SaaS terms and conditions

1. Definitions

• “Kenerix”, “we”, “us”: DataGravity Limited, trading as Kenerix, company number 13394375, registered office 78 High Street, Newport Pagnell, England, MK16 8AQ.
• “Customer”, “you”: the organisation named in the Order Form.
• “Services”: the Kenerix platform, portal, gateway, APIs and any related onboarding, support or professional services described in an Order Form.
• “Order Form”: the document, signed or accepted by both parties, that sets out the Services, subscription term, users, sources and fees.
• “Authorised Users”: your employees, contractors and, where the Order Form allows, your own customers, whom you permit to use the Services.
• “Customer Data”: data you or your Authorised Users connect to, upload to or create in the Services, including knowledge base content, reports and configurations.
• “Output”: answers, reports, alerts, datasets and other content generated by the Services from Customer Data.
• “AI Clients”: third-party AI tools, such as assistants and agents, that you connect to the Services through the Kenerix gateway.

2. The agreement

These terms, each Order Form, the Data Processing Addendum and any service level schedule form the agreement between us. If they conflict, the Order Form takes priority, then the Data Processing Addendum, then these terms. These terms are for business customers only; they do not apply to consumers.

3. Subscription and access

• We grant you a non-exclusive, non-transferable right for your Authorised Users to use the Services during the subscription term, for your internal business purposes and, where the Order Form includes white-label or client portals, to serve your own customers.
• You are responsible for your Authorised Users, for keeping sign-in credentials secure, for setting access roles and permission groups, and for telling us promptly about any unauthorised access.
• Usage limits, such as users, sources or AI Clients, are set out in the Order Form.

4. Customer Data

• You own Customer Data. You grant us a limited licence to host, copy, process and display it only as needed to provide, secure and support the Services.
• You are responsible for having the rights and lawful basis to connect Customer Data and for the accuracy of the source systems you connect.
• We recommend connecting sources with read-only credentials. The Services do not write to your source systems unless you approve a specific change.
• We may use aggregated, anonymised usage information that does not identify you or any individual to operate and improve the Services.

5. Data protection

For personal data within Customer Data, you are the controller and Kenerix is your processor. Our Data Processing Addendum, which meets Article 28 of UK GDPR and EU GDPR, forms part of this agreement. In particular, we will process personal data only on your documented instructions, ensure our staff are bound by confidentiality, use only sub-processors we have told you about (giving you notice and a chance to object to new ones), assist you with data subject requests and impact assessments, and notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data.

6. AI features

• Review before reliance. Output is generated with AI and may be incomplete or inaccurate. You are responsible for reviewing Output and for decisions you make with it. Certified definitions and reports exist so your team can mark what has been checked.
• Governed access. AI Clients and agents can only reach data allowed by the access rules you configure. You choose which AI Clients to connect and remain responsible for your use of them under their own terms.
• Human approval. Proposed changes to data or logic are not applied without approval by an Authorised User.
• No training on your data. We do not use Customer Data or Output to train general-purpose AI models, and we require our AI sub-processors to do the same.
• Regulation. Where you use the Services in a way that falls under the EU AI Act or sector rules, you remain responsible for your obligations as deployer; we will provide reasonable information about the Services to help you meet them.

7. Acceptable use

You must not, and must ensure your Authorised Users do not: break the law or infringe anyone’s rights; upload malicious code; attempt to bypass access controls, security or usage limits; probe or test the Services’ vulnerability without our written agreement; reverse engineer the Services except as permitted by law; resell the Services except as the Order Form allows; or use the Services to build a competing product.

8. Service levels and support

We aim for the availability and support response times set out in the Order Form or service level schedule, and will give reasonable advance notice of planned maintenance. Support is provided by email and the portal during UK business hours unless the Order Form says otherwise.

9. Fees and payment

• Fees are set out in the Order Form, exclusive of VAT, and invoiced annually in advance unless agreed otherwise.
• Invoices are payable within 30 days. We may charge interest on late payments under the Late Payment of Commercial Debts (Interest) Act 1998, and may suspend the Services if an undisputed invoice remains unpaid 30 days after we notify you.
• We may change fees for a renewal term by giving at least 60 days’ notice before the renewal date.

10. Confidentiality

Each party will keep the other’s confidential information secret, use it only for this agreement and share it only with people who need to know it and are bound by similar obligations. This does not apply to information that is public, already known, independently developed or that must be disclosed by law. These obligations continue for five years after the agreement ends, and indefinitely for Customer Data and trade secrets.

11. Intellectual property

• We own the Services, the Kenerix platform, our software, documentation and the Kenerix name and marks, including improvements.
• You own Customer Data and, as between us, the Output generated from it.
• If you give us feedback, we may use it to improve the Services without obligation to you.

12. Security

We maintain appropriate technical and organisational measures to protect the Services and Customer Data, including encryption in transit and at rest, role-based access control, logging and regular security testing, as further described in our security documentation. We hold Cyber Essentials Plus certification and will provide current assurance reports on request.

13. Warranties

We warrant that the Services will perform materially as described in our documentation and that we will provide them with reasonable skill and care. If they do not, we will, at our option, correct the issue or refund prepaid fees for the affected Services. Except as stated in this agreement, the Services are provided without other warranties, to the extent the law allows.

14. Indemnities

We will defend you against claims that your authorised use of the Services infringes a third party’s UK intellectual property rights, and pay damages finally awarded, provided you notify us promptly and let us control the defence. You will do the same for us for claims arising from Customer Data or your breach of the acceptable use terms.

15. Liability

• Nothing in this agreement limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot be limited by law.
• Neither party is liable for loss of profits, revenue, business, goodwill or anticipated savings, or for any indirect or consequential loss.
• Each party’s total liability in each contract year is limited to the fees paid and payable in the 12 months before the event giving rise to the claim. Breaches of confidentiality, data protection and the indemnities are subject to a separate cap of two times those fees.

16. Term and termination

• The subscription term is set out in the Order Form. It renews automatically for 12 months unless either party gives at least 90 days’ notice before the end of the current term.
• Either party may terminate if the other commits a material breach that is not remedied within 30 days of notice, or becomes insolvent.
• We may suspend access immediately if needed to prevent a security threat or serious breach of the acceptable use terms, and will restore it as soon as the issue is resolved.

17. After termination

Your right to use the Services ends. For 30 days you can export Customer Data, including your knowledge base and reports, in standard formats. We then delete Customer Data from our systems within 90 days, except where the law requires us to keep it, and will confirm deletion on request.

18. General

• Force majeure: neither party is liable for delays caused by events beyond its reasonable control.
• Assignment: neither party may transfer the agreement without the other’s consent, except to a successor in a merger or sale of the business.
• Notices: must be in writing to the addresses in the Order Form; email is accepted for operational notices.
• Entire agreement: this agreement is the whole agreement between us on its subject.
• Third parties: no one else has rights under the Contracts (Rights of Third Parties) Act 1999.
• Law and courts: this agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.