Terms of Service

• Version: 1.0 (Draft)
• Supplier: Vector Finsoft Limited
• Company number: 17421302
• Registered office: 2 Claridge Court, Lower Kings Road, Berkhamsted, England, HP4 2AF
• Website: https://www.vectorfinsoft.com
• Legal contact: mail@vectorfinsoft.com

These Terms of Service govern access to and use of Vector Finsoft's business-to-business loan management software and related services. They are intended for businesses, including banks, bridging lenders, specialist lenders and other lending organisations, and not for individuals contracting as consumers.

The commercial terms applicable to each Customer, including subscription fees, implementation fees, usage charges, contract duration and renewal arrangements, are set out in the relevant Order Form.

The Data Processing Agreement in Schedule 1 and the Service Level Agreement in Schedule 2 form part of the Agreement where applicable.

These Terms are a working draft and must be reviewed and completed before publication or contractual use, particularly the liability provisions, data protection arrangements, security commitments and operational service levels.

1.1 Definitions

In this Agreement, the following terms have the meanings set out below.

Acceptable Use Policy means any applicable acceptable use policy published by Vector Finsoft or expressly incorporated into an Order Form.

Agreement means these Terms, the applicable Order Form, Schedule 1 (Data Processing Agreement), Schedule 2 (Service Level Agreement), and any other schedules, policies or documents expressly incorporated into the Agreement.

AI Services means artificial intelligence and machine learning functionality made available through the Services, including document analysis, summarisation, extraction, underwriting reports, risk flags and recommendations.

Authorised User means an individual whom the Customer authorises to access and use the Services in accordance with this Agreement.

Business Day means a day other than a Saturday, Sunday or public holiday in England.

Confidential Information means information disclosed by or on behalf of one party to the other which is confidential by nature or is identified as confidential, including business plans, technical information, security information, pricing, Customer Data and non-public product information.

Customer means the business entity identified in the applicable Order Form or, where the Services are acquired through online registration, the business entity accepting these Terms.

Customer Data means data, documents, loan records, financial information, personal data and other materials submitted to, uploaded to, generated for or stored in the Services on behalf of the Customer, excluding Vector Finsoft's own software, documentation, platform information and intellectual property.

Data Protection Legislation means the data protection and privacy laws applicable to the parties and the processing in question, including the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 where applicable, and any applicable amendments or replacement legislation.

Documentation means user guides, technical documentation and other instructions relating to the Services supplied by Vector Finsoft.

Fees means the subscription, implementation, configuration, usage, transaction, support, exit assistance and other charges set out in an Order Form or otherwise agreed in writing.

Intellectual Property Rights means copyright, database rights, patents, trade marks, design rights, rights in inventions, trade secrets, know-how and other intellectual property rights recognised under applicable law.

Order Form means an order, subscription confirmation or other written or electronically accepted commercial document specifying the Services and relevant commercial terms.

Personal Data, Personal Data Breach, Controller, Processor and Processing have the meanings given to them under applicable Data Protection Legislation.

Services means the software, modules, functionality, hosting, implementation, support, integrations and other services expressly made available to the Customer under an Order Form.

Subprocessor means a third party engaged by Vector Finsoft to process Personal Data on behalf of the Customer in connection with the Services.

Term means the initial contract period and any subsequent renewal period specified in the applicable Order Form.

Vector Finsoft means Vector Finsoft Limited, company number 17421302.

1.2 Interpretation

References to legislation include amendments and replacement legislation in force from time to time. Words such as “including” and “for example” are illustrative and do not limit the meaning of preceding words. Headings are included for convenience and do not affect interpretation.

2.1 Services provided

Subject to the applicable Order Form, Vector Finsoft provides a software platform intended to support lending operations, which may include:

1. customer relationship management and loan origination;
2. loan servicing and loan management;
3. AI-assisted underwriting, document analysis, reports and risk flags;
4. accounting functionality and bank-feed integrations;
5. investor functionality and related reporting;
6. integrations, APIs and connections to third-party systems; and
7. implementation, onboarding, configuration, support and related services.

Only modules and functionality expressly included in the Customer's Order Form are included in the contracted Services.

2.2 Implementation

Implementation and onboarding are included as specified in the applicable Order Form. The parties will cooperate on implementation activities, responsibilities, dependencies, access requirements and any agreed milestones.

