AI Rider

This AI Rider sets out additional terms governing the use of Fifty5Blue data in connection with artificial intelligence, machine learning or similar technologies (“AI”). This AI Rider forms part of the agreement or any applicable order form, statement of work, or other document entered into under that agreement, between Fifty5Blue and the counterparty identified in the agreement, where that agreement or document incorporates this AI Rider by reference or refers to the URL at which this AI Rider is published (the “Agreement”). It applies to all data licensed or otherwise made available by Fifty5Blue under the Agreement (the “Data”), unless otherwise agreed in writing by Fifty5Blue.

If there is any conflict or inconsistency between this AI Rider and the Agreement, this AI Rider shall prevail solely to the extent of that conflict or inconsistency and only in relation to the use of the Data in connection with AI. Except as expressly modified by this AI Rider, the Agreement remains unchanged and in full force and effect.

1 Definitions and Scope

1.1 In this AI Rider, the terms in initial-capitalised form shall have the meaning set out in this clause 1.1, whether or not such terms are otherwise defined in the Agreement. Capitalised terms used but not otherwise defined in this AI Rider shall have the meanings assigned to such terms in the Agreement.

“AI Appendix” means any exhibit, schedule, appendix, order form, statement of work, or other document forming part of the Agreement that identifies an AI-related use of the Data expressly approved by Fifty5Blue and sets out the applicable Permitted Purpose, Data, AI System, Approved Environment, Approved Provider, Approved RLD Workflow, retention period, conditions, and other relevant details of that use. An Agreement may contain more than one AI Appendix. Each AI Appendix applies only to the AI-related use expressly identified in that AI Appendix. A reference in this AI Rider to “the AI Appendix” means the AI Appendix applicable to the relevant AI-related use.

“AI System” means:

1. a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments; or
2. any artificial intelligence, machine learning, deep learning, neural network, foundation model, large language model, multimodal model, generative AI system, AI assistant, autonomous agent, retrieval-augmented generation system, embedding-based or vector-based retrieval component, automated decision-support system, synthetic-content generation system, or similar technology, whether now known or hereafter developed, including any API, plug-in, connector, retrieval layer, context-management layer, orchestration layer, agent memory, model artefact, model weight, or other component used in connection with, or holding or processing Data, prompts, context, or outputs generated by or submitted to, any of the foregoing.

“Approved Environment” means the named and secured environment specified in the AI Appendix within which an approved AI-related use of the Data may take place.

“Approved Provider” means a cloud, technology, or service provider expressly identified in the AI Appendix and bound by written terms that prohibit the use of the Data, prompts, context and outputs for Model Training or service improvement and impose confidentiality, security, retention, deletion, and onward disclosure obligations at least as restrictive as those set out in this AI Rider.

“Approved RLD Workflow” means a specific use of Record-Level Data that is expressly and exhaustively described as permitted in the AI Appendix, including the applicable purpose, Data, AI System, Approved Environment, Approved Provider, data flows, technical and organisational measures, outputs, recipients and retention period.

“Data Sharing Agreement” means the Fifty5Blue Data Sharing Agreement as detailed and available at https://www.fifty5blue.com/data-protection/data-sharing-agreement.

“Derived Analytical Output” means an aggregated insight, statistic, report, visualisation, prediction, segment description, or other analytical result generated from the Data that does not contain Record-Level Data, does not reproduce, substitute for or materially replicate the Data or any substantial part of it, and does not enable reconstruction, reverse engineering, singling out, or re-identification of the underlying Data.

“Embedding” means a numeric, vector, or other machine-readable representation of Data, metadata, taxonomy, concepts, attributes, patterns, or relationships, whether stored in a vector database or otherwise.

“Model Training” means any process by which an AI System learns patterns, relationships, or representations from data, including (without limitation) initial training, re-training, fine-tuning, transfer learning, continuous learning, reinforcement learning, or validation.

“Non-RLD” means Data that is not Record-Level Data, including aggregated Data and Derived Analytical Outputs, provided that such Data cannot reasonably be used, alone or together with other information available to the Company or to any third party to whom the Company makes the Data available, to reconstruct, single out, infer, or otherwise derive a record relating to an individual respondent, panellist, household, user, or device.

