Terms of Service | Artsignal

Business customers

Last updated: 7 October 2026

These terms cover Artsignal’s services for business customers, including subscriptions, trials and pilots. A separately agreed enterprise or pilot agreement takes priority for the services it covers.

1. About these terms

1.1 The parties. These Terms of Service apply to the business services provided by ArtVest AI Limited, trading as Artsignal, a company registered in England and Wales under number 15535449, with its registered office at 10 Rose & Crown Yard, London SW1Y 6RE (Artsignal, we, us). Customer means the business or professional organisation accepting these terms (you). These terms are for business use, not use as a consumer.

1.2 Agreement and acceptance. The Agreement consists of these terms, Schedule 1 and any order form, subscription order or other written service agreement accepted by both parties (Order). You accept by signing or expressly accepting an Order, confirming acceptance by email, or completing an electronic acceptance process that refers to these terms. The person accepting must have authority to bind the Customer.

1.3 Priority. A separately agreed enterprise or pilot agreement governs the services it covers and prevails over these terms. An Order prevails over these terms to the extent of an express conflict. Schedule 1 and clauses 6 to 10 and 12 govern the processing and protection of Customer Data; an Order changes those protections only if it expressly identifies the change and both parties agree it in writing. Administrative purchase-order terms do not amend the Agreement.

1.4 Defined terms.

(i) Services means the Artsignal applications, APIs, research, analytics and related services covered by the Order. Outputs means reports, estimates, analyses and other results generated through the Services.
(ii) Authorised Users means individuals you authorise to use the Services on your behalf. Subscription Term means the initial paid service period agreed in the Order and any renewal periods. Fees means the charges agreed in the Order.
(iii) Customer Data has the meaning in clause 6.1. Data Protection Laws means applicable data-protection and privacy laws, including the UK GDPR and Data Protection Act 2018, as amended, and the EU GDPR where applicable.
(iv) Business Day means a day other than a Saturday, Sunday or public holiday in England. Writing includes email. References to including are illustrative and do not limit the preceding words.

2. Services and access

2.1 Access rights. Subject to the Agreement and payment of applicable Fees, Artsignal grants you a non-exclusive, non-transferable right to allow Authorised Users to access the Services during the agreed service period for your business purposes. Usage limits, features and any specific support or training arrangements are set out in the Order. Your permitted use of Outputs is set out in clause 4.

2.2 Users and account security. Each account is for a named individual aged 18 or over. You may reassign access if the previous user’s access is revoked. You are responsible for your Authorised Users’ compliance and must protect credentials, avoid sharing accounts, and promptly tell us about suspected compromise. Additional users are subject to agreed charges, prorated for the remaining term where applicable.

2.3 Service standard and availability. Artsignal will provide the Services with reasonable skill and care. For paid Services, unless the Order states otherwise, we will use commercially reasonable efforts to achieve at least 98% availability in each calendar month, excluding:

(i) planned maintenance with reasonable advance notice and urgent maintenance needed for security or integrity;
(ii) outages caused by your systems, misuse or Customer Data;
(iii) outages of third-party AI, cloud or communications services outside our reasonable control; and
(iv) events described in clause 16.2.

We will notify you by email of significant unplanned outages affecting the paid Services, with updates until service is restored. AI features may experience latency or temporary unavailability. These exclusions do not limit our responsibilities for Customer Data or subprocessors.

2.4 Support and service changes. For paid Services, we provide email support on Business Days from 9am to 6pm UK time, targeting an initial response within one Business Day, and assign a customer success contact. These are response targets, not guaranteed resolution times. We may update the Services, but will not materially reduce their overall core functionality during a paid Subscription Term without your agreement.

2.5 Trials and previews. Free trials and pilots run for the period agreed in writing and may be extended by agreement. Either party may end a free trial or pilot on seven days’ written notice unless separately agreed otherwise. They do not automatically become paid subscriptions. Paid access requires an expressly accepted Order. Trial and preview features may change or be withdrawn and have no uptime or support targets unless agreed. The Customer Data, confidentiality, security and data-processing protections in this Agreement continue to apply.

3. Your responsibilities and acceptable use

3.1 Lawful inputs and use. You must have the rights and lawful basis needed to provide Customer Data, give processing instructions and use the Services and Outputs. You must provide reasonable cooperation and use the Services in accordance with the Agreement and applicable law, including applicable sanctions, export-control, anti-bribery and financial-services laws.

