1.  About Clu and These Terms
 

1.1  Who We Are
Clu is a trading name of Included AI Limited, a company registered in England and Wales (Company Number: 13111292), with its registered office at Floor 3, Capital Tower Business Centre, Greyfriars Road, Cardiff, Wales, CF10 3AG.
You can contact us at:

• Email: hello@getaclu.io

​

1.2  What Clu Does

Included AI Limited develops Clu, a software for analysing and modelling workforce architecture. The Platform ingests HR data provided by the Client, including but not limited to job specifications, reward and banding data, headcount, reporting lines, job titles, and department architecture, and applies proprietary non-generative AI modelling (the Clu Models) to produce diagnostic outputs.

​

The Platform does not make or recommend employment decisions and is not a system of record for employment data. The Client uses outputs to inform its own decisions relating to workforce structuring, operating model design, AI deployment planning, and capability planning.

​

The Platform also includes two optional modules that may be made accessible to employees of the Client:

• Career Pathways Module: allows Client employees to navigate a rebuilt organisational model via a web application, exploring personalised role adjacency and internal mobility options. Access requires a work email link. Completion of personally identifiable fields is not mandatory.

• Work Capture Forms: lightweight structured forms deployed to targeted individuals (in areas flagged by the Clu model as presenting structural risk) to gather information about actual work being performed. Access requires a work email link. Completion of personally identifiable fields is not mandatory.

​

​Professional services engagements, including change management, programme management, and transformation consultancy, are contracted separately under a Statement of Work and are governed by those documents in addition to these Terms.

​

1.3  Nature of the Contract

These Terms apply to all access to and use of the Clu Platform by the Client and its Authorised Users. They take effect on the Effective Date set out in the applicable Order Form and remain in force until terminated in accordance with Section 12.
Where there is any conflict between these Terms and an Order Form or Statement of Work, the Order Form or Statement of Work shall prevail in respect of the specific matters it addresses, but these Terms shall otherwise govern.​

These Terms are between Clu and the Client organisation. Individual employees of the Client who access the Career Pathways Module or Work Capture Forms do so as authorised users of the Client; the Client bears responsibility for their access and use.

​

2. Definitions

​

In these Terms, the following words and phrases have the meanings set out below:​

• Admin User: An individual nominated by the Client to manage platform access, assign and revoke licences, and act as the primary point of contact with Clu.

• Anonymised Statistics: statistics produced by the operation of the Clu Models on Client Data, anonymised and aggregated in accordance with clause 6.2.

• Assessment Screening: The optional feature within the Assessment Pack Generator by which the Client’s interviewers record their own assessment of named candidates against a structured checklist, as described in clause 3.6(c).

• Authorised User: Any individual authorised by the Client to access the Platform, including Admin Users, Standard Users, and, where applicable, employees of the Client accessing the Career Pathways Module or Work Capture Forms.

• Career Pathways Module: The optional employee-accessible web application that allows Client employees to navigate a rebuilt organisational model and explore role adjacency and internal mobility options.

• Client: The organisation that has entered into an Order Form with Clu and is the counterparty to these Terms.

• Client Data: All data (including Structural HR Data and any other information) submitted, uploaded, or otherwise provided by or on behalf of the Client to the Platform.

• Confidential Information: All information of a confidential or proprietary nature disclosed by one party to the other in connection with these Terms, whether disclosed in writing, orally, or by any other means, and whether or not marked as confidential, including (without limitation) technical data, trade secrets, business plans, financial information, and Platform outputs. It does not include information that: (a) is or becomes publicly available other than through a breach of these Terms; (b) was already known to the receiving party at the time of disclosure, free of any obligation of confidence; (c) is independently developed by the receiving party without use of or reference to the disclosing party’s information; or (d) is received from a third party who is free to disclose it without restriction.

• Clu: Included AI Limited, trading as Clu (Company Number: 13111292).

• Clu Models: Clu's proprietary, non-generative AI models, benchmarks, and algorithms used to process Structural HR Data and produce Diagnostic Outputs, including role benchmark matching, structural pattern detection, capability gap modelling, AI augmentation scoring, and scenario modelling.

• Cyber Essentials Plus: The UK government-backed Cyber Essentials Plus certification scheme, to which Clu maintains current certification.

• Data Protection Legislation: The UK GDPR (as defined in section 3(10) of the Data Protection Act 2018), the Data Protection Act 2018, and any applicable EU GDPR provisions that continue to have effect, together with all applicable subordinate legislation, guidance, and codes of practice issued by the Information Commissioner's Office.

