Master Services Agreement

1. How this Agreement is put together

1.1 The agreement between us is made up of these Terms, each Statement of Work ("SOW") signed by both parties, the Schedules to these Terms, and any Change Request signed by both parties. Together these are the "Agreement".

1.2 These Terms are published at neoswave.com/msa and are versioned. The version incorporated into a SOW is the version in force on that SOW's Effective Date, as identified in the SOW by version number. That version continues to apply to that SOW for its duration regardless of any later version we publish, unless both parties agree in writing to move to a later version.

1.3 If there is a conflict, the following order applies (highest first):

• (a) any variation or Change Request signed by both parties after the SOW's Effective Date;
• (b) the SOW, but only where it expressly states that it varies these Terms and identifies the clause number it varies;
• (c) these Terms;
• (d) the Schedules to these Terms;
• (e) the rest of the SOW;
• (f) any other document referred to in the SOW.

1.4 A SOW that is silent on a matter covered by these Terms, or that contradicts these Terms without expressly identifying the clause it varies, does not vary these Terms. This is so that a commercially drafted SOW cannot accidentally displace the legal framework both parties rely on.

1.5 Each SOW is a separate contract for the purposes of its term, notice periods, minimum commitments, Service Levels, Charges and liability caps. Terminating one SOW does not terminate any other.

1.6 An Affiliate of the Client may sign a SOW under these Terms. Where it does, that Affiliate becomes a party to that SOW and these Terms apply to it as if it were the Client. Where the Client is named in a SOW as the procuring party for an Affiliate, the Client is jointly and severally liable for that Affiliate's obligations under that SOW.

1.7 No purchase order, supplier portal terms, click-through terms, or standard terms of purchase issued by the Client apply to the Agreement, even if we acknowledge or reference a purchase order for administrative or invoicing purposes.

1.8 In these Terms: headings are for convenience only; the singular includes the plural; "including" and "such as" are not limiting; "writing" includes email; references to legislation include that legislation as amended or replaced; and a reference to a party includes its permitted successors and assigns.

2. Definitions

Affiliate

Any entity that controls, is controlled by, or is under common control with a party, where control means holding more than 50% of the voting rights.

Access & Permissions Matrix

The record, in the form set out in the SOW, of the systems Neos Personnel are given access to, the roles and permission sets granted, who configured them, and when they were last confirmed.

Business Day

Monday to Friday, excluding public holidays in England and Wales.

Charges

All sums payable by the Client under a SOW, exclusive of VAT.

Client Data

All data, including personal data, that the Client or its customers provide to us, or that we process on the Client's behalf, in delivering the Services.

Client Dependencies

The things the Client must do, provide or maintain for us to deliver the Services, as set out in clause 4 and listed in the SOW.

Client Materials

Content, documentation, brand assets, macros, templates, process guides and other materials the Client provides for use in the Services.

Client Systems

Any system, platform, application or environment owned, licensed, contracted or administered by the Client or its other suppliers, including the Client's helpdesk, CRM, order management, telephony and identity systems.

Confidential Information

Information disclosed by one party to the other in connection with the Agreement that is marked confidential or that a reasonable person would understand to be confidential, including commercial terms, pricing, customer data, technical information and business plans.

Data Protection Law

The UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and where applicable Regulation (EU) 2016/679 and any other applicable data protection or privacy legislation, in each case as amended or replaced.

Effective Date

The date a SOW starts, as stated in that SOW.

Good Industry Practice

The standard of skill, care, diligence and judgement that would reasonably be expected of a competent, experienced provider of managed customer experience and contact centre services.

Insolvency Event

A party suspends or ceases to carry on business; is unable to pay its debts as they fall due; enters administration, liquidation, receivership or a voluntary arrangement with creditors; has a bankruptcy order made against it; or anything equivalent occurs in any jurisdiction.

Minimum Commitment

Any minimum volume of hours, full-time equivalents, tickets, resolutions or Charges stated in a SOW.

Neos Materials

Everything we own or develop independently of the Agreement, including our methods, frameworks, standards, quality models, training assets, knowledge packs, agent configurations, prompt libraries, tooling, software, templates, reporting formats and know-how, together with all improvements to them.

Neos Personnel

Our employees, workers, contractors and approved subcontractors engaged in delivering the Services.

Relief Event

An event listed in clause 5.4.

Root Cause Review

The joint review process in clause 5.6.

Security Incident

A confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Client Data.

Service Credit

A credit against Charges payable where a SOW expressly provides for one and the conditions in clause 5.8 are met.

Service Levels

The measurable performance targets set out in a SOW.

Services

The services described in a SOW.

Stabilisation Period

The period after go-live stated in a SOW during which Service Levels are measured for information only.

Term

In relation to a SOW, its duration as stated in that SOW.

3. Our obligations

3.1 We will provide the Services described in each SOW, from its Effective Date, for its Term.

3.2 We will provide the Services with reasonable skill and care and in accordance with Good Industry Practice, and will comply with all laws and regulatory requirements applicable to us in delivering them.

3.3 We will follow the Client's reasonable written instructions, provided they are consistent with the SOW, lawful, and given by a person the Client has named in the SOW as authorised to give them. Where an instruction would take us outside the SOW, clause 6 applies.

3.4 We will comply with the Client's IT, security, data and acceptable use policies to the extent they are provided to us in writing in advance, are relevant to the Services, and do not conflict with the Agreement. Where a policy would materially increase our cost or reduce our ability to meet a Service Level, clause 6 applies.

People

3.5 We will provide suitably skilled, trained and vetted personnel in the numbers and to the standards set out in the SOW. All Neos Personnel complete data protection and security training before being given access to any Client System, and are under written confidentiality obligations.