3.2 Restrictions. You must not, or allow others to:

(i) submit unlawful, infringing or malicious material, or use the Services fraudulently;
(ii) compromise security, disrupt the Services, access another customer’s information, or perform security testing without our prior written consent;
(iii) share or resell platform access, bypass usage limits, remove proprietary notices, or access the Services using automated tools except through authorised APIs;
(iv) copy or reverse engineer the Services except to the extent permitted by law; or
(v) use the Services or Outputs to build, train, test or operate competing software or a competing data platform, or create datasets for sale or licensing, without our written agreement.

These restrictions do not prevent your ordinary auction, valuation, advisory, lending, insurance or other professional activities, including permitted client reporting under clause 4. They do not restrict your use of your own source materials independently of the Services.

3.3 Suspension. We may suspend affected access where reasonably necessary to address a material breach, security threat, unlawful use or legal requirement. We will explain the reason where lawful, give notice where practicable, limit the scope and duration, and restore access promptly when the issue is resolved. Non-payment suspension is governed by clause 5.3.

4. Outputs and professional judgement

4.1 Ownership and use. You own the Outputs generated for you, except for Artsignal's underlying data and any third-party material they include, such as auction records, images and catalogue descriptions. Subject to compliance with the Agreement and payment of applicable Fees, you may retain and use Outputs during and after the service period for your business activities. You may incorporate them into your work and share them with clients and professional advisers for those purposes, subject to this clause and any rights restrictions clearly disclosed with third-party material. This does not permit resale of the Services or bulk licensing of Outputs as a standalone dataset.

4.2 Indicative results. Outputs may contain errors, omissions or bias and may rely on incomplete or inaccurate information. They are decision-support material and do not themselves constitute a formal appraisal, certified valuation, Red Book valuation, investment advice or other regulated professional opinion. We do not warrant that every Output is accurate, complete, current or suitable for a particular purpose.

4.3 Review and reliance. You are responsible for specialist review, checking relevant facts and obtaining professional advice where appropriate before relying on or sharing Outputs. Do not rely solely on Outputs for significant business, investment, lending or other decisions. You remain responsible for your own conclusions and compliance with applicable professional and regulatory standards.

4.4 Sharing with others. You must not represent that Artsignal has certified a valuation, provided regulated advice or assumed a professional duty to your clients. When sharing an Output as an Artsignal-generated result, identify it as indicative and AI-assisted. You may use reviewed Outputs as supporting material for your own professional opinion, provided you take responsibility for that opinion and do not attribute it to Artsignal.

5. Fees and payment

5.1 Charges and invoicing. Fees, usage allowances and billing arrangements are as agreed in the Order. Unless otherwise agreed, Fees are invoiced annually in advance and payable within 30 days of the invoice date. Fees exclude VAT and other applicable taxes and are non-refundable except as expressly provided in the Agreement or required by law. No Fees are due for a free trial unless expressly agreed.

5.2 Usage and additional capacity. We may measure usage to administer the agreed allowances. You may request a review of a measurement within 14 days of receiving it; we will investigate in good faith and correct errors. Unless the Order specifies overage pricing, if use exceeds agreed limits by more than 15% in two consecutive months, we will discuss an upgrade or revised allowance. Pricing changes require agreement and apply prospectively. We will not impose retrospective overage charges except for intentional circumvention of limits and only using an agreed charging basis.

5.3 Late payment. On undisputed overdue amounts, we may charge simple interest at 4% per annum above the Bank of England base rate, calculated daily. We may suspend paid access after at least seven days’ written notice if undisputed amounts remain unpaid. You must notify us promptly of a genuine invoice dispute and pay undisputed amounts when due. Payment disputes do not remove our data-protection, return or deletion obligations.

5.4 Renewal prices. For annual or longer subscriptions, any proposed renewal price change will be notified with the renewal reminder at least 120 days before renewal. Shorter subscription periods and their price-change notice arrangements must be specified in the Order. Fees do not increase during a committed term unless agreed. If a renewal change is notified late, clause 11.2 provides a further opportunity to decline renewal.

6. Customer Data and permitted processing

6.1 Scope of Customer Data. Customer Data means materials and information supplied by you or on your behalf to Artsignal for the Services, including uploads, images, collection records, prompts, documents and private annotations, together with copies and Outputs or derived records to the extent they contain or reveal those materials or their private context. It does not include information Artsignal lawfully holds or obtains independently without using those materials or their private context. This exclusion applies to independently sourced records, not copies supplied by you or their private context. The selection or grouping of works and information about a proposed sale, ownership or customer relationship remain protected where supplied through the Services.