• Delivery Affiliate: an individual or firm engaged by Clu to deliver services to the Client, who is bound by obligations of confidentiality and security no less onerous than those Clu owes the Client under these Terms.

• Diagnostic Output: Any report, model, analysis, visualisation, or insight produced by the Platform through the application of Clu Models to Client Data.

• Documentation: Any user guides, technical specifications, onboarding materials, and security and compliance summaries made available to the Client by Clu.

• Effective Date: The date set out in the applicable Order Form from which these Terms take effect.

• Fees: The amounts payable by the Client as specified in the Order Form.

• Managed Diagnostic: A delivery model under which Clu personnel operate the Platform to produce Diagnostic Outputs for the Client, as described in clause 3.0(a).

• Order Form: A written agreement (including electronic signature) between Clu and the Client specifying the scope of the engagement, Fees, term, and any special conditions.

• Platform: The Clu web-based application, including all features, modules, dashboards, models, APIs, and integrations made available to the Client under the applicable Order Form.

• Platform Subscription: A delivery model under which the Client receives Platform licences and operates the Platform itself, as described in clause 3.0(b).

• Professional Services: Change management, programme management, transformation consultancy, or other advisory services delivered by Clu personnel and contracted under a separate Statement of Work.

• Regulated Client Schedule: the additional terms at Schedule 1, which apply only where an Order Form says they apply.

• Statement of Work: A written document (including electronic signature) setting out the scope, deliverables, timelines, and commercial terms for a Professional Services engagement.

• Structural HR Data: Organisational data submitted by the Client at role level, including role and manager identifiers and titles, team or department, headcount, reporting line structures, grade or banding information, pay ranges at grade or band level, and job specifications. It does not include names or contact details. The Client may be able to link identifiers within Structural HR Data to individuals using its own records, and Clu therefore treats Structural HR Data as personal data and processes it under the Data Processing Agreement.

• Work Capture Forms: Optional, targeted anonymised questionnaires deployed to specific employees to validate model outputs.

• Work Model: the set of skill, task and workflow profiles the Platform produces from Client Data and the Client approves, which forms the basis for scenario modelling. The Work Model is a Diagnostic Output.

​

3.  Licence and Platform Access
 

Each Order Form specifies one of the two delivery models below. Where a provision of these Terms applies to only one model, it says so.

a) Managed Diagnostic. Clu personnel operate the Platform to produce Diagnostic Outputs for the Client over the period stated in the Order Form. The Client receives the Diagnostic Outputs and any other deliverables identified in the Order Form, and does not receive Platform licences unless the Order Form says otherwise. Clauses 3.2, 3.4 and 3.5 do not apply to a Managed Diagnostic. Client Data is retained only for the period stated in the Order Form and is deleted within 30 days of final delivery unless the Client instructs otherwise in writing, with written confirmation of deletion provided. The continual learning process described in clause 6.2 is disabled by default for a Managed Diagnostic and operates only where the Order Form records the Client’s agreement.

b) Platform Subscription. The Client receives named licences and operates the Platform itself for the term stated in the Order Form. Clauses 3.2 to 3.5 apply in full. Client Data is retained for the term and is handled on termination in accordance with clause 12.4. The continual learning process described in clause 6.2 operates by default and may be disabled at any time 

c) Moving between models. Where a Managed Diagnostic is followed by a Platform Subscription, the Subscription Order Form governs any Client Data carried forward, and the position ​in clause 3.0(b) applies from its Effective Date

 

3.1  Licence Grant

Subject to the Client’s compliance with these Terms and payment of Fees, Clu grants the Client a non-exclusive, non-transferable licence, revocable only in accordance with Section 12, to access and use the Platform during the term of the applicable Order Form, solely for the Client’s internal business purposes as described in the Order Form.

This licence does not permit the Client to: (a) sublicence, resell, or otherwise make the Platform available to any third party other than Authorised Users; (b) use the Platform to develop or train a competing product or service; or (c) use the Platform in a manner inconsistent with these Terms or applicable law.

​

3.2  Authorised Users
The Client is responsible for ensuring that only Authorised Users access the Platform and that all Authorised Users comply with these Terms. Licences are assigned to named individuals and may not be shared or transferred between individuals without Clu’s prior written consent. The Client’s Admin User is responsible for: (a) managing the assignment and revocation of licences; (b) ensuring all Authorised Users are aware of and comply with these Terms; and (c) promptly notifying Clu if any Authorised User’s access should be revoked, including on that individual leaving the Client’s employment.