Unless expressly agreed otherwise, bespoke development, extensive data migration, third-party charges and work outside the agreed implementation scope may be subject to additional Fees.

Estimated delivery dates are estimates unless the parties expressly agree a binding delivery date in writing.

2.3 Changes to the Services

Vector Finsoft may develop, improve, maintain or modify the Services. It will use reasonable efforts not to materially reduce the core functionality expressly purchased by the Customer during the applicable Term.

Where a change is likely to materially affect the Customer's use of a contracted feature, Vector Finsoft will provide reasonable advance notice where practicable.

Security updates, emergency changes, changes required by law and changes to third-party services may need to be implemented more urgently.

A material change to the contracted scope or Fees must be agreed in accordance with the Agreement.

2.4 Third-party services

The Services may interoperate with third-party services, including Microsoft services, Companies House data, property information providers, credit reference services, Open Banking providers and AI providers.

The availability, terms, accuracy and functionality of third-party services may be outside Vector Finsoft's control. The Customer may need its own account, licence, consent, lawful basis or contractual arrangement to use a third-party service.

Vector Finsoft does not warrant the continuous availability or accuracy of information obtained from an external provider unless expressly agreed in writing.

3.1 Licence

Subject to payment of the applicable Fees and compliance with this Agreement, Vector Finsoft grants the Customer a limited, non-exclusive, non-transferable and non-sublicensable right during the Term to access and use the contracted Services and Documentation for its internal business operations.

The licence does not transfer ownership of the Services or any underlying Intellectual Property Rights.

3.2 Accounts and security

The Customer must ensure that registration information is accurate and kept up to date. The Customer is responsible for managing Authorised Users, assigning appropriate access rights and protecting account credentials.

The Customer must promptly notify Vector Finsoft of suspected unauthorised access, compromised credentials or misuse of its accounts.

The Customer is responsible for the activities of its Authorised Users and for ensuring they comply with this Agreement.

3.3 Affiliates and external access

The Customer must obtain Vector Finsoft's prior written consent before permitting an affiliate, group company, broker, external administrator or other third party to access or use the Services, unless that access is expressly authorised in the applicable Order Form.

Any approved access must comply with the applicable access controls, confidentiality requirements, usage limits and Fees.

The Customer remains responsible for approved users accessing the Services through its account, except to the extent responsibility cannot lawfully be allocated to the Customer.

3.4 Customer responsibilities

The Customer must:

1. use the Services in accordance with the Agreement, Documentation and applicable law;
2. ensure it has the rights, permissions and lawful bases required to submit Customer Data and authorise its Processing;
3. maintain suitable internal controls, access permissions and operational procedures;
4. review outputs and records generated by the Services for suitability for its intended purpose;
5. maintain appropriate independent backups or exports where reasonably necessary for its business continuity;
6. provide accurate information and reasonable cooperation required for implementation and support; and
7. promptly report material errors, security concerns or suspected misuse.

4.1 Prohibited activities

The Customer must not, and must not permit any third party to:

1. use the Services unlawfully or in breach of applicable regulatory requirements;
2. copy, reproduce, resell, sublicense, distribute or commercially exploit the Services except as expressly permitted;
3. reverse engineer, decompile or disassemble the Services except to the extent applicable law expressly permits the activity and the restriction cannot lawfully exclude it;
4. circumvent authentication, security, usage restrictions or access controls;
5. introduce malware, malicious code or other harmful material;
6. interfere with the integrity, security or availability of the Services;
7. use the Services or Documentation to develop, train, benchmark or operate a competing product or service, subject to applicable legal exceptions;
8. conduct competitive benchmarking or publish performance comparisons without Vector Finsoft's prior written consent;
9. use the Services to infringe another person's rights or unlawfully obtain or disclose information; or
10. access the Services beyond the scope of the applicable Order Form.

4.2 Monitoring and enforcement

Vector Finsoft may investigate reasonably suspected misuse and take proportionate steps to protect the Services, its customers and its systems.

Where reasonably practicable, Vector Finsoft will notify the Customer and provide an opportunity to remedy the issue before restricting access, except where urgent action is reasonably necessary to protect security, prevent unlawful activity or comply with law.

5.1 Fees

The Customer must pay the Fees specified in the applicable Order Form. Fees may include recurring subscriptions, implementation, configuration, usage, transaction, support and other agreed charges.