3.6 Where a SOW names core resources, we will maintain a written record of them and give the notice stated in the SOW before changing them, except where a change is outside our reasonable control (for example resignation, illness, or dismissal for cause), in which case we will notify the Client as soon as reasonably practicable and provide a replacement of equivalent capability.

3.7 We may replace Neos Personnel with individuals of equivalent skill and capability. Where a SOW specifies a handover period, we will observe it.

Subcontracting and delivery locations

3.8 We deliver through a distributed team and may use approved subcontractors. We remain responsible for the performance of the Services and for the acts and omissions of Neos Personnel as if they were our own. The delivery locations and any subcontractors relied on are listed in the SOW; we will give the Client 30 days' written notice before adding a delivery location or subcontractor that will process Client Data, and the Client may object on reasonable data protection or regulatory grounds.

Third-party platforms

3.9 Where a SOW provides that we supply or administer a third-party platform (for example a helpdesk, telephony or integration platform):

• (a) we will administer, configure, monitor and maintain it with reasonable skill and care, and carry out the testing set out in the SOW;
• (b) we are responsible for our own administration and configuration of it;
• (c) we are not responsible for the underlying availability, performance, security or defects of that third party's platform or of any telecommunications network. Our obligation in respect of those matters is to notify the Client promptly, investigate within the times set out in the SOW, provide regular updates until resolution, use reasonable endeavours to pursue the third party, and pass through to the Client any credit or recovery we obtain that relates to the Client's use;
• (d) the Service Levels do not apply to the extent a failure is caused by such a third-party platform failure.

3.10 Third-party platform licences and subscriptions we procure on the Client's behalf are subject to the minimum terms and notice periods stated in the SOW, which reflect the terms we are committed to with the supplier.

Reporting and continuous improvement

3.11 We will provide the reports and attend the governance meetings set out in the SOW, check reports for accuracy before issuing them, and raise risks, themes and improvement opportunities we identify. We will act on the Client's behalf only where a SOW expressly says we may, and only within the scope stated.

4. Your obligations, dependencies and system access

4.1 The Client will provide the information, decisions, approvals, materials, training, system access and cooperation we need to deliver the Services, in each case in reasonable time. Where a SOW sets a response time for a decision or approval, the Client will meet it.

4.2 Each SOW lists the specific Client Dependencies for that engagement, with named owners. The Client will perform them. The list is not exhaustive of the Client's obligations under this clause 4.

Access, roles and permissions

4.3 The Client is responsible for creating, configuring, granting, restricting, monitoring, reviewing and revoking all user accounts, roles, permission sets, entitlements, approval limits and workflow rules that apply to Neos Personnel within Client Systems.

4.4 The permissions, roles and approval limits the Client configures in Client Systems are the definitive record of the access the Client has authorised for Neos Personnel; the Client need not maintain any separate access schedule. Before go-live, and on any material change, the Client will confirm in writing which Neos Personnel may take high-impact actions — in particular issuing refunds, credits, replacements, discounts or goodwill payments, making account or data changes, or deleting records — and any value limits on them. Where a SOW includes an Access & Permissions Matrix, it supplements this clause; where it does not, the configuration in Client Systems together with that confirmation is the record of the Client's intent.

4.5 Neos Personnel will act within the permissions actually granted to them and in accordance with the process documentation the Client provides. We are entitled to rely on the permissions configured in Client Systems as an accurate expression of the authority the Client intends to grant, and on the Client's process documentation as accurate and current.

4.6 We are not liable for any loss arising from an act or omission of Neos Personnel that was within the permissions granted by the Client and consistent with the Client's process documentation, where the loss arises because:

• (a) the permissions, roles, entitlements or approval limits configured by the Client were broader than the Client intended, or were incorrectly configured;
• (b) the Client's process documentation, macros, workflow rules or knowledge base content were inaccurate, incomplete or out of date; or
• (c) the Client changed any of the above without notifying us in accordance with clause 4.8.

This clause 4.6 does not apply where the act or omission was reckless, dishonest, or in deliberate disregard of a written instruction we had received and acknowledged.

4.7 Balancing this, if we become aware that the permissions granted appear materially broader than the scope recorded in the Matrix, or that the Client's process documentation appears materially inaccurate, we will notify the Client in writing without undue delay and, where the Client asks, help identify the correction needed. Notification is at no charge; implementing changes in Client Systems is the Client's responsibility.

4.8 The Client will notify us in writing, giving the notice stated in the SOW (and if the SOW is silent, at least five Business Days), before making any change to Client Systems, permission configurations, entitlement rules, escalation routes, approval limits or documented processes that affects the Services. Where advance notice is not possible, the Client will notify us as soon as reasonably practicable.

4.9 The parties will conduct a joint access review at the frequency stated in the SOW, and at least once every six months, to confirm that the permissions granted still match the Matrix and that leavers have been removed. Each party will action its own part of the review outcome within 10 Business Days.

Systems, licences and materials

4.10 The Client will provide access to Client Systems and any licences we need, free of charge, for the duration of the SOW and solely for the purpose of delivering the Services. The Client is responsible for the availability, performance, security and configuration of Client Systems.

4.11 The Client warrants that it owns or is licensed to use the Client Materials and Client Data it provides, that providing them to us and our use of them for the Services will not infringe any third party's rights, and that its instructions are lawful.

4.12 Where a SOW requires the Client to provide volume forecasts, the Client will provide them at the stated frequency and to the stated accuracy tolerance. Forecast accuracy is a condition of the Service Levels: see clause 5.4(e).

4.13 The Client is responsible for obtaining any third-party consent, licence or permission needed for us to deliver the Services, in advance.

4.14 Any delay in or failure of the Services that results from the Client not complying with this clause 4 is not our responsibility, and is a Relief Event.

