Terms of Service

Effective date: 16 November 2026

1. Definitions and interpretation

1.1 In these Terms:

• “Agreement” means these Terms, the applicable Order Form and Schedule 1 (Data Processing).

• “Authorised Users” means your employees, contractors and, where the Order Form allows, SMEs participating in your programme, whom you permit to use the Service.

• “Business Hours” means 09:00 to 17:00 UK time on a day that is not a Saturday, Sunday or public holiday in England and Wales.

• “Customer Data” means data, documents and information submitted to the Service by you or your Authorised Users.

• “Fees” means the fees set out in the Order Form.

• “Force Majeure Event” means an event beyond a party’s reasonable control, including acts of God, war, terrorism, civil unrest, pandemic or epidemic, strikes or lockouts (other than of that party’s own workforce), failure of utilities or telecommunications networks, third-party cloud hosting outages, cyber-attacks or malicious acts (where not caused by that party’s failure to meet its security obligations), or government action.

• “Order Form” means the order form, statement of work or other document signed by both parties that describes the services and Fees.

• “Outputs” means reports, diagnostics, benchmarks, readiness indicators, scores, roadmaps and other materials the Service produces, including those generated using artificial intelligence.

• “Service” means the SciBridgeX platform and related assessment, benchmarking, implementation support, connection and monitoring services described in an Order Form.

• “SciBridgeX”, “we”, “us” means SciBridgeX Technologies Limited, registered in England and Wales (company number 16942880), registered office 20–22 Wenlock Road, London, N1 7GU.

• “you” means the organisation that has signed an Order Form or, for Part A only, a visitor to our website.

1.2 Unless the context requires otherwise: the singular includes the plural and vice versa; “person” includes a company or other legal entity; “including” means “including without limitation”; and headings do not affect interpretation.

2. About these Terms

2.1 Part A (clause 3) applies to everyone who uses our website. Part B (clauses 4 to 20) applies only where you have signed an Order Form.

2.2 If there is a conflict, the order of precedence is: (a) the Order Form; (b) Schedule 1, for data protection matters; (c) these Terms.

2.3 If you sign an Order Form on behalf of an organisation, you confirm that you are authorised to bind it.

Part A – Website use

3. Using our website

3.1 Our website provides general information about SciBridgeX and our services. It is not an offer of services capable of acceptance, and nothing on it is advice of any kind. The Important information page forms part of these Terms.

3.2 We try to keep the website accurate but do not guarantee that it is complete, accurate or up to date, or that it will be available without interruption. To the extent permitted by law, we are not liable for any loss arising from reliance on website content.

3.3 Links to third-party websites are provided for information only. We are not responsible for their content.

3.4 You must not misuse the website, including by introducing malicious code, attempting unauthorised access, or scraping content for commercial purposes.

Part B – Platform services

4. The Service

4.1 SciBridgeX provides a business-to-business data, diagnostic, benchmarking, implementation support and connection platform for SMEs and the organisations that support them, as described in the Order Form.

4.2 The Service is provided on a subscription or project basis, as set out in the Order Form. You are responsible for your Authorised Users’ compliance with this Agreement and for keeping log-in details secure.

4.3 We will provide the Service with reasonable skill and care. Apart from that, and except as expressly stated in this Agreement, we exclude all implied terms, conditions and warranties to the fullest extent permitted by law. We do not warrant that the Service will be uninterrupted or error-free.

4.4 We may update the Service from time to time. We will not materially reduce its core functionality during a paid subscription term without reasonable notice.

5. Service levels

5.1 Target. During a paid subscription term, we will use commercially reasonable efforts to make the Service available with a Monthly Uptime Percentage of at least 99.5% in each calendar month.

5.2 Measurement. “Monthly Uptime Percentage” means (total minutes in the month − Downtime minutes) ÷ total minutes in the month × 100. “Downtime” means any period when the core functions of the Service are unavailable, as measured by our monitoring systems, excluding Excluded Downtime.

5.3 Service credits. If we miss the target, you may request a credit, calculated as a percentage of the monthly Fees for the affected Service (annual Fees divided by 12):

5.4 Excluded Downtime. Excluded Downtime is unavailability caused by: (a) scheduled maintenance, for which we will use reasonable efforts to give at least 48 hours’ notice and to carry out outside Business Hours; (b) emergency maintenance needed to protect security or integrity; (c) a Force Majeure Event; (d) your acts or omissions, or your equipment, software or network; (e) suspension under this Agreement; or (f) use of the Service other than in accordance with this Agreement.