​

3.3  Account Security

The Client must ensure that all Authorised Users: (a) use strong, unique passwords; (b) complete multi-factor authentication where enabled or required by Clu; and (c) treat access credentials as confidential and do not share them.
The Client must notify Clu immediately at accounts@getaclu.io if it suspects any unauthorised access to the Platform or compromise of any access credentials. Clu reserves the right to suspend access pending investigation of a suspected security incident.

​

3.4  Platform Availability
Clu targets Platform availability of 99.5% in any calendar month, excluding scheduled maintenance windows (for which reasonable advance notice will be provided) and any unavailability caused by force majeure events or by the Client’s own systems or actions. This is a target, not a contractual commitment, and does not give rise to any right of termination or financial remedy unless otherwise agreed in writing in an Order Form.

Clu may update, modify, or discontinue features of the Platform at any time, provided that material reductions in core functionality are notified to the Client with at least 30 days' written notice. Clu does not guarantee that the Platform will be uninterrupted or error-free.

​

3.5 Modules and Bolt-on Features

​The core Platform provides benchmarking, work modelling and scenario modelling from Structural HR Data. The features below are not part of the core Platform. Each is disabled by default, operates only where an Order Form records the Client’s agreement, and carries a different data protection profile which the Order Form sets out.

a) Career Pathways Module. Allows employees of the Client to explore role adjacency and internal mobility options through a web application reached by a link sent to a work email address. No name or email address is stored with an employee’s use of the module. Completion of any identifying field is optional, and participation is voluntary.

b) Work Capture Forms. Structured forms that gather information about the work being performed in areas the Clu Models have flagged. Access links are issued at team level rather than to named individuals, unless the Order Form records a different arrangement and the Client confirms it has informed the employees concerned. Completion of any identifying field is optional, and participation is voluntary.

c) Assessment Pack Generator and Assessment Screening. Produces interview and assessment materials from approved role profiles. Where Assessment Screening is enabled, the Client’s interviewers record their own assessment of named candidates against a structured checklist and set their own scores. Clu does not assess, score or rank any candidate and does not complete any part of the checklist. The Platform calculates an expected score from the entries recorded by the interviewer using a fixed formula, and displays the difference between that figure and the interviewer’s score so that the Client may review the assessment for possible bias. That comparison is displayed only after the interviewer’s score has been recorded. The Client is Data Controller in respect of candidate data and is responsible for its lawful basis, the transparency information it gives candidates, and its retention. The Client must not use the comparison to evaluate or manage interviewers without first informing them.

d) Common conditions. For each feature in this clause: the Client is Data Controller, and Clu is Data Processor in respect of any personal data processed; the Client must ensure it has a lawful basis and has provided appropriate transparency information; no coercive element may be applied to participation; and Clu processes only the data necessary to deliver the feature. The Client acknowledges that the categories of data subject and the data protection analysis for these features differ from the core Platform, and that the Client’s own assessment should be updated before a feature is enabled.

1. ​

3.7 Data Ingestion & Roadmap Features

a) Ingestion. Client Data is submitted through the Platform interface. For a Platform Subscription, the Client may instead agree in the Order Form to submit data by secure file transfer or by an integration configured for that purpose. Data flows into the Platform only. Clu does not connect to, read from or write to the Client’s systems or operational technology, except where Assessment Screening is enabled, and the Client instructs the Platform to return assessment scores to a system it nominates.

b) Roadmap features. Features described to the Client but not listed in an Order Form, including those demonstrated in sales or product discussions, form no part of the licence until an Order Form records them.

​​

4.  Client Obligations​

4.1  General

The Client shall:

• Use the Platform only for lawful purposes and in accordance with these Terms;

• Ensure that Client Data submitted to the Platform is accurate, complete, and that the Client has the right to submit it;

• Not attempt to reverse-engineer, decompile, or otherwise derive the source code or underlying logic of the Platform or Clu Models, except that nothing in this bullet restricts the Client from exercising any audit, explainability or verification right given to it elsewhere in these Terms, in the Data Processing Agreement, or by applicable law;

• Not introduce viruses, malicious code, or any material that is harmful, unlawful, or disruptive to the Platform or other users;

• Not circumvent or attempt to circumvent any security or access control measures implemented by Clu;

• Comply with all applicable laws and regulations in connection with its use of the Platform;

• Maintain appropriate internal policies and controls to ensure responsible and ethical use of Diagnostic Outputs, including where those outputs inform decisions affecting employees.