5. Service Levels, Relief Events and remedies

5.1 The Service Levels are those set out in the SOW, measured using the method and reporting source stated there. Where a SOW does not state a measurement method, the Service Level is measured from the reporting available in the platform used to deliver the Services.

5.2 Where a SOW provides that Service Levels will be agreed after go-live once baseline performance is understood, no Service Level applies, and no Service Credit can accrue, until the Service Levels have been agreed in writing by both parties. Both parties will work in good faith to agree them within the period stated in the SOW. If the Service Levels have not been agreed within that period, or within 90 days of go-live where the SOW is silent, either party may escalate under clause 18.

5.3 During any Stabilisation Period, Service Levels are measured and reported for information only. No Service Credit accrues and clause 5.7(d) does not apply.

Relief Events

5.4 Each of the following is a Relief Event:

• (a) a failure by the Client to perform a Client Dependency or any obligation in clause 4;
• (b) instructions, process documentation, macros, templates, workflow rules or knowledge base content provided by the Client that are inaccurate, incomplete, out of date or inconsistent;
• (c) misconfiguration of Client Systems, user roles, permission sets, entitlements, approval limits, routing or workflow by the Client, its Affiliates or its other suppliers;
• (d) unavailability, degradation, defect or change in any Client System, or in any third-party platform or telecommunications network we do not administer, or in any third-party platform we administer to the extent covered by clause 3.9(c);
• (e) actual volumes varying from the Client's forecast by more than the tolerance stated in the SOW, or the Client failing to provide a forecast;
• (f) the Client failing to provide a decision, approval, sign-off, training or product information within the time stated in the SOW;
• (g) the Client failing to provide the reporting or data access needed to measure a Service Level;
• (h) a suspension under clause 7.8, or a force majeure event under clause 17;
• (i) any other act or omission of the Client, its Affiliates, its customers or its other suppliers that materially prevents or delays our performance.

5.5 Where a Relief Event occurs, to the extent it affects our performance:

• (a) we are relieved from the affected obligations;
• (b) the affected Service Levels do not apply for the affected period, and any affected measurement is excluded from the Service Level calculation;
• (c) no Service Credit accrues, and no refund, credit note or price adjustment is payable;
• (d) any deadline or milestone is extended by a period at least equal to the delay caused;
• (e) we may charge for the additional time and reasonable costs we incur in working around, investigating or remedying the Relief Event, at the rates in the SOW, provided we notify the Client of the expected effort before incurring it where it is reasonably practicable to do so.

We will notify the Client of a Relief Event within five Business Days of becoming aware of it, will take reasonable steps to mitigate its effect, and will resume full performance as soon as reasonably practicable. If we fail to notify within that period we may still rely on the Relief Event, but not on 5.5(e) for effort incurred before notification.

Root Cause Review

5.6 If either party considers that a Service Level has been missed, or that a service failure, error or incident has caused loss, either party may request a Root Cause Review. Then:

• (a) the Review starts within five Business Days of the request and concludes within 15 Business Days, unless the parties agree a longer period;
• (b) both parties provide the relevant records, logs, system configuration history, permission audit trails, tickets and reports in their control;
• (c) the Review produces a short written record setting out what happened, the root cause, how responsibility is attributed between us, the Client and any third party, the remedial actions required, and who owns each;
• (d) no Service Credit, refund, credit note, discount or other financial concession is payable or agreed in respect of the matter until the Review is concluded, unless both parties agree otherwise in writing;
• (e) if the parties cannot agree the attribution, either may escalate under clause 18.

Remedies

5.7 Where a Root Cause Review finds a Service Level failure or service failure attributable to us:

• (a) we will re-perform the affected Services at no additional charge, where re-performance is possible and would be of benefit;
• (b) we will produce a remediation plan within 10 Business Days, agree it with the Client, and deliver it within the budgeted Charges;
• (c) where the SOW provides Service Credits, clause 5.8 applies;
• (d) if the same Service Level fails in three consecutive months and each failure is attributable to us, the Client may terminate the affected SOW on 30 days' written notice, with no exit charge under clause 8.4(b) or 8.4(d).

5.8 Service Credits. Where a SOW expressly provides for Service Credits:

• (a) they are calculated as stated in the SOW;
• (b) the total Service Credits for any month cannot exceed 10% of the Charges for that month under that SOW, and for any rolling 12 months cannot exceed 10% of the Charges for that period;
• (c) they must be claimed in writing within 30 days of the conclusion of the Root Cause Review, failing which the claim lapses;
• (d) they are applied as a credit against the next invoice, not paid in cash;
• (e) they are the Client's sole financial remedy for a Service Level failure, the Client's other remedies being re-performance under 5.7(a), remediation under 5.7(b) and termination under 5.7(d). This does not limit the Client's remedies for breach of clause 9, 10, 11 or 12, or for any matter within clause 13.1.

Where a SOW does not expressly provide for Service Credits, none apply.

5.9 Goodwill concessions. If we offer a credit, refund, free-of-charge work or other concession outside this clause 5, it is a one-off act of goodwill. It is not an admission of liability or of a Service Level failure, does not create any precedent or entitlement, and does not oblige us to make the same concession again.

5.10 The Client will not withhold, deduct or set off any amount from the Charges in respect of a claimed service failure. Claims are pursued under this clause 5 and, if necessary, clause 18. See clause 7.6.

6. Change control

6.1 In-scope changes. Changes within the delivery model already agreed — for example adjusting volumes, hours, languages, categories or channels already priced in the SOW — are requested in writing to the person named in the SOW, on the notice period stated there, and are subject to availability. We will confirm in writing when the change takes effect.

6.2 Out-of-scope changes. Anything else is requested as a Change Request. We will respond within five Business Days (or one Business Day for an emergency request where the SOW provides for one) with the scope, effort, cost, timing and any impact on Service Levels or Client Dependencies. No work starts until both parties sign.

