WASH AI Institutional Subscription Terms

Version 2 · Updated 28 September 2026

Issued by Baobab Tech, a trading name of Mills IT Consulting Ltd, a company incorporated in Alberta, Canada under Corporate Access Number 2019455316, whose registered office is at 2836 29 St SW, Calgary, Alberta, Canada (the Supplier).

These Terms apply to every organisation that holds a tenant on the WASH AI platform, hereby referred to as Tenant. Each tenant's commercial terms are set out in its Order Form.

This document comprises:

• these Institutional Subscription Terms (clauses 1 to 20);
• the Service Level Agreement; and
• the Data Processing Agreement, with its Annexes A, B and C.

Schedules in this document are referred to by name and not by number, so that they do not conflict with the numbered schedules of any Order Form.

Individual users of WASH AI are covered by the Terms of Service and the Privacy Policy.

---

1. Definitions and interpretation

1.1 In these Terms:

Agreement: these Terms, the Service Level Agreement, the Data Processing Agreement and the Order Form, together.

Authorised User: an individual whom the Tenant permits to access the Tenant Space.

Business Day: a day other than a Saturday, Sunday or public holiday in England, unless the Order Form states otherwise.

Confidential Information: has the meaning given in clause 9.2.

Data Processing Agreement: the Data Processing Agreement forming part of this document.

Data Protection Laws: all laws on the processing of personal data that apply to a party's processing under this Agreement, including the UK GDPR, the Data Protection Act 2018, Regulation (EU) 2016/679 (EU GDPR), and Canadian federal and provincial privacy law including but not limited to POPA, PIPA (Alberta) and PIPEDA (Federal).

Effective Date: the start date stated in the Order Form.

Exit Period: the 30 days following termination or expiry of this Agreement.

Fees: the fees stated in the Order Form.

Model Configuration: the models, providers and processing regions to which the Tenant's AI inference may be routed, as stated in the Order Form.

Order Form: a document signed by the Supplier and the Tenant that refers to this Agreement and sets out the tenant-specific terms. A services or framework agreement between the Supplier and a Tenant that incorporates this Agreement is an Order Form.

Output: content the Platform generates in response to an Authorised User's input.

Platform: the WASH AI software, infrastructure, shared knowledge base and interfaces (web, mobile, WhatsApp and other integrations) operated by the Supplier.

Private Content and Public Content: Tenant Content marked private or public in the Tenant Space admin panel.

Seat: as defined in the Order Form. If the Order Form gives no definition, one Seat is one Authorised User active in a calendar month.

Service Levels: the service levels set out in the Service Level Agreement.

Services: access to the Platform through the Tenant Space, and the onboarding, support, maintenance and reporting described in the Order Form and the Service Level Agreement.

Subprocessor: a third party engaged by the Supplier to process Tenant Personal Data.

Tenant: the organisation or organisations named as customer in the Order Form.

Tenant Content: documents, data and other material uploaded to the Tenant Space by the Tenant or its Authorised Users, including prompts.

Tenant Personal Data: personal data the Supplier processes on behalf of the Tenant under this Agreement.

Tenant Space: the dedicated tenant on the Platform provided to the Tenant.

Term: the period stated in the Order Form.

Terms of Service and Privacy Policy: the WASH AI documents of those names published at washai.org/terms and washai.org/privacy.

Usage Data: data about use of the Platform, including seat counts, query volumes, topics, languages and performance metrics.

1.2 Headings do not affect interpretation. "Including" means including without limitation. A reference to a law includes that law as amended or replaced.

1.3 Where the Tenant comprises more than one organisation, the Order Form sets out how obligations and payments are allocated between them. The limits in clause 12 apply to all of those organisations together.

2. Structure and precedence

2.1 The Order Form, these Terms, the Service Level Agreement and the Data Processing Agreement form one contract between the Supplier and the Tenant.

