially restricting use must be disclosed before supply; unidentified third-party terms impose no undisclosed customer obligations. Ordinary authorised research, accessibility use, permitted extracts, independent development from lawful independent sources, good-faith validation and mandatory legal rights remain permitted.

7.4 After expiry, lawfully delivered Assignment Reports and permitted extracts may be retained and used only within the surviving scope of the Data and Intelligence Licence Schedule, including completing that same Assignment and necessary audit, legal or professional records. There is no fresh search, refresh or unrelated assignment right. Apply lawful retention, access and correction controls, preserve assessment dates and do not present historical intelligence as current. Unused raw exports and API caches outside that surviving scope must be removed from active systems within 30 days unless an accepted licence variation or law requires otherwise. Hosted Customer Content return and deletion remain separate.

8 Acceptable use

8.1 You and your users must comply with the incorporated AUP and the obligations in these Terms. Do not use the Services for unlawful discrimination, harassment, deception, defamatory publication, unlawful surveillance, privacy abuse or unlawful communications. Do not evade seats, Projects, AI Runs, storage, exports, API limits, trials, Voice allowances, spending caps or security controls through duplicate identities, account or seat rotation, disguised assignments, split requests or manipulated metering. Report a discovered metering defect rather than exploit it. Reaching an allowance, legitimately refining an Assignment, seeking a correction or disputing usage in good faith is not itself misuse. Professional contact details grant no blanket marketing permission: comply with applicable UK PECR and EU or national rules, relevant subscriber distinctions and preference registers, sender identification, objections and opt-outs. Lawful business communications are permitted.

8.2 Do not upload or transmit malware, ransomware, malicious macros, phishing material or content intended to compromise accounts, connected systems or other customers. Malicious prompt injection includes instructions designed to expose another tenant’s data, reveal protected system information, execute unauthorised actions or defeat safeguards. Do not attempt credential attacks, privilege escalation, denial of service, tenant-boundary bypass or interference with logs and security controls. Security or load testing requires prior written agreement on scope. Reverse engineering and removal of protected notices are prohibited except where a mandatory legal right applies. Asking for available explanations, reporting errors and exercising lawful rights are permitted. On discovering unintended access, stop the affected activity, collect only minimum necessary evidence and report it securely; cooperate proportionately in containing an accidental harmful upload.

8.3 Do not upload special category personal data, criminal-offence data, classified material, government secrets or information subject to security-clearance restrictions unless Ductio has expressly agreed the processing and safeguards in writing and you have the necessary legal authority. The standard commercial service is not an approved environment for classified or restricted defence workloads.

8.4 Do not use protected characteristics, sensitive traits or proxies to discriminate unlawfully in matching, ranking or selection, including by applying criteria that produce unlawful indirect discrimination. Do not use Ductio for unlawful profiling, sensitive-trait inference, stalking, doxxing, coercion, persecution, unlawful blacklisting or surveillance, or to evade valid correction, objection or suppression instructions by reimporting a record. Public professional data does not remove lawful-basis, transparency, accuracy, minimisation, impact-assessment or individual-rights duties. Lawful equality monitoring, reasonable adjustments and positive action require their own valid basis, permitted scope and safeguards. Specialised public-sector, defence or regulated research requires separately agreed lawful scope, authority, source rights and controls; no agreement permits a prohibited practice.

9 Artificial intelligence and human decisions

9.1 The Services may use AI to extract, link, summarise, compare and analyse information and generate indicators. Outputs may contain errors, omissions, bias, outdated information or incorrect identity matches. Scores describe an analysis against stated inputs and context; they do not establish objective suitability or predict an outcome with certainty.

9.2 The standard Services are decision support. A competent person with authority to change the outcome must meaningfully review relevant identity, source evidence, criteria, accuracy, bias and limitations before a consequential decision takes effect. Rubber-stamping an automated recommendation is insufficient. Do not use the standard Services to make final hiring, rejection, promotion, dismissal or other legally or similarly significant decisions solely by automated processing. Maintain required explanations and challenge routes. This is a contractual restriction for the standard product; it does not assert that every automated decision is unlawful. A separately proposed automated-decision service requires an expressly agreed lawful scope and safeguards before deployment.

9.3 Ductio provides decision support, rather than regulated investment advice, legal advice, a formal background check, security clearance or a guarantee of candidate performance. Commission any required professional advice, verification or regulated screening separately. Ductio remains responsible for its own contractual and legal duties.