6.2 Ownership and use. You and your licensors retain your rights in Customer Data. You authorise Artsignal to host, store and process it only as necessary to provide, secure, maintain and support your Services, follow your lawful documented instructions, or comply with law. This includes applying AI models to produce, review and amend the Outputs you request. Human access is limited to authorised service delivery, support, maintenance, security and legal purposes on a need-to-know basis.

6.3 No model training.

(i) Neither Artsignal nor its service providers may use Customer Data to train, retrain, fine-tune, validate, benchmark, test or otherwise improve any AI or machine-learning model, whether our own or a third party’s.
(ii) Customer Data received or generated through the Services will not be included in model training, validation or test datasets. We will not permit providers to use it for their own product improvement.

6.4 No shared database or onward commercial use.

(i) Customer Data will not be added to Artsignal’s shared market databases, general reference datasets or model-development datasets, made publicly searchable, sold, or disclosed to other customers.
(ii) We will not use Customer Data to enrich services or reports for other customers. Storage within your authorised workspace and processing to provide your Services are permitted under clause 6.2.
(iii) External AI and research tools may receive Customer Data only through providers meeting clause 9 and the same purpose, confidentiality and no-training restrictions. We will not submit private images or sale-sensitive information to public tools that do not meet those requirements.

6.5 Operational statistics and feedback. We may use fully anonymous technical operational statistics to manage reliability, capacity and security, provided they do not identify a customer, individual, artwork or transaction, reveal confidential content, or involve using Customer Data for model development. We may use voluntary product feedback only to the extent it excludes Customer Data and confidential information. Neither provision creates an exception to clauses 6.3 or 6.4.

7. Confidentiality

7.1 Confidential handling. Each party will protect the other’s non-public information with reasonable care, use it only for the Agreement, and disclose it only to personnel, professional advisers and permitted providers who need access and are bound by confidentiality obligations. Customer Data is confidential by default, whether or not it contains personal data. Non-public information about Artsignal’s software, models and business is also confidential.

7.2 Exceptions. These duties do not apply to information the receiving party can show:

(i) was already lawfully known without restriction;
(ii) became public without a breach of confidence;
(iii) was independently developed without using the confidential information; or
(iv) was lawfully received from another source without restriction.

Required legal disclosure must be limited to what is necessary, with advance notice where lawful. These exceptions do not authorise repurposing Customer Data received through the Services contrary to clause 6.

7.3 Publicity and duration. Neither party may use the other’s name or logo in marketing or case studies without prior written consent. Consent may be withdrawn for future use. Confidentiality continues for five years after the Agreement ends; for Customer Data and trade secrets it continues for as long as the information remains confidential.

8. Information security and incidents

8.1 Security controls. Artsignal will maintain technical and organisational measures appropriate to the sensitivity of Customer Data and the risks of processing, including:

(i) logical customer segregation and controls to prevent unauthorised cross-customer access;
(ii) encryption in transit using TLS 1.2 or higher, and at rest using AES-256 or equivalent current industry standards;
(iii) role-based, least-privilege access and multi-factor authentication for Artsignal personnel accessing production or customer data-bearing systems; and
(iv) access logging, security monitoring, vulnerability management, risk-based security testing, staff confidentiality and security awareness measures, and backup, recovery and incident-response procedures.

Access will be reviewed and removed when no longer needed. Controls may evolve without materially reducing the protection provided.

8.2 Incidents. We will notify you without undue delay after becoming aware of a security incident affecting the confidentiality, integrity or availability of Customer Data, including a personal data breach. We will provide available details of the incident, affected data, likely consequences, response measures and a contact, with updates as information becomes available. We will investigate, contain and mitigate the incident and reasonably assist your assessment and response.

9. Service providers and international transfers

9.1 Authorised providers. You give general written authorisation for Artsignal to use hosting, infrastructure and AI providers as subprocessors where necessary to deliver and support the Services, provided they meet the protections in the Agreement and offer sufficient guarantees of compliance with applicable Data Protection Laws. A current list of subprocessors, their functions and processing locations is available on request.