1. ​

4.2  Workforce Decisions and AI Governance

Clu improves the quality, clarity, and evidential basis of the data available to the Client when making workforce decisions. It does not make those decisions, recommend a course of action, or solve the underlying organisational challenges that give rise to them. Diagnostic Outputs are analytical inputs to human decision-making processes, not conclusions, strategies, or directives. The existence of a Diagnostic Output does not imply that any particular action is warranted, appropriate, or lawful.

The Client is solely responsible for: (a) the interpretation of any Diagnostic Output; (b) the strategic agenda, plan, or course of action it chooses to develop or pursue on the basis of that interpretation; (c) the manner and pace of execution of any such agenda; and (d) all decisions affecting employees, structures, roles, or operations that are progressed using or informed by Platform outputs. Where Clu outputs are used to inform decisions that affect employees, including collective consultations, redundancy processes, or significant role changes, the Client is responsible for ensuring compliance with applicable employment law, including the Employment Rights Act 1996, TUPE regulations, and collective redundancy consultation obligations under the Trade Union and Labour Relations (Consolidation) Act 1992 (as amended). The limitations on Clu’s liability in respect of Diagnostic Outputs and workforce decisions are set out in Section 11.

Clu has assessed the core Platform against the EU AI Act and considers that it falls within the exception in Article 6(3), because it analyses roles rather than individuals and prepares information for decisions taken by the Client. Clu maintains technical documentation, logging, transparency information, human oversight and bias monitoring consistent with the practices expected of high-risk systems. Where the Client uses Diagnostic Outputs in relation to staff or candidates in the European Union, the obligations that fall on a deployer, including those in Article 26, rest with the Client, and Clu will provide the documentation reasonably required to support them. Clu does not warrant that the Client’s use of the Platform satisfies any particular regulatory obligation.
Where outputs are used to inform decisions affecting employees, including collective consultation, redundancy or significant role change, the Client remains responsible for compliance with applicable employment law, including the Employment Rights Act 1996, the Transfer of Undertakings (Protection of Employment) Regulations 2006 and the collective redundancy consultation obligations in the Trade Union and Labour Relations (Consolidation) Act 1992.

1. ​

4.3  Data Submission Standards

The Client is responsible for the quality and accuracy of Client Data. Clu's Diagnostic Outputs are derived from the data provided; materially inaccurate or incomplete data will produce materially inaccurate or incomplete outputs. Clu accepts no liability for the accuracy of outputs where they result from deficiencies in Client Data.​

The Client must ensure that any personal data included in Client Data submissions is minimised, pseudonymised, or anonymised to the greatest extent practicable before submission. Where personal data is unavoidably included, the Client must ensure it has a lawful basis for processing and has complied with its transparency obligations under Data Protection Legislation.

1. ​

5.  Fees, Payment, and Commercial Terms
 

5.1  Fees

Clu’s standard payment terms are:

• Managed Diagnostic engagements: 100% of the Fee due on signature of the Order Form.

• Programme subscriptions: 50% on signature of the Order Form, 50% on the six-month anniversary of the Effective Date.

• Enterprise subscriptions: quarterly in advance, or annually in advance where the Order Form says so.

All Fees are exclusive of VAT, which is added at the applicable rate. Fees are payable in GBP unless the Order Form says otherwise. Refunds on termination are dealt with in clause 12.2.

1.  

5.2  Late Payment

If any undisputed amount remains unpaid 30 days after the due date, Clu reserves the right to: (a) suspend the Client’s access to the Platform until payment is received; and (b) charge interest on the overdue amount at the rate of 8% per annum above the Bank of England base rate, accruing daily from the due date until the date of actual payment, pursuant to the Late Payment of Commercial Debts (Interest) Act 1998.

1.  

5.3  Pricing Changes

Clu may revise Fees at renewal. Any proposed increase will be notified to the Client in writing at least 45 days before the renewal date. If the Client does not accept the revised Fees, it may terminate the agreement in accordance with clause 12.2 before the renewal date takes effect.

