1. Definitions and Interpretation
1.1 Definitions
In these Terms, the following words have the following meanings:
-
"Business Hours" means 09:00 to 17:00 UK time on a day that is not a Saturday, Sunday, or public holiday in England and Wales.
-
"Force Majeure Event" means any event beyond a party's reasonable control, including acts of God, war, terrorism, civil unrest, strikes, lockouts, failure of utilities or telecommunications, or government action.
-
"Service" means the SciBridgeX platform and website.
-
"SciBridgeX", "we", "us" means SciBridgeX Technologies Limited, a company registered in England and Wales (No. 16942880), with its registered office at 20–22 Wenlock Road, London, N1 7GU.
1.2 Interpretation
Unless the context otherwise requires, words in the singular include the plural and vice versa, and references to a person include a company or other legal entity. Headings are for convenience only and do not affect interpretation.
2. Who we are and what these terms cover
These Terms govern access to and use of the Service. By accessing or using the Service, you agree to these Terms. If you are using the Service on behalf of an organisation, you confirm that you have authority to bind that organisation.
3. The Service.
SciBridgeX provides a B2B data processing, benchmarking, and routing software platform for SMEs and their partners. The Service is provided on a subscription or project basis as set out in an applicable order form or statement of work.
The Service is provided on an “as available” basis. We do not warrant that access will be uninterrupted, timely, secure, or error-free, and we exclude all implied terms, conditions, and warranties to the fullest extent permitted by law. We may update or modify the Service from time to time, provided that we do not materially reduce its core functionality during a paid subscription term without reasonable notice.
Where clause 3A applies, it sets out the sole contractual standard for availability and your sole remedy for any failure to meet it.
3A. Service levels
3A.1 Target availability.
We will use commercially reasonable efforts to make the Service available with a Monthly Uptime Percentage of at least 99.5% in each calendar month during a paid subscription term.
3A.2 Measurement.
“Monthly Uptime Percentage” means: (total minutes in the calendar month − Downtime minutes) ÷ total minutes in the calendar month × 100. “Downtime” means any period during which the core functions of the Service are not available to you, as measured by our monitoring systems, excluding Excluded Downtime (clause 3A.4).
3A.3 Service credits.
If we fail to meet the Monthly Uptime Percentage in a given calendar month, you may request a service credit. Service credits are calculated as a percentage of the monthly Fees for the affected Service (annual Fees divided by twelve), in accordance with the following table:
| Monthly Uptime Percentage | Service Credit |
|---|---|
| At least 99.5% | No credit |
| 99.0% to below 99.5% | 5% of monthly Fees |
| 98.0% to below 99.0% | 10% of monthly Fees |
| Below 98.0% | 20% of monthly Fees |
3A.4 Excluded Downtime.
Downtime does not include unavailability caused by: (a) scheduled maintenance, for which we will use reasonable efforts to give at least 48 hours’ notice and which we will aim to perform outside Business Hours; (b) emergency maintenance reasonably required to protect security or integrity; (c) a Force Majeure Event; (d) your acts, omissions, equipment, software, or network; (e) suspension in accordance with these Terms; or (f) your use of the Service other than in accordance with these Terms.
3A.5 Claim process.
To claim a service credit, you must submit a request to info@scibridgex.com within 30 days after the end of the affected calendar month, including the dates and times of the Downtime you experienced. We will validate the claim against our monitoring records. Approved service credits are applied against future Fees (or refunded if no further Fees are payable).
3A.6 Cap and sole remedy.
The total service credits in any calendar month will not exceed 20% of that month’s Fees. Service credits are your sole and exclusive remedy for any failure to meet the Monthly Uptime Percentage. Service credits are not payable where the Agreement has been terminated for your non-payment or material breach.
3A.7 Relationship with clause 9.
Service credits are in addition to, and not in substitution for, any other remedy expressly provided under these Terms, except that you may not recover damages for the same loss of availability for which a service credit has been claimed. Service credits are not subject to the limitation in clause 9(c).