9.2 Provider terms.

(i) We may engage providers under binding standard business terms and data-processing agreements, including terms accepted electronically. The applicable terms must protect Customer Data through confidentiality, appropriate security, restricted use, no model training and deletion commitments. We will configure those services consistently with these commitments.
(ii) For personal data processed on your behalf, provider terms must also meet Article 28(4) of the UK GDPR and EU GDPR, as applicable. Provider retention must be limited to periods necessary for the authorised service, security and legal purposes.
(iii) Artsignal remains responsible for its subprocessors’ performance of these obligations.

9.3 Provider changes. For subprocessors processing personal data on your behalf, we will give reasonable advance written notice of any intended addition or replacement and a reasonable opportunity to object before the change takes effect.

9.4 International transfers. Any restricted transfer of personal data outside the UK or EEA must comply with applicable Data Protection Laws. We will ensure a valid adequacy decision or appropriate safeguards, including the UK International Data Transfer Agreement or UK Addendum to EU Standard Contractual Clauses, and EU clauses where required, with any necessary assessment and supplementary measures. Some subprocessors, including AI and email providers, process data in the United States. Relevant transfer information is available on request.

9.5 Optional third-party services. If you independently choose to connect or use a third-party service under your own contract, its terms govern that service. This does not reduce Artsignal’s obligations for providers we appoint to process Customer Data or otherwise perform our obligations under the Agreement.

10. Personal data

10.1 Roles and responsibilities. Each party will comply with applicable Data Protection Laws. For personal data processed on your behalf, you are the controller and Artsignal is the processor, or you are a processor and Artsignal is your subprocessor where you act for another controller. In the latter case, you must have authority to appoint Artsignal and pass on lawful instructions. The processing details are in Schedule 1. You are responsible for the lawful basis, notices and instructions for that processing.

10.2 Documented instructions. We will process personal data only on your documented instructions, including for transfers, unless required by law; where permitted, we will inform you of that requirement before processing. The Agreement and your authorised use of the Services constitute instructions. We will immediately notify you if we consider an instruction unlawful and may pause the affected processing pending clarification.

10.3 Assistance and personnel. We will ensure authorised personnel are bound by confidentiality, maintain security measures meeting Article 32, and assist you through appropriate technical and organisational measures with data-subject requests, taking account of the processing. We will promptly forward requests received directly and will not respond on your behalf without instructions unless required by law. Taking account of the processing and information available, we will assist with security, breach notifications, data-protection impact assessments and required prior consultation with regulators.

10.4 Compliance information and audits. We will provide information necessary to demonstrate compliance with our processor obligations and allow and contribute to proportionate audits and inspections by you or an independent auditor you appoint. Reviews will use documents or remote evidence where sufficient. Reasonable notice, confidentiality and safeguards for other customers apply, without preventing urgent or legally required access.

10.5 Data minimisation. Upload only the information needed for the agreed Services. Client names, contact details and other direct identifiers should be omitted unless necessary for an expressly agreed workflow. Personal data supplied inadvertently, or allowing indirect identification through a work or collection, remains protected under the Agreement. Do not upload special-category or criminal-offence data unless we have expressly agreed suitable arrangements in writing.

10.6 Artsignal’s own administration. Where Artsignal independently determines the purposes of processing business contact, billing and website visitor data for its own administration, it acts as a controller as described in its Privacy Policy at artsignal.co/privacy-policy. That policy does not give Artsignal additional rights to use Customer Data or override the protections in this Agreement.

11. Duration, renewal and termination

11.1 Service period. The Agreement starts when accepted under clause 1.2. Paid Services run for the period in the Order. Unless the Order states otherwise, an initial term of at least one year renews for successive one-year periods unless either party gives at least 90 days’ written notice of non-renewal. An initial term shorter than one year expires at its end unless the Order expressly specifies renewal periods and a suitable notice period. Free trials are governed by clause 2.5.

11.2 Renewal reminder. For annual and longer subscriptions, we will send a renewal reminder at least 120 days before renewal, stating the renewal date, proposed Fees and any material changes. If we provide that information after the applicable non-renewal deadline or less than 30 days before it, you may decline renewal within 30 days of receiving it. If renewal occurs during that window, a timely rejection ends the renewed term immediately; we will refund Fees for the unused part and will not charge a cancellation penalty.

11.3 Ending for cause. Either party may end the Agreement by written notice if the other commits a material breach that cannot be remedied or is not remedied within 30 days of written notice specifying it. Either may also terminate if the other enters insolvency, administration or liquidation or ceases business, to the extent permitted by applicable law.

