Master Services Agreement

This Master Services Agreement (the “Agreement”) is made between:

Interiu AI S.L., a company incorporated in Spain, with registered office at Calle Maquinaria 4, 3, 1, 07011 Palma de Mallorca, Balearic Islands, Spain, tax identification number B75247320, registered in the Palma de Mallorca commercial register (“Interiu”); and

[Client legal name], a company incorporated in [jurisdiction], with registered office at [address], company number [number] (the “Client”).

Interiu and the Client are each a “Party” and together the “Parties”.

This is Interiu’s standard form, published so it can be read before anyone asks for it. The version signed between the parties governs.

1. Structure of the agreement

1.1 This Agreement sets the standing terms. It does not by itself commit either Party to any work.

1.2 Work is commissioned in one of two ways. An Order Form commissions a subscription to a System. An Engagement Letter commissions one matter of bespoke work. Each incorporates this Agreement by reference, and Schedule 1 applies additionally to every Order Form.

1.3 Where an Order Form or Engagement Letter conflicts with this Agreement, it prevails for that commission only. Where Schedule 1 conflicts with the body of this Agreement in respect of a subscription, Schedule 1 prevails.

1.4 Purchase orders, portal terms, click-through terms and any other document issued by either Party in the ordinary course of procurement have no contractual effect between the Parties, whatever they say, unless signed by both Parties as an amendment to this Agreement.

2. Definitions

Client Data means everything the Client or a party acting for the Client places into the System. Client Data may include personal data, to which clause 8 and Annex A additionally apply.

Client Environment means infrastructure the Client owns, leases or controls, including its own servers, its private cloud, its own accounts with a cloud provider, and its own Microsoft 365 or equivalent productivity tenancy.

Client Methodology means the documents and materials the Client supplies to Interiu for a commission that record the Client’s own working methods, templates, checklists, materiality thresholds, review standards or report formats, together with the information they contain. It does not include knowledge, skill or experience, whether or not derived from them.

Deliverable means an output an Order Form or Engagement Letter identifies as deliverable to the Client.

Interiu Technology means everything Interiu owns or licenses independently of this Agreement and everything Interiu creates in performing the Services: source code, libraries, model orchestration, retrieval and verification machinery, prompts, rules, thresholds, checks, templates, tooling, know-how, and improvements to any of it. It does not include the Client Methodology, Client Data or Deliverables.

Output means anything the System produces, whether or not it becomes a Deliverable.

Permitted Scope means the entities, territories, users and volumes stated in the Order Form.

Services means the services described in an Order Form or Engagement Letter.

System means the analytical system Interiu licenses, builds, configures or operates for the Client.

3. Services

3.1 Interiu will perform the Services with the skill and care reasonably expected of a competent provider of comparable software and analytical services, in accordance with the Order Form or Engagement Letter.

3.2 Interiu will appoint an engagement lead for each Order Form or Engagement Letter, who is the Client’s point of contact and is responsible for Interiu’s performance of it. Interiu may replace them with a person of comparable seniority and relevant experience on written notice. Nothing in this clause creates any personal duty or liability on the part of any individual, and the Client’s remedies lie against Interiu alone.

3.3 Interiu may use subcontractors. Interiu remains responsible for their acts and omissions as for its own, except that Interiu is not responsible under this clause for the acts or omissions of a third-party model provider, cloud infrastructure provider or telecommunications provider, whose treatment is governed by clause 9.

3.4 Interiu is an independent contractor. Nothing in this Agreement creates a partnership, joint venture, agency or employment relationship.

3.5 This Agreement is not exclusive. Where an Order Form or Engagement Letter records specific conflict-management requirements, Interiu will observe them for that commission.

4. Where the System runs

4.1 The System runs in the Client Environment. Unless an Order Form or Engagement Letter expressly says otherwise, the System is deployed on the Client’s own servers, in the Client’s private cloud, or into the Client’s own cloud account.

4.2 This applies to pilots.

4.3 No transfer of Client Data to Interiu. Interiu does not require Client Data to be transferred to, or hosted on, infrastructure Interiu owns or controls, and Interiu will not itself remove Client Data from the Client Environment. Client Data is processed where it already sits, under the Client’s access controls and retention rules.

Where Client Data nonetheless comes into Interiu’s possession incidentally, because the Client sends it or because it appears in a support request, screenshot, log, error report or recorded session, Interiu will hold it as Confidential Information, use it only to provide the Services, retain it only as long as that requires and in any event no longer than ninety days, and delete it on the Client’s written request. The Client will not transmit Client Data to Interiu outside the Client Environment except under clause 4.4, and Interiu is not responsible for Client Data the Client transmits contrary to this clause.

4.4 If a specific piece of work cannot be performed without Client Data leaving the Client Environment, Interiu will say so in writing before the work starts, and will not proceed without the Client’s written instruction identifying what may move, to where, and for how long.