Unless expressly stated otherwise, Fees are exclusive of VAT and other applicable taxes, which will be charged in accordance with law.

5.2 Invoicing and payment

Invoices are payable within 30 days of the invoice date unless the applicable Order Form specifies otherwise.

The Order Form may specify whether subscription Fees are payable in advance, usage charges are payable in arrears, or implementation Fees are payable against milestones.

The Customer must notify Vector Finsoft promptly of any genuine invoice dispute, providing reasonable details. The Customer must pay undisputed amounts by the due date.

5.3 Late payment

Where a qualifying commercial debt is overdue, Vector Finsoft may exercise applicable statutory rights, including rights to statutory interest and compensation under the Late Payment of Commercial Debts (Interest) Act 1998, where applicable.

Any contractual interest or recovery charges must be applied consistently with applicable law and the relevant Order Form.

5.4 Overdue invoices and suspension

If an undisputed invoice remains unpaid after its due date, Vector Finsoft may issue written notice requiring payment.

If the Customer fails to pay within the remedy period specified in the notice, Vector Finsoft may suspend affected Services where reasonably proportionate and legally permissible.

Vector Finsoft will, where reasonably practicable, consider the operational impact of suspension on critical loan servicing and data access. Suspension will not remove the Customer's obligation to pay Fees properly due.

Access will be restored within a reasonable period after the grounds for suspension have been resolved.

5.5 Refunds

Refund rights, including any refunds following early termination, are governed by the applicable Order Form and any express refund terms agreed in writing.

Nothing in this Agreement excludes any refund or other remedy that cannot lawfully be excluded.

5.6 Price changes

Any price increases or changes to the commercial charging structure will be governed by the applicable Order Form or a written variation agreed by the parties.

5.7 Records and verification

Each party must retain records reasonably necessary to verify Fees charged under the Agreement. Any audit of usage or billing must be proportionate, conducted on reasonable notice and subject to confidentiality and security requirements.

6.1 Vector Finsoft intellectual property

Vector Finsoft or its licensors retain all Intellectual Property Rights in the Services, platform, software, APIs, Documentation, underlying technology and general product improvements.

Except for the limited rights expressly granted under this Agreement, no Intellectual Property Rights are transferred to the Customer.

6.2 Customer Data

As between the parties, the Customer retains its rights in Customer Data. The Customer grants Vector Finsoft a limited right to host, reproduce, transmit, process and otherwise use Customer Data only as reasonably necessary to provide, secure, support and maintain the Services, comply with law and perform its contractual obligations.

This clause does not transfer ownership of Customer Data to Vector Finsoft.

6.3 Bespoke development

Ownership and licensing arrangements for bespoke development, customer-specific configuration and commissioned deliverables must be expressly set out in the applicable Order Form or development agreement.

Unless otherwise agreed in writing, the Customer does not acquire ownership of Vector Finsoft's pre-existing software, platform, reusable components or general-purpose technology merely because they are used in customer-specific work.

6.4 Feedback

The Customer may provide suggestions or feedback about the Services. The Customer grants Vector Finsoft permission to use such feedback to improve its products, provided that this does not authorise the use or disclosure of Customer Data or Confidential Information contrary to this Agreement.

6.5 No analytics use of Customer Data

Vector Finsoft will not use Customer Data for aggregated or anonymised analytics or product improvement beyond what is necessary to provide the contracted Services, unless the Customer expressly authorises such use in writing or the use is otherwise lawfully agreed.

7.1 Obligations

Each party must protect the other party's Confidential Information using reasonable care and must not disclose it except as permitted by this Agreement.

A receiving party may use Confidential Information only to perform or exercise its rights under the Agreement.

7.2 Permitted disclosures

Confidential Information may be disclosed to employees, professional advisers, auditors and approved suppliers who need to know it for the relevant purpose and are subject to appropriate confidentiality obligations.

A party may disclose information where required by law, a court or a competent regulator, provided that, where legally permitted, it gives the other party reasonable advance notice.

7.3 Exclusions

Confidential Information does not include information that the receiving party can demonstrate is public other than through breach, was lawfully known without restriction, was independently developed without use of the confidential material, or was lawfully received from a third party without a duty of confidence.

7.4 Duration

Confidentiality obligations continue during the Term and for five years after termination, except that trade secrets and information protected by applicable law remain protected for as long as the relevant legal protection applies.