9.4 Customer Personal Data is processed only within the DPA’s documented instructions. Ductio shall not sell or license it, build a shared candidate database from it, disclose it to unrelated customers, or train or fine-tune shared or general-purpose models with it. Provider training, retention and access must be restricted consistently with those instructions. Customer-specific adaptation requires explicit instructions, tenant isolation and agreed processing details. Genuinely anonymous statistics may be created only within lawful authority and applicable instructions; pseudonymised or merely aggregated identifiable data remains personal data. Feedback permission does not extend to private project information.

9.5 Each party shall meet the AI obligations applicable to its actual role and intended use, including the EU AI Act as amended and to the extent applicable and in force. Ductio remains responsible for its provider duties. The Customer must follow intended-use instructions, assign competent oversight, maintain required records, train relevant personnel and report material concerns, fulfilling applicable deployer duties. Human review does not itself remove a high-risk classification. A material change of purpose, substantial modification or repackaged AI service requires review and express lawful scope before deployment; contractual labels do not settle regulatory status. The standard Services do not permit prohibited AI practices, unlawful social scoring, sensitive-trait ranking or workplace emotion recognition. If legally required safeguards are unavailable for an intended use or territory, do not deploy there until they are implemented. No separate licence can legalise a prohibited practice.

10 Customer content and intellectual property

10.1 You retain your rights in Customer Content. You grant Ductio and its contracted providers only the rights necessary to host, copy, process, transmit and generate Outputs from it to provide, secure and support the Services and comply with the Agreement. For personal data processed on your behalf, those activities must follow your documented instructions and the Data Processing Agreement.

10.2 You confirm that you have the rights and authority needed to supply Customer Content and instruct its processing. You are responsible for its lawful collection, appropriate privacy information, accuracy and permitted use. Tell us promptly about a restriction, correction or rights request affecting it.

10.3 Ductio and its licensors retain their rights in the platform, software, taxonomies, methodologies, templates and supplied intelligence. You retain rights in Customer Content and your own contributions. Reports may contain several rights layers: permitted report use does not transfer the underlying database or third-party rights. Ductio does not claim ownership of facts merely because they appear in a profile. Confidential customer-specific inputs and results shall not be supplied to unrelated customers. AI-generated material may not attract exclusive IP rights, and similar results may be generated independently.

10.4 Ductio may separately license or sell professional intelligence collected and maintained in its independent-controller capacity, subject to lawful processing, transparency, source licences and individual rights. This clause does not authorise the sale of Customer Content, private CVs, confidential notes, recordings or client projects, or their reuse across products for unrelated purposes. A separate lawful written arrangement is required for such use.

10.5 You may voluntarily provide suggestions. We may use those suggestions without payment, but this permission does not extend to your personal data, confidential information or intellectual property embedded in Customer Content. Neither party may use the other's name, logo or customer relationship in publicity without prior written permission.

11 Data protection and confidentiality

11.1 Each party must comply with applicable data-protection and electronic-communications law, including UK GDPR and the Data Protection Act 2018 as amended, including the Data (Use and Access) Act 2025 to the extent in force, EU GDPR where applicable, and relevant national electronic-communications requirements. Roles follow actual activities, not labels. Ductio may act as an independent controller for its separately maintained intelligence and necessary account, billing and security processing; the Customer normally controls its selection decisions and onward use. The same person’s data may be held separately in different roles.

11.2 The incorporated DPA governs personal data processed on the Customer’s behalf, including uploads, prompts, transcripts, embeddings and customer-specific outputs. It must be accepted with completed relevant schedules before trial or paid processing begins. A Customer acting as processor must obtain its controller’s authority for Ductio to act as subprocessor. Matching or enrichment does not convert private Customer Personal Data into Ductio-controlled intelligence. The DPA governs instructions, security, subprocessor authorisation and notice, breach reporting, rights assistance, audits, transfers, return and deletion; these Customer Terms neither replace nor dilute those protections.

11.3 Each controller remains responsible for lawful purposes and bases, transparency, minimisation, retention, rights handling and required impact assessments. Licensed supply is neither consent from the individual nor a lawful basis itself. Provide required direct or indirect-collection information and document any lawful exception; public availability is not a blanket exemption. The parties shall cooperate proportionately on corrections, restrictions, complaints and rights requests concerning exchanged intelligence, update affected active copies and notify known recipients where required. Sensitive-data processing, controller-to-controller distribution and joint-controller activities require their applicable documented lawful arrangements. Each party must provide the complaint route and acknowledgements required by applicable law. Nothing impedes an individual’s statutory rights or a regulator’s powers.