4.5 Model endpoints. The System adds no new data path. Where the System uses a language model, the Order Form or Engagement Letter records which of the following applies:

(a) inside the Client Environment, where the model runs on the Client’s own servers or in the Client’s private cloud, in which case no Client Data leaves the Client Environment at any point;

(b) on the Client’s own AI infrastructure, where the Client already operates language models under its own contracts, for example in its own Microsoft Azure, Amazon Web Services, Google Cloud, OVHcloud or Nebius tenancy, or under its own enterprise agreement with a model provider, in which case Interiu configures the System to use that existing infrastructure, the Client’s own terms with that provider govern, and Interiu introduces no additional provider; or

(c) on an endpoint Interiu procures, in the Client’s own jurisdiction, under terms meeting clause 9.1, where the Client has no infrastructure of its own to use.

The Client is responsible for network egress to any endpoint outside the Client Environment.

4.6 Delivery form. The Order Form or Engagement Letter records how the System is delivered:

(a) as software deployed in the Client Environment; or

(b) as an agent, connector or application the Client installs in its own productivity tenancy, which executes against a container operating in the Client Environment.

Clause 4.1 applies to both. Where (b) applies, the productivity tenancy and the container are both within the Client Environment, and no Client Data reaches infrastructure Interiu owns or controls at any point.

5. Access to Client systems

5.1 Where building or supporting the System requires access to the Client Environment, Interiu will request access that is named, limited to what the work requires, and granted for a stated period, and will notify the Client when the work no longer requires it.

5.2 Access is granted, administered and revoked by the Client, through the Client’s own identity provider and policies. Interiu will not request or accept standing access between commissions, and will not retain or use credentials after notifying the Client under clause 5.1. The Client is responsible for the lifecycle of credentials it issues, including revocation.

5.3 Individuals with access will comply with the Client’s own access, security and acceptable-use policies where the Client has provided them.

5.4 Interiu will tell the Client promptly if it becomes aware that access granted under this clause has been used outside its scope.

5.5 Agent identity. Where clause 4.6(b) applies, the agent, connector or application authenticates as the signed-in user through the Client’s own identity provider and inherits that user’s permissions. It cannot reach a document, site or mailbox the user could not already open, and it holds no elevated or service-account permission of its own. Interiu holds no separate identity in the Client’s tenancy.

6. Client responsibilities

6.1 The Client will provide the environment, access, information and personnel identified in the Order Form or Engagement Letter, and will tell Interiu about constraints, policies or regulatory obligations that affect how the work may be performed.

6.2 The Client is responsible for the lawfulness of Client Data, including its right to place that data into the System and to have it processed for the purposes of the commission.

6.3 The Client reviews the Output. Output is decision-support, produced to be checked. The Client is responsible for satisfying itself that a finding is correct before relying on it, for its own professional judgement, for its own advice to its own clients, and for its own filings, opinions and reports. Checking is not limited to following a citation.

6.4 To the extent a loss is caused or contributed to by the Client’s act or omission, including a failure to perform clause 6.3, Interiu’s liability for it is reduced accordingly.

7. Confidentiality

7.1 Each Party may receive information from the other that is marked confidential or that a reasonable person would understand to be confidential (“Confidential Information”). Client Data, the Client Methodology and the Deliverables are the Client’s. Interiu Technology is Interiu’s.

7.2 The receiving Party will keep Confidential Information confidential, use it only for the purposes of this Agreement, and disclose it only to those of its personnel and subcontractors who need it for those purposes and who are bound by equivalent obligations.

7.3 Clause 7.2 does not apply to information that is or becomes public without breach, was already lawfully known to the receiving Party without a duty of confidence, is independently developed without use of the disclosing Party’s information, or is lawfully received from a third party without a duty of confidence.

7.4 The receiving Party may disclose Confidential Information where required by law, regulation, court order or a competent regulator. Where lawful and practicable it will tell the disclosing Party first.

7.5 Third-party confidences. Where Client Data includes information the Client holds under a duty of confidence to its own client, and the Client notifies the terms of that duty in writing, Interiu will consider them and, where it accepts them in writing, will observe them. Interiu is not bound by terms it has not accepted, and no notification under this clause varies clause 14. Where Interiu does not accept notified terms, either Party may terminate the affected commission on thirty days’ notice.

7.6 These obligations survive for five years after the end of this Agreement, indefinitely for anything that constitutes a trade secret, and indefinitely in respect of Interiu Technology and of the source code, architecture, prompts, rules and thresholds of the System.

7.7 Publicity. Neither Party will name the other, or describe the commission in a way that identifies the other, in any external material without the other Party’s prior written consent. Consent will not be unreasonably withheld in respect of a factual statement that the Parties work together, without describing any matter.

7.8 Neither Party is liable for a breach of this clause to the extent it is caused by the other Party’s own act or omission.

8. Data protection

8.1 Each Party will comply with applicable data protection law, including Regulation (EU) 2016/679 (“GDPR”) and, in Spain, Organic Law 3/2018.

8.2 The Client is the controller in respect of personal data contained in Client Data. The Parties’ shared understanding is that, because the System runs in the Client Environment and Interiu does not take a copy of Client Data, Interiu’s processing on the Client’s behalf is limited to the access described in clause 5 and to any incidental receipt under clause 4.3. Annex A applies to that processing and constitutes the Parties’ Article 28 terms. Where the scope of Interiu’s processing is in fact wider than this clause contemplates, Annex A applies to the whole of it, and neither Party’s characterisation in this clause limits the other’s rights.