6.3 A signed Change Request amends the SOW it relates to. All other terms of the SOW and these Terms continue to apply. Schedule 3 sets out the form.

6.4 We may decline a change that is not operationally or commercially viable, or that would require capability we do not have, giving our reasons. We will not unreasonably decline a change that is within the delivery model already agreed.

6.5 Scope changes only take effect when signed by a person named in the SOW as authorised to sign them. Requests made informally — in tickets, chat messages, meeting notes or email threads — do not change scope, Charges, Service Levels or Client Dependencies, however often they are repeated. Where we do additional work in good faith at the Client's informal request, we may charge for it at the rates in the SOW, having first told the Client that the work is out of scope and chargeable.

7. Charges, invoicing and payment

7.1 The Client will pay the Charges set out in the SOW. All Charges are exclusive of VAT and any other applicable sales or transaction tax, which the Client pays in addition at the prevailing rate.

7.2 Minimum Commitment. Where a SOW states a Minimum Commitment, the Client pays it in full for each period it applies, whether or not it is fully used. Unused volume does not carry forward unless the SOW says so.

7.3 We invoice as set out in the SOW. Where the SOW is silent: recurring Services are invoiced monthly in advance; project and out-of-scope work is invoiced on completion or monthly against effort delivered, whichever the SOW indicates; adjustments and disbursements are reconciled in the following month's invoice.

7.4 Invoices are payable within 30 days of the invoice date unless the SOW states otherwise, in cleared funds in pounds sterling (or the currency stated in the SOW) to the account we nominate.

7.5 Disputed invoices. If the Client disputes an invoice or part of one, it must notify us in writing within 15 Business Days of the invoice date, setting out the amount disputed and the reason. The Client pays the undisputed balance by the due date. The parties resolve the disputed amount under clause 18, and any amount found payable is due within 10 Business Days of resolution. An invoice not disputed within 15 Business Days is payable in full by the due date, and the Client may not withhold payment on account of a dispute raised after that period. The Client may still pursue the disputed amount under clause 18.

7.6 No set-off. All payments are made in full without set-off, counterclaim, deduction or withholding, except any deduction required by law. Neither party may set off amounts due under the Agreement against amounts due under any other agreement.

7.7 Interest accrues daily on overdue amounts at 8% above the Bank of England base rate, in accordance with the Late Payment of Commercial Debts (Interest) Act 1998, from the due date until payment.

7.8 Suspension. If an undisputed invoice is more than 30 days overdue and remains unpaid 10 Business Days after we give written notice of intention to suspend, we may suspend all or part of the Services until payment is received. Suspension does not relieve the Client of the Charges for any Minimum Commitment, Service Levels do not apply during suspension, and we will resume the Services within five Business Days of receiving payment. We may charge our reasonable, evidenced costs of suspension and resumption.

7.9 Annual indexation. We may increase the rates in a SOW once in each 12-month period, taking effect no earlier than the first anniversary of the SOW's Effective Date, on 60 days' written notice. Any increase will not exceed the greater of zero and the annual percentage change in the Consumer Prices Index including owner occupiers' housing costs (CPIH) published by the Office for National Statistics for the most recent 12-month period available, and in any event will not exceed 5%. Increases are not cumulative if not applied. Any increase beyond this is a Change Request.

7.10 Travel, accommodation and other expenses are chargeable only where the SOW provides for them or the Client approves them in writing in advance, and are charged at cost.

7.11 Each party will keep the records needed to verify amounts payable. Either party may, on 30 days' notice and no more than once in any 12 months, inspect and take copies of the other's records to the extent they relate to the calculation of the Charges. The requesting party bears its own costs and the other party's reasonable costs of supporting the inspection.

7.12 Where a SOW states a currency conversion rate, that rate applies for the period stated. If it is silent and exchange rate movement exceeds 5% against the rate at the Effective Date, either party may request a review under clause 6.2.

8. Term, termination and exit

8.1 These Terms take effect on the Effective Date of the first SOW that incorporates them and continue until no SOW between the parties is in force. Each SOW runs for the Term stated in it.

8.2 Where a SOW provides for renewal, it renews as stated. Where a SOW is silent on what happens after its Term, it continues month to month on the same terms until either party gives 60 days' written notice.

8.3 Termination for convenience. Either party may terminate a SOW on the notice period stated in that SOW. If the SOW is silent, the notice period is 90 days. Notice may not take effect before the end of any Minimum Commitment period stated in the SOW unless the SOW says otherwise.

8.4 What is payable on early termination. Where a SOW is terminated by the Client for convenience, or by us under clause 8.6 or for the Client's material breach, the Client pays:

• (a) the Charges for Services delivered up to the termination date;
• (b) the Charges for the notice period, including any Minimum Commitment falling within it, whether or not the Services are used;
• (c) our reasonable, evidenced and unavoidable committed third-party costs incurred specifically for the Client — for example platform licence terms, telephony commitments or recruitment costs — that we cannot cancel or redeploy, less any amount we recover; and
• (d) any exit charge expressly stated in the SOW.

We will use reasonable endeavours to mitigate these amounts, including by redeploying personnel and cancelling or reassigning third-party commitments where we can, and will evidence amounts claimed under 8.4(c). Nothing in this clause requires the Client to pay for Services after the notice period expires.

8.5 Termination for cause. Either party may terminate a SOW, or these Terms and all SOWs, immediately on written notice if the other party:

• (a) commits a material breach and fails to remedy it within 30 days of written notice giving full particulars of the breach and requiring it to be remedied;
• (b) commits a material breach that is not capable of remedy; or
• (c) suffers an Insolvency Event.

The Client may also terminate under clause 5.7(d).