2.2 If there is a conflict, the following order of precedence applies, highest first:

(a) the Order Form, in respect of parties, Term, Seats, Fees, payment, invoicing, tenant-specific services, Model Configuration, governing law, jurisdiction and notices;

(b) the Data Processing Agreement;

(c) the rest of these Terms and the Service Level Agreement;

(d) the rest of the Order Form;

(e) the Terms of Service and the Privacy Policy.

2.3 Authorised Users accept the Terms of Service when they use the Platform. The Tenant's rights and remedies against the Supplier are governed by this Agreement.

2.4 The version of this document attached to or referenced in the Order Form applies from signature. Clause 16 governs later versions.

3. Term

3.1 This Agreement starts on the Effective Date and continues for the Term, unless terminated earlier under clause 15.

3.2 The parties may renew the Term by a new or amended Order Form.

4. The Services

4.1 The Supplier shall:

(a) provide the Tenant Space and the Services with reasonable skill and care, in accordance with the Order Form and the Service Level Agreement;

(b) maintain, secure and update the Platform as set out in the Service Level Agreement;

(c) provide onboarding, support and usage reporting as set out in the Order Form and the Service Level Agreement;

(d) comply with the laws that apply to its provision of the Services; and

(e) hold the licences and permissions it needs to provide the Services.

4.2 The Platform is a shared, multi-tenant service. The Supplier develops and improves it for all tenants. Improvements the Supplier makes available to all tenants are included in the Fees.

4.3 The Tenant Space gives Authorised Users access to the Tenant Content and to the shared WASH AI knowledge base. The Supplier curates the shared knowledge base and does not warrant that it is complete.

5. Tenant responsibilities

5.1 The Tenant shall:

(a) appoint at least one tenant administrator and one designated representative, and keep their contact details current;

(b) manage its Authorised Users, Seats and roles through the admin panel;

(c) ensure its Authorised Users comply with the Terms of Service, including its rules on prohibited use;

(d) keep login credentials secure and notify the Supplier promptly of any suspected unauthorised access;

(e) ensure it has the rights and lawful basis to upload Tenant Content and to have the Supplier process it under this Agreement; and

(f) give the Supplier the information and co-operation it reasonably needs to provide the Services.

5.2 The Tenant is responsible for the acts and omissions of its Authorised Users.

5.3 The Platform accepts free-text input from Authorised Users. The Tenant shall not knowingly upload, and shall instruct its Authorised Users not to include, special category personal data, criminal offence data or personal data of children, unless the Order Form permits it. The Supplier does not filter input for such data, and the Tenant remains responsible for what its Authorised Users submit.

6. Seats, Fees and payment

6.1 The Tenant shall pay the Fees as set out in the Order Form.

6.2 Unless the Order Form states otherwise, the Tenant shall pay each valid invoice within 30 days of receipt. Fees exclude VAT and similar taxes, which the Tenant shall pay or account for as the law requires.

6.3 If the Tenant disputes an invoice in good faith, it shall notify the Supplier within 14 days of receipt and pay any undisputed part. The parties shall resolve the dispute under clause 20.

7. Intellectual property

7.1 The Supplier or its licensors, as applicable, own all intellectual property rights in the Platform, including its software, models, prompts, interfaces, documentation, the curation of the shared knowledge base, and aggregated anonymised Usage Data. Third-party software, models, services and open-source components used in the Platform ("Third-Party Components") remain the property of their respective owners and are subject to their own licence or service terms.

7.2 Subject to clause 7.1, the Supplier grants the Tenant a non-exclusive, non-transferable right, for the Term, for its Authorised Users to access and use the Platform through the Tenant Space for the Tenant's own purposes. This right extends to Third-Party Components only to the extent the Supplier is permitted to grant it.

7.3 The Tenant warrants that it owns, or has obtained all rights, licences and consents needed to upload, store and process, all Tenant Content, and that the Supplier's use of Tenant Content under this Agreement will not infringe the rights of any third party. The Tenant will indemnify the Supplier against any claim that Tenant Content infringes a third party's intellectual property rights.