8.1 Data protection roles

The parties will comply with applicable Data Protection Legislation.

Where Vector Finsoft processes Personal Data on behalf of the Customer, the Customer will generally act as Controller and Vector Finsoft as Processor for that Processing. The actual roles depend on the nature and purposes of each Processing activity.

Each party remains responsible for its own legal obligations.

8.2 Data Processing Agreement

Schedule 1 sets out the contractual terms applicable to Processing carried out by Vector Finsoft as Processor on behalf of the Customer.

The parties will complete any additional processing details reasonably required for the relevant Services.

8.3 Hosting and data location

The Services are intended to use Microsoft Azure hosting, with customer data hosting and access restricted to the UK and EEA in accordance with the agreed service architecture and applicable data protection arrangements.

Before making this commitment operationally binding, Vector Finsoft must verify that all relevant storage, backups, support access, subprocessors and AI processing arrangements meet this requirement.

Any change that materially affects agreed data location or international access arrangements will be handled in accordance with the DPA and applicable law.

8.4 Security measures

Vector Finsoft will implement appropriate technical and organisational measures proportionate to the risks of the Processing and the nature of the Services, as further described in Schedule 1.

No particular certification, independent audit, uptime percentage or security control is promised unless expressly specified in an Order Form or applicable schedule.

8.5 Security incidents

Vector Finsoft will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Data processed on the Customer's behalf, in accordance with Schedule 1.

Other material security incidents will be handled under the applicable security procedures and any agreed SLA.

8.6 Subprocessors and third parties

Vector Finsoft may use third-party suppliers to provide hosting, AI functionality, integrations and other elements of the Services, subject to the authorisation and contractual safeguards in Schedule 1.

Where required by applicable law or the DPA, Vector Finsoft will obtain the Customer's prior written authorisation before engaging a Subprocessor.

8.7 Policies

The Customer must comply with applicable published policies expressly incorporated into the Agreement. Policies will not override an express provision of the Agreement unless the parties expressly agree otherwise in writing.

9.1 Nature of AI Services

The Services may use AI providers, including OpenAI, Anthropic and Google Gemini, or other providers accessed through an AI gateway, to support document processing, extraction, summarisation, underwriting reports, risk flags and recommendations.

The providers and models used may change as the Services evolve, subject to the Agreement, applicable law and the DPA.

9.2 No training on Customer Data

Vector Finsoft will not use Customer Data to train general-purpose AI models. Vector Finsoft will configure its AI providers and service arrangements consistently with this commitment, subject to verification of the applicable provider terms and technical settings.

9.3 Human review and lending decisions

AI outputs are intended to assist users and do not constitute a final credit decision or substitute for professional judgement.

The Customer must ensure that appropriately qualified personnel review AI-generated reports, risk flags, summaries and recommendations before relying on them in lending decisions.

The Customer must not rely solely on AI outputs to make lending decisions through the Services.

9.4 Accuracy and limitations

AI outputs may be incomplete, inaccurate, out of date or misleading. Extraction and summarisation may omit context, and external data may contain errors.

The Customer is responsible for reviewing material outputs against source documents, applicable lending policies and other relevant evidence before taking action.

Vector Finsoft does not warrant that an AI output will be error-free or suitable for every lending scenario.

9.5 Regulatory responsibilities

The Customer retains responsibility for its lending policies, underwriting criteria, credit decisions, affordability assessments where applicable, regulatory compliance, record-keeping and customer outcomes.

Nothing in this clause excludes Vector Finsoft's own obligations under applicable law or any express contractual commitments.

9.6 AI provider changes

Vector Finsoft may update or replace underlying AI models or providers where reasonably necessary to maintain, secure or improve the Services. Material changes affecting functionality, data processing or agreed data location will be addressed under the applicable change management and data protection provisions.

10.1 Service standard

Vector Finsoft will provide the Services with reasonable care and skill and in accordance with any expressly agreed service commitments.

10.2 Customer responsibilities

The Customer is responsible for determining whether the Services meet its operational and regulatory requirements, configuring the Services appropriately, validating outputs and maintaining suitable business processes and controls.

10.3 External information

Vector Finsoft does not guarantee the accuracy, completeness or availability of information obtained from Companies House, property providers, credit reference agencies, Open Banking providers or other third parties unless expressly agreed in writing.