8.3 Where a commission is structured so that Interiu receives or hosts personal data, the Order Form or Engagement Letter will say so expressly and clause 4.4 applies.

8.4 Each Party will tell the other without undue delay on becoming aware of a personal data breach affecting data covered by this Agreement.

9. Artificial intelligence

9.1 No training on Client Data. Interiu will not use, and will not permit any person under its control to use, Client Data, the Client Methodology, Deliverables or Output to train, fine-tune or otherwise adapt the weights of any machine-learning model.

Where clause 4.5(c) applies, Interiu will procure that each third-party model provider it engages for the Services is contracted on terms prohibiting that provider from using data submitted through Interiu’s account to train or improve its models, and from retaining that data beyond the period necessary to process the request, and will identify those providers and terms on request.

Where clause 4.5(a) or 4.5(b) applies, the model runs on infrastructure the Client controls or contracts for. Interiu’s obligation is then to configure the System to use that infrastructure and no other, and not to route Client Data to any endpoint the Order Form or Engagement Letter does not record. The terms governing that provider are the Client’s own, and Interiu gives no undertaking in respect of them.

In every case, Interiu’s obligation in respect of a third-party model provider is to select or configure against an endpoint carrying the prohibitions above, to keep that configuration in force and to act promptly on becoming aware of any breach. Interiu does not guarantee, and is not liable for, the acts or omissions of a third-party model provider.

Nothing in this clause prevents Interiu from processing Client Data and Output within the Client Environment as the Services require, from retaining and using Operational Metrics under clause 9.7, or from testing and evaluating the System within the Client Environment where no Client Data leaves it.

9.2 Disclosure. Interactive AI systems Interiu provides carry the following notice: “You are interacting with an AI system provided by Interiu AI. Its outputs are decision-support and require review by a qualified professional before use.” Written Deliverables carry an equivalent notice.

9.3 Traceability. Interiu will design the System so that a finding in a Deliverable cites the documents, transactions or records it rests on, and will apply that design to each finding. Where a citation is incomplete or incorrect, Interiu will correct it promptly on notice, and correction is the Client’s sole remedy for a citation defect that has not caused loss.

9.4 Human review of Interiu Deliverables. This clause applies only to work commissioned by an Engagement Letter under which Interiu produces and delivers a Deliverable. Before delivering it, Interiu will cause the findings within the review coverage stated in the Engagement Letter to be reviewed by a person with relevant domain experience. The Engagement Letter states whether that review covers every finding or an expressly defined risk-weighted sample. Interiu will not include in the Deliverable a finding that reviewer has rejected, and will not represent an unreviewed finding as reviewed. Conclusions and recommendations Interiu makes in a Deliverable are authored or approved by a person with relevant domain experience.

Where a subscription is commissioned by an Order Form, the Client operates the System and Interiu does not receive, review or deliver the Output it produces. Review of that Output is governed by clauses 6.3, 9.2 and 9.5 and by Annex B2.

9.5 No autonomous decisions. Interiu will not configure the System to produce decisions with legal or similarly significant effects on individuals without human intervention. The Client will not deploy or configure it that way, and Interiu is not responsible for a deployment or configuration made by the Client.

9.6 Annex B sets out the transparency and human-oversight arrangements.

9.7 Operational metrics. Interiu may collect, retain and use metrics about the operation of the System that contain no Client Data and no personal data and from which the Client, its clients and any individual cannot be identified, for example counts of documents processed, run times, error rates, check-level hit and false-positive rates, latency and cost, and the categories of check that fired. Interiu may use those metrics to operate, support, secure and improve its products and to compile aggregated statistics. This clause is an exception to clause 9.1, and metrics collected under it are not Client Data, Output or Confidential Information of the Client. The Order Form may disapply this clause, in which case the fee is adjusted accordingly.

10. Intellectual property

10.1 The Client Methodology belongs to the Client. Interiu acquires no right in it, and nothing in this Agreement restricts the Client from using its own methodology, in any form, with any person, at any time, during or after this Agreement. Clause 10.7 governs what Interiu may and may not do with it.

10.2 Interiu Technology belongs to Interiu. Nothing in this Agreement transfers it. The Client Methodology is not Interiu Technology: it belongs to the Client under clause 10.1, and clause 10.7 prevents Interiu from reproducing it, disclosing it to any other person or supplying it to another client. What belongs to Interiu is the system that runs the Client’s method: the code, the machinery and the capabilities Interiu builds, including capabilities first built during a commission for the Client, whether or not built for the Client alone.

The Client’s right to use Interiu Technology is the licence in clause 10.4 and lasts only as long as that licence. When the licence ends the System stops operating, and no right to use any part of it survives.

10.3 Client Data and Deliverables belong to the Client. Interiu acquires no rights in either beyond what performing the Services requires.

10.4 Licence to operate. For the term of the relevant Order Form or Engagement Letter, and for so long as the Client is not in arrears on an undisputed invoice, Interiu grants the Client a non-exclusive, non-transferable, non-sublicensable licence to install and operate the System in the Client Environment, for the Permitted Scope.