11.4 Ductio shall apply appropriate technical and organisational security measures and the contractual minimum measures in the DPA to processor-held data. Those minimum obligations, incident notices and lawful audit rights are not reduced by a general disclaimer. Document actual hosting, processing, backup and relevant remote-access locations, agreed residency and transfer safeguards in the Order or DPA. Regional hosting does not imply every supplier or support activity occurs there. No certification, regulatory approval, particular residency or unrecorded service level is promised. Internal security policies and supplier certifications are not evidence that Ductio itself is certified.

11.5 Each party must protect the other's confidential information using reasonable care, restrict access to people and providers who need it and are bound by appropriate confidentiality duties, and use it only to perform the Agreement or exercise rights under it. Confidential information includes non-public commercial terms, Customer Content, credentials and proprietary technical information.

11.6 Confidentiality does not cover information lawfully public, independently developed, already lawfully known or lawfully received without restriction. Legally compelled disclosure is permitted, with prior notice where lawful and practicable and disclosure limited to what is required. Confidentiality continues for five years after termination, and for trade secrets and personal data for as long as their nature or law requires.

12 Voice communications and integrations

12.1 Voice, recording, transcription, forwarding, summaries and integrations apply only where included and expressly enabled. The accepted activation record must identify numbers, destinations, charges, counting and rounding, forwarding legs, storage, retention, spending caps, cancellation and any portability arrangements. Premium or otherwise unapproved destinations and processing must remain blocked. Number availability and portability depend on providers and local rules; no ownership or portability guarantee is made unless agreed. The Product and Usage Schedule governs metering and approved additions.

12.2 You are responsible for lawful communications, recording and transcription notices, consent where required and appropriate retention. Ductio shall provide the agreed technical controls, display usage and retention information and process customer recordings under the DPA. The standard service does not perform emotion recognition, biometric identification or sensitive-trait inference from Voice. Voice is not an emergency-calling service and must not be relied on to contact emergency services. Any lawful specialised use requires separate scope and safeguards.

12.3 Connect external accounts only where authorised, using scoped permissions and protected credentials; revoke access when no longer required. Identity association must use verified identifiers where available and uncertain matches must be reviewed: a name alone is not conclusive identity. Third-party services have their own applicable terms and charges, disclosed where incorporated into the purchase. Ductio remains responsible for its contracted integration and processing chain, while independent providers’ functionality and the Customer’s separately purchased accounts are outside its control. Authorising a connection does not authorise unrelated provider retention, training or onward disclosure.

12.4 Communications or agent features may send messages or initiate activity only within the permissions and scope you approve. You are responsible for approved recipients and lawful instructions; Ductio remains responsible for executing the agreed permissions and safeguards. New separately chargeable integrations require approval under section 5.

13 Service delivery support and changes

13.1 Ductio will provide the paid Services with reasonable skill and care and materially in accordance with the agreed description. Support hours, response commitments and any service levels apply only if stated in the Order or a service-level schedule. No specific uptime percentage or response time is implied.

13.2 Maintenance, updates and outages may interrupt access. We will use reasonable efforts to notify you of planned material interruptions and restore service after an incident. We may immediately take protective action where necessary for security or legal compliance and will communicate material effects as soon as reasonably practicable.

13.3 We may improve and update the Services, but will not materially reduce core purchased functionality during a committed term without your agreement. If an unavoidable legal or third-party licensing change removes a material contracted function, we will seek a reasonable substitute; if none is available, you may terminate the affected Service and receive a pro rata refund of unused prepaid fees for it.

13.4 Preview or beta features must be identified before use and may be changed or withdrawn within their disclosed evaluation scope. Do not rely on them for critical production decisions unless separately agreed. Applicable confidentiality, security, data-protection and non-excludable obligations continue. Roadmaps, proposed integrations and future certifications are not purchased commitments unless expressly included in the Order. Support targets, restoration targets and uptime warranties require an accepted service-level schedule; no certification is claimed without current evidence.