8.6 We may terminate a SOW on written notice if an undisputed invoice remains unpaid 60 days after its due date and 10 Business Days after we give written notice of intention to terminate.

8.7 Termination of these Terms terminates all SOWs in force. Termination of one SOW does not affect any other SOW.

8.8 Exit assistance. For 60 days after a SOW ends, or for the longer period stated in the SOW, we will, at the rates in the SOW:

• (a) return Client Data in a commonly used machine-readable format, or delete it, as the Client instructs, and confirm deletion in writing;
• (b) provide a documented handover covering process, open items, escalation routes and known issues;
• (c) hand over Client-specific documentation and knowledge base content created for the Client under the SOW;
• (d) where a platform is held in our name and the Client pays the transfer and licensing costs, use reasonable endeavours to transfer administration of it, subject to the third party's terms; and
• (e) cooperate reasonably with any replacement supplier, without being required to disclose our Confidential Information or Neos Materials.

Exit assistance is conditional on the Client having paid all undisputed Charges. We are not required to transfer or license Neos Materials on exit.

8.9 Termination does not affect accrued rights or liabilities. Clauses 1, 2, 5.9, 7 (in respect of amounts accrued), 8.4, 8.8, 8.9, 9, 10, 11.3, 12, 13, 15, 16.2, 16.4, 18 and 19 survive termination, together with any other clause that by its nature is intended to survive.

9. Confidentiality

9.1 Each party will keep the other's Confidential Information confidential, use it only for the purposes of the Agreement, and not disclose it, during the Agreement and for three years afterwards. This obligation continues indefinitely for anything that is a trade secret for as long as it remains one.

9.2 A party may disclose Confidential Information to its Affiliates, personnel, approved subcontractors and professional advisers who need it for the purposes of the Agreement, provided they are bound by confidentiality obligations at least as protective as these, and to a regulator or as required by law or a court, giving the other party as much notice as is lawfully possible.

9.3 These obligations do not apply to information that is or becomes public through no fault of the receiving party, was already lawfully known to the receiving party without restriction, is independently developed without reference to the disclosing party's information, or is lawfully received from a third party without restriction. This clause 9 does not restrict the development and use of know-how and abstracted materials under clause 12.4, or the use of aggregated and anonymised operational metrics and insights under clause 12.5.

9.4 On request after termination, each party will return or destroy the other's Confidential Information, except that it may retain one copy where required by law or its professional obligations, and copies held in routine backups which will be deleted in the ordinary course. Retained copies remain subject to this clause.

9.5 Use of name. We may identify the Client as a client of Neos Wave and describe the Services in general terms in credentials, case studies and marketing, provided the specific wording is approved by the Client in writing beforehand and does not disclose the Client's Confidential Information, commercial terms or customer data. The Client may withdraw approval for future use on 30 days' notice, in which case we will stop using the material prospectively but need not recall printed material already distributed.

10. Data protection

10.1 Both parties will comply with Data Protection Law. Nothing in the Agreement relieves either party of its own obligations under it.

10.2 For personal data processed in delivering the Services, the Client is the controller and we are the processor. We are the controller of our own personnel records, our business contact records, and our own operational and financial records. Where either party determines that the parties are joint controllers or independent controllers for any processing, they will agree the necessary arrangement in writing.

10.3 Schedule 1 (Data Processing Terms) applies. The particulars of processing — the categories of data and data subjects, the nature and purpose of the processing, its duration, the delivery locations and the sub-processors relied on — are set out in the SOW.

10.4 The Client warrants that it has a lawful basis for the processing it instructs, has given all required privacy information to data subjects, and has the consents and notices in place to allow the transfer of personal data to us and to the delivery locations stated in the SOW.

10.5 International transfers. We deliver through a distributed team. The Client authorises the transfer of personal data to, and access from, the countries listed in the SOW, subject to the safeguards in Schedule 1. Where a transfer is to a country without a UK adequacy decision, the parties will rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, which are incorporated by reference and completed as set out in Schedule 1, together with a documented transfer risk assessment which we will make available on request.

10.6 Sub-processors. The Client gives general written authorisation for the sub-processors listed in the SOW. We will give 30 days' written notice before appointing or replacing a sub-processor that processes personal data, and the Client may object on reasonable data protection grounds within that period. If we cannot resolve a reasonable objection, either party may terminate the affected SOW on 60 days' notice without exit charge under clause 8.4(b) or 8.4(d).

11. Security and audit

11.1 We will maintain the technical and organisational measures set out in Schedule 2, and will maintain Cyber Essentials certification and, where a SOW relates to health or care data, NHS Data Security and Protection Toolkit "Standards Met" status, or in each case an equivalent or successor standard. We will provide current certificates on request and will notify the Client if certification lapses.

11.2 We will carry out the pre-engagement checks described in Schedule 2 on all Neos Personnel before they are given access to Client Systems or Client Data, and will remove access promptly when an individual leaves the engagement.

11.3 We will notify the Client of a Security Incident affecting Client Data without undue delay and in any event within 24 hours of becoming aware of it, with the information available at the time, and will keep the Client updated, cooperate with the Client's investigation, and take reasonable steps to mitigate and remedy.

11.4 Audit. The Client, or an independent auditor it appoints who is not our competitor and who signs a confidentiality undertaking, may audit our compliance with clauses 10 and 11 and Schedules 1 and 2, once in any 12-month period, on 30 days' written notice, during business hours, in a way that does not disrupt our operations or compromise other clients' confidentiality. We may satisfy an audit request by providing our current certifications, our most recent independent assessment, and a completed security assurance questionnaire, where these reasonably address the Client's questions. Additional audits, and audits required by a regulator, are at the Client's cost, save where an audit identifies a material breach by us, in which case we bear the reasonable cost of that audit.