The Client will not, and will not permit any person to: use the System after the licence ends, or otherwise than this Agreement permits, without Interiu’s prior written consent; copy the System other than for backup; modify, adapt, translate, decompile, disassemble or reverse engineer it, or attempt to derive its source code, prompts, rules or thresholds; create derivative works of it; remove or alter any notice or licence mechanism; circumvent any licence key, expiry or usage-measurement mechanism; or make the System available to any third party, including as a service bureau. This paragraph applies to every commission, including a pilot, proof of concept or trial, whether commissioned by an Order Form or an Engagement Letter, and applies except to the extent Article 100 of Royal Legislative Decree 1/1996 permits and cannot be excluded by agreement.

Use of the System after the licence ends is a material breach of this Agreement and an infringement of Interiu’s rights. Except as expressly stated, no right in Interiu Technology is granted, by implication, estoppel or otherwise.

10.5 Exit. The Client Data and the Deliverables are the Client’s, sit in the Client Environment at all times, and nothing has to be recovered from Interiu. On expiry or termination, and subject to clause 10.6, the licence in clause 10.4 ends; within thirty days the Client will cease use of the System, delete or uninstall it and every copy from the Client Environment, and confirm this in writing on request. Deliverables already produced may be used and retained by the Client without limit of time. No other part of Interiu Technology may be used or retained after the licence ends.

10.6 Continuity. The licence key is embedded in the System as delivered and is verified without any connection to Interiu. The Order Form records the period the key covers, which may be longer than the period for which the Client has paid, and Interiu will ensure that the key in the Client’s possession covers at all times at least the period for which the Client has paid. Nothing Interiu does, or fails to do, can stop the System operating before the key already delivered expires.

Where Interiu terminates for convenience, ceases to carry on business without a successor assuming this Agreement, or enters liquidation, the licence in clause 10.4 continues royalty-free for the version of the System then deployed and for the Permitted Scope for as long as the key already delivered permits, without any right to support, updates, modification or new versions, and without any act by Interiu being required.

The licence does not continue beyond that, and Interiu neither holds nor undertakes to procure any means of extending it. This clause is not source-code escrow and does not have the same effect. Beyond that point, the Client’s protection is that the Client Data and the Deliverables are already the Client’s and already in the Client Environment under clauses 10.3 and 10.5.

10.7 Reuse, residuals and non-use.

(a) Non-use of the Client Methodology. Interiu will not reproduce the Client Methodology, disclose it to any other person, or supply it to another client.

(b) What paragraph (a) does not reach. Paragraph (a) does not apply to anything that was known to Interiu or in Interiu’s possession before the commission, is or becomes general practice in the discipline or is otherwise public without breach, Interiu develops independently without reference to the Client Methodology, or Interiu receives from a third party without a duty of confidence.

(c) Residuals. Interiu and its personnel may use the general knowledge, skill and experience they retain in unaided memory, including knowledge, skill and experience gained before this Agreement and in performing the Services. This paragraph does not permit reproduction of the Client Methodology or disclosure of the Client’s Confidential Information.

(d) No restriction on the System. Nothing in this Agreement restricts Interiu from designing, developing, operating, licensing or selling the System, any part of it, or anything performing a similar function, to any person, whether or not a step, check, rule, threshold or other capability was first built during a commission for the Client. Interiu Technology built during a commission is Interiu’s under clause 10.2, and paragraph (a) does not qualify that.

(e) No presumption from similarity. Similarity of function, structure, sequence or output between the System and the Client’s own methodology is not of itself evidence of reproduction of, or use of, the Client Methodology.

(f) Remedy. The Client’s remedy for breach of paragraph (a) is damages, subject to clause 14. The Client will not seek, and waives any right to seek, an injunction or other order restraining Interiu from operating, licensing or selling the System or any part of it, whether to the Client or to any other person.

(g) Exclusivity is bought, not assumed. Where the Client requires exclusivity over a capability, the Order Form or Engagement Letter records it, its scope and its duration, and the fee reflects it. Absent such a record, no exclusivity is granted.

10.8 No competing build, and no competitive use of Output. For twelve months after the last commission ends, the Client will not use Interiu Technology, or knowledge of its design obtained under this Agreement, to develop, procure or specify a product performing substantially the same function. The Client will not use the System, any Output or any Deliverable to build, train, benchmark or improve a product or service that competes with the System, and will not publish any benchmark, evaluation or performance comparison of the System without Interiu’s prior written consent. This clause applies to every commission, whether commissioned by an Order Form or an Engagement Letter.

10.9 Interiu will not assert any lien over Client Data or Deliverables.

11. Fees and payment

11.1 Fees are stated in the Order Form or Engagement Letter, exclusive of VAT and of pre-agreed expenses.

11.2 Invoices are payable within thirty days of the invoice date.

11.3 Interiu may charge statutory late-payment interest and the statutory recovery costs under Spanish Law 3/2004 on amounts unpaid after the due date.

11.4 An amount disputed in good faith, notified with reasons before the due date, is not payable until the dispute is resolved, provided the amount disputed does not exceed twenty per cent of the invoice and the Parties escalate to a director on each side within ten business days. The remainder of the invoice remains payable.

12. Term and termination

12.1 This Agreement starts on the date of last signature and continues until terminated. Termination of this Agreement does not terminate a commission in progress unless the notice says so.

12.2 Either Party may terminate this Agreement for convenience on thirty days’ written notice. Commissions in progress continue on these terms until they expire or are terminated.

