Datazag Terms of Service

Version 1.0

Effective date 25 October 2026 for new contracts accepting this version on or after that date

Governing law England and Wales

1. Parties and business customers

1.1 These Terms are between Datazag Ltd, registered in England and Wales under company number 13217786, with its registered office at 12 South Drive, Wokingham, England, RG40 2DH (Datazag, we, us), and the business or other organisation accepting them (Customer, you).

1.2 Datazag supplies Services only for business, trade, professional or organisational purposes. We do not offer consumer sales. An individual may contract as a sole trader when acting for those business purposes. You must not purchase for personal, family or household use. This description does not exclude any mandatory rights that apply to the actual transaction.

1.3 The individual accepting these Terms confirms that they have authority to bind the named Customer. You must provide accurate legal entity, billing and contact information and keep it current. An employee accepting for an organisation does not become the contracting Customer merely by operating its account.

2. Contract formation and applicable documents

2.1 These Terms govern access to Datazag websites, portals and the services actually ordered, including infrastructure assessments, Reports, monitoring, alerts, datasets, APIs and related support (Services). A description of a product does not grant access to it or imply that it is available under every plan.

2.2 A paid contract is formed when you accept the identified documents through checkout or a signed order and we confirm the order or activate the purchased Service. An automated acknowledgement alone is not acceptance if clearly identified as an acknowledgement. Before contracting, the order or checkout must identify the Customer, Service, scope, price, taxes, term, renewal basis and applicable document versions. We will correct a material pricing or availability error before acceptance or offer cancellation and a refund if it cannot be resolved.

2.3 An Order means the mutually accepted order form or checkout record. Product Terms means a Partner Agreement, Data Licensing Agreement, service schedule or other expressly incorporated product-specific agreement. The Contract comprises the Order, these Terms and the applicable Product Terms and Data Processing Addendum (DPA), including its incorporated schedules.

2.4 Mandatory data transfer clauses prevail over conflicting provisions throughout the Contract. Subject to those clauses, the DPA prevails for personal data processing. For other matters, a separately signed variation expressly identifying the provision it changes prevails; applicable Product Terms then prevail over these Terms. An Order specifies the selected scope, quantity and price but does not silently override Product Terms, liability provisions, historical licence rights or data protection safeguards. Any intended override must be expressly identified and mutually agreed. The Privacy Policy is a privacy notice and does not vary contractual rights. Marketing descriptions and purchase-order boilerplate do not amend the Contract.

2.5 For Partners, the Partner Agreement governs partner pricing, allowances, founding status, co-branding, delivery to Clients or Prospects, historical Report rights, termination and liability. Nothing in these Terms removes those rights or adds a second liability cap or indemnity. No general fee or amendment power overrides founding fee protection.

2.6 We identify and retain the version accepted for a paid Contract and make a durable copy or acceptance record available. This version does not retrospectively replace an earlier contract; amendments follow Clause 18. Website use alone does not constitute acceptance of an undisclosed paid order, recurring charge or amended paid-contract terms.

3. Accounts and authorised users

3.1 You must keep access credentials and integration secrets secure, limit access to authorised users and promptly notify us of suspected compromise. You are responsible for your authorised users and activity caused by your failure to meet those duties, subject to Clause 15. You are not responsible to the extent caused by our breach or security failure.

3.2 We may require verification of your business, authority or contact address before activating a Service. Account access and security controls must not be bypassed. You must not share administrative credentials externally. Authorised service-provider access requires appropriate individual or service credentials and any required permissions.

4. Service scope and delivery

4.1 We will supply the ordered Services with reasonable skill and care and in accordance with the agreed scope. Outputs are limited to the data sources, external visibility, time coverage and methods applicable to the Service. Operational completion estimates are targets unless an Order or Product Terms expressly make them binding.

4.2 Monitoring and alert subscriptions do not include continuous human review, guaranteed detection or an incident response service unless expressly agreed. A service-level agreement applies only where expressly incorporated. Support channels and hours are those stated for the purchased Service; where none are stated, reasonable support is available through the Portal or partners@datazag.com during UK business hours, excluding public holidays in England and Wales.

4.3 We may maintain and improve the Services, giving reasonable advance notice of planned material disruption where practicable. We must not materially reduce a purchased core function during a prepaid period without your agreement, except as strictly necessary for law or urgent security. If a necessary change materially prevents the purchased use and no reasonable equivalent is available, you may terminate the affected Service and receive unused prepaid fees for the period after termination. Product Terms and protected founding scope prevail.