4. Acceptable use.
You agree not to: (a) use the Service in breach of applicable law; (b) attempt to reverse engineer, copy, or resell the Service; (c) upload malicious code or interfere with the Service’s operation; or (d) use the Service to transmit unlawful, infringing, or harmful content.
5. Intellectual property.
5.1 Platform and data. SciBridgeX retains all rights in the Service, including its software, methodology, benchmarks, and outputs, excluding your data. You retain all rights in the data you submit. You grant us a licence to use your data solely to provide and improve the Service, as described in our Privacy Notice.
5.2 AI-generated outputs. Where the Service produces outputs generated by artificial intelligence, we grant you a perpetual, irrevocable, royalty-free, worldwide licence to use, reproduce, adapt, and commercially exploit those outputs for your internal business purposes. We will not assert any intellectual property rights against you in respect of such outputs. We do not warrant that AI-generated outputs are free from third-party rights, and you are responsible for clearing any such rights before commercial exploitation. This licence does not extend to our underlying platform, models, or methodologies, which remain our property. Nothing in this clause 5.2 permits you to exploit outputs in a manner that infringes third-party rights, and your obligations under clause 4 (Acceptable use) continue to apply.
6. Data protection.
Where we process personal data on your behalf, the terms of the Data Processing Agreement set out in Schedule 1 apply and are incorporated into these Terms by reference. Where we act as controller (for example, in relation to your account contacts), we process personal data in accordance with our Privacy Notice.
Nothing in these Terms limits either party’s liability to a data subject under Article 82 UK GDPR or sections 168–169 of the Data Protection Act 2018.
7. Fees and payment.
Fees are as set out in the applicable order form. Unless otherwise stated, fees are exclusive of VAT and payable within 30 days of invoice. We may suspend the Service for overdue undisputed invoices after providing written notice.
8. Confidentiality.
8.1 Definition. “Confidential Information” means any non-public information disclosed by one party to the other in connection with the Service that is marked as confidential or would reasonably be understood to be confidential, including business plans, technical data, SME datasets, pricing, and customer lists.
8.2 Obligations. Each party shall: (a) use the other’s Confidential Information solely to perform its obligations or exercise its rights under these Terms; (b) protect it using at least the same degree of care it uses for its own confidential information, and no less than reasonable care; and (c) not disclose it to any third party except to employees, professional advisers, or subcontractors who need to know it and are bound by equivalent confidentiality obligations.
8.3 Exclusions. Confidential Information does not include information that: (a) is or becomes public through no breach of these Terms; (b) was lawfully known to the recipient before disclosure; (c) is independently developed without use of the discloser’s Confidential Information; or (d) is required to be disclosed by law or a competent authority, provided the recipient gives prompt notice where lawful.
9. Limitation of liability.
Nothing in these Terms excludes or limits liability for: death or personal injury caused by negligence; fraud or fraudulent misrepresentation; or any other liability that cannot lawfully be excluded or limited.
Subject to the foregoing, and to the fullest extent permitted by law:
(a) neither party is liable for indirect or consequential loss, or for loss of profit, loss of business, or loss of anticipated savings;
(b) neither party is liable for loss of or corruption of data to the extent it is not caused by its wilful misconduct or gross negligence;
(c) each party’s total aggregate liability arising out of or in connection with these Terms, whether in contract, tort (including negligence), or otherwise, shall not exceed the fees paid or payable by you in the 12 months preceding the event giving rise to the claim.
9.1 Data protection carve-out. Nothing in this clause 9 limits or excludes either party’s liability to a data subject under Article 82 UK GDPR or sections 168–169 of the Data Protection Act 2018.
9.2 Reasonableness. The parties agree that the limitations in this clause 9 are reasonable having regard to the circumstances known at the time of contracting, including the availability of alternative services, the commercial allocation of risk, and the pricing of the Service.