​

5.4  Taxes

The Client is responsible for all taxes, levies, or duties imposed on payments made under these Terms by any jurisdiction outside the United Kingdom. If any withholding tax is required by law, the Client shall gross up payments so that Clu receives the full amount it would have received in the absence of any such deduction.

​

5.5  No Set-Off

All amounts payable under these Terms shall be paid in full without any deduction, withholding, or set-off, except as required by law or as expressly agreed in writing.

1. ​

6.  Intellectual Property
 

6.1  Clu's Intellectual Property

All intellectual property rights in the Platform, Clu Models, Documentation, and any materials developed by Clu (including all underlying code, algorithms, benchmarks, data compilations, methodologies, and proprietary tools) are and shall remain the exclusive property of Clu or its licensors. Nothing in these Terms transfers any intellectual property rights in the Platform, Clu Models, or Documentation to the Client.

​

6.2  Client Data

• Ownership. All intellectual property rights in Client Data remain with the Client.

• Licence. The Client grants Clu a non-exclusive, royalty-free licence to use Client Data to provide and operate the Platform and to deliver the services described in the Order Form during the term.

• Continual learning. Where continual learning operates in accordance with clause 3.0, the Client additionally grants Clu a non-exclusive, royalty-free licence to produce Anonymised Statistics from the operation of the Clu Models on Client Data and to use them to refine the Clu Models. Client Data itself is not used to train or refine the Clu Models.

• Anonymisation standard. Statistics are used only where it is not reasonably likely that the Client or any individual could be identified from them, applying the standard in the Information Commissioner’s anonymisation guidance, and only once aggregated across clients. Clu is responsible for maintaining, documenting and reviewing the standard applied, and will make its current standard available to the Client on request.

• Control. Continual learning is enabled by default for a Platform Subscription and disabled by default for a Managed Diagnostic. The Client may enable or disable it at any time, through the Platform control panel where the Client has Platform access, or by written notice to Clu where it does not, and may record its choice in the Order Form before any Client Data is submitted. Clu will confirm a change by email within five business days. Disabling prevents any further contribution from Client Data. It does not affect Anonymised Statistics already incorporated into the Clu Models, which exist only in aggregated form and cannot be extracted, attributed or reversed. Clu will state this plainly to the Client rather than imply that past contributions can be withdrawn.

• Lawful basis. Clu acts as Data Controller for the step that produces and anonymises the statistics, relying on its legitimate interests in improving the accuracy of the Clu Models, as documented in its Legitimate Interests Assessment, which is available to the Client on request. Once anonymised, the statistics are no longer personal data.

• Restrictions. Clu will not: (i) use Client Data to train or improve any model operated by or for a third party; (ii) sell, rent or otherwise commercialise Client Data; or (iii) disclose Client Data to any third party except as permitted by the Data Processing Agreement or required by law. Continual learning operates solely within Clu’s own infrastructure and involves no disclosure of Client Data to any external party.

• Survival. The licence in clause 6.2(c) survives termination only to the extent necessary to preserve Anonymised Statistics already incorporated into the Clu Models at the date of termination.

1. ​

6.3  Diagnostic Outputs

Diagnostic Outputs, including the Work Model, are licensed to the Client for its internal business purposes for the term and thereafter in perpetuity in respect of outputs delivered during the term. The Client may share Diagnostic Outputs with its board, leadership teams, recognised trade unions and employee representatives, regulators, auditors and professional advisers in connection with workforce planning, consultation or governance activities, without Clu’s consent.
When presenting Diagnostic Outputs in a formal external context, including board papers, regulatory submissions and consultation materials, the Client must state that the analysis was produced using third-party analytical software. A generic statement to that effect requires no consent from Clu; naming Clu or using its branding is subject to clause 6.5.
The Client must not: (a) commercialise Diagnostic Outputs or make them available to third parties for commercial purposes; or (b) use Diagnostic Outputs in a manner that infringes applicable law.

 

6.4  Feedback

If the Client provides Clu with feedback, suggestions, or ideas regarding the Platform, Clu may use such feedback freely and without restriction or attribution. The Client grants Clu a perpetual, irrevocable, royalty-free licence to use such feedback for any purpose.

​

6.5  Trade Marks

The Client must not use Clu's trade marks, logos, or branding without Clu's prior written consent. Reference to Clu as a technology partner in board-level or external materials requires written approval from Clu.

