Master Data Custody & Processing Agreement

In this Agreement the following expressions bear the meanings given to them in this clause 1, whether or not capitalised in the body of the text.

Protected Records means the records described in Schedule A, together with any copy, extract, index or derived dataset produced from them, irrespective of form or medium.

Business Day means a calendar day on which clearing banks are open for general business in London.

Headings are inserted for convenience only and do not affect construction. References to a clause or Schedule are to a clause of, or Schedule to, this Agreement.

The Custodian grants the Processor a non-exclusive, non-transferable, revocable right to hold and process Protected Records solely within the Permitted Environment for the duration of the Term.

The right granted under clause 2.1 does not confer title, and no assignment of intellectual property is made or implied by this Agreement.

Prohibited handling

The Processor shall not, and shall procure that its personnel do not:

1. transfer any Protected Record outside the Permitted Environment except under clause 5.3;

2. combine Protected Records with any external dataset without prior written consent, such consent not to be unreasonably withheld;

3. attempt to re-identify any individual from records subject to Certified Anonymisation; or

4. retain any Protected Record beyond the retention window specified in Schedule A.

The Processor shall meet the service levels set out below, measured on a rolling calendar-month basis and reported within five (5) Business Days of month end.

Service credits are the Custodian's sole financial remedy for a failure to meet a service level, save where the failure is persistent within the meaning of clause 3.4.

A failure is Persistent where it recurs three or more times within any rolling six-month period, in which case clause 7.2 applies.

The Processor shall maintain technical and organisational measures no less protective than those set out in Schedule C, and shall not degrade them during the Term.

The Processor shall notify the Custodian of any actual or reasonably suspected compromise within twelve (12) hours of becoming aware, whether or not the compromise is confirmed at that time.

The Custodian may audit compliance not more than twice in any twelve-month period on thirty (30) days' notice, and at any time following a notifiable incident.

The Processor shall provide reasonable assistance, including access to premises, personnel and system records, at its own cost.

Where an audit requires the transfer of Protected Records to the Custodian's auditor, that transfer shall be made under an encrypted channel approved in writing in advance.

Subject to clause 6.3, the aggregate liability of either party under this Agreement shall not exceed the greater of (i) the charges paid in the preceding twelve months and (ii) two million pounds (£2,000,000).

Neither party is liable for indirect or consequential loss, loss of profit, or loss of anticipated saving, however arising.

Nothing in this Agreement limits liability for death or personal injury caused by negligence, for fraud, or for any liability that cannot lawfully be limited.

Either party may terminate on ninety (90) days' written notice expiring no earlier than the first anniversary of the Effective Date.

The Custodian may terminate immediately where a failure is Persistent, where an insolvency event occurs, or where a material security compromise is not remediated within fourteen (14) days.

On termination the Processor shall, within ten (10) Business Days, return all Protected Records in a machine-readable form and thereafter destroy every remaining copy, certifying destruction in the form annexed at Schedule D.

This Agreement, together with its Schedules, constitutes the entire agreement between the parties and supersedes all prior arrangements relating to its subject matter.

No variation is effective unless made in writing and signed by an authorised representative of each party.

A person who is not a party to this Agreement has no right to enforce any of its terms.

This Agreement and any dispute arising out of it are governed by the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.