7.4 The Tenant grants the Supplier a non-exclusive, royalty-free licence, for the Term and the Exit Period, to host, copy, index, process and transform Tenant Content to provide the Services.

7.5 The Supplier shall use Private Content only within the Tenant Space.

7.6 The Tenant shall not, and shall ensure Authorised Users do not, copy, modify, reverse engineer, resell or sublicense the Platform, or use it or its Outputs to build a competing product or train AI models.

8. AI models and data use

8.1 The Order Form sets the Tenant's Model Configuration, including any requirement as to the data processing region. The Supplier shall route the Tenant's AI inference only to models and providers that meet its Model Configuration, shall enforce that routing server-side, and shall not expose model selection to that Tenant's Authorised Users.

8.2 The Supplier may replace a model with another model that meets the same Model Configuration. It shall notify the designated representative before the change takes effect. Where the change adds a Subprocessor, paragraph 5 of the Data Processing Agreement applies.

8.3 The Supplier maintains a record of the model that served each request, and shall make that record available to the Tenant on request in respect of the Tenant's own requests.

8.4 The Supplier shall not use Tenant Content, Outputs or Tenant Personal Data to train or fine-tune AI models without the Tenant's explicit permission, and shall contract with its model providers on terms that exclude training use and, where the provider offers it, exclude data retention.

8.5 The Supplier may use Usage Data in anonymised or aggregated form to operate, secure and improve the Platform and to produce sector-level reporting. Usage Data used in this way shall not identify the Tenant or any individual, shall not be sold, and shall not be used to train AI models.

8.6 Outputs are generated by AI and may be inaccurate or incomplete. The Tenant is responsible for ensuring that qualified staff validate Outputs before relying on them for decisions affecting health, safety, infrastructure or emergency response.

9. Confidentiality

9.1 Each party shall keep the other's Confidential Information confidential and shall use it only to perform or exercise its rights under this Agreement. It may disclose Confidential Information only:

(a) to its employees, officers, contractors, Subprocessors and advisers who need to know it for that purpose and are bound by equivalent confidentiality obligations; or

(b) as required by law, a court or a regulator, giving the other party as much notice as the law allows.

9.2 Confidential Information means information disclosed by one party to the other in connection with this Agreement that is marked confidential or that a reasonable person would treat as confidential. It includes Private Content and the terms of the Order Form. It excludes information that:

(a) is or becomes public other than through breach of this Agreement;

(b) the recipient held without restriction before disclosure;

(c) the recipient receives from a third party entitled to disclose it; or

(d) the recipient develops independently.

9.3 Public Content ceases to be Confidential Information once published to the shared knowledge base.

9.4 This clause 9 continues for three years after termination or expiry, and without limit for personal data and trade secrets.

10. Warranties

10.1 Each party warrants that it has full power and authority to enter into and perform this Agreement.

10.2 The Supplier warrants that the Services will conform in all material respects to the Order Form and the Service Level Agreement. If they do not, the Supplier shall correct the non-conformity within a reasonable time.

10.3 The Tenant warrants that it has the rights and lawful basis needed for the Supplier to process Tenant Content under this Agreement.

10.4 Except as expressly stated in this Agreement, and to the extent the law allows, the parties exclude all implied warranties and conditions, including those of satisfactory quality and fitness for a particular purpose. The Supplier does not warrant that Outputs will be accurate or complete, or that the Platform will be uninterrupted or error-free.

11. Indemnities

11.1 The Supplier shall indemnify the Tenant against losses arising from a third-party claim that the Tenant's use of the Platform in accordance with this Agreement infringes that third party's intellectual property rights.

11.2 Clause 11.1 does not apply to claims arising from:

(a) Tenant Content;

(b) third-party documents in the shared knowledge base, which the Supplier shall remove promptly on notice of a claim;

(c) use of the Platform in breach of this Agreement or the Terms of Service; or

(d) combination of the Platform with items the Supplier did not supply.