11.5 The Client is responsible for the security of Client Systems, including identity and access management, permission configuration, entitlement rules, logging and monitoring, in accordance with clause 4.

12. Intellectual property and AI

12.1 Neos Materials remain our property, including any improvement or development of them made during the Agreement. We grant the Client a non-exclusive, non-transferable, royalty-free licence to use Neos Materials for the duration of the relevant SOW, solely to receive and use the benefit of the Services. That licence ends when the SOW ends, except that on expiry or termination of a SOW the licence continues for 90 days to the extent necessary for the Client to transition the Services, subject to the Client paying the Charges for that period and having paid all undisputed Charges then due.

12.2 Client Materials and Client Data remain the Client's property. The Client grants us a non-exclusive licence to use, copy, adapt and store them for the duration of the Agreement, and for any period required by law, solely to deliver the Services, meet our legal obligations, defend claims, and carry out the permitted uses in clauses 12.4 and 12.5.

12.3 Client-specific deliverables. Documentation created specifically for the Client and paid for under a SOW — for example Client-specific process documentation, macros, knowledge base articles, reports and designs — is assigned to the Client on payment of the Charges relating to it. This does not include any Neos Materials embedded in or used to produce it, which remain ours and are licensed under clause 12.1. Where a deliverable cannot practically be separated from Neos Materials, we grant the Client a perpetual, non-exclusive licence to use the deliverable for its internal business purposes.

12.4 We may continue to develop our know-how, methods, tooling and frameworks, such as workflows, intent taxonomies, routing and escalation logic, quality rubrics and evaluation criteria, prompt patterns, and process and training templates, including through experience gained delivering the Services, and use them for other clients, provided the result is abstracted so that it does not contain, reproduce or reveal Client Data or the Client's Confidential Information, does not identify the Client or its customers, and makes no reference to the Client.

12.5 AI and model training. We will not use Client Data to train, fine-tune or otherwise adjust the model weights of any AI model, whether our own or a third party's. We may use Client Data within the Services to configure Client-specific automation, retrieval, prompts, routing, quality scoring and reporting. We may use aggregated and anonymised operational metrics and insights that do not identify the Client, its customers or any individual for benchmarking, capacity planning and service improvement. Where a SOW involves AI-assisted or automated handling of customer interactions, the SOW will state the scope of automation, the human oversight applied, and the escalation route to a person. Where we use third-party AI providers to deliver the Services, we will contract with them on terms that prohibit them from using Client Data to train or improve their models, and on zero data retention terms where those are available. Except as expressly agreed in a SOW, we will not use the content of customer interactions for any purpose other than delivering the Services to the Client.

12.6 Each party indemnifies the other against third-party claims that materials it provides, or requires the other to use, infringe that third party's intellectual property rights, subject to clauses 13 and 15. Neither party is liable under this clause where the claim arises from the other party's modification of the materials, or from use of them outside the Agreement.

13. Liability

13.1 Nothing in the Agreement excludes or limits liability for: death or personal injury caused by negligence; fraud or fraudulent misrepresentation; breach of the obligations implied by section 2 of the Supply of Goods and Services Act 1982 as to title; the Client's obligation to pay Charges properly due; or anything else that cannot lawfully be excluded or limited.

13.2 Excluded losses. Subject to clause 13.1, neither party is liable to the other, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for: loss of profit; loss of revenue; loss of anticipated savings; loss of business or business opportunity; loss of goodwill or reputation; loss of or corruption of data (other than the reasonable cost of restoring it from the most recent available backup); wasted management time or expenditure; or any indirect or consequential loss. This applies whether or not the loss is direct, and whether or not it was foreseeable. This clause 13.2 does not exclude the Client's right to recover Charges paid for Services that were not delivered.

13.3 Cap. Subject to clauses 13.1 and 13.4, each party's total liability arising out of or in connection with each SOW, whether in contract, tort (including negligence), breach of statutory duty, restitution or otherwise, is limited in aggregate to the greater of:

• (a) £25,000; and
• (b) 125% of the Charges paid and payable under that SOW in the 12 months immediately before the date the claim arose, or, where the SOW has been running for less than 12 months, 125% of the annualised equivalent of the Charges paid and payable to date.

13.4 Data protection cap. Liability for breach of clause 10, clause 11 or Schedule 1 is limited in aggregate, per SOW, to the greater of £250,000 and 200% of the Charges paid and payable under that SOW in the 12 months before the claim arose. This cap applies instead of, not in addition to, the cap in clause 13.3 for those claims, and the two caps are not cumulative in respect of the same loss.

13.5 Any Service Credit received by the Client in respect of a failure is deducted from any damages awarded for the same failure, so that the Client is not compensated twice.

13.6 Subject to clause 13.1, we are not liable for loss arising from:

• (a) a Relief Event, or a matter within clause 4.6;
• (b) the Client not following a recommendation we gave in writing which we identified at the time as material to the Services, where the Client declined it in writing or did not act on it within the period we specified;
• (c) the availability, performance, security or defects of a third-party platform or network we do not administer, or a matter within clause 3.9(c);
• (d) a decision taken by the Client, its Affiliates or its other suppliers; or
• (e) use of the Services, deliverables or our recommendations for a purpose or in a context not contemplated by the SOW.

13.7 Neither party may bring a claim under the Agreement more than two years after it became aware, or ought reasonably to have become aware, of the circumstances giving rise to it. This does not apply to a claim within clause 13.1 or to a claim for unpaid Charges.

13.8 The Charges have been set on the basis of the allocation of risk in this clause 13. Both parties are commercial entities that have had the opportunity to take independent legal advice and to negotiate these provisions, and each considers them reasonable.