5.5 Claims. You must claim a credit by email to info@scibridgex.com within 30 days after the end of the affected month, giving the dates and times of the Downtime. We will check the claim against our records. Approved credits are deducted from future Fees, or refunded if no further Fees are payable.

5.6 Cap and sole remedy. Credits in any month will not exceed 20% of that month’s Fees. Service credits are your sole and exclusive remedy for any failure to meet the availability target. This does not affect your right to terminate under clause 15 for material breach. Credits are not payable if the Agreement has been terminated for your non-payment or material breach.

6. No advice, no rating, no reliance

6.1 Outputs are assessments based on information provided by SMEs, by you and by third parties, which we do not independently audit. Outputs are not an audit, certification, guarantee or credit rating. They are not investment, credit, legal, tax or financial advice, or a recommendation to enter into any transaction.

6.2 SciBridgeX does not arrange or advise on investments, lending or other financial transactions. We do not hold client money or assets.

6.3 You and any recipient of Outputs remain responsible for your own due diligence, credit and investment decisions, and legal and regulatory obligations, including customer due diligence under anti-money laundering laws.

6.4 Outputs are provided for your use alone. No other person may rely on them unless we have agreed in a signed reliance letter, which may set its own terms and limits on liability.

7. Acceptable use

7.1 You must not, and must ensure your Authorised Users do not: (a) use the Service in breach of applicable law; (b) reverse engineer, copy, resell or sub-license the Service, except as this Agreement allows; (c) upload malicious code or interfere with the Service’s operation; (d) upload unlawful, infringing or harmful content; or (e) use the Service or Outputs to carry on any regulated financial activity, or present Outputs as a credit rating or as investment advice.

7.2 You must ensure that you have the rights, notices and, where needed, consents required to submit Customer Data to the Service.

8. Intellectual property and Outputs

8.1 Our IP. SciBridgeX owns all rights in the Service, including its software, models, methodology and benchmarks.

8.2 Your data. You keep all rights in Customer Data. You grant us a non-exclusive licence to use Customer Data to provide and support the Service during the Agreement. You also authorise us to create anonymised, aggregated data from Customer Data, which does not identify you, any SME or any individual. We may use that anonymised data to develop benchmarks and improve our services, during and after the Agreement.

8.3 Outputs. Once the Fees for them are paid, we grant you a non-exclusive, perpetual, royalty-free, worldwide licence to use, copy and adapt Outputs for your own business purposes. You may share an Output with: (a) the SME it concerns; and (b) other third parties named in the Order Form or approved by us in writing (approval not to be unreasonably withheld), provided that the Output carries the notice in clause 6 when shared.

8.4 AI-generated material. Some Outputs are generated using artificial intelligence. We do not warrant that AI-generated material is free from third-party rights or errors. We will not assert our intellectual property rights against you for use of Outputs that complies with clause 8.3.

9. Data protection

9.1 Where we process personal data on your behalf, Schedule 1 applies. Where we act as controller (for example, for your account contacts), our Privacy Notice applies.

9.2 Nothing in this Agreement limits either party’s liability to a data subject under Article 82 UK GDPR or sections 168–169 of the Data Protection Act 2018.

10. Fees and payment

10.1 You will pay the Fees set out in the Order Form. Unless the Order Form says otherwise, Fees are exclusive of VAT and payable within 30 days of the invoice date.

10.2 Fees for the Service do not depend on whether any investment, loan or other financial transaction takes place.

10.3 If an undisputed invoice is overdue, we may charge interest at 4% a year above the Bank of England base rate. After giving you 14 days’ written notice, we may also suspend the Service.

11. Confidentiality

11.1 “Confidential Information” means any non-public information disclosed by one party to the other in connection with this Agreement that is marked as confidential, or would reasonably be understood to be confidential. It includes business plans, technical data, SME data, pricing and customer lists.

11.2 Each party will: (a) use the other’s Confidential Information only to perform its obligations or exercise its rights under this Agreement; (b) protect it with at least the care it uses for its own confidential information, and no less than reasonable care; and (c) disclose it only to employees, professional advisers or subcontractors who need to know it and are bound by equivalent confidentiality obligations.