10.4 Excluded warranties

Except for express commitments in the Agreement and to the fullest extent permitted by law, implied warranties and conditions are excluded.

Nothing in this Agreement excludes or limits a warranty, liability or remedy that cannot lawfully be excluded or limited.

11.1 Service levels

The applicable Service Level Agreement is set out in Schedule 2 or in a customer-specific SLA expressly agreed in writing.

No universal uptime guarantee applies unless specified in the applicable SLA.

11.2 Maintenance

Vector Finsoft may perform scheduled and emergency maintenance. Where practicable, it will provide advance notice of scheduled maintenance likely to materially affect the Services.

Emergency maintenance may be undertaken without advance notice where reasonably necessary to protect security, preserve integrity or maintain the Services.

11.3 Support

Support channels, support hours, incident priorities, response targets and any service credits will be specified in the applicable SLA or Order Form.

Unless expressly agreed, response targets are not guarantees of resolution within a particular period.

11.4 Business continuity

The parties will cooperate reasonably on continuity planning and recovery from service interruptions. Any specific recovery time objectives, recovery point objectives, disaster recovery testing commitments or continuity service levels must be expressly agreed in writing.

Vector Finsoft may suspend all or part of the Services where reasonably necessary:

1. to address a material security risk or suspected unauthorised access;
2. to prevent unlawful use or material breach of the Agreement;
3. where an overdue invoice remains unpaid after the applicable notice and remedy period;
4. where a third-party provider requires suspension; or
5. to comply with law or a binding regulatory requirement.

Where reasonably practicable, Vector Finsoft will give advance notice, limit the suspension to the affected functionality and cooperate with the Customer to resolve the cause.

Suspension will not automatically terminate the Agreement or extinguish accrued payment obligations.

13.1 Unlimited liabilities

Nothing in the Agreement excludes or limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot lawfully be excluded or limited.

13.2 General liability cap

Subject to clauses 13.1 and 13.3, each party's aggregate liability arising out of or in connection with the Agreement in any contract year will not exceed the Fees paid or payable by the Customer for the Services during the 12 months preceding the event giving rise to the claim.

Where a claim arises before 12 months of Fees have accrued, the cap will be calculated by reference to the annualised Fees under the applicable Order Form.

This proposed cap is subject to review and agreement in the applicable Order Form.

13.3 Higher-risk liabilities

The parties may agree separate higher caps for specified liabilities, including confidentiality breaches, data protection breaches, security incidents and intellectual property infringement.

Unless expressly agreed in an Order Form, no additional numerical cap applies under this clause.

Any cap or exclusion remains subject to applicable law, including relevant statutory reasonableness requirements.

13.4 Excluded losses

Subject to clauses 13.1 and 13.3 and to the extent permitted by law, neither party will be liable to the other for indirect or consequential loss.

The parties also exclude loss of profits, revenue, anticipated savings, business opportunity, goodwill or anticipated contracts, to the extent such losses fall within the agreed exclusion and are lawfully excludable.

Nothing in this clause automatically classifies every loss of data, restoration cost or operational loss as indirect or consequential. The legal character of a loss depends on the circumstances and applicable law.

13.5 Allocation of responsibility

The Customer is responsible for lending decisions, underwriting policies, the legality of its lending activities, the accuracy of information it supplies and the use it makes of Service outputs.

Vector Finsoft remains responsible for its own contractual obligations, its own acts and omissions, and its legal responsibilities under applicable law.

13.6 Mitigation and claims

Each party must take reasonable steps to mitigate losses for which it seeks recovery.

A party seeking to rely on a contractual indemnity must give the other party reasonable notice of the claim, provide reasonable cooperation and avoid making admissions or settlements that materially prejudice the other party without consent, except where urgent action is reasonably necessary.

Any specific indemnities must be expressly agreed in the applicable Order Form.

14.1 Commencement and term

The Agreement begins when the Customer accepts these Terms online and the relevant Order Form or subscription is accepted, or on another commencement date specified in the Order Form.

The initial Term and any renewal period will be specified in the applicable Order Form.

14.2 Renewal

Renewal arrangements and the notice period required to prevent renewal will be specified in the Order Form.

Where automatic renewal applies, the Order Form must state the relevant renewal period and the deadline for notice.