14 Warranties and third party claims

14.1 Each party warrants that it has authority to enter into and perform the Agreement and will comply with laws applicable to its performance. Ductio warrants that it holds or will procure the rights needed to supply the contracted Services and grant the expressly recorded intelligence permissions. It does not warrant complete, current or error-free source coverage or Outputs, or a particular recruitment, financial or commercial outcome. These qualifications do not remove reasonable skill and care, express contractual commitments, applicable source-right remedies or non-excludable duties.

14.2 Ductio will defend a third-party claim that the contracted platform or Ductio-supplied Intelligence, as supplied and used within granted rights, infringes that party’s UK or EU copyright, database right or trade mark. Ductio will pay damages, reasonable legal costs finally awarded and reasonable settlement sums it agrees. Exclusions apply only to the extent a claim is caused by Customer Content, an unauthorised modification, a combination neither supplied nor required by Ductio that would otherwise not infringe, or continued affected use after notice and availability of a suitable non-infringing replacement. Ductio’s source and supply obligations continue; no wider patent or freedom-to-operate warranty is implied. Sections 14.5 and 15 govern process and limits.

14.3 For a covered claim, Ductio may obtain continued-use rights, provide an equivalent non-infringing replacement or modification, or terminate the affected Service with a pro rata refund of unused prepaid fees. These remedies and section 14.2 are the contractual remedies for that infringement claim, subject to section 15.1.

14.4 You will defend third-party claims arising from Customer Content supplied without necessary rights, your deliberate unlawful use, or your knowing unauthorised extraction or redistribution of Ductio Intelligence, and pay damages, reasonable legal costs finally awarded and reasonable settlement sums you agree. This applies only to the extent caused by that conduct and excludes the part caused by Ductio’s breach, unlawful processing or negligence. Minor accidental usage errors and good-faith disputes do not themselves create an indemnity. Sections 14.5 and 15 govern process and limits.

14.5 The protected party must promptly notify the defending party, allow control of the defence through competent counsel and provide reasonable cooperation at the defending party’s expense. Late notice reduces protection only to the extent it materially prejudices the defence. The protected party may participate through its own counsel at its own expense. A settlement must fully release the protected party for the covered claim; no admission of fault or non-monetary obligation may be imposed without its consent, not unreasonably withheld. If the defending party fails to undertake a required defence after reasonable notice, the protected party may defend reasonably and seek covered costs within section 15. No party may settle so as to increase the other’s liability without consent.

15 Limits of liability

15.1 Nothing in the Agreement excludes or limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any liability that cannot lawfully be excluded or limited. The Agreement does not restrict an individual's statutory rights or a regulator's powers.

15.2 Subject to section 15.1, neither party is liable for indirect or consequential loss, or loss of profit, revenue, anticipated savings or business opportunity, whether direct or indirect. This exclusion does not remove properly due fees or refunds, amounts covered under section 14, or reasonable direct costs of restoring Customer Content and responding to an incident caused by breach. Those costs and covered third-party claim amounts remain subject to the applicable cap unless section 15.1 or mandatory law prevents limitation.

15.3 Subject to sections 15.1 and 15.4, each party’s aggregate liability arising under or in connection with the Agreement for events first occurring in a Contract Year is capped at the greater of £5,000 and fees paid or payable under the Agreement for that Contract Year. A Contract Year is each consecutive 12-month period beginning on the subscription start date and its anniversaries, rather than a rolling window. For an Agreement shorter than 12 months, use fees for its full term; for a final partial Contract Year, use fees for that partial period. Related claims from the same event or connected series are allocated to the Contract Year of the first event and do not multiply the cap.

15.4 For breaches of confidentiality, data-protection duties and section 14 obligations, the cap is twice the amount calculated under section 15.3. It is a higher aggregate ceiling, not a sum added to the general cap: liabilities subject to either ceiling count towards that higher ceiling, while ordinary claims remain bounded by the lower ceiling. Properly due agreed fees and contractual refunds are outside these caps. Mandatory transfer provisions prevail where they prohibit limiting liability; no cap removes individual or regulatory liability where law prohibits it. The exclusions and caps apply only so far as lawful, including applicable UCTA reasonableness and EU Data Act unfair-term rules. No schedule or AUP creates an undisclosed unlimited indemnity, penalty or additional cap.

15.5 These limits reflect a business-to-business service and remain subject to applicable legal requirements of reasonableness. They apply in contract, tort including negligence, breach of statutory duty and otherwise. Each party must take reasonable steps to mitigate loss.