11.3 If a claim under clause 11.1 is made or likely, the Supplier may modify the Platform to avoid the infringement, obtain a licence for continued use, or, if neither is reasonably possible, terminate the affected Services and refund prepaid Fees for the period after termination.

11.4 The Tenant shall indemnify the Supplier against losses arising from a third-party claim that Tenant Content, or its processing in accordance with this Agreement, infringes that third party's rights or breaches the law.

11.5 A party seeking an indemnity shall notify the other promptly, allow it to control the defence and settlement, give reasonable co-operation at the indemnifying party's cost, and make no admission without its consent.

11.6 The indemnities in this clause 11 are subject to clause 12.

12. Limitation of liability

12.1 Nothing in this Agreement limits or excludes liability for:

(a) death or personal injury caused by negligence;

(b) fraud or fraudulent misrepresentation;

(c) the Tenant's obligation to pay the Fees; or

(d) any other liability that cannot lawfully be limited or excluded.

12.2 Neither party is liable to the other for:

(a) loss of profits, revenue, business, goodwill, funding or anticipated savings;

(b) loss or corruption of data, except the cost of restoring it from the Supplier's backups; or

(c) any indirect or consequential loss.

12.3 Subject to clause 12.1, each party's total liability arising under or in connection with this Agreement, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to the total Fees payable under the Order Form.

13. Insurance

The Supplier shall maintain cyber insurance covering data breach response and third-party claims, professional indemnity insurance and general liability insurance with reputable insurers throughout the Term, and shall provide evidence of cover on request.

14. Suspension

14.1 The Supplier may suspend access to the Tenant Space, or for individual Authorised Users, to the minimum extent and for the minimum time needed, if:

(a) it is necessary to prevent or contain a security threat to the Platform or other tenants;

(b) an Authorised User breaches the Terms of Service;

(c) an undisputed invoice remains unpaid 30 days after its due date and the Supplier has given 14 days' written notice; or

(d) the law requires it.

14.2 The Supplier shall notify the designated representative before suspension where practicable, and otherwise promptly after it. The Supplier shall restore access promptly once the cause is resolved.

15. Termination and exit

15.1 Either party may terminate this Agreement by written notice if the other party:

(a) commits a material breach that cannot be remedied, or fails to remedy a remediable breach within 30 days of written notice; or

(b) becomes insolvent, enters administration, liquidation or an arrangement with its creditors, or undergoes an equivalent process in any jurisdiction.

15.2 The Tenant may also terminate this Agreement by written notice under paragraph 5 of the Service Level Agreement (persistent availability failure) or paragraph 5.4 of the Data Processing Agreement (Subprocessor objection).

15.3 On termination or expiry:

(a) during the Exit Period, the Supplier shall allow the tenant administrators to export Tenant Content and user records in a standard format;

(b) after the Exit Period, the Supplier shall delete Tenant Content and Tenant Personal Data in accordance with paragraph 9 of the Data Processing Agreement;

(c) Public Content already published to the shared knowledge base may remain in it, and the licence in clause 7.4 continues for that Public Content;

(d) if the Tenant terminates under clause 15.1 or 15.2, the Supplier shall refund prepaid Fees for the period after termination, calculated pro rata; and

(e) rights and liabilities accrued before termination are unaffected.

15.4 Clauses 7, 9, 11, 12, 15.3, 19 and 20, and the Data Processing Agreement, survive termination or expiry.

16. Changes

16.1 The Supplier may change the Platform, including its features, models and interfaces, provided that no change materially reduces during the Term the functionality described in the Order Form or the protections in this Agreement, and provided that no change takes the Tenant outside its Model Configuration.

16.2 The Supplier may publish new versions of this document at washai.org/institutional-terms. A new version applies to an existing Tenant from the start of its next Term, or earlier if the Tenant agrees in writing or the law requires it. The Supplier shall give the designated representative 30 days' notice of any new version.