“Permitted Analytics” means the use of Non-RLD as input for analysis, reporting, modelling, forecasting, benchmarking, insight generation, visualisation, business intelligence or decision-support purposes, including through the use of AI-enabled tools, where:

1. the Data is processed to generate insights, reports, statistics, or business intelligence;
2. the Data is not retained by, or used for Model Training or to improve, any AI System, including through logging, caching, or similar technical storage mechanisms;
3. the AI System operates in a private, enterprise or controlled environment under terms that expressly prevent the Data, prompts, and outputs from being used for Model Training or service improvement;
4. the AI System does not have access to Record-Level Data through an API call, context window, system prompt, retrieval layer, connector, plug-in, tool, cache, log, or other connected system; and
5. any outputs do not contain Record-Level Data or enable reconstruction, reverse engineering, singling out, or re-identification of the underlying Data;
6. the use does not create or support a product, dataset, model, or service that substitutes for the Data or materially reduces the need for continued licensing of the Data; and
7. the use remains within the Licensed Purpose.

“Permitted Purpose” means:

1. the specific uses of the Data authorised in the Agreement (the “Licensed Purpose”);
2. Permitted Analytics; or
3. any other AI-related use of the Data expressly approved and recorded in the AI Appendix (the “Additional Approved Use”).

“Public AI Service” means any AI System made available to the public or to users on consumer or standard terms, or any AI System whose provider may use inputs, prompts, context, outputs, logs, telemetry or other usage data for Model Training or service improvement.

“Record-Level Data”or“RLD” means any Data that includes individual respondent-level, panellist-level, household-level, user-level, or device-level data. Record-Level Data also includes any vector embedding or other representation derived from such Data where the representation retains or encodes respondent-level, panellist-level, household-level, user-level or device-level attributes or patterns.

“RLD-Free Query” means a prompt, request, API call or instruction sent to an AI System that does not include, attach, expose, retrieve or otherwise make available any Record-Level Data in the payload, prompt, context window, system prompt, retrieval layer, connector, tool call, log, cache, telemetry, or connected data source.

“Synthetic Data” means any data, record, response, attribute, variable, profile, persona, audience, segment, cohort, or dataset that is artificially generated, simulated, imputed, inferred, extrapolated, augmented, or statistically modelled so as to resemble, approximate, reproduce, extend, or substitute for the characteristics, distributions, correlations, relationships, behaviours, preferences, propensities, or predictive value of the Data. Synthetic Data includes any such output whether or not it corresponds, or is intended to correspond, to any real individual, respondent, panellist, household, user, or device, and whether generated at record, profile, segment, cohort, audience, or dataset level.

1.2 Nothing in this AI Rider expands the datasets, territories, markets, users, affiliates, clients, purposes, delivery methods, term, output rights or sub-licensing rights granted under the Agreement. An AI-related use is permitted only if it is both within the scope of the licence granted under the Agreement and permitted under this AI Rider.

2 General provisions on AI use

2.1 The Company may use the Data only within the Permitted Purpose and only in accordance with this AI Rider.

2.2 The Company shall not, and shall ensure that its affiliates, sub-licensees, contractors, personnel, and agents do not use the Data, in whole or in part, for Model Training or to develop, improve, validate, fine-tune or otherwise incorporate the Data into any AI System. This clause 2.2 applies notwithstanding any other provision of this AI Rider, including any entry in the AI Appendix, or any approval or authorisation given by Fifty5Blue, and may not be varied, waived, or overridden by any such entry, approval, or authorisation.

2.3 Except for Permitted Analytics or an Additional Approved Use, the Company shall not, and shall ensure that its affiliates, sub-licensees, contractors, personnel, and agents do not:

2.3.1 input, upload, disclose, make available or otherwise permit the Data to be accessed by:

1. any Public AI Service;
2. any unapproved AI System; or
3. any AI System that is hosted, operated, or made available by a provider other than the Approved Provider;

2.3.2 use the Data to create Synthetic Data, Embeddings, or other derivative datasets; or

2.3.3 allow any third party to access or use the Data in a manner inconsistent with this AI Rider.

Where Record-Level Data is involved, clause 3 applies in addition to, and prevails over, this clause 2.3.