16 Suspension and termination

16.1 Ductio may investigate credible evidence of security threats, unlawful use or material misuse using proportionate necessary records, subject to confidentiality, law and the DPA. Consider legitimate explanations, authorised bulk rights, client delivery and disputed metering. Unusual usage alone is not proof. Measures must reflect evidence, seriousness, intent, recurrence, harm and risk; consider clarification, warning, correction, revoking compromised credentials, quarantining a suspect upload or restricting an affected user, export or integration before wider suspension. Immediate containment may be necessary for credible security risk, serious harm or binding law, confined to affected access where practicable, with reasons and next steps promptly where lawful. Suspension for overdue undisputed fees requires at least 14 days’ written warning and opportunity to pay; section 6.3 protects genuine disputes. You may request review and submit evidence through the Order contact or website support route. Use a reviewer separate from the initial decision where practicable; normally acknowledge within five UK business days and give an outcome or reasoned progress update within ten UK business days after receiving necessary information. Explain any extension and next update date; consider urgent disruption promptly. Review continuing restrictions and restore mistaken or resolved access promptly, correcting usage and allowances where appropriate. This process does not delay statutory rights, incident notices or urgent relief, permit unrestricted system audits or content access, or create an automatic fine, forfeiture, punitive licence fee or retrospective charge. Termination follows section 16.2; a minor error does not automatically end every surviving Report licence.

16.2 Either party may terminate for the other's material breach if it remains unremedied 30 days after written notice specifying the breach. A material breach incapable of remedy permits immediate termination. Either party may terminate where the other ceases business or enters an insolvency process, to the extent permitted by applicable insolvency law.

16.3 A non-renewal ends the subscription at term expiry. Early termination for convenience is permitted only where the Order expressly provides it. On valid termination, accrued fees remain payable; future fees cease except for the remaining committed fees expressly payable where the Customer terminates for convenience or Ductio terminates for the Customer's material breach, subject to law and mitigation. Ductio will not recover the same loss twice.

16.4 Termination does not affect accrued rights or clauses intended to survive, including permitted report retention, confidentiality, intellectual property, payment, liability, data return and dispute provisions. A suspension must not be used to frustrate a lawful data-return obligation.

17 Exit data return and deletion

17.1 Export Customer Content before expiry where practicable. For at least 30 days after expiry or termination, you may request secure return in an available commonly used, machine-readable format, subject to the DPA and any longer mandatory switching or retrieval period under section 17.5. Ductio may provide a safe limited export route where full access would present a justified risk. Exhausted intelligence-export allowances and a payment dispute do not defeat a contractual or statutory return. Standard return of processor-held personal data is not conditioned on buying a new subscription; additional migration work requires advance agreement and any fee must be lawful. Missing the ordinary request window does not waive an individual’s rights, mandatory switching rights or the DPA’s return and deletion duties.

17.2 At your choice, processor-held personal data shall be returned then deleted, or deleted alone, under the DPA. Unless an earlier lawful instruction applies, active copies shall be deleted no later than 90 days after termination, with no intervening use except return, deletion or lawful retention. Isolated residual backups shall be overwritten or securely erased within a further maximum 90 days under the DPA. Deletion covers relevant derived records, indexes and embeddings, not only source files, and is propagated to subprocessors. Restored data must have prior deletion and restriction instructions reapplied before ordinary use. DPA confirmation and lawful-retention provisions govern.

17.3 Ductio may retain limited independently controlled account, accounting, security or dispute records only for justified lawful periods and with restricted access. Processor-held Customer Personal Data may be retained after the DPA deletion deadline only to the extent storage is required by applicable law, under the DPA’s notice, isolation and restriction requirements; a general business convenience or future product purpose is insufficient. Independently maintained professional intelligence follows its separate lawful retention and rights processes. Ending a subscription does not convert private Customer Content into that database.

17.4 Telephone-number release, integration disconnection and agreed portability assistance follow the add-on terms, subject to mandatory law. Coordinate these before expiry. Retained Reports and personal data remain subject to section 7 and applicable privacy obligations.