14.3 Termination for breach

Either party may terminate the Agreement by written notice if the other party commits a material breach and fails to remedy it within 30 days after receiving written notice describing the breach and requiring it to be remedied.

Where a breach is incapable of remedy, the innocent party may terminate by written notice where legally permissible.

14.4 Immediate suspension or termination

A party may suspend performance or terminate the Agreement immediately by written notice where reasonably justified by circumstances such as serious unlawful conduct, a material and uncontainable security threat, fraud or a breach that cannot lawfully or practically be remedied.

A party may also exercise termination rights arising from insolvency or similar events to the extent permitted by applicable insolvency law.

Where immediate action is necessary to protect systems or data, Vector Finsoft may suspend access first and provide notice as soon as reasonably practicable.

14.5 Consequences of termination

On termination or expiry:

1. the Customer's licence to use the Services ends, subject to any agreed Exit Period;
2. all undisputed Fees accrued up to termination become payable in accordance with the Agreement;
3. each party must return or destroy the other party's Confidential Information where reasonably requested, subject to legal retention obligations; and
4. the Customer may exercise its data export and exit rights under clause 15 and Schedule 1.

14.6 Accrued rights

Termination does not affect rights, remedies or liabilities accrued before termination. Provisions which by their nature are intended to survive termination will continue in effect.

15.1 Export period

The post-termination data export period will be specified in the applicable Order Form.

During that period, subject to reasonable security controls and payment of applicable undisputed Fees, Vector Finsoft will make Customer Data available for export using the export functionality or format reasonably supported by the Services.

15.2 Exit assistance

Additional migration, transition and exit assistance will be available at reasonable additional Fees agreed in advance.

The parties will cooperate in good faith to support an orderly transition, taking into account the nature of the Customer's loan records, transaction histories, documents and operational requirements.

15.3 Data deletion

After the agreed export period and subject to the DPA, Vector Finsoft will delete or render inaccessible Customer Data within 30 days, except where retention is required by law, reasonably necessary for the establishment or defence of legal claims, or otherwise permitted by the DPA.

Backups may remain until deleted through the applicable backup lifecycle, provided they remain protected and are not restored or used except for legitimate recovery or legal purposes.

15.4 Customer responsibility

The Customer is responsible for exporting and retaining the records it needs for its legal, regulatory, accounting and operational obligations.

Nothing in this clause relieves either party of its obligations under applicable data protection law.

16.1 Order of precedence

If documents forming part of the Agreement conflict, the following order applies, unless expressly agreed otherwise:

1. A signed variation expressly identifying the provision it changes.
2. The applicable Order Form, but only in relation to commercial terms or provisions it expressly states it overrides.
3. Schedule 1, for data protection matters.
4. Schedule 2 or the customer-specific SLA, for service-level matters.
5. These Terms.
6. Other policies incorporated by reference.

A policy will not silently amend an express contractual commitment.

16.2 Changes to the Agreement

Changes to the Agreement must be agreed in writing by authorised representatives, except for operational policy updates expressly permitted by the Agreement that do not materially reduce the Customer's contractual rights.

16.3 Assignment

The Customer may not assign or transfer the Agreement without Vector Finsoft's prior written consent, which will not be unreasonably withheld where the proposed transfer does not materially increase risk or reduce the other party's protections.

Vector Finsoft may assign the Agreement as part of a bona fide corporate reorganisation, merger or sale of substantially all relevant business assets, subject to applicable law and the continued protection of Customer Data.

16.4 Subcontracting

Vector Finsoft may use subcontractors to provide the Services but remains responsible for performing its contractual obligations, subject to the Agreement.

Any Processing by Subprocessors is governed by Schedule 1.

16.5 Force majeure

Neither party will be liable for delay or failure caused by circumstances beyond its reasonable control, including natural disasters, widespread network failures, war, civil unrest, government action or major third-party infrastructure outages.

The affected party must notify the other where reasonably practicable and take reasonable steps to mitigate the effects.

Force majeure does not excuse payment obligations for Services already supplied.

16.6 Notices

Contractual notices must be in writing and sent to the relevant contact details in the Order Form or, for Vector Finsoft, to mail@vectorfinsoft.com and its registered office where appropriate.

Termination notices and formal legal notices must be clearly identified as such.

Email notices are deemed received when successfully transmitted without an automated delivery failure, subject to applicable law and any contrary provisions in the Order Form.