10. Indemnity.
10.1 Our indemnity. We shall defend you against any third-party claim that the Service (excluding your data and any modifications made by you or on your behalf) infringes any UK intellectual property right, and shall pay damages finally awarded against you or agreed in settlement, provided you promptly notify us and allow us to control the defence. We shall have no liability where the claim arises from: (a) your data; (b) modifications not made by us; (c) your combination of the Service with other products or services; or (d) your continued use after we have notified you to cease.
10.2 Your indemnity. You shall defend us against any third-party claim arising from your data or your breach of clause 3 (Acceptable use), and shall pay damages finally awarded against us or agreed in settlement, provided we promptly notify you and allow you to control the defence.
10.3 Interaction with cap.
Our liability under clause 10.1 (IP indemnity) and clause 10.2 (your indemnity) is subject to the limitation in clause 9(c). This clause 10.3 is without prejudice to clause 9.1 (data protection carve-out).
11. Term and termination.
These Terms apply for the duration of your access to the Service. Either party may terminate for material breach that remains uncured 30 days after written notice. On termination, your right to access the Service ceases, and we will make your data available for export for 30 days, after which it may be deleted in accordance with our retention policy. Clauses 5, 8, 9, 10, 12, and 13 survive termination.
12. Governing law and jurisdiction.
These Terms are governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction over any dispute arising out of or in connection with these Terms.
13. Changes to these Terms.
We may update these Terms from time to time. Material changes will be notified to you in advance. The current version is always published on this page, with the effective date below.
Effective date: 11 Nov 2026
Contact: info@scibridgex.com
Schedule 1: Data Processing
This Schedule forms part of the Terms of Service between SciBridgeX Technologies Limited ("SciBridgeX", "Processor", "we") and the customer ("Controller", "you"). It applies where SciBridgeX processes personal data on the Controller's behalf in the course of providing the Services. Capitalised terms not defined in this Schedule have the meanings given in the Terms of Service.
1. Roles and scope
1.1 In respect of the personal data described in Annex A, the Controller acts as data controller and SciBridgeX acts as data processor. SciBridgeX shall process such personal data only on the documented instructions of the Controller, including with regard to transfers of personal data to a third country, unless required to do otherwise by UK law (in which case SciBridgeX shall inform the Controller of that legal requirement before processing, unless prohibited by law from doing so).
1.2 The Controller's instructions are set out in the Terms of Service, this Schedule, and any written instructions issued by the Controller from time to time (including by email). SciBridgeX shall immediately inform the Controller if, in its opinion, an instruction infringes UK GDPR or other applicable data protection law.
1.3 If SciBridgeX processes personal data for its own purposes rather than on the Controller's instructions, it shall be treated as a controller in respect of that processing and shall bear the corresponding liability.
2. Subject matter, duration, nature and purpose
2.1 Subject matter. The subject matter of the processing is the provision of the Services under the Terms of Service, including diagnostic assessment, verification, and connection of SMEs, and the processing of personal data submitted through the Services or the website contact form.
2.2 Duration. Processing shall continue for the term of the Terms of Service, unless terminated earlier in accordance with their terms, and shall end with the deletion or return of data under clause 7.
2.3 Nature and purpose. The nature of the processing is set out in Annex A. The purposes are: (a) providing the Services described in the Terms of Service; (b) maintaining, supporting, and securing the Services; (c) responding to enquiries submitted through the website contact form; and (d) any other purpose expressly instructed by the Controller in writing.
2.4 SciBridgeX shall not process Controller personal data for any purpose other than those specified in Annex A or expressly instructed by the Controller in writing.
3. Categories of data and data subjects
3.1 The categories of personal data and categories of data subjects are set out in Annex A.
3.2 The Controller is responsible for ensuring that Annex A accurately reflects the data submitted through the Services, and shall notify SciBridgeX of any material change.
4. Processor obligations and assistance
4.1 Confidentiality. SciBridgeX shall ensure that any person authorised to process Controller personal data is subject to a duty of confidence (whether contractual or statutory), covering employees, temporary workers, and agency workers who have access to the data.