12.3 Either Party may terminate this Agreement or any commission immediately on written notice if the other commits a material breach that is not remedied within thirty days of notice, or becomes insolvent. A breach capable of remedy must be notified in writing with reasonable particularity, and the cure period runs from that notice.

12.4 The Client may terminate an Engagement Letter for convenience on thirty days’ written notice, and will pay for Services performed and expenses committed to the termination date. Clause S2.2 governs subscriptions, and this clause does not apply to them.

12.5 Interiu may terminate a commission immediately on written notice where performance would in its reasonable opinion put it in breach of law, of a professional obligation or of a duty to another client, where a conflict of interest arises that cannot be managed, where the Client fails to provide access, information or personnel and does not remedy within thirty days of notice, or where the Client is more than sixty days in arrears on an undisputed invoice.

12.6 On termination, each Party will return or destroy the other’s Confidential Information, except where retention is required by law. Clause 10.5 governs the deployed System.

12.7 Clauses 4.3, 5.4, 6, 7, 8, 9.1, 9.7, 10, 11, 12.6, 13, 14, 16, 17, 18 and Schedule 1 clause S6 survive termination.

13. Warranties

13.1 Each Party warrants that it has authority to enter into this Agreement.

13.2 Interiu warrants that the Services will be performed as described in clause 3.1, and that so far as Interiu is actually aware at the date of the relevant commission, having made no enquiry beyond its own records, the Interiu Technology as supplied does not infringe a third party’s intellectual property rights in the European Economic Area or the United Kingdom. This warranty does not extend to Output, to any third-party model, to anything built to the Client’s specification or instruction, to Client Data, or to any combination, modification or use of the System not authorised by Interiu.

13.3 Interiu does not warrant that the System will find everything, or that any Output is accurate. Output is generated in part by probabilistic systems, may be incomplete and may be wrong. The completeness of any analysis of an unknown document set cannot be warranted by anyone. Interiu’s obligations are the process obligations in clause 9, and the Client’s protection is the review in clause 6.3.

13.4 The Client acknowledges that the absence of a finding is not a statement that nothing exists to be found, and that the presence of a finding is not a statement that it is correct without the Client’s own review.

13.5 IP indemnity. Interiu will defend the Client against a third-party claim that the Interiu Technology as supplied infringes that third party’s intellectual property rights in the EEA or the UK, and will pay damages finally awarded or agreed in settlement, provided the Client notifies Interiu promptly in writing, gives Interiu sole conduct of the defence and settlement, makes no admission, and gives reasonable assistance at Interiu’s cost. Liability under this clause, including the costs of defence, is subject to clause 14.3.

13.6 Exclusions and sole remedy. Clause 13.5 does not apply to a claim arising from Output, from a third-party model, from Client Data, from anything built to the Client’s specification or instruction, from modification of the System by anyone other than Interiu, from combination with anything not supplied by Interiu, or from continued use after Interiu has given notice to stop. Where such a claim arises or is likely, Interiu may procure the right to continue use, modify or replace the affected part, or terminate the affected commission and refund fees prepaid for the unexpired period. Clauses 13.5 and 13.6 are the Client’s sole remedy and Interiu’s entire liability for infringement.

13.7 No professional advice. Interiu does not provide legal, audit, assurance, tax, accounting, valuation, investment or regulatory advice, is not registered or regulated to do so, and nothing it supplies is such advice or a substitute for it. Interiu performs no audit, review or agreed-upon-procedures engagement under any auditing standard, and no Output or Deliverable is an opinion, certificate or assurance of any kind. This includes work described as due diligence, forensic analysis or investigation. The Client is responsible for obtaining its own professional advice and for its own obligations to its clients and regulators.

13.8 Except as stated in this Agreement, all other warranties, conditions and terms implied by statute or common law are excluded to the fullest extent permitted by law.

14. Limitation of liability

14.1 Nothing in this Agreement limits liability for death or personal injury caused by negligence, for fraud, or for any liability that cannot lawfully be limited.

14.2 Neither Party is liable for loss of profit, loss of revenue, loss of anticipated savings, loss of business opportunity, loss of goodwill, or any indirect or consequential loss. This clause applies in all cases and is not disapplied by any other provision of this Agreement.

14.3 Subject to 14.1, each Party’s total liability arising out of or in connection with this Agreement is limited in aggregate to the greater of the fees paid and payable under the relevant Order Form or Engagement Letter in the twelve months preceding the event, and the annual fee for that commission.

14.4 The limit in 14.3 does not apply to the Client’s obligation to pay fees, to the Client’s liability under clauses 14.7 or S6, or to breach of clause 10.4 or 10.8. In every other case, including a breach of clause 7 or clause 9.1 and including any act or omission of a third-party model provider, Interiu’s liability is subject to the limit in 14.3.

14.5 Interiu is not liable for loss arising from the Client’s use of, or reliance on, any Output or Deliverable without the review clause 6.3 requires, from use outside the Permitted Scope or the checks recorded in the commission, from inaccuracy or incompleteness of Client Data, from the Client Environment or any third-party product, or from any advice the Client gives its own client.

14.6 A claim must be notified within twelve months of the claiming Party becoming aware of the circumstances giving rise to it.