5. Orders fees and renewals

5.1 Prices, billing currency, quantities, usage limits and included features are those agreed at checkout or in the Order. A subscription renews only on the renewal frequency disclosed and accepted before purchase. Unless a fixed commitment or other rule is expressly agreed, it renews for successive periods of the same length and you may stop the next renewal through the Portal or written notice before it occurs. Cancellation is effective at the end of the current paid period. A fixed commitment must be expressly disclosed and accepted.

5.2 Subscription fees are payable in advance and one-off fees at ordering unless agreed otherwise. An expressly agreed invoice is payable within its stated payment period, or within 30 days of issue if no period is stated. You authorise the disclosed recurring charges to your selected payment method. Stripe or another identified payment provider may process payment under its applicable terms; we remain responsible for our own contractual obligations.

5.3 Additional purchases or chargeable usage require authorisation under the Order or service controls. Credit validity, allowance resets, rollover and overage rates apply only as disclosed before purchase; these Terms do not impose an undisclosed expiry, rollover restriction or usage charge. Partner allowances and discounts remain governed by the Partner Agreement.

5.4 We may change standard recurring prices on at least 30 days direct written notice, effective only from a renewal after that notice and not during an agreed fixed-price commitment. You may stop renewal before the increase takes effect. Product-specific and founding price protections prevail. One-off purchases already accepted are unaffected.

6. Taxes and payment problems

6.1 Fees exclude VAT and applicable sales, use, goods and services and similar transaction taxes unless expressly stated otherwise. We will collect and account for taxes we are legally required to collect. You are responsible for transaction taxes legally payable by you, but not taxes on our income, profits, payroll or property. Both parties will provide reasonably required tax information. Reverse charge or exemption applies only where legally available.

6.2 You may deduct withholding required by law, remit it to the relevant authority and promptly supply official evidence. We will reasonably cooperate to obtain lawful relief. No gross-up applies unless expressly agreed. You bear your own bank and currency conversion charges.

6.3 We will notify you of a failed payment or overdue invoice and give at least 14 days to pay before suspending for non-payment. Promptly explain a good-faith dispute and pay undisputed amounts; both parties will work reasonably to resolve it. We will not suspend solely for a genuinely disputed amount while you cooperate and pay undisputed fees. Any suspension follows Clause 16. Partner-specific payment arrangements prevail.

7. Cancellation refunds and service failure

7.1 Except for an express refund right in the Contract or applicable law, cancellation for your convenience does not refund a completed one-off purchase or the current paid subscription period. It stops future renewals in accordance with Clause 5.1. This does not restrict remedies for our breach, required refunds or agreed trial and satisfaction guarantees, including those in the Partner Agreement.

7.2 If our technical failure prevents delivery of a paid one-off output, notify us and we will reasonably investigate and offer re-performance without additional charge. If we cannot deliver within a reasonable agreed period, you may cancel the affected undelivered purchase for a refund. A failed allowance-funded output is restored to the allowance under the applicable Product Terms. These measures do not remove other contractual remedies, subject to Clause 15 and no double recovery.

7.3 Unused prepaid fees must be refunded where these Terms or Product Terms expressly require it, including Datazag convenience termination or termination for its unremedied material breach. Refunds normally use the original payment method unless otherwise agreed. Accrued undisputed charges remain payable.

8. Licences and intellectual property

8.1 Datazag and its licensors retain rights in the Services, underlying intelligence, software, methodologies, databases and Report structure. You retain rights in your own submissions, branding, independent analysis and advisory material. Neither party acquires the other's ownership rights merely by using the Services.

8.2 Subject to payment and the Contract, we grant you a non-exclusive, non-transferable right to access the purchased Service and use its outputs for your internal business purposes during the applicable service term. Your authorised staff, professional advisers, auditors, insurers and service providers may access relevant outputs on your behalf under confidentiality and limited-purpose duties. You remain responsible for providers acting for you. Client delivery, resale, data licensing and broader redistribution require express Product Terms; the Partner Agreement supplies the permissions it expressly grants.

8.3 Paid Reports and permitted extracts may continue to be retained and used for the authorised purpose after the Service ends, with source attribution and licence restrictions continuing. This confers no continuing Portal access, updates, new monitoring or right to create a dataset, feed or competing product. Partner historical rights follow the Partner Agreement. Retention must remain lawful where outputs contain personal data or third-party confidential information.

8.4 Raw datasets, API integration, bulk feeds, automated data shares, systematic extraction and onward redistribution require the applicable express licence. Product-specific included alerts and authorised integration permissions are not prohibited by this general restriction. You must not remove required attribution, misrepresent modified findings as Datazag originals, or use outputs for AI training, fine-tuning or benchmarking unless expressly licensed.