​

6.6 Benchmarks and Methodology

For the avoidance of doubt, the Clu Models, benchmarks, risk frameworks, job type taxonomies, skill, task and workflow libraries, scoring methods and the structure of the Work Model remain the exclusive property of Clu. The Client’s rights are to the Diagnostic Outputs produced for it, not to the underlying benchmarks or methodology.

​

7.  Data Protection
 

7.1  Scope 

Clu’s processing under these Terms falls into four categories, each with a different data protection basis.

a) Core platform processing. Ingesting Structural HR Data and producing Diagnostic Outputs. Structural HR Data is personal data, as explained in the definition of that term. The Client is Data Controller, and Clu is Data Processor, acting on the Client’s documented instructions. The Client must not submit names, contact details, individual salaries, individual performance or absence records, special category data within the meaning of Article 9 of the UK GDPR, or criminal offence data within the meaning of Article 10. Where such data is submitted, Clu removes it on ingestion and does not use it in the modelling.

b) Module processing. Where the Client enables a feature under clause 3.6, personal data may be processed as described in that clause. The Client is Data Controller, and Clu is Data Processor.​

c) Platform account data. Names, work email addresses, job titles and login activity of Authorised Users, and the names and work email addresses of those the Client asks to approve role profiles. Clu is Data Controller in respect of data it holds to operate and secure the Platform, and Data Processor in respect of approval records held so the Client can track sign-off.

d) Continual learning processing. The production and anonymisation of statistics as described in clause 6.2, for which Clu is Data Controller. Once anonymised in accordance with clause 6.2(d), the statistics are no longer personal data and Data Protection Legislation does not apply to them.

The Data Processing Agreement is executed with the Order Form and applies to all processing in which Clu acts as Data Processor. It prevails over these Terms in the event of conflict in respect of personal data processing.

7.2  Client's Obligations as Data Controller

Where the Client acts as Data Controller, the Client shall:

• Ensure it has a lawful basis for any processing of personal data undertaken using or in connection with the Platform, including any use of the Career Pathways Module or Work Capture Forms;

• Provide appropriate privacy notices to employees and other data subjects, informing them of the processing, its purposes, and their rights

• Process personal data only for the purposes set out in these Terms and comply fully with the Data Protection Legislation;

• Respond promptly and completely to all data subject rights requests (access, rectification, erasure, portability, restriction, objection) within the statutory timeframes;

• Notify Clu immediately upon becoming aware of any personal data breach that involves data processed using or in connection with the Platform.​

7.3  Clu's Obligations as Data Processor

Where Clu acts as Data Processor, Clu shall:

• Process personal data only on the Client’s documented instructions, unless required otherwise by law;.

• Implement and maintain appropriate technical and organisational security measures, consistent with its obligations under Data Protection Legislation and the standards stated in clause 9.1;

• Ensure that persons authorised to process the personal data, including Delivery Affiliates, are subject to appropriate confidentiality obligations and security training;

• Assist the Client in responding to data subject rights requests and in meeting its obligations under Data Protection Legislation, including by providing the information reasonably required for a data protection impact assessment, and will provide a pre-populated draft assessment on request;

• Host and process the primary copy of Client Data within the United Kingdom, and may hold encrypted backup copies within the European Union, which is an adequate jurisdiction under UK data protection law. Clu will give the Client at least 30 days’ written notice before any change to the location of processing or backup, and the parties will agree appropriate transfer safeguards before any transfer outside the United Kingdom or the European Union takes place. No other transfer of Client Data is made without the Client’s prior written consent;

• Notify the Client without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting Client Data, so the Client can meet its own 72-hour notification deadline to the Information Commissioner’s Office. A shorter notification period may be agreed in the Order Form or the Data Processing Agreement;

• On the Client’s request at any point during the term, make Client Data available for export in a structured, commonly used format; an

• Delete Client Data in accordance with clause 12.4 and provide written confirmation of deletion on request

1. ​

7.4  Sub-processing

Clu may engage sub-processors, including Delivery Affiliates who access the Client’s Platform instance in order to deliver the engagement. A current list of sub-processors is maintained in Clu’s Documentation and provided on request. Delivery Affiliates engaged on the Client’s engagement are named in the Order Form before they are given access, access the Platform through named accounts subject to multi-factor authentication, and are bound by confidentiality and security obligations no less onerous than those Clu owes the Client.
Clu will give at least 30 days’ written notice of any material change to its sub-processor arrangements and will impose data protection obligations on all sub-processors equivalent to those in this Section 7. If the Client objects within the notice period, the parties will discuss the objection in good faith. If they cannot resolve it within that period, either party may terminate the relevant Order Form on 30 days’ written notice, and clause 12.2 applies to any prepaid Fees.