16.7 Severability

If any provision is invalid or unenforceable, it will be modified to the minimum extent necessary to make it enforceable where legally possible. The remaining provisions will continue in effect.

16.8 Waiver

A failure or delay in exercising a right does not waive that right. A waiver is effective only where given in writing by an authorised representative.

16.9 Third-party rights

Except as expressly stated, a person who is not a party to the Agreement has no right to enforce its terms under the Contracts (Rights of Third Parties) Act 1999.

16.10 Entire agreement

The Agreement constitutes the entire agreement between the parties concerning its subject matter and supersedes prior agreements and understandings relating to that subject matter, subject to any express terms preserved in the applicable Order Form.

16.11 Governing law and jurisdiction

The Agreement and any dispute or claim arising out of or in connection with it, including non-contractual disputes or claims, are governed by the law of England and Wales.

The courts of England and Wales have exclusive jurisdiction to settle disputes arising out of or in connection with the Agreement, subject to any mandatory legal requirements.

1. Purpose and scope

This Schedule applies where Vector Finsoft processes Personal Data on behalf of the Customer as Processor in connection with the Services.

The Customer acts as Controller and determines the purposes and essential means of the relevant Processing, except where applicable law provides otherwise.

2. Processing details

The subject matter, duration, nature and purpose of Processing, categories of Personal Data and categories of Data Subjects will be determined by the Services and documented in the applicable Order Form or processing record.

Processing may include hosting, storage, retrieval, organisation, document extraction, summarisation, transmission, reporting, support and deletion of Personal Data.

Data Subjects may include borrowers, guarantors, directors, beneficial owners, brokers, investors, employees, applicants and other individuals whose information is submitted by the Customer.

Personal Data may include identification and contact details, financial and loan information, property information, company and directorship information, documents, correspondence, transaction records and other data submitted to the Services.

Special category data should not be submitted unless the parties have expressly agreed the relevant Processing and safeguards.

3. Customer obligations

The Customer must:

1. ensure that it has an appropriate lawful basis and any necessary permissions for Processing and disclosure;
2. provide lawful, documented instructions to Vector Finsoft;
3. provide required privacy information to Data Subjects;
4. ensure that Personal Data supplied to Vector Finsoft is relevant and reasonably accurate;
5. respond to Data Subject requests and regulatory enquiries where required; and
6. ensure its use of the Services complies with Data Protection Legislation.

4. Processor obligations

Vector Finsoft must:

1. process Personal Data only on the Customer's documented instructions, unless required by applicable law;
2. ensure that persons authorised to process Personal Data are subject to appropriate confidentiality obligations;
3. implement appropriate technical and organisational security measures;
4. comply with the Subprocessor requirements in this Schedule;
5. assist the Customer, taking into account the nature of the Processing, with Data Subject rights requests where reasonably practicable;
6. assist the Customer with its obligations relating to security, Personal Data Breaches, impact assessments and regulatory consultations, taking into account the nature of Processing and information available;
7. make available information reasonably necessary to demonstrate compliance with applicable Processor obligations; and
8. delete or return Personal Data at the end of the Services in accordance with this Schedule, unless retention is required by law.

5. Security measures

Vector Finsoft will implement security measures appropriate to the risks, which may include, where appropriate to the relevant service architecture:

1. access controls and authentication;
2. least-privilege access permissions;
3. encryption in transit and at rest where supported by the applicable infrastructure and configuration;
4. monitoring, logging and incident response procedures;
5. backup and recovery arrangements;
6. vulnerability management and security updates;
7. separation of customer access and permissions;
8. personnel confidentiality and access management; and
9. supplier and Subprocessor security reviews proportionate to the Processing.

Specific technical controls, independent audits, penetration testing, certifications and recovery objectives will only be contractual commitments where expressly agreed.

6. Personal Data Breaches

Vector Finsoft will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data processed on the Customer's behalf.

The notification will include information reasonably available to Vector Finsoft to assist the Customer in assessing the incident, meeting legal notification duties and mitigating adverse effects.

Where information is not immediately available, Vector Finsoft may provide information in phases as it becomes available.

The Customer remains responsible for determining whether notification to the ICO or Data Subjects is required, except where Vector Finsoft has a separate legal obligation.

7. Subprocessors

The Customer authorises Vector Finsoft to use the hosting, AI and other Subprocessors expressly identified or otherwise authorised in writing for the relevant Services.