8.5 You permit us to process your submissions and use your branding only to provide the ordered Services or as otherwise expressly agreed. Processing personal data remains subject to the DPA and applicable law. Providing a submission does not transfer ownership or authorise unrelated marketing, corpus ingestion or model training. Feedback may be used to improve the Services without transferring ownership of your confidential material or granting unrelated use of personal data.

9. Acceptable use and international compliance

9.1 You must use the Services lawfully and hold the authority needed for your submissions, assessments, communications and client activities. A commercial reason for contacting a Prospect does not itself establish consent or a lawful basis. Each party remains responsible for the laws applicable to its own activities, including privacy, electronic marketing, anti-bribery, sanctions, export control and trade restrictions.

9.2 You must not exploit systems without authorisation; facilitate phishing, fraud, extortion, impersonation or malicious activity; circumvent access controls or rate limits; unlawfully scrape the Services; infringe intellectual property or confidentiality; or present an unsupported allegation of a breach as an established fact. Reverse engineering restrictions apply only to the extent permitted by applicable law.

9.3 Do not describe an external assessment as an internal penetration test, exhaustive security assurance, legal opinion, insurance guarantee, regulatory audit or certification. Do not imply that Datazag endorses your business or a Client beyond an expressly agreed relationship. Use in direct marketing must comply with applicable laws and objections; maintain a minimal lawful suppression record where needed to prevent further unwanted contact.

10. Evidence scores and limitations

10.1 Reports may contain observed technical records, derived findings, probabilistic classifications and risk assessments. An observed record is evidence from the identified source and time, rather than proof of every underlying circumstance. A score or classification is an assessment, not a guarantee or conclusive determination of wrongdoing, compromise, future conduct or insurance eligibility.

10.2 Generation time and observation time are distinct. We will show generation time and, where available, material observation or source timestamps and timing limitations appropriate to the output. Sources may be cached, delayed, incomplete or inaccurate; false positives and false negatives can occur. Externally observable analysis does not reveal private systems or every ephemeral or unindexed asset.

10.3 You must apply appropriate professional judgement and validate material findings before enforcement, legal, underwriting or other consequential action. These limitations do not excuse failure to exercise reasonable skill and care or remove an express contractual commitment.

11. Alerts and third-party destinations

11.1 You may configure integrations only where included in your purchased scope and only to destinations you control or are authorised to operate. Secure credentials and endpoint configuration and restrict Client data to its authorised recipients. A shared operations platform must preserve Client separation and must not expose one Client's confidential information to another.

11.2 Unless broader licensing is agreed, alerts may be received, stored, indexed, searched, correlated, annotated and routed only for the authorised business or managed service purpose. This does not permit a reusable intelligence product, cross-Client disclosure or onward resale. Preserve supported source and event metadata; machine-readable alerts do not require document cover pages or page footers. Partner attribution follows Schedule 2 of the Partner Agreement.

11.3 We remain responsible for reasonable skill and care in our own delivery processing and for providers we engage. We are not responsible to the extent a delivery failure is caused by a destination outside our control, but will reasonably assist diagnosis. Customer-selected providers and destinations are distinguished from our Sub-processors under the DPA; choosing a destination does not excuse an unlawful transfer or disclosure.

12. Confidentiality and publicity

12.1 Confidential Information means non-public commercial, technical or operational information disclosed for the Contract, including submitted Client lists and the fact of a Client assessment. Ownership of underlying Datazag intelligence does not remove confidentiality from non-public Client-specific submissions or assessment context.

12.2 Each receiving party must use Confidential Information only for the Contract and protect it with reasonable care and at least the care used for its own similar information. Disclosure is permitted to authorised staff, advisers and service providers who need to know under confidentiality duties, and to expressly authorised output recipients or destinations. Each party remains responsible for recipients acting on its behalf.

12.3 Information is excluded only to the extent it lawfully becomes public without breach, was already lawfully held without restriction, is independently developed without use of the disclosure, or is lawfully received from another source without a duty of confidence. Legally required disclosure is permitted, limited to what is required, with prior notice where lawful and practicable and reasonable cooperation on protection.

12.4 Confidentiality lasts throughout the Contract and for three years afterwards; trade secrets remain protected for as long as they retain that status. Personal data protections continue as required by law and the DPA. Return or deletion on request is subject to lawful records and continuing permitted Report use. Neither party may publicly use the other's name or logo as a customer reference without prior written consent, except an expressly permitted partner-status statement.