​

7.5  Non-Generative AI Commitment

The Clu Models do not use generative AI. They produce deterministic, reproducible outputs derived from structured input data measured against proprietary benchmarks, and every output is traceable to the underlying data and can be independently audited.
If Clu introduces any generative AI capability, it will be offered as an optional feature, disclosed to the Client in advance, and enabled only with the Client’s separate written agreement. It will not be required for, and will not affect, the core Platform functions described in clause 3.6. Any such capability will process only Anonymised Statistics and will not process Client Data or anything that identifies the Client or an individual.​

​

8.  Confidentiality 
 

8.1  Obligations

Each party agrees to: (a) keep the other party's Confidential Information strictly confidential; (b) not disclose it to any third party without the disclosing party's prior written consent; (c) use it only for the purposes of these Terms; and (d) protect it using at least the same degree of care as it applies to its own confidential information, but in any event no less than reasonable care.

 

8.2  Permitted Disclosures

A receiving party may disclose Confidential Information: (a) to its employees, officers, advisers, or contractors who have a genuine need to know it for the purposes of these Terms and who are bound by confidentiality obligations no less stringent than these; or (b) to the extent required by applicable law, a court order, or a regulatory body, provided the receiving party gives the disclosing party as much advance written notice as practicable and co-operates with any steps to limit disclosure.

​

8.3  Duration

The obligations in this Section 8 shall survive termination of these Terms for a period of five (5) years. In respect of trade secrets, the obligations shall continue indefinitely.

1. ​

8.4  Client Confidentiality regarding Diagnostic OutputsSubject to clauses 6.3 and 8.2, the Client acknowledges that Diagnostic Outputs constitute Confidential Information of the Client, as they reflect Client Data, and of Clu in respect of methodology. The Client shall apply reasonable controls to prevent unauthorised disclosure of Diagnostic Outputs, including where they are shared with boards, employee representatives, unions or regulators in accordance with clause 6.3.​

​

9.  Security

 

9.1  Clu's Security Commitments

Clu holds current Cyber Essentials certification, covering network firewalls, secure configuration, user access control, malware protection and patch management.
Clu’s information security controls are designed and mapped to ISO 27001, and Clu is working towards certification with a target of H1 2027. Clu is not currently certified to ISO 27001 and holds no SOC 2 report. Clu’s AI governance practices are aligned with ISO 42001 but have not been independently assessed.
Clu carries out regular security assessments, independent penetration testing and continuous vulnerability management, and maintains the controls described in its Compliance and Security Summary, which is available on request. Clu will notify the Client promptly if any standard stated in this clause is no longer met.
​

9.2  Client's Security Responsibilities

The Client is responsible for:

Ensuring that devices and systems used to access the Platform meet reasonable security standards, including up-to-date operating systems, endpoint protection, and patch management;

Implementing appropriate access controls within the Client's own organisation to limit access to the Platform to Authorised Users;

Reporting any actual or suspected security incidents involving the Platform or Client Data to Clu at security@getaclu.io without undue delay.

​

9.3  Incident Response

In the event of a security incident affecting the Platform or Client Data, Clu will: (a) investigate promptly; (b) notify the Client without undue delay; (c) take reasonable steps to contain and mitigate the incident; and (d) co-operate with the Client in any regulatory notifications or response activities required.

​

9.4 Business Continuity

Clu maintains backup and recovery arrangements for the Platform, including encrypted daily backups and tested restoration procedures. Clu’s target is to restore the standard operational systems within 24-48 hours and to lose no more than the previous 24 hours of data following a failure. Clu tests its restoration procedures at least annually and will share a summary of the most recent test on request. The Client may export Client Data at any point during the term in accordance with clause 7.3(g), which the parties acknowledge is the Client’s primary protection against interruption of the Platform.

​

9.5 Insurance

Clu maintains professional indemnity insurance of not less than £1,000,000 and cyber insurance of not less than £250,000 with reputable insurers, and will maintain that cover for the term of each Order Form and indefinitely afterwards. Clu will provide evidence of cover on request.