14.7 The Client will indemnify Interiu against any third-party claim, and any loss Interiu suffers, arising from Client Data including any allegation that it infringes a third party’s rights or that its processing is unlawful, from the Client’s breach of clause 6.2 or S6, from disclosure of a Deliverable in breach of clause 18.10, or from a deployment or configuration contrary to clause 9.5.

15. Insurance

15.1 Where an Order Form or Engagement Letter records insurance requirements, Interiu will maintain the cover stated in it with a reputable insurer for the term of that commission, and will produce a certificate of currency on reasonable request, not more than once a year. Interiu gives no insurance covenant except in a commission that records one.

15.2 Interiu’s obligation is to maintain the insurance. The existence, level or response of any policy neither increases nor evidences Interiu’s liability under this Agreement, and clause 14 applies whether or not a claim is covered.

16. Non-solicitation

16.1 During a commission and for twelve months after it ends, neither Party will knowingly solicit for employment any individual of the other who was directly involved in it. This does not restrict general advertising, except in respect of an individual who has within the preceding six months had material involvement in a commission between the Parties.

16.2 A Party in breach of 16.1 will pay the other, as a genuine pre-estimate of loss and not a penalty, an amount equal to fifty per cent of the individual’s first-year total remuneration in the new role.

17. Notices

17.1 Notices take effect on delivery, sent to the addresses on the signature page. Routine notices may be sent by email to a named address. Notices of termination or breach must be sent by registered post or courier.

18. General

18.1 Force majeure. Neither Party is liable for failure to perform caused by an event beyond its reasonable control, including act of God, war, terrorism, civil disorder, epidemic, act of government or regulator, industrial action other than by the affected Party’s own workforce, failure or interruption of a utility, telecommunications network, cloud infrastructure provider or third-party model provider, and cyber attack not resulting from the affected Party’s own failure to take reasonable measures. If the event continues for more than sixty days, either Party may terminate the affected commission, and Interiu will refund prepaid fees for the unexpired period. This does not excuse payment obligations already due.

18.2 Assignment. Neither Party may assign this Agreement without the other’s written consent, not to be unreasonably withheld, except to a successor to substantially all of its business.

18.3 Entire agreement. This Agreement, its Annexes and Schedule, and the Order Forms and Engagement Letters signed under it, are the entire agreement on their subject matter. Neither Party relies on any statement not set out in them. This clause does not limit liability for fraud.

18.4 Variation. Amendments are effective only in writing signed by both Parties.

18.5 Severability. An unenforceable provision is modified to the minimum extent necessary, or severed, and the rest continues in force.

18.6 No waiver. A failure or delay in exercising a right is not a waiver.

18.7 Third parties. No third party has any right to enforce this Agreement.

18.8 Counterparts and electronic signature. Permitted.

18.9 Governing law and forum. This Agreement is governed by Spanish law. The Parties submit to the exclusive jurisdiction of the courts of Palma de Mallorca, Spain.

18.10 No third-party reliance. The Services, the Output and each Deliverable are provided to the Client alone, for the purpose stated in the commission. Interiu owes no duty of care and accepts no responsibility or liability to any person other than the Client, in contract, tort, under statute or otherwise. The Client will not disclose a Deliverable, or the fact of Interiu’s involvement, to any third party except to its own client for whom the commission was performed on terms that the recipient may not rely on it and that Interiu owes it no duty, to its professional advisers under a duty of confidence, or where required by law or a regulator. Where the Client discloses in breach of this clause, it will indemnify Interiu against any claim by the recipient arising from that disclosure.

18.11 Marketplace acquisition. Where the Client acquires a subscription through a third-party marketplace, that marketplace’s terms govern the transaction and the marketplace operator’s relationship with the Client. This Agreement governs the Services, and where the two conflict in respect of the Services, this Agreement prevails as between the Parties.

18.12 Change of control. Either Party may terminate on thirty days’ notice where the other undergoes a change of control and the acquirer is a competitor of the terminating Party. Where the Client undergoes a change of control, the Permitted Scope does not extend to the acquirer or its group without a new Order Form.

Schedule 1. Subscription terms

Applies to every Order Form and prevails over the body of this Agreement in respect of it.

S1. Order Forms. A subscription is commissioned by an Order Form signed by both Parties, stating the System, the Permitted Scope, the fee, the initial term and any specific terms.

S2. Term and renewal. S2.1 Each subscription runs for the initial term stated in the Order Form, not less than twelve months, and renews for successive twelve-month periods unless either Party gives written notice of non-renewal not less than sixty days before the end of the then-current term. S2.2 Neither Party may terminate a subscription for convenience during a term. Fees for the current term are non-refundable and, where unbilled, remain payable on termination other than by the Client under clause 12.3 for Interiu’s material breach.

S3. Fees and escalation. S3.1 The fee is payable annually in advance unless the Order Form says otherwise, and is non-refundable except under clause 13.6 or S2.2. S3.2 Interiu may increase the fee with effect from each renewal, on not less than sixty days’ notice, by no more than the greater of five per cent and the increase in the Spanish Consumer Price Index over the preceding twelve months. A larger increase takes effect only if the Client does not give notice of non-renewal within thirty days. S3.3 Where Interiu’s third-party model or infrastructure costs attributable to the Client’s use increase by more than twenty-five per cent during a term, the Parties will discuss an adjustment in good faith; failing agreement within thirty days, Interiu may terminate on sixty days’ notice with a pro-rata refund of prepaid fees.