14. Insurance

14.1 We will maintain, with reputable insurers, throughout the Agreement and for two years afterwards: public liability insurance of at least £2,000,000 per claim; professional indemnity insurance of at least £2,000,000 in the aggregate; cyber and data liability insurance of at least £1,000,000 in the aggregate; and employer's liability insurance as required by law. We will provide evidence of cover on request, once in each 12-month period.

14.2 The level of insurance we hold does not set, extend or otherwise affect the liability caps in clause 13. The caps in clause 13 apply regardless of the cover available.

15. Indemnities

15.1 The Client indemnifies us against losses, liabilities, costs and reasonable legal expenses arising from:

• (a) a third-party claim resulting from an instruction the Client gave and we followed, where the instruction was unlawful or infringed a third party's rights and we had no reasonable means of knowing that;
• (b) breach of the warranty in clause 4.11;
• (c) a claim by a data subject or a regulatory fine imposed on us that results from the Client's breach of clause 10.4 or its own obligations as controller; and
• (d) loss of or damage to our equipment caused by the Client, its Affiliates, personnel or other suppliers.

15.2 We indemnify the Client against losses, liabilities, costs and reasonable legal expenses arising from a regulatory fine imposed on the Client, or a successful claim by a data subject against the Client, to the extent it results from our breach of clause 10, clause 11 or Schedule 1. This indemnity is subject to the cap in clause 13.4.

15.3 An indemnity applies only if the indemnified party: notifies the other promptly of the claim; does not admit liability or settle without the other's written consent; gives the other the right to conduct the defence and settlement, at the other's cost; provides reasonable assistance at the other's cost; and takes reasonable steps to mitigate.

15.4 Each indemnity is reduced to the extent the loss is caused or contributed to by the indemnified party's own act, omission or breach. All indemnities are subject to clause 13, except where clause 13.1 applies.

16. People, non-solicitation and TUPE

16.1 Neos Personnel are our employees, workers or contractors and are not employees or workers of the Client. We are responsible for their pay, tax, national insurance, benefits and employment rights, and for compliance with employment law in the jurisdictions we operate in. Nothing in the Agreement creates a partnership, joint venture, agency or employment relationship between the parties.

16.2 Non-solicitation. During the Agreement and for six months after the end of the relevant SOW, neither party will solicit for employment or engagement, or employ or engage, any individual who is or was engaged by the other party in connection with the Agreement, without the other party's written consent. This does not apply to:

• (a) a response to a general advertisement or recruitment campaign not specifically directed at the other party's personnel; or
• (b) an individual who approaches the party unprompted and who has not been employed or engaged by the other party for at least three months.

16.3 If a party breaches clause 16.2, it will pay the other a sum equal to 30% of the individual's annual base salary or annualised fee at the date of the breach. The parties agree this is a genuine and reasonable pre-estimate of the recruitment, training and disruption cost the other party will incur, and is payable instead of damages for that breach.

16.4 TUPE and equivalent legislation.

• (a) The parties do not intend that the Transfer of Undertakings (Protection of Employment) Regulations 2006, or equivalent legislation in any other jurisdiction, will apply when a SOW starts. The Client warrants that it has disclosed to us in writing any circumstances it is aware of that could give rise to such a transfer.
• (b) If it is found or alleged that any person's employment transfers to us when a SOW starts, the Client indemnifies us against all employment costs, claims and liabilities relating to that person, including the cost of dismissal, and we may dismiss that person without further liability to the Client.
• (c) On the expiry or termination of a SOW, we will provide employee liability information for any Neos Personnel who may be deemed to transfer to the Client or a replacement supplier, within 20 Business Days of a written request, to the extent we lawfully can. The Client indemnifies us against all employment costs, claims and liabilities relating to any person deemed to transfer to the Client or its replacement supplier, other than those arising from our own act or omission before the transfer.
• (d) Each party will cooperate with the other's information and consultation obligations and provide the information the other reasonably needs to comply with them.

16.5 The Client may request the removal of an individual from the engagement on reasonable, documented performance or conduct grounds. We will investigate and, where appropriate, provide a replacement of equivalent capability within a reasonable period. The Client will not direct Neos Personnel outside the scope of the SOW or the Access & Permissions Matrix, and will route performance concerns through the governance route in the SOW rather than to individuals.

17. Force majeure

17.1 Neither party is liable for a failure or delay in performing its obligations, other than an obligation to pay, caused by an event beyond its reasonable control, including power or telecommunications failure, failure of a public internet or cloud infrastructure provider, industrial action affecting a third party, civil unrest, epidemic or pandemic and any resulting public health measure, fire, flood, storm, earthquake, act of terrorism, war, cyber attack on national infrastructure, or governmental action.

17.2 The affected party will notify the other as soon as reasonably practicable, take reasonable steps to mitigate and to invoke its business continuity arrangements, and resume performance as soon as reasonably practicable. Lack of funds is not a force majeure event.

17.3 If the event continues for more than 30 consecutive days, or for more than 60 days in aggregate in any six-month period, either party may terminate the affected SOW on 14 days' written notice. On termination, the Client pays for the Services delivered to that date and for any unavoidable committed third-party costs under clause 8.4(c), but clause 8.4(b) and 8.4(d) do not apply.

18. Escalation and disputes

18.1 Operational issues are raised first between our Client Success Lead and the Client's nominated contact named in the SOW, who will try to resolve them within five Business Days.

18.2 If unresolved, either party may escalate to a director of Neos Wave and the Client's senior sponsor named in the SOW, who will meet within 10 Business Days.

18.3 If still unresolved after a further 20 Business Days, the parties will attempt to settle the dispute by mediation administered by CEDR or another provider they agree, sharing the mediator's costs equally. Neither party may start court proceedings until mediation has concluded or one party has refused to participate, except for a claim for injunctive relief, a claim for unpaid Charges, or where a limitation period is about to expire.