​

10.  Warranties and Representations
 

10.1  Clu's Warranties

Clu warrants that:

• It has the right and authority to enter into these Terms and to grant the licences described herein;

• The Platform will perform materially in accordance with the Documentation during the term of the applicable Order Form;

• It will provide the Platform in a professional and workmanlike manner using personnel with appropriate skills and experience;

• It holds the certifications stated in clause 9.1, maintains the controls described in that clause, and will notify the Client promptly if any of them is no longer held or maintained.

• The Platform does not, to Clu's knowledge, infringe the intellectual property rights of any third party.

​

10.2  Client's Warranties

The Client warrants and represents that:

• It has the authority to enter into these Terms and to provide Client Data to Clu for the purposes described herein;

• Client Data does not infringe the intellectual property or other rights of any third party;

• Its use of the Platform and Diagnostic Outputs will comply with all applicable laws and regulations, including employment law, data protection law, and any applicable AI governance requirements;

• It will seek appropriate legal advice before progressing any workforce restructuring, redundancy process, or significant employment decision informed by Diagnostic Outputs, and will not rely solely on Diagnostic Outputs as the basis for any such decision.

​

10.3  Disclaimer

Except as expressly set out in these Terms, the Platform and all Diagnostic Outputs are provided on an ‘as is’ basis. Clu does not warrant that the Platform will be error-free or uninterrupted, or that Diagnostic Outputs will be complete, accurate, or suitable for any particular purpose. All implied warranties, conditions, and representations (including as to merchantability, fitness for purpose, and non-infringement) are excluded to the fullest extent permitted by law.

Diagnostic Outputs provide a model of the organisation derived from Client Data. They are evidence to inform thinking, not answers, conclusions, or recommended actions. They are not legal, financial, HR, or regulatory advice. Clu expressly disclaims all liability for: (a) any interpretation placed on a Diagnostic Output by the Client or any third party; (b) any strategy, agenda, plan, or programme developed using or informed by a Diagnostic Output; (c) any decision executed without the level of human oversight, legal review, expert input, or procedural rigour appropriate to the nature and consequence of that decision; and (d) any outcome, whether to the Client, its employees, or any third party, arising from action taken, or not taken, on the basis of Platform outputs. The more consequential the decision, the greater the Client's obligation to apply independent expert judgement, legal advice, and appropriate human oversight before acting. Clu’s platform increases the quality of the information available to decision-makers; it does not reduce or transfer the decision-maker’s responsibilities.

​

11.  Limitation of Liability

1.  

11.1  Uncapped Liabilities

Nothing in these Terms limits or excludes either party's liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; (c) any other liability that cannot be limited or excluded by law.

​

11.2  Cap on Liability

Subject to clause 11.1, the total aggregate liability of either party to the other under or in connection with these Terms, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, shall not exceed the greater of: (a) the total Fees paid or payable by the Client in the 12-month period immediately preceding the event giving rise to the claim; or (b) the total Fees paid under the most recent Order Form in force at the time of the event giving rise to the claim. This floor ensures that the cap is not reduced to zero or a nominal amount where a claim arises outside an active subscription period following a fixed-fee Diagnostic engagement.

​​

11.3  Excluded Losses

Subject to clause 11.1, neither party shall be liable to the other for any of the following, whether direct or indirect and whether or not foreseeable: loss of profits; loss of revenue; loss of business or contracts; loss of anticipated savings; loss of goodwill; business interruption; fines or penalties imposed by a regulator; or any indirect or consequential loss or damage.
Loss or corruption of Client Data is not excluded by this clause where it results from Clu’s breach of Section 7 or Section 9, and any such liability is subject to the cap in clause 11.2.

​

11.4  Client's Responsibility for Workforce Decisions

The Client explicitly acknowledges and agrees that: (a) Clu is not a party to, and accepts no liability in respect of, any employment, workforce, operational, or strategic decision made by the Client; (b) the Client is solely responsible for the legal, procedural, and ethical validity of any decision informed by Diagnostic Outputs, including any decision that affects individual employees, is subject to collective consultation obligations, or carries regulatory or legal consequence; (c) no Diagnostic Output constitutes a recommendation to act, and the Client must not act on any Platform output without the degree of human oversight, verification, expert review, and procedural rigour appropriate to the nature, scale, and consequence of the intended action; and (d) Clu accepts no liability for any loss, damage, liability, regulatory sanction, employment claim, or other consequence arising from any interpretation of Diagnostic Outputs or any strategy, restructure, redundancy programme, operating model change, or AI deployment decision progressed by the Client, whether or not such action was consistent with or supported by the Diagnostic Outputs.