4.2 Security. SciBridgeX shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, meeting the requirements of Article 32 UK GDPR, including as appropriate: encryption and pseudonymisation; ongoing confidentiality, integrity, availability and resilience; the ability to restore access after an incident; and regular testing of effectiveness. A description of current measures is set out in Annex B.
4.3 Data subject rights. SciBridgeX shall assist the Controller, by appropriate technical and organisational measures and insofar as possible, in fulfilling the Controller's obligation to respond to data subject requests under UK GDPR (access, rectification, erasure, restriction, portability, objection). Where a data subject contacts SciBridgeX directly, SciBridgeX shall forward the request to the Controller without undue delay and shall not respond except on the Controller's written instruction or as required by law.
4.4 Breach notification. SciBridgeX shall notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Controller personal data. This contractual deadline is set to allow the Controller to meet its own obligation to notify the ICO within 72 hours where feasible. The notification shall include, to the extent available: the nature of the breach, categories and approximate number of data subjects and records affected, likely consequences, and measures taken or proposed. SciBridgeX shall not notify any third party (including data subjects or the ICO) without the Controller's prior written consent, except as required by law.
4.5 DPIA and prior consultation. SciBridgeX shall provide reasonable assistance to the Controller in connection with any data protection impact assessment or prior consultation with the ICO that the Controller reasonably considers necessary.
4.6 Compliance information. SciBridgeX shall provide all information reasonably necessary to demonstrate compliance with this Schedule.
5. Sub-processors
5.1 General written authorisation. The Controller provides general written authorisation for SciBridgeX to engage sub-processors, subject to the conditions in this clause 5. This is permitted under Article 28(2) UK GDPR provided SciBridgeX informs the Controller of intended changes and gives it an opportunity to object.
5.2 Notification and objection. SciBridgeX shall maintain a list of current sub-processors at Annex C (or a linked webpage) and shall notify the Controller of any intended addition or replacement at least 30 days in advance, giving the Controller the opportunity to object on reasonable data protection grounds within 14 days of notification. If the Controller objects and no commercially reasonable solution is found within 30 days, either party may terminate the affected Services without penalty.
5.3 Flow-down obligations. SciBridgeX shall impose on each sub-processor, by written contract, data protection obligations equivalent to those in this Schedule, and shall remain fully liable to the Controller for the sub-processor's performance.
6. International transfers
6.1 SciBridgeX shall not transfer Controller personal data outside the UK unless one of the following applies: (a) the destination is covered by UK adequacy regulations; or (b) appropriate safeguards are in place under Article 46 UK GDPR — specifically the ICO's International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Standard Contractual Clauses, accompanied by a completed transfer risk assessment confirming that the standard of protection is not materially lower than in the UK, as required by the data protection test introduced by the Data (Use and Access) Act 2025.
6.2 Where SciBridgeX relies on the IDTA or Addendum, that instrument may be incorporated into this Schedule by reference, provided the requirements in the ICO's current guidance are met. Details of the specific safeguard applied to any given transfer are available on request from info@scibridgex.com.
6.3 SciBridgeX shall notify the Controller without undue delay if it becomes unable to comply with an applicable transfer mechanism, or if it receives a legally binding request from a public authority for disclosure of Controller personal data.
7. Deletion or return on termination
7.1 On termination or expiry of the Terms of Service, SciBridgeX shall, at the Controller's written election, delete or return all Controller personal data in its possession or control within 30 days of the termination date, and shall certify deletion in writing if requested.
7.2 Where SciBridgeX is required by UK law to retain any Controller personal data, it shall inform the Controller of that requirement and shall continue to protect the data in accordance with this Schedule for as long as it is retained.
7.3 SciBridgeX may retain anonymised data that no longer constitutes personal data for the purposes of improving the Services.