13. Personal data

13.1 Each party must comply with its applicable privacy and data protection obligations. Where Datazag processes personal data on your instructions as processor or sub-processor, the identified DPA and its schedules are incorporated and must be agreed before that processing begins. The applicable DPA is available at /legal/dpa and the Security and Sub-processor Schedule at /legal/subprocessors; checkout or the Order identifies their accepted versions.

13.2 Independent controller activities are governed by applicable law and explained in the Privacy Policy. Roles follow the actual purpose and means, not a blanket data label. Public availability does not remove personal data protections. You must not submit special category, criminal offence or children's data without express agreement and appropriate safeguards.

13.3 Restricted transfers require a valid applicable mechanism and completed details before they occur. These Terms neither establish a transfer mechanism nor represent that all processing is in the UK or Europe. Deletion, backup retention, assistance, breach notification and Sub-processors follow the DPA; a historical output licence does not override lawful personal data retention limits.

14. Warranties and evaluation services

14.1 We warrant that we will provide purchased Services with reasonable skill and care and materially in accordance with the agreed scope. Each party warrants its authority to contract. You warrant that you have the rights and authorisations needed for your submissions and instructions, without assuming responsibility for Datazag's own processing or sourcing.

14.2 There is no promise of uninterrupted or error-free operation, complete detection or a particular commercial, security or insurance outcome unless expressly agreed. To the extent legally permitted, terms implied by law are excluded only where they are inconsistent with these express commitments. Nothing removes an express warranty, indemnity or remedy in applicable Product Terms.

14.3 Beta, pilot or evaluation features must be clearly identified as such before use, with their scope, charges if any, duration and limitations disclosed. No production-critical reliance should be placed on them without separate agreement. Subject to mandatory law and express promises, identified free evaluation features are provided as available without a production availability commitment. Describing a feature as beta does not retrospectively remove commitments for a paid core Service or reduce confidentiality, security or data protection duties.

15. Liability and indemnities

15.1 Nothing excludes or limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or liability that applicable law does not permit to be excluded or limited. Nothing restricts mandatory data subject rights, regulatory powers or mandatory transfer-clause protections. The remaining limits apply only to the extent lawful and enforceable in the circumstances.

15.2 Where an applicable Partner Agreement or separately negotiated agreement sets liability limits or indemnities for the Service, that regime governs instead of Clauses 15.3 to 15.5 for the same claims. It is not cumulative with these defaults. Mandatory transfer clauses remain paramount.

15.3 For each successive 12-month period from contract acceptance and each anniversary, each party's aggregate liability for claims first arising in that period is capped at the greatest of: fees paid or payable under the Contract in the 12 months before the first event giving rise to those claims; 12 times the then-current monthly recurring fee, or the annual equivalent for other billing frequencies; and US$1,000 (Base Cap). Related events form one claim assigned to the first event period. For evaluation or free use without fees, the US$1,000 floor applies. Limits cover contract, negligence, statutory duty and other causes of action.

15.4 Liability for confidentiality, data protection, intellectual property licence restrictions and acceptable use breaches is subject to an enhanced aggregate cap of twice the Base Cap. Other claims remain subject to the Base Cap; all capped claims together may not exceed twice the Base Cap for the period. Properly due fees are debts outside these caps, but associated damages claims remain capped. No additional general indemnity is created by these Terms. Any Product Terms indemnity remains governed by its express terms and applicable cap, subject to Clause 15.1.

15.5 Subject to Clause 15.1, neither party is liable to the other for indirect or consequential loss, or loss of profits, revenue, anticipated savings, business opportunity or goodwill, whether direct or indirect. This does not exclude reasonable direct restoration costs, confidentiality or personal data breach investigation and response costs, refunds expressly due, or amounts recoverable under an applicable express indemnity; relevant damages remain subject to their applicable cap. Refunds and price adjustments expressly due are not denied by a damages cap. Each party must reasonably mitigate loss; there is no double recovery.

16. Suspension

16.1 We may suspend affected functions for a reasonably evidenced material breach, overdue undisputed payment after Clause 6.3, or a material legal or security risk. Unless immediate action is reasonably necessary to comply with law or prevent serious harm, we will give reasons, reasonable prior notice and an opportunity to remedy. Any urgent action must be explained promptly unless prohibited by law.

16.2 Suspension must be limited to the necessary scope and duration, reviewed promptly and lifted without undue delay when its grounds cease. Safe export access should remain available or a secure alternative provided where lawful. We will credit prepaid affected fees for a suspension ultimately found unjustified. Suspension does not automatically remove protected founding status or historical rights.