11.4 Consequences. On expiry or termination, platform access ends subject to export arrangements, and accrued undisputed Fees remain due. If you terminate for Artsignal’s material breach, we will refund prepaid Fees for the unused service period. Otherwise a committed paid term cannot be cancelled for convenience unless the Order allows it. Permitted use of retained Outputs, data protection, return and deletion, confidentiality, accrued rights and liability provisions continue as needed to give them effect.

12. Return, deletion and retention

12.1 Your choice. At the end of the Services, you may choose return of Customer Data and retained Outputs in a commonly used format followed by deletion of our copies, or deletion without return. You may request a standard export during the Services or within 30 days after they end, without an additional fee. Data will remain protected and available for that purpose during this period unless you request earlier deletion.

12.2 Deletion periods.

(i) We will delete active copies within 30 days of your deletion instruction or completion of return.
(ii) If no instruction is received within 30 days after the Services end, we will delete active copies within the following 30 days.
(iii) Residual backups will remain protected, isolated from ordinary use and expire under our documented backup retention cycle, details of which are available on request. If a backup is restored, deletion instructions will be reapplied.

12.3 Retained copies and providers. We will ensure equivalent handling by subprocessors and confirm completion on request. Copies retained because law requires them will be limited to what is necessary, used only for that requirement and deleted when it ends. Confidentiality, security, no-training and data-processing obligations continue for any retained Customer Data.

13. Intellectual property, warranties and claims

13.1 Platform rights. Artsignal and its licensors retain rights in the platform, software, models, methods, documentation and underlying data they provide. You receive only the rights expressly granted in the Agreement. Your rights in Customer Data are unaffected. Third-party source materials may remain subject to their owners’ rights; the Agreement does not transfer ownership of them.

13.2 Warranties. Each party warrants that it has authority to enter into the Agreement. Artsignal’s service standard is in clause 2.3. Except as expressly stated and to the extent permitted by law, no other warranties or conditions are given, including as to fitness for a particular purpose or uninterrupted or error-free operation. These qualifications do not limit our express obligations for Customer Data, confidentiality, security or data protection.

13.3 Customer claims indemnity. Subject to clause 14, you will indemnify Artsignal against damages finally awarded and reasonable defence costs from a third-party claim arising from Customer Data infringing that party’s rights, or your unlawful use of the Services or material breach of the Agreement. This does not apply to the extent a claim results from Artsignal’s breach or use outside your lawful instructions.

13.4 Artsignal intellectual property indemnity. Subject to clause 14, Artsignal will indemnify you against damages finally awarded and reasonable defence costs from a third-party claim that your authorised use of the Services infringes a UK copyright, trade mark or patent. This excludes claims caused by Customer Data, unauthorised modifications or combinations not supplied or authorised by Artsignal. We may obtain rights to continue use, modify or replace the affected Services without materially reducing functionality, or terminate the affected Services and refund prepaid Fees for the unused period.

13.5 Claim procedure. The party seeking an indemnity must promptly notify the other of the claim, provide reasonable cooperation, and allow the indemnifying party to control the defence. A settlement requiring an admission of fault, payment or non-monetary obligation by the protected party requires its written consent, not to be unreasonably withheld. Delay in notification reduces protection only to the extent it materially prejudices the defence.

14. Liability

14.1 Liability that cannot be limited. Nothing in the Agreement limits or excludes liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot lawfully be limited or excluded.

14.2 Financial caps. Subject to clause 14.1 and any cap expressly agreed in the Order:

(i) for paid Services, each party’s total aggregate liability arising out of or in connection with the Agreement in any 12-month period beginning on the paid service start date or an anniversary is limited to the total Fees paid or payable for that period;
(ii) for a free trial or pilot, each party’s total aggregate liability is limited to £100,000 for that trial or pilot and all its extensions; and
(iii) these caps include confidentiality, security, data protection and the indemnities in clause 13, and apply in contract, tort (including negligence), breach of statutory duty or otherwise. A claim is allocated to the period in which the event giving rise to it first occurred. An event occurring after paid Services end is allocated to the final 12-month period in which those Services were provided. Later conversion of a trial to paid Services does not change the cap for an earlier event.

Your obligation to pay Fees properly due is not reduced by these caps.

14.3 Excluded losses and direct costs. Subject to clause 14.1, neither party is liable for indirect or consequential loss, or loss of profit, revenue, anticipated savings or business opportunity. This does not exclude reasonable direct costs of investigating and responding to a breach of the Agreement or restoring affected Customer Data, subject to clause 14.2. Nothing restricts individuals’ or regulators’ rights under applicable Data Protection Laws.