S4. Suspension. S4.1 Interiu may suspend the licence and any support on ten business days’ written notice where an undisputed invoice is more than thirty days overdue, where the Client is in material breach of the Permitted Scope or S6, or where continued operation would in Interiu’s reasonable opinion breach applicable law. Suspension does not relieve the Client of its obligation to pay, and Interiu will lift it promptly once the cause is remedied. S4.2 Suspension is a contractual step, not a technical one. The licence key is verified without any connection to Interiu, so Interiu does not deactivate a key already delivered and cannot interrupt a running deployment. Suspension is effected by withdrawal of the licence by notice, by discontinuation of support and of any component Interiu supplies or operates, and by withholding further keys, updates and renewals. On a notice of suspension the Client will stop using the System, and continued use after that notice is a material breach of clauses 10.4 and S6.1.

S5. Support, and no availability commitment. S5.1 Interiu provides support per the Order Form during Spanish business hours, and will use reasonable endeavours to acknowledge a request within one business day. S5.2 Interiu gives no warranty or commitment as to the availability, uptime or performance of the System. The System operates in the Client Environment on infrastructure the Client provides, controls and maintains. S5.3 Where the Order Form provides service credits, they are the Client’s sole remedy for a missed support target, are capped in aggregate at ten per cent of the annual fee, and must be claimed within thirty days. S5.4 Interiu has no obligation in respect of a problem caused by the Client Environment, by modification of the System, by failure to install an update Interiu has made available, by use outside the Permitted Scope, or by a third party.

S6. Acceptable use. S6.1 This clause applies in addition to clause 10.4. The Client will not, and will not permit any person to: use the System outside the Permitted Scope; copy it other than for backup, or modify, decompile, disassemble or reverse engineer it, or attempt to derive its source code, prompts, rules or thresholds, except to the extent Article 100 of Royal Legislative Decree 1/1996 permits and cannot be excluded; remove or alter any notice or licence mechanism; circumvent any licence key, expiry or usage-measurement mechanism; make the System available to any third party, including as a service bureau; use the System or its Output to build, train, benchmark or improve a product or service that competes with it; or publish any benchmark, evaluation or performance comparison of the System without Interiu’s prior written consent. S6.2 The Client is responsible for the acts and omissions of its personnel and of any affiliate or contractor it permits to use the System, as for its own.

S7. Permitted Scope, affiliates, usage records. S7.1 The Order Form states the Permitted Scope. Where the System is delivered under clause 4.6(b), the Order Form states whether the agent, connector or application is published to named users, to a named group, or tenant-wide, and prices accordingly. Publication beyond the stated scope is use beyond the Permitted Scope. Use beyond the Permitted Scope is a material breach and is chargeable at Interiu’s then-current rates. S7.2 “Client” means only the legal entity signing the Order Form. An affiliate acquires no rights unless named. Where the Client is a member firm of an international network, no other member firm acquires any right under this Agreement. S7.3 The System records usage against the Permitted Scope, including invocations of any agent, connector or application delivered under clause 4.6(b). The Client will not disable that recording and will provide the records on request, not more than twice a year. Where records show use beyond the Permitted Scope, the Client will pay the difference plus Interiu’s reasonable verification costs where the excess exceeds ten per cent.

S8. Updates and versioning. S8.1 Interiu makes updates available during the subscription. The Client will install updates Interiu identifies as required for security or legal compliance within thirty days of availability. S8.2 Interiu supports the current version and the immediately preceding major version. S8.3 Interiu may change the System, including the models, providers and components it uses, provided the change does not materially reduce functionality during the then-current term. Interiu will give thirty days’ notice of a change to a model provider that processes Client Data. S8.4 Interiu may discontinue a System on not less than six months’ notice expiring at the end of a term, refunding prepaid fees for any unexpired period.

S9. Environment. S9.1 The Client provides and maintains the Client Environment to Interiu’s stated specification, including compute, storage, network access to any model endpoint the System requires, identity management and backup. Interiu’s obligations are conditional on that.

Annex A. Data processing terms

Applies to processing described in clause 8.2 or 8.3, and constitutes the Parties’ agreement under Article 28(3) GDPR for that processing.

A1. Roles. The Client is the controller. Interiu is the processor.

A2. Subject matter and duration. The access granted under clause 5 and any incidental receipt under clause 4.3, for the period of the commission.

A3. Nature and purpose. Building, configuring, testing, supporting and operating the System within the Client Environment.

A4. Types of personal data and categories of data subject. As determined by the Client Data the Client places into the System.

A5. Instructions. Interiu processes personal data only on the Client’s documented instructions unless required otherwise by law, and will tell the Client if an instruction appears to infringe data protection law.

A6. Confidentiality. Persons authorised to process are bound by confidentiality obligations.

A7. Security. Interiu implements the measures in Annex C, taking account of the state of the art and the nature of the processing.