17. Termination and its consequences

17.1 Either party may terminate for material breach not remedied within 14 days after written notice describing the breach and remedy required, or immediately if incapable of remedy. Either may terminate for the other's insolvency or equivalent procedure only as legally permitted. You may cancel renewal under Clause 5.1; any express product-specific termination provision prevails.

17.2 Unless an agreed fixed commitment or Product Terms provides otherwise, Datazag may terminate a recurring Service for convenience on at least 30 days written notice and refund unused prepaid fees after termination. Founding Partners receive the notice and protections in the Partner Agreement. We may not use convenience termination or a general change power to circumvent protected founding pricing or accrued rights.

17.3 When the Service ends, access, new generation and monitoring cease, except any agreed export period. Paid historical Report rights and permitted recipient rights survive under Clause 8.3 or Product Terms. Other dataset, API and feed rights expire or survive as their express licence states; a Report permission does not extend a dataset licence.

17.4 The DPA governs return and deletion of instructed personal data, including export alternatives and backups. Accrued payment, refunds and remedies, document precedence, historical licence restrictions, intellectual property, applicable confidentiality, data protection, liability, dispute and other provisions intended to continue survive. We will not retain personal data merely because a commercial licence survives.

18. Changes to the Contract

18.1 We may propose changes on at least 30 days direct written notice, identifying the new version, effective date and material effect. Changes apply to new contracts or renewals after the notice period, subject to any express-agreement requirement and fixed or protected terms. Materially adverse changes during a current committed period require your express agreement or deferral until renewal; website posting or continued use alone is not sufficient consent to such changes.

18.2 You may stop renewal before a proposed change takes effect. Where an unavoidable legal or urgent security change materially prevents the purchased use during a prepaid period, Clause 4.3 applies. A stricter Product Terms or DPA amendment process prevails, including express consent where required.

18.3 Strictly necessary legal or urgent security changes may take effect sooner, limited to what is necessary, with reasons and as much notice as practicable. No change retrospectively alters accrued claims, accepted one-off purchases, historical licences, founding price protections or mandatory transfer safeguards. Supplier changes follow the DPA notice and objection process rather than a silent website edit. We retain accepted versions.

19. Notices and general provisions

19.1 Legal notices to Datazag must be sent to legal@datazag.com, with a copy to partners@datazag.com for Partner matters. Notices to you go to your designated legal contact or registered account or billing email. An email is treated as received on the next business day in England and Wales after sending unless the sender receives a delivery failure; a failed notice must be resent by a reasonably effective method. Incident notices follow the DPA's faster requirements.

19.2 Neither party may assign the Contract without the other's consent, not unreasonably withheld, except to an affiliate or as part of a genuine merger or sale of the relevant business with written notice and assumption of obligations. No transfer may reduce protected rights or bypass DPA supplier or transfer requirements. Product-specific assignment rules prevail.

19.3 We may use service providers but remain responsible for their performance under the Contract. Sub-processing requires the DPA arrangements. Neither party is the other's agent or authorised to bind it. You are responsible for your own professional services; Datazag remains responsible for its own commitments.

19.4 Neither party is liable for delay caused by events beyond reasonable control to the extent the event could not reasonably have been prevented or mitigated. The affected party must promptly notify, mitigate and resume performance. This does not excuse accrued fees, security or data protection duties. If a material affected Service cannot be provided for 30 consecutive days, either party may end it and Datazag will refund unused prepaid affected fees.

19.5 The Contract is the entire agreement for its subject matter. Neither party relies on a statement not included in it, subject to liability that cannot lawfully be excluded, including fraud. No third party may enforce it under the Contracts (Rights of Third Parties) Act 1999, except expressly conferred rights or mandatory transfer-clause rights. Permitted recipient licences do not create a direct Datazag services contract.

19.6 An invalid provision is severed only to the necessary extent and the remainder continues where lawful. Delay in exercising a right is not a waiver. Variations require the Contract's stated process. Electronic acceptance and signatures may be used; we keep evidence of accepted versions and authority declarations.

20. Governing law and disputes

20.1 The Contract and related non-contractual disputes are governed by the laws of England and Wales. Its courts have exclusive jurisdiction between the parties, subject to mandatory applicable law and mandatory forum or third-party rights under data transfer clauses.

20.2 The parties will first seek to resolve a dispute through their designated contacts in good faith, without delaying urgent relief, statutory deadlines or mandatory rights. Selecting English law does not displace applicable privacy, marketing, tax, sanctions or other mandatory requirements in relevant territories, and no jurisdiction-wide enforceability is promised.

End of Terms of Service Version 1.0