15. Changes to these terms

15.1 Future agreements and renewals. We may publish updated terms for future agreements. For an existing paid subscription, material changes will be notified by email at least 90 days before they are proposed to take effect, and other changes at least 30 days beforehand. Changes apply only at renewal unless required by law or you expressly agree earlier application. Material renewal changes for annual or longer subscriptions will be included with the reminder under clause 11.2. That clause’s additional non-renewal opportunity applies if notice is late.

15.2 Objections and legal changes. If you object to a material change within 30 days of notification, we will discuss it in good faith. Unless resolved, the existing terms continue for the current term and the subscription will expire at its end. If a change required by law must apply sooner, we will give as much advance notice as reasonably possible; if it materially reduces your contractual rights or the Services, you may end the affected Services before it takes effect and receive a refund for the unused prepaid period.

15.3 Existing agreements. Publishing a new version does not itself amend an existing separately agreed enterprise or pilot agreement. Free trials remain on the accepted version for their agreed duration unless a change is required by law or expressly agreed.

16. General provisions and contact

16.1 Entire agreement. The Agreement is the entire agreement for its subject matter and supersedes earlier discussions and proposals for those Services, without affecting accrued rights or separately agreed confidentiality obligations. Neither party relies on statements not set out in it. Nothing excludes liability for fraud.

16.2 Events outside reasonable control. Neither party is liable for delay or failure caused by events beyond its reasonable control, except payment obligations, provided it promptly notifies the other and takes reasonable steps to mitigate the effects. This does not excuse required security measures, incident notification or compliance with Data Protection Laws.

16.3 Assignment and other provisions. You may not assign the Agreement without our written consent, not to be unreasonably withheld. Artsignal may assign it to an affiliate or successor in a merger, reorganisation or sale of the relevant business, provided the successor assumes its obligations. No partnership, agency or exclusivity is created. Failure to enforce a right is not a waiver. If a provision is invalid, the remainder continues. No third party has contractual enforcement rights under the Contracts (Rights of Third Parties) Act 1999.

16.4 Notices and contact. Contractual notices must be in writing to the contact in the Order or a replacement notified in writing. If no Artsignal contact is specified, use info@artsignal.co or ArtVest AI Limited, 10 Rose & Crown Yard, London SW1Y 6RE. Emails are deemed received on the next Business Day after transmission if no failure notice is received. Security notices should also be sent to any designated incident contact.

16.5 Law and disputes. The Agreement and related non-contractual obligations are governed by the laws of England and Wales. The parties will first seek to resolve disputes through senior representatives, without preventing urgent relief. Mediation may be used by agreement. The courts of England and Wales have exclusive jurisdiction.

Schedule 1 | Processing details

This schedule applies where Artsignal processes personal data on the Customer’s behalf and forms part of the Agreement.

Subject matter and duration

Provision of the agreed Services during the applicable trial or Subscription Term, followed by the return, deletion and limited retention periods in clause 12.

Nature and purpose

Receiving, hosting, organising, retrieving and analysing object information; generating and reviewing Outputs; supporting authorised access; securing and maintaining the Services; and exporting or deleting data on instructions. No model training or general model evaluation.

Types of personal data

Artwork images, metadata, provenance, condition information, estimates, collection records and related notes may identify individuals directly or indirectly. Authorised-user names, business contact details, account identifiers, access records and activity logs may also be processed on the Customer’s behalf.

Categories of individuals

The Customer’s Authorised Users and personnel; clients, owners, consignors, buyers, advisers and other individuals identifiable in the materials supplied, as determined by the Customer’s lawful use of the Services.

Scope and minimisation

Only information necessary for the agreed workflow should be supplied. Direct client identifiers should be omitted unless necessary for an expressly agreed workflow. Inadvertently supplied personal data and indirect identification remain protected. Special-category and criminal-offence data require prior written agreement.

Instructions and rights

The Customer may give lawful documented instructions, manage users, request compliance information and assistance, and choose return or deletion. Where the Customer acts for another controller, it must have authority to give those instructions and exercise those rights.

Applicable safeguards

Clauses 6 to 10 and 12 set out purpose limitation, confidentiality, security, subprocessors, transfers, assistance, audit, incident response and return or deletion. These provisions and this schedule form the parties’ data-processing agreement.