16.3 Changes to Subprocessors follow paragraph 5 of the Data Processing Agreement.

16.4 Changes to an Order Form take effect only if made in writing and signed by both parties.

17. Subcontracting and assignment

17.1 The Supplier may subcontract the performance of the Services and remains responsible for its subcontractors. Paragraph 5 of the Data Processing Agreement governs Subprocessors.

17.2 Neither party may assign or transfer this Agreement without the other's prior written consent, which shall not be unreasonably withheld. Either party may assign it on written notice to an affiliate or to a successor to all or most of its business, provided the assignee accepts the same obligations.

18. Force majeure

18.1 Neither party is liable for delay or failure to perform caused by events beyond its reasonable control. This clause does not excuse payment obligations.

18.2 The affected party shall notify the other promptly and take reasonable steps to limit the effect.

18.3 Fees reduce pro rata for any period in which the Services are not provided.

18.4 If the event continues for more than 60 days, either party may terminate this Agreement by written notice, and clause 15.3(d) applies.

19. General

19.1 Notices. Notices shall be in writing and sent by email or delivered by hand or courier to the addresses in the Order Form. An email notice is received at the time of sending if sent during business hours on a Business Day in the recipient's location, and otherwise at the start of the next Business Day. This clause does not apply to service of legal proceedings.

19.2 Entire agreement. This Agreement is the entire agreement between the parties on its subject matter and replaces all earlier agreements and understandings on it. Neither party has relied on any statement not set out in it.

19.3 Variation. Variations are effective only if made in writing and signed by both parties.

19.4 Waiver. A waiver is effective only if given in writing. A delay in exercising a right is not a waiver of it.

19.5 Severance. If a provision is invalid or unenforceable, the rest of this Agreement remains in force.

19.6 No partnership. Nothing in this Agreement creates a partnership, joint venture or agency between the parties.

19.7 Third party rights. No person other than the parties may enforce this Agreement, including under the Contracts (Rights of Third Parties) Act 1999 where English law applies.

19.8 Compliance. Each party shall comply with the anti-bribery, anti-corruption, sanctions and modern slavery laws that apply to it.

19.9 Counterparts. The Order Form may be signed in counterparts and by electronic signature.

20. Governing law and disputes

20.1 This Agreement is governed by the law stated in the Order Form. If none is stated, it is governed by the laws of the Province of Alberta and the federal laws of Canada that apply there.

20.2 The parties shall first try to resolve any dispute through their designated representatives, then by escalation to senior managers for 30 days.

20.3 If the dispute remains unresolved, either party may refer it to mediation under the mediation procedure named in the Order Form. If the mediation does not resolve it within 60 days, either party may bring proceedings in the courts named in the Order Form or, if none are named, the courts of Alberta, Canada.

20.4 Nothing in this clause 20 prevents a party from seeking urgent injunctive relief.

---

Service Level Agreement

This Schedule forms part of the WASH AI Institutional Subscription Terms.

1. Availability

1.1 The Supplier shall make the Tenant Space available for at least 99% (uptime rate) of each calendar month.

1.2 Availability is the total minutes in the month, less minutes of Downtime, divided by the total minutes in the month.

1.3 Downtime is any period in which no Authorised User can log in to or query the Tenant Space through the web interface, or through WhatsApp where the Tenant has enabled it, as recorded by the Supplier's external monitoring or reported by the Tenant and confirmed by the Supplier.

2. Exclusions

Downtime does not include unavailability caused by:

(a) scheduled maintenance announced at least 48 hours in advance, up to 8 hours a month;

(b) emergency security maintenance;

(c) events under clause 18 (force majeure);

(d) outages of WhatsApp or other messaging services caused by their operators;

(e) outages of a third-party AI model provider, where at least one model permitted by the Tenant's Model Configuration remains available;

(f) the Tenant's own systems, networks or actions; or

(g) suspension under clause 14.

3. Maintenance and updates

3.1 The Supplier applies security updates weekly and technical and feature updates monthly.

3.2 The Supplier schedules maintenance outside 07:00 to 19:00 Central European Time on Business Days where practicable, and notifies the designated representative in advance.