18.4 During a dispute, we will continue to deliver the Services and the Client will continue to pay all undisputed Charges when due.

18.5 The Agreement, and any dispute or claim arising out of or in connection with it including any non-contractual dispute or claim, is governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.

19. General

19.1 Notices. Notices must be in writing and sent to the address or email address named in the SOW for that purpose. A notice sent by email is deemed received at the time of transmission, or if sent outside the recipient's business hours, when business hours resume. A notice sent by courier or recorded delivery is deemed received on signature. A notice of termination or of material breach must be sent by email and by courier or recorded delivery to be effective.

19.2 Assignment. Neither party may assign or transfer the Agreement or any SOW without the other's written consent, which will not be unreasonably withheld or delayed. Either party may, on written notice and without consent, assign or transfer the Agreement and all SOWs to an Affiliate, or to a successor in connection with a group reorganisation, merger, or a sale of all or substantially all of its business or assets, provided the transferee is able to perform the obligations and assumes them in writing.

19.3 Entire agreement. The Agreement is the entire agreement between the parties on its subject matter and supersedes all previous agreements, proposals, pitch materials, presentations and understandings relating to it. Each party confirms it has not relied on any statement, representation, assurance or warranty not set out in the Agreement. Nothing in this clause limits liability for fraud or fraudulent misrepresentation.

19.4 Variation. The Agreement may only be varied in writing signed by an authorised representative of each party, including by electronic signature.

19.5 No waiver. A failure or delay in exercising a right is not a waiver of it, and a waiver of one breach is not a waiver of any other.

19.6 Severance. If any provision is found unlawful, invalid or unenforceable, it is severed to the minimum extent necessary and the rest of the Agreement continues in force. The parties will negotiate in good faith a replacement provision that achieves as nearly as possible the same commercial result.

19.7 Third-party rights. Except for an Affiliate that becomes a party under clause 1.6, and a person entitled to be indemnified under clause 15, no one other than the parties has any right to enforce the Agreement, and the Contracts (Rights of Third Parties) Act 1999 does not apply.

19.8 Counterparts and signature. A SOW may be signed in counterparts and by electronic signature, each of which is an original and together constitute one agreement.

19.9 Time. Except where a SOW expressly states that a date or period is of the essence, time is not of the essence.

19.10 Costs and further assurance. Each party bears its own costs of negotiating and entering into the Agreement, and will do all things reasonably necessary to give full effect to it.

19.11 Anti-bribery, modern slavery and sanctions. Each party will comply with the Bribery Act 2010, the Modern Slavery Act 2015 and applicable sanctions and export control laws, will maintain appropriate policies, and will notify the other of any breach relevant to the Agreement.

19.12 Publication and versioning. We publish these Terms and every superseded version at neoswave.com/msa. We will retain each version for at least seven years after it ceases to be current, and will provide a copy of the version applicable to a SOW on request. Publication of a new version does not vary any existing SOW: see clause 1.2.

Schedule 1 — Data Processing Terms

This Schedule applies where we process personal data as processor on the Client's behalf. Terms defined in Data Protection Law have the same meaning here. The particulars of processing are set out in each SOW.

1.1 We will process personal data only on the Client's documented instructions, as set out in the Agreement and the SOW, and as necessary to comply with law. If we are required by law to process otherwise, we will tell the Client first unless the law prohibits it. If we consider an instruction breaches Data Protection Law, we will tell the Client without undue delay.

1.2 We will implement and maintain the technical and organisational measures in Schedule 2, appropriate to the risk, and will not materially reduce the overall level of protection during the Agreement.

1.3 We will ensure that Neos Personnel with access to personal data are subject to a duty of confidence, are trained in data protection and security before access is granted, and have access only to the data they need for their role.

1.4 We will not transfer personal data outside the United Kingdom except to the countries listed in the SOW, and only where an adequacy decision applies, or the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses is in place, together with a documented transfer risk assessment and any supplementary measures identified by it. For the purposes of those clauses: the Client is the data exporter, we are the data importer, the categories of data, data subjects and purposes are those in the SOW, the governing law and forum are England and Wales, and the appendices are completed by reference to the SOW and Schedule 2.

1.5 We will assist the Client, at the Client's reasonable cost where the assistance goes beyond routine support, with: responding to data subject requests; data protection impact assessments; consultation with the Information Commissioner's Office or another supervisory authority; and demonstrating compliance. We will forward any data subject request we receive directly to the Client within three Business Days and will not respond to it ourselves unless the Client instructs us to.

1.6 We will notify the Client of a personal data breach without undue delay and in any event within 24 hours of becoming aware of it, and will provide the information the Client needs to meet its own notification obligations, as it becomes available.

1.7 On the Client's written instruction, and in any event on termination of the relevant SOW, we will delete or return all personal data and any copies, except any we are required to retain by law or that is held in routine backups which will be deleted in the ordinary cycle. We will confirm deletion in writing. Retained data remains subject to this Schedule.

1.8 We will maintain records of our processing activities and the measures we have implemented, sufficient to demonstrate compliance with this Schedule, and will make them available under clause 11.4.

1.9 Sub-processors are appointed under clause 10.6. We will impose on each sub-processor obligations equivalent to those in this Schedule by written contract, and remain liable to the Client for the sub-processor's performance of them.

1.10 If Data Protection Law changes such that this Schedule no longer meets the requirements for a processor contract, the parties will agree the necessary amendments in good faith within 30 days of either party's request.

Schedule 2 — Security Measures

This is a summary of the technical and organisational measures we maintain. Our current certifications and a full security assurance pack are available on request.

Schedule 3 — Change Request form

A Change Request under clause 6.2 records the following. Both parties sign before work starts.