11.3 Clause 11.2 does not apply to information that: (a) is or becomes public other than through a breach of this Agreement; (b) the recipient lawfully knew before disclosure; (c) is independently developed without using the Confidential Information; or (d) must be disclosed by law or by a competent authority. In case (d), the recipient will give prompt notice where it lawfully can.

12. Limitation of liability

12.1 Nothing in this Agreement limits or excludes liability for: death or personal injury caused by negligence; fraud or fraudulent misrepresentation; or any other liability that cannot lawfully be limited or excluded.

12.2 Subject to clauses 12.1 and 9.2, neither party is liable for: (a) indirect or consequential loss; (b) loss of profit, business, revenue or anticipated savings; or (c) loss or corruption of data, except to the extent caused by that party’s breach of its security obligations, wilful default or negligence. A party’s liability under (c) is limited to the reasonable cost of restoring the data from the most recent backup.

12.3 Subject to clauses 12.1 and 9.2, each party’s total aggregate liability arising out of or in connection with this Agreement, whether in contract, tort (including negligence) or otherwise, is limited to the Fees paid or payable in the 12 months before the event giving rise to the claim. This cap does not apply to your obligation to pay Fees.

12.4 Service credits under clause 5 count towards the cap in clause 12.3.

12.5 The parties agree that these limits are reasonable, taking into account the circumstances when this Agreement was made, the pricing of the Service and the commercial allocation of risk.

13. Indemnities

13.1 Our IP indemnity. We will defend you against any third-party claim that your use of the Service in accordance with this Agreement infringes that third party’s UK intellectual property rights. This excludes claims relating to Customer Data, to modifications we did not make, to combinations with other products, or to continued use after we have told you to stop. We will pay damages finally awarded against you, or settlements we have agreed.

13.2 Your indemnity. You will defend us against any third-party claim arising from Customer Data or from your breach of clause 7 (Acceptable use). You will pay damages finally awarded against us, or settlements you have agreed.

13.3 Conditions. The indemnified party must: notify the other party promptly; let the other party control the defence and settlement; and give reasonable help, at the other party’s cost.

13.4 Cap. Liability under this clause 13 is subject to clause 12.3.

14. Suspension

We may suspend access to the Service, in whole or in part, if reasonably necessary: to prevent a security threat; because of a breach of clause 7; or as permitted by clause 10.3. We will give notice where practicable and restore access promptly once the cause is resolved.

15. Term and termination

15.1 This Agreement runs for the term stated in the Order Form.

15.2 Either party may terminate the Agreement by written notice if the other party: (a) commits a material breach that is not remedied within 30 days of written notice; or (b) becomes insolvent, enters administration or liquidation, or makes an arrangement with its creditors.

15.3 Either party may terminate the Agreement immediately by written notice if the other party breaches clause 17.

16. Consequences of termination

16.1 On termination, your right to use the Service ends. For 30 days, we will make Customer Data available for export. After that, we will delete or return it in line with Schedule 1.

16.2 Termination does not affect rights and remedies that accrued before termination.

16.3 Clauses 6, 8, 9, 11, 12, 13, 16, 19 and 20, and clauses 7 and 8 of Schedule 1, survive termination.

17. Compliance

Each party will comply with applicable anti-bribery and anti-corruption laws, including the Bribery Act 2010, and with applicable sanctions laws. Each party will also have reasonable procedures to prevent modern slavery in its business and supply chains. Neither party will offer or accept any improper payment or advantage in connection with this Agreement, including to or from any public official.

18. Force majeure

Neither party is liable for delay or failure to perform caused by a Force Majeure Event. This does not apply to payment obligations, and it does not relieve SciBridgeX of its security, breach-notification and business-continuity obligations under Schedule 1. If a Force Majeure Event continues for more than 60 days, either party may terminate the affected services by written notice.

19. General

19.1 Entire agreement. This Agreement is the entire agreement between the parties on its subject matter. Neither party has relied on any statement not set out in it, but this does not limit liability for fraud.

19.2 Changes. We may update Part A at any time by posting a new version. Changes to Part B apply to an existing Order Form only if both parties agree them in writing, or from the next renewal date after at least 60 days’ notice.