17.5 Where mandatory EU Data Act switching rules apply to an enabled data-processing Service, those rules prevail over conflicting commitment, notice, retrieval, fee or deletion provisions. Ductio shall remove contractual and technical switching obstacles, provide required assistance and continuity, and make exportable input, output and relevant metadata available in a commonly used machine-readable format with the interfaces required by law. The Order or incorporated switching record must identify exportable categories and formats, justified exclusions, procedure, lawful notice and transition periods, retrieval period, security and continuity arrangements, termination trigger and permitted charges. Necessary switching operations are not subject to commercial intelligence-export quotas; no prohibited switching charge or disguised penalty is payable. Switching does not grant unrelated rights in protected provider or third-party material, but exclusions must not impede mandatory rights. Ductio shall preserve data for the applicable retrieval period, then delete consistently with law and the DPA, without extending ordinary processor retention beyond lawful instructions. The parties shall cooperate reasonably on the destination’s requirements; functional-equivalence guarantees apply only where law or an express agreement requires them.

18 Changes to these terms

18.1 The versions accepted for the current committed term govern the complete contract set. Publishing a replacement website page, catalogue, AUP or schedule does not silently replace them. Ductio shall retain versioned masters and accepted snapshots or immutable references and make the relevant versions available on request. Orders shall record the accepting representative, organisation, time and versions. Internal approval records are not incorporated as customer obligations.

18.2 Proposed renewal changes to the contract set require at least 60 days’ written notice, direct access to the replacement versions and notice before the non-renewal deadline. Late-notified changes do not apply to an automatic renewal without express acceptance; the existing versions govern that renewal. You may decline renewal within 30 days of late notice on the same exit and refund basis as section 4.4. Material changes during a committed term require agreement except narrowly necessary mandatory-law changes under section 18.3. Operational measures implementing existing security obligations do not create new charges, data-use rights or undisclosed licence restrictions.

18.3 For a mandatory-law change, we will explain the reason and give reasonable advance notice where practicable. If the change materially adversely affects the purchased Service and no reasonable alternative is available, you may terminate the affected Service with a pro rata refund of unused prepaid fees. We will not retrospectively authorise new charges or unrelated use of Customer Content by updating these Terms.

19 General contractual provisions

19.1 Neither party is liable for delay caused by an event beyond its reasonable control where it takes reasonable mitigation steps and promptly notifies the other. Lack of funds and ordinary avoidable supplier-management failures are not such events. If a material affected Service cannot be performed for more than 30 consecutive days, either party may terminate it and unused prepaid fees will be refunded. Accrued fees remain due.

19.2 Neither party may assign the Agreement without the other's written consent, not unreasonably withheld, except to a successor acquiring substantially all of the relevant business, provided it assumes the obligations, can perform them and the transfer does not materially reduce protection for the other party. Data transfers remain subject to law and the Data Processing Agreement.

19.3 Ductio may use subcontractors but remains responsible for performing its obligations. Subprocessor appointment and objections follow the Data Processing Agreement. The Agreement creates no partnership, employment, agency or exclusivity.

19.4 The Agreement is the entire agreement for the purchased Services and supersedes earlier discussions about them. Neither party relies on representations not included in it, without excluding fraud or liability that cannot lawfully be excluded. A waiver applies only if expressly given; delay in enforcing a right is not a waiver.

19.5 If a provision is invalid, the remainder continues so far as lawful. A lawful limited modification may be made only to the minimum extent needed to give effect to the provision. Except as expressly stated in the Data Processing Agreement or required by law, no third party may enforce the Agreement under the Contracts (Rights of Third Parties) Act 1999.

19.6 Electronic acceptance and signatures may form the Agreement. Notices must be in writing to the contractual contact in the Order or a notified replacement; notices to Ductio may also be delivered to its registered office. Email notices are effective on acknowledgement or on the next UK business day after transmission without a delivery-failure message. Postal notices are effective on evidenced delivery. This clause does not govern formal service of court proceedings.

20 Governing law disputes and contact

20.1 The Agreement and related non-contractual disputes are governed by England and Wales law and its courts have exclusive jurisdiction, subject to mandatory law and applicable transfer clauses’ law, forum and beneficiary rights. This does not disapply mandatory EU data, AI, equality, employment or local requirements. After written dispute notice, commercial contacts shall seek resolution, escalating to senior representatives after ten UK business days. After a further twenty UK business days, either party may propose mediation or bring proceedings. Mediation requires agreement. These steps do not delay urgent relief, regulatory complaints, individual rights or statutory and limitation deadlines.

20.2 For account, payment, cancellation, usage and contract queries, use https://www.ductio.co.uk, the Order contact or Legal, DUCTIO LTD, at its registered office. Privacy requests follow the Privacy Policy. Retain your Order and accepted Terms.