2.4 Notwithstanding clause 2.3.2, the Company may create and store Embeddings derived solely from taxonomies or metadata that do not contain, encode, or derive from Record-Level Data, provided that such Embeddings are used only for internal search and retrieval for the Permitted Purpose, are not used for Model Training, and are deleted upon termination or expiry of the applicable licence. The Company shall identify Fifty5Blue or Fifty5Blue’s products as the source of such Embeddings where required under the Agreement.

2.5 The Company shall implement appropriate technical and organisational measures to prevent inadvertent or unauthorised disclosure of the Data to AI Systems, including without limitation:

2.5.1 data loss prevention measures;

2.5.2 restrictions on copying Data to clipboard or personal devices;

2.5.3 network controls preventing upload to public AI services;

2.5.4 staff training on the restrictions in this AI Rider;

2.5.5 where applicable, isolated sessions that do not retain or make available Data or context from any previous session; and

2.5.6 network and access controls appropriate to the relevant AI-related use designed to prevent Data flowing to any system, provider, affiliate, client, or other third party other than permitted under clause 2.3.

2.6 The Company shall ensure that any contractors, sub-licensees, or other third parties who are granted access to the Data are subject to written obligations at least as restrictive as those in this AI Rider, including express restrictions on Model Training, retention, onward disclosure, and service improvement. The Company shall remain responsible for their acts and omissions.

2.7 The Company shall not retain any Data, Embedding, prompt, context, or output in any vector database, embedding store, model artefact repository, cache, log, telemetry stream, or prompt history beyond the period necessary for the Permitted Purpose, and in any event shall delete the same on the earlier of the expiry of the applicable licence and the retention period specified in the applicable AI Appendix.

2.8 If the Company wishes to use the Data in connection with any AI System other than for Permitted Analytics, the Company may seek Fifty5Blue’s approval for that use to constitute an Additional Approved Use. A use shall not constitute an Additional Approved Use unless and until Fifty5Blue has given its approval in accordance with this clause 2.8.

2.8.1 The Company shall provide Fifty5Blue with written details of the proposed use, including the purpose, Data involved, AI System and provider, architecture and data flows, security measures, retention, outputs, and whether the system is public-facing, private, shared, or controlled.

2.8.2 Fifty5Blue may, in its sole discretion, grant or refuse approval for the proposed use to constitute an Additional Approved Use, or grant approval subject to conditions. Any approval shall identify the Approved Provider and shall be recorded in an AI Appendix forming part of the Agreement. Where the proposed use involves Record-Level Data, any approval shall take effect only when recorded in the AI Appendix as an Approved RLD Workflow, and clause 3 shall apply.

2.8.3 The Company shall pay any additional fees specified by Fifty5Blue as a condition of an Additional Approved Use.

2.9 Fifty5Blue may approve a proof of concept using Non-RLD for a defined Synthetic Data or generative modelling use case. Any such approval constitutes an Additional Approved Use and shall be expressly set out in an AI Appendix forming part of the Agreement, identifying the source Data, purpose, AI System, Approved Provider, Approved Environment, output testing, intellectual property protections, re-identification controls, retention period, and deletion requirements. No such approval permits the use of Record-Level Data, which may only be authorised as an Approved RLD Workflow in accordance with clause 3. No such approval, and nothing else in this AI Rider, permits Model Training, in accordance with clause 2.2.

3 AI use involving record-level data

3.1 Record-Level Data shall not be input into, uploaded to, disclosed to, incorporated into, retrieved by, made accessible to, processed by, or otherwise permitted to flow into or across any AI System, directly or indirectly, except to the specific and exhaustive extent expressly set out in an Approved RLD Workflow (the “RLD Restriction”). All queries to any AI System shall be RLD-Free Queries except within an Approved RLD Workflow.

3.2 The RLD Restriction applies to each component of the relevant AI workflow, including any API request or response, payload, prompt, context window, system prompt, retrieval layer, vector database, connector, plug-in, tool call, agent memory, cache, log, telemetry stream, monitoring system, backup, training corpus, validation set, and output store.

3.3 For the avoidance of doubt, Permitted Analytics and an Additional Approved Use do not, of themselves, authorise any use of Record-Level Data. A use involving Record-Level Data is permitted only to the specific and exhaustive extent set out in an Approved RLD Workflow and subject to this clause 3.

3.4 Record-Level Data shall not be used for service improvement of any AI System, except as expressly and exhaustively set out in the Approved RLD Workflow.