8. Audit rights
8.1 SciBridgeX shall allow the Controller (or an independent auditor appointed by the Controller and bound by confidentiality) to conduct one audit per 12-month period on 30 days' prior written notice, to verify compliance with this Schedule.
8.2 The audit may be satisfied by SciBridgeX providing a recent independent third-party audit report (e.g., SOC 2 Type II or ISO 27001 certification) covering the relevant controls. If the Controller reasonably considers that report insufficient, a further audit may be conducted no more than once in that 12-month period.
8.3 Audits shall be conducted during business hours, in a manner that does not unreasonably disrupt SciBridgeX's operations, and at the Controller's cost unless the audit reveals a material breach of this Schedule, in which case SciBridgeX shall bear the reasonable costs.
9. Liability
9.1 Each party's liability under this Schedule is subject to the limitations in clause 9 of the Terms of Service, except that nothing in this Schedule or the Terms of Service limits either party's liability to a data subject under Article 82 UK GDPR or sections 168–169 of the Data Protection Act 2018.
9.2 SciBridgeX shall not be liable for any breach of this Schedule to the extent it arises from the Controller's instructions or from the Controller's failure to comply with its own obligations under data protection law.
10. Order of precedence
In the event of conflict: (a) this Schedule prevails over the Terms of Service in respect of data protection matters; and (b) where an IDTA or Addendum applies to a restricted transfer, that instrument prevails over this Schedule and the Terms of Service in respect of that transfer.
Annex A: Details of Processing
A.1 Controller: As identified in the applicable Order Form or Statement of Work.
A.2 Processor: SciBridgeX Technologies Limited.
A.3 Nature of processing: Storage, retrieval, analysis, verification, and transmission of personal data in connection with the Services.
A.4 Purpose of processing: To enable the Controller to submit SME information for diagnostic assessment; to verify compliance, credit-readiness, and ESG data; and to respond to enquiries submitted through the Services.
A.5 Categories of data subjects: Controller's personnel; SME founders, employees, and representatives whose data is submitted by the Controller; and individuals who submit enquiries through the website.
A.6 Categories of personal data: Name, role, organisation, email address, phone number; financial information and compliance/ESG documentation submitted by or about SMEs; and the content of enquiry messages.
A.7 Duration: Term of the Terms of Service, plus the deletion or return period in clause 7.
A.8 Customer-specific completion: The Controller's registered name and any engagement-specific processing details will be recorded in the applicable Order Form or a signed Schedule at the point of contracting.
Annex B: Technical and Organisational Security Measures
Encryption in transit and at rest; role-based access controls; logging and monitoring; documented incident response procedures; confidentiality undertakings for personnel with access.
Annex C: Sub-processors
Current status. As at the effective date of this Schedule, SciBridgeX does not engage any sub-processor to process Controller personal data on its behalf. All processing described in Annex A is carried out by SciBridgeX's own personnel.
Infrastructure providers. SciBridgeX may use cloud hosting, email delivery, or similar infrastructure services that store or transmit data incidentally in the course of providing the Services. Where such a provider does not have access to Controller personal data and does not process it for any purpose, it is not treated as a sub-processor for the purposes of this Schedule. If any such provider's role changes such that it processes Controller personal data, it will be added to this Annex C in accordance with clause 5.
Future sub-processors. If SciBridgeX intends to engage a sub-processor to process Controller personal data, it will:
(a) update this Annex C (or the linked sub-processor webpage) before any such processing begins;
(b) notify the Controller at least 30 days in advance in accordance with clause 5.2, giving the Controller the opportunity to object on reasonable data protection grounds within 14 days; and
(c) impose on the sub-processor, by written contract, data protection obligations equivalent to those in this Schedule, and remain fully liable to the Controller for the sub-processor's performance.
No blanket consent to unknown sub-processors. Nothing in this Annex C constitutes advance consent to any unnamed sub-processor. The Controller's general authorisation in clause 5.1 applies only to sub-processors notified and recorded in accordance with this Annex C and clause 5.2.