The parties must maintain an appropriate record of authorised Subprocessors and the Processing they perform.

Where required, Vector Finsoft will obtain prior written authorisation before appointing a new Subprocessor. Any general authorisation, notice period, objection process and consequences of an objection must be documented in the relevant Order Form or Subprocessor policy.

Vector Finsoft will impose data protection obligations on each Subprocessor that provide an appropriate level of protection for the relevant Personal Data and will remain responsible for its contractual obligations concerning the Subprocessor, subject to the Agreement.

8. International transfers and data location

Vector Finsoft will process and permit access to Customer Personal Data within the UK and EEA in accordance with the agreed hosting and access arrangements.

No transfer of Personal Data outside the UK/EEA will be made where prohibited by the Agreement. Any permitted international transfer must comply with applicable Data Protection Legislation and use an appropriate transfer mechanism where required.

Vector Finsoft must verify the relevant locations and access arrangements for hosting, backups, support, AI providers and Subprocessors before making this commitment operationally binding.

9. Data Subject requests and regulatory assistance

Vector Finsoft will provide reasonable assistance, taking into account the nature of the Processing, to enable the Customer to respond to Data Subject requests and meet applicable obligations.

If Vector Finsoft receives a request directly concerning Customer Personal Data, it will, where legally permitted, refer the request to the Customer rather than responding independently, unless instructed otherwise or required by law.

Reasonable additional assistance outside the standard Services may be charged at agreed rates.

10. Audits and compliance information

Vector Finsoft will make available information reasonably necessary to demonstrate compliance with this Schedule.

Where documentation is insufficient to address a material compliance concern, the parties will agree a proportionate audit or inspection process, subject to reasonable notice, confidentiality, security safeguards and protection of other customers' information.

Audits must not unreasonably disrupt the Services or compromise system security.

11. Return and deletion

On termination or expiry of the Services, Vector Finsoft will, at the Customer's choice where technically feasible and legally permissible, return or delete Personal Data processed on the Customer's behalf.

Deletion will follow the agreed export period and deletion process under the Agreement. Personal Data retained under a legal obligation will remain protected and will be processed only for the permitted retention purpose.

Backup copies may remain until deleted under the applicable backup lifecycle, provided they remain protected and are not used for other purposes.

12. Liability

The liability provisions in the Agreement apply to this Schedule unless the parties expressly agree a separate allocation of liability in writing, subject always to mandatory law.

1. Scope

This Schedule provides the framework for service levels applicable to the Services. Customer-specific availability commitments, support hours, response targets, exclusions, recovery objectives and service credits must be completed in the relevant Order Form or SLA.

No fixed uptime percentage or guaranteed incident resolution time applies unless expressly agreed.

2. Support

The applicable Order Form must identify:

• support channels and contact details;
• support operating hours and time zone;
• incident priority definitions;
• response targets;
• escalation contacts;
• any out-of-hours support;
• maintenance arrangements; and
• any service credits or remedies.

3. Incident handling

The parties will provide reasonable information and cooperation when reporting and investigating incidents.

Vector Finsoft will use reasonable efforts to acknowledge, investigate, prioritise and address reported service incidents in accordance with the agreed support arrangements.

Response targets refer to acknowledgement or initial response unless the SLA expressly defines them as resolution targets.

4. Maintenance

Vector Finsoft may undertake scheduled maintenance and emergency maintenance in accordance with the Agreement.

Where practicable, Vector Finsoft will notify the Customer in advance of scheduled maintenance likely to materially affect availability.

5. Availability calculation

If an uptime commitment is agreed, the Order Form or SLA must specify:

1. the applicable service and measurement period;
2. the availability percentage and calculation methodology;
3. permitted maintenance exclusions;
4. exclusions for failures caused by the Customer, third-party systems outside Vector Finsoft's control or force majeure events; and
5. the evidence and process required to claim service credits.

6. Business continuity and recovery

Recovery time objectives, recovery point objectives, backup frequency, restoration targets and disaster recovery testing commitments must be expressly agreed in the applicable Order Form or SLA.

7. Service credits

Any service credits must be expressly specified in the applicable SLA, including eligibility, claim deadlines, calculation, caps and whether credits are the exclusive remedy for the relevant availability failure.

No service credits apply unless expressly agreed.