A8. Subprocessors. The Client gives general authorisation for Interiu to engage the subprocessors listed in Annex C. Interiu imposes obligations no less protective than these terms, remains liable for their performance, and will give thirty days’ notice before adding or replacing one. The Client may object on reasonable data protection grounds within that period, and the Parties will discuss in good faith. Where no resolution is reached, either Party may terminate the affected commission on sixty days’ notice, and Interiu will refund prepaid fees for the unexpired period. Termination under this clause is not a breach by either Party and clause S2.2 does not apply to it.

A9. Data subject rights. Interiu will assist the Client insofar as possible. Because the data remains in the Client Environment, the Client will ordinarily respond without Interiu’s involvement.

A10. Assistance. Interiu will assist the Client with Articles 32 to 36, taking into account the nature of processing and the information available to Interiu.

A11. Deletion or return. At the end of the provision of services, Interiu will delete or return personal data processed under these terms and delete existing copies, unless law requires storage.

A12. Audit. Interiu will make available the information necessary to demonstrate compliance with Article 28. The Client’s audit right is satisfied in the first instance by Interiu’s written responses to a reasonable security questionnaire and by any third-party assessment Interiu then holds. Where those are genuinely insufficient, the Client may audit on these terms: not more than once in any twelve months, save where a personal data breach affecting the Client has been confirmed; on not less than thirty days’ written notice; during business hours, for not more than two business days, by not more than two individuals; by the Client’s own personnel or an independent auditor that is not a competitor of Interiu and that signs a confidentiality undertaking directly with Interiu; limited to systems and records relevant to the processing, and excluding source code, prompts, other clients’ information and commercially sensitive information; subject to Interiu’s security rules; and at the Client’s cost together with Interiu’s reasonable assistance costs, save where the audit identifies a material breach by Interiu.

A13. International transfers. Interiu will not transfer personal data outside the European Economic Area without a valid transfer mechanism under Chapter V GDPR. The model endpoints and regions recorded under clause 4.5 are notified to the Client in the commission.

Annex B. AI transparency and human oversight

B1. Disclosure. The notice in clause 9.2 is displayed in interactive systems and reproduced in written Deliverables.

B2. Human oversight. Where Interiu produces and delivers a Deliverable under an Engagement Letter, findings are reviewed by a person with relevant domain experience before delivery, under clause 9.4, and conclusions and recommendations in that Deliverable are authored or approved by a person. Where the Client operates the System under a subscription, Output is produced and made available inside the Client Environment without review by Interiu, and the Client is responsible for reviewing it under clause 6.3 before relying on it.

B3. Traceability. Findings cite the documents, transactions or records they rest on, under clause 9.3.

B4. Documented limits. The commission records what the System is configured to check and what it is not.

B5. Model providers. Interiu contracts with its model providers on the terms described in clause 9.1. Current providers are listed in Annex C.

B6. Regulatory classification. The Parties will cooperate in documenting the System’s classification under applicable AI regulation and in meeting the obligations that follow from it. Where the Client modifies or configures the System, the Client is responsible for the consequences of that modification under such regulation.

Annex C. Security measures and subprocessors

C1. Deployment. The System runs in the Client Environment. Client Data is processed where it already sits.

C2. Access control. Access to the Client Environment is requested and used as described in clause 5. Access to Interiu’s own systems is granted on the basis of what a role requires, reviewed at least annually and on any change of personnel, and removed on departure.

C3. Separation. Working artefacts are held separately per engagement and are not commingled. Access to each is restricted to the personnel assigned to it.

C4. Encryption. Data is encrypted in transit using TLS 1.2 or above. Encryption at rest within the Client Environment is provided by the Client’s own infrastructure and key management.

C5. Personnel. Interiu personnel are bound by written confidentiality obligations that survive their engagement, and receive instruction on the handling of Client Data before working on a commission.

C6. Model handling. As described in clause 9.1.

C7. Incident notification. Interiu will notify the Client without undue delay and in any event within seventy-two hours of confirming that a Security Incident has occurred. “Security Incident” means a confirmed unauthorised access to, or disclosure of, Client Data in Interiu’s possession or of credentials granted under clause 5. It does not include unsuccessful attempts, routine scanning, or interruptions to availability. Notification is not an acknowledgement of fault or liability.

C8. Continuity. Because the System runs in the Client Environment, its availability depends on the Client’s own infrastructure. Interiu maintains source control, offsite backup of its own materials, and documented handover arrangements so that a commission can be continued by another member of the team.

C9. Subprocessors. Where clause 4.5(a) or 4.5(b) applies, the model provider is the Client’s own and is not a subprocessor of Interiu. Where clause 4.6(b) applies, the provider of the Client’s productivity tenancy is likewise the Client’s own. Under the default deployment there is therefore no subprocessor of Interiu’s in the path of Client Data.

Any subprocessor Interiu does engage for a commission is named in the Order Form or Engagement Letter before the commission begins, and clause A8 governs adding or replacing one.

Signature page

Interiu AI S.L.

Name: Yan Serebryakov Title: Chief Executive Officer Date: Signature:

[Client legal name]

Name: Title: Date: Signature:

Notice address, Interiu: Calle Maquinaria 4, 3, 1, 07011 Palma de Mallorca, Spain.

Notice address, Client: [address].