19.3 Assignment and subcontracting. Neither party may assign this Agreement without the other’s written consent (not to be unreasonably withheld). However, we may assign it to a successor to our business. We may use subcontractors, but remain responsible for their performance.

19.4 Notices. Notices must be in writing and sent by email to the addresses in the Order Form (or, for us, info@scibridgex.com). A notice is treated as received on the next day after it is sent that is not a Saturday, Sunday or public holiday in England and Wales.

19.5 No partnership. Nothing in this Agreement creates a partnership, joint venture or agency between the parties.

19.6 Third-party rights. No one other than the parties has any right under the Contracts (Rights of Third Parties) Act 1999 to enforce this Agreement.

19.7 Severance and waiver. If any provision is held invalid, the rest of the Agreement continues in force. A delay in exercising a right is not a waiver of it.

20. Governing law and jurisdiction

This Agreement, and any dispute arising out of or in connection with it (including non-contractual disputes), is governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.

Contact: info@scibridgex.com

Schedule 1: Data Processing

This Schedule forms part of the Agreement between SciBridgeX Technologies Limited (“SciBridgeX”, the “Processor”) and the customer named in the Order Form (the “Controller”). It applies only where SciBridgeX processes personal data on the Controller’s behalf in providing the Service. It does not apply to personal data that SciBridgeX processes as a controller, such as website enquiries or the Controller’s account contacts; that data is covered by SciBridgeX’s Privacy Notice. Capitalised terms not defined here have the meanings given in the Terms of Service.

1. Roles and instructions

1.1 For the personal data described in Annex A (“Controller Personal Data”), the Controller is the controller and SciBridgeX is the processor.

1.2 SciBridgeX will process Controller Personal Data only on the Controller’s documented instructions, including on transfers to a third country, unless the law requires otherwise. In that case, SciBridgeX will tell the Controller of the requirement before processing, unless the law prohibits it.

1.3 The Controller’s instructions are set out in the Agreement, this Schedule, and any further written instructions the Controller gives that the parties agree. The Controller instructs SciBridgeX to anonymise and aggregate Controller Personal Data for the purpose described in clause 10.

1.4 SciBridgeX will tell the Controller immediately if, in its opinion, an instruction infringes the UK GDPR or other applicable data protection law.

1.5 If SciBridgeX processes Controller Personal Data for its own purposes in breach of this Schedule, it will be a controller for that processing.

2. Controller obligations

2.1 The Controller is responsible for: having a lawful basis for the processing; giving data subjects the required privacy information; and meeting any registration, notification or permit requirements that apply to it as controller in its own jurisdiction.

2.2 The Controller will not submit special category data or criminal offence data unless the parties have agreed it in writing, with appropriate safeguards.

3. Details of processing

The subject matter, duration, nature and purpose of the processing, and the types of personal data and categories of data subjects, are set out in Annex A.

4. Processor obligations

4.1 Confidentiality. SciBridgeX will make sure that everyone authorised to process Controller Personal Data, including employees, temporary workers and contractors, is bound by a duty of confidentiality.

4.2 Security. SciBridgeX will implement appropriate technical and organisational measures that meet Article 32 UK GDPR. These include, as appropriate: pseudonymisation and encryption; the ability to ensure ongoing confidentiality, integrity, availability and resilience; the ability to restore access after an incident; and regular testing. Current measures are described in Annex B.

5. Assistance and breaches

5.1 Data subject requests. Taking into account the nature of the processing, SciBridgeX will help the Controller, with appropriate measures, to respond to requests from data subjects exercising their rights. If SciBridgeX receives a request directly, it will forward it to the Controller without undue delay. It will not respond except on the Controller’s written instruction or where the law requires.

5.2 Breach notification. SciBridgeX will notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Controller Personal Data. The notice will include, so far as available: the nature of the breach; the categories and approximate number of data subjects and records affected; the likely consequences; and the measures taken or proposed. SciBridgeX will provide further information as it becomes available. It will not notify any regulator or data subject without the Controller’s prior written consent, unless the law requires.

5.3 Impact assessments. SciBridgeX will give reasonable help with data protection impact assessments and with any prior consultation with the ICO or another supervisory authority.

5.4 Information. SciBridgeX will make available all information reasonably needed to demonstrate compliance with this Schedule.