4. Support

4.1 Channels: support@washai.org and the in-platform support form.

4.2 The Supplier provides support on a reasonable endeavours basis during its business hours on Business Days.

4.3 Languages: English, French and Spanish.

4.4 The Supplier shall respond to support requests within the following times. A response means acknowledgement by a member of staff with an initial assessment.

5. Persistent failure

If availability falls below the uptime rate in any three months within a rolling six-month period, the Tenant may terminate this Agreement by written notice within 30 days of the third failure. Termination under this paragraph is the Tenant's sole remedy for failure to meet the availability target.

6. Reporting

The admin panel shows active users for the last 30 days and the previous calendar month. The Supplier provides the monthly availability figure from its external monitoring on request.

---

Data Processing Agreement

This Data Processing Agreement forms part of the WASH AI Institutional Subscription Terms and is the parties' agreement under Article 28 of the UK GDPR and the EU GDPR. Terms defined in the Institutional Subscription Terms have the same meaning here. References to numbered clauses are to clauses of the Institutional Subscription Terms.

1. Roles

1.1 The Tenant is the controller of Tenant Personal Data, or a processor acting for its affiliates. The Supplier is a processor acting on the Tenant's behalf.

1.2 The Supplier is a controller only of business contact and billing data about the Tenant's staff, which it processes under the Privacy Policy.

1.3 Annex A sets out the particulars of processing.

2. Instructions

2.1 The Supplier shall process Tenant Personal Data only on the Tenant's documented instructions. This Agreement, the Order Form and the Tenant's configuration of the Tenant Space are the Tenant's instructions.

2.2 If the law requires the Supplier to process Tenant Personal Data otherwise, the Supplier shall notify the Tenant before processing unless the law prohibits it.

2.3 The Supplier shall notify the Tenant promptly if, in its opinion, an instruction infringes Data Protection Laws.

3. Personnel

The Supplier shall ensure that everyone it authorises to process Tenant Personal Data is bound by confidentiality obligations and has access only as needed for their role.

4. Security

4.1 The Supplier shall maintain the technical and organisational measures set out in Annex B.

4.2 The Supplier may update those measures provided the overall level of protection does not fall.

5. Subprocessors

5.1 The Tenant gives general authorisation for the Supplier to engage the Subprocessors listed in Annex C. The current list is published at washai.org/privacy.

5.2 The Supplier shall ensure that each Subprocessor is bound by data protection terms, which may be the Subprocessor's standard published terms, providing a level of protection appropriate to the processing.

5.3 The Supplier shall give the designated representative at least 30 days' notice by email before adding or replacing a Subprocessor where the change would result in:

(a) Tenant Personal Data being processed in a country or region not listed in Annex C; or

(b) the Subprocessor processing categories of Tenant Personal Data, or processing for purposes, not described in Annex C

(a "Material Change").

5.4 The Tenant may object to a Material Change on reasonable data protection grounds within the notice period. The parties shall discuss the objection in good faith, and the Supplier may offer a configuration of the Tenant Space that avoids the Material Change. If the objection is not resolved within 30 days, the Tenant may terminate the affected Services by written notice, and clause 15.3(d) applies.

5.5 For any other addition or replacement of a Subprocessor, the Supplier shall update the list at washai.org/privacy and notify the designated representative by email no later than the date the change takes effect.

5.6 Where a Material Change must be made urgently for security or continuity reasons, the Supplier may make it and shall notify the Tenant as soon as practicable. Paragraph 5.4 then applies.

6. Location and international transfers

6.1 The Supplier stores Tenant Content and Tenant Personal Data at rest within the United Kingdom or the European Economic Area.

6.2 Where the Order Form sets a Model Configuration requiring processing within the European Union, the Supplier shall route that Tenant's AI inference only to providers processing within the European Union, as recorded in Annex C.