6. Sub-processors

6.1 The Controller gives general written authorisation for SciBridgeX to engage the sub-processors listed in Annex C.

6.2 SciBridgeX will give the Controller at least 30 days’ notice of any intended addition or replacement. The Controller may object on reasonable data protection grounds within 14 days of the notice. If no commercially reasonable solution is found within 30 days of the objection, either party may terminate the affected services without penalty, and the Controller will receive a pro rata refund of any prepaid Fees for them.

6.3 SciBridgeX will impose on each sub-processor, by written contract, data protection obligations equivalent to those in this Schedule. SciBridgeX remains fully liable to the Controller for each sub-processor’s performance.

7. Deletion or return

7.1 Within 30 days after the Agreement ends, SciBridgeX will, as the Controller chooses in writing, delete or return all Controller Personal Data. If the Controller requests it, SciBridgeX will certify deletion in writing. If the Controller makes no choice within that period, SciBridgeX will delete the data.

7.2 If the law requires SciBridgeX to keep any Controller Personal Data, it will tell the Controller and will continue to protect the data under this Schedule for as long as it keeps it.

8. Audit

8.1 SciBridgeX will allow the Controller, or an independent auditor it appoints who is bound by confidentiality, to carry out one audit in any 12-month period, on 30 days’ written notice, to verify compliance with this Schedule. A further audit is allowed after a personal data breach or where a regulator requires it.

8.2 SciBridgeX may meet an audit request first by giving written answers and documents describing its controls or, where available, a current independent certification report. If the Controller reasonably considers this insufficient, an audit may then take place.

8.3 Audits will take place during Business Hours, without unreasonably disrupting SciBridgeX’s operations. They are at the Controller’s cost, unless the audit reveals a material breach of this Schedule, in which case SciBridgeX will bear the reasonable costs.

9. International transfers

9.1 SciBridgeX will not transfer Controller Personal Data outside the UK unless: (a) the destination is covered by UK adequacy regulations; or (b) an appropriate safeguard under Article 46 UK GDPR is in place, namely the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a documented transfer risk assessment confirming that the data protection test is met.

9.2 Where Controller Personal Data originates in another country, the parties will cooperate to meet that country’s transfer requirements before the data is transferred to SciBridgeX. This includes any regulator approval, permit or transfer agreement that the law requires.

9.3 SciBridgeX will tell the Controller without undue delay if it can no longer comply with a transfer safeguard, or if it receives a legally binding request from a public authority for disclosure of Controller Personal Data, unless the law prohibits it from doing so.

10. Anonymised data

SciBridgeX may create anonymised, aggregated data from Controller Personal Data that does not identify any individual, SME or the Controller. It may use that data to develop benchmarks and improve its services. Once anonymised, the data is no longer Controller Personal Data. SciBridgeX will not attempt to re-identify it.

11. Liability

11.1 Each party’s liability under this Schedule is subject to clause 12 of the Terms of Service. Nothing in the Agreement limits either party’s liability to a data subject under Article 82 UK GDPR or sections 168–169 of the Data Protection Act 2018.

11.2 SciBridgeX is not liable for any breach of this Schedule to the extent it results from following the Controller’s instructions, or from the Controller’s own failure to comply with data protection law.

12. Order of precedence

On data protection matters, this Schedule prevails over the Terms of Service. Where an IDTA or the UK Addendum applies to a restricted transfer, that instrument prevails for that transfer.

Annex A: Details of processing

Annex B: Technical and organisational security measures

• Encryption of data in transit (TLS 1.2 or above) and at rest

• Role-based access controls, least-privilege access and multi-factor authentication for staff

• Logging and monitoring of access to Controller Personal Data

• Regular backups, and a tested process for restoring data

• A documented incident response procedure, including the 48-hour notification in clause 5.2

• Confidentiality undertakings and data protection training for staff with access

• Supplier due diligence before any sub-processor is appointed

Annex C: Sub-processors

The Controller authorises SciBridgeX to use sub-processors in the following categories:

The Order Form names each current sub-processor, with its location and transfer safeguard. The list is also available at any time on request from info@scibridgex.com. SciBridgeX will notify the Controller of any change under clause 6.2.

Any provider that stores or can access Controller Personal Data, including in encrypted form, is treated as a sub-processor.