6.3 Tenant Personal Data is processed outside the United Kingdom and the European Economic Area only:

(a) during document ingest, on servers the Supplier owns and operates in Canada, which hold temporary copies of Tenant Content and delete them when each ingest job completes;

(b) by Supplier personnel and contractors in Canada and internationally, for support and maintenance; and

(c) by the Subprocessors listed in Annex C as located outside the United Kingdom and the European Economic Area.

6.4 Transfers under paragraph 6.3 rely on:

(a) adequacy decisions under UK and EU law, for transfers to Canada and the United Kingdom; and

(b) the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and the UK International Data Transfer Addendum, for all other transfers, including to the Supplier's international contractors.

6.5 The Supplier shall provide a summary of its transfer impact assessments on request.

6.6 If a transfer mechanism relied on in paragraph 6.4 ceases to be valid, the Supplier shall notify the Tenant without undue delay and shall put an alternative mechanism in place.

7. Assistance

7.1 The Supplier shall forward to the Tenant within five Business Days any request from a data subject about Tenant Personal Data, and shall not respond to it except on the Tenant's instructions.

7.2 The Supplier shall provide tools in the admin panel, and reasonable further assistance, to help the Tenant respond to data subject requests.

7.3 The Supplier shall give reasonable assistance with data protection impact assessments and consultations with supervisory authorities.

7.4 Assistance under this paragraph is at the Tenant's reasonable cost, except where the need for it arises from the Supplier's breach.

8. Personal data breaches

8.1 The Supplier shall notify the Tenant without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Tenant Personal Data.

8.2 The notice shall describe the breach, the data and data subjects affected, likely consequences and the measures taken or proposed, as far as known. The Supplier shall provide further information as it becomes available.

8.3 The Supplier shall take reasonable steps to contain and remedy the breach and co-operate with the Tenant's response.

8.4 Notification is not an admission of fault or liability.

9. Deletion and return

9.1 Clause 15.3(a) governs export of Tenant Personal Data during the Exit Period.

9.2 Within 30 days after the Exit Period, the Supplier shall delete Tenant Personal Data from live systems, unless the law requires it to retain the data. Database point-in-time recovery history is retained for 24 hours and is overwritten within that period.

9.3 The Supplier shall confirm deletion in writing on request.

10. Records and audit

10.1 The Supplier shall keep the records of processing required by Data Protection Laws.

10.2 The Supplier shall, once in any 12 months, complete a reasonable internal security and data protection questionnaire from the Tenant, and provide summaries of independent security assessments where available.

10.3 The Tenant may carry out an on-site or remote audit only where:

(a) a personal data breach affecting Tenant Personal Data has occurred;

(b) a supervisory authority requires it; or

(c) the information provided under paragraph 10.2 is insufficient to demonstrate compliance with this Data Processing Agreement.

10.4 Audits under paragraph 10.3 require 30 days' notice, take place during business hours, occur no more than once in 12 months unless a further breach occurs, and are at the Tenant's cost. Auditors shall be bound by confidentiality obligations and shall have no access to other tenants' data.

11. Liability

Liability under this Data Processing Agreement is subject to clause 12.

---

Annex A: Particulars of processing

Annex B: Security measures

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256)
• Logical separation of each tenant's data by tenant identifier
• Email one-time passcode login and social login (Google, LinkedIn) for Authorised Users; role-based access control
• Multi-factor authentication for all staff and contractors with production access
• Database network access controls
• Audit logging of administrative actions, including a record of the AI model that served each request
• Server-side enforcement of each Tenant's Model Configuration, with model selection not exposed to that Tenant's Authorised Users
• Vulnerability management and weekly security patching
• Secure development practices, including code review
• Primary database and text search index hosted in the European Union, with point-in-time recovery history retained for 24 hours
• External uptime monitoring
• Document ingest servers operated by the Supplier, with temporary copies deleted after each job
• Confidentiality obligations for all staff and contractors
• Data protection due diligence on Subprocessors

Annex C: Subprocessors

This is the current list of Subprocessors. It is also published at washai.org/privacy.

Last updated: 25 September 2026.