3.5 Embeddings derived from Record-Level Data are prohibited unless expressly approved as part of an Approved RLD Workflow. Any approval shall specify the source Data, method of creation, vector store, hosting environment, access controls, permitted use, retention period, and deletion requirements. Even where approved, such Embeddings shall not be exposed to any AI System outside the Approved RLD Workflow, transferred to shared or unapproved third-party infrastructure used for retrieval-augmented generation unless expressly approved, or used to reconstruct or infer Record-Level Data, and clause 2.2 applies without limitation to any such Embeddings.

3.6 Where an AI Appendix authorises any use of Record-Level Data, the Company shall ensure that the use is limited to the purpose, Data, AI System, Approved Environment, Approved Provider, workflow, users, outputs, recipients, and retention period specified in that AI Appendix.

3.6.1 Record-Level Data shall remain within the Approved Environment and shall not be made available to any other system or third party except as expressly specified in the applicable AI Appendix.

3.6.2 The Company shall implement the technical and organisational measures specified in the applicable AI Appendix, including controls relating to API calls, context windows, system prompts, persistence, sessions, logging, caching, telemetry, access, outputs and deletion.

3.6.3 Any supervised or unsupervised machine learning, predictive modelling, segmentation, audience insight, or lookalike modelling involving Record-Level Data shall be carried out only where expressly approved in the applicable AI Appendix and shall not externalise Record-Level Data.

3.6.4 Any change to the approved purpose, Data, AI System, provider, architecture, location, access, retention, Embeddings, outputs, or recipients shall be subject to Fifty5Blue’s prior written approval and shall take effect only when recorded in an amendment to the applicable AI Appendix or in a new AI Appendix forming part of the Agreement.

3.6.5 Any output leaving the Approved Environment shall be aggregated and subject to appropriate disclosure control and reconstruction testing, shall not contain Record-Level Data, and shall not enable reconstruction, reverse engineering, singling out, or re-identification of the underlying Data.

3.6.6 Provider and system logging, caching, telemetry, prompt history, human review, and service-improvement functions shall be disabled for Record-Level Data, unless a specific technical function is expressly approved in the applicable AI Appendix subject to an agreed retention period and access controls.

3.6.7 Where lookalike modelling is expressly approved, the seed Record-Level Data shall be removed promptly after the approved modelling process, shall not be made available to any activation platform unless expressly stated in the applicable AI Appendix, and shall not remain in any model, Embedding or output in a form that permits extraction, reconstruction, or substitution.

3.6.8 Where an approval is limited to a proof-of-concept involving Record-Level Data, no production use shall commence unless Fifty5Blue has confirmed its approval in writing following review of the proof-of-concept results, controls, outputs and any required data protection assessment, and the production use has been recorded in an amendment to the applicable AI Appendix or in a new AI Appendix forming part of the Agreement.

4 security, verification and audit

4.1 The Company shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the risk of any unauthorised or unlawful processing. Such measures shall be designed (without limitation) to:

4.1.1 ensure compliance with clauses 2 and 3 of this AI Rider; and

4.1.2 ensure that only authorised personnel have access to the Data and that such personnel are trained on and aware of such restrictions.

4.2 With respect to the Company’s compliance with the obligations set out in this AI Rider in connection with AI-related uses that do not involve Record-Level Data, including restrictions on data use, prohibition of Model Training, data retention and misuse, Fifty5Blue may request information reasonably necessary to verify compliance with the Agreement and this AI Rider. Such verification shall be conducted primarily through questionnaires, compliance certifications and the provision of relevant documentation and materials demonstrating adherence to this AI Rider.

4.3 The Company shall cooperate with any verification request under clause 4.2 and shall:

4.3.1 respond in good faith and within a reasonable timeframe, not exceeding 10 (ten) Business Days unless a longer period is agreed by Fifty5Blue, such agreement not to be unreasonably withheld;

4.3.2 provide complete, accurate and up-to-date information; and

4.3.3 promptly notify any material incident or non-compliance related to this AI Rider.

4.4 Fifty5Blue may require additional verification measures in accordance with clause 4.5 where any of the following occurs:

4.4.1 failure to respond within the agreed timeframe without reasonable justification;

4.4.2 provision of incomplete, inconsistent or objectively contradictory information;

4.4.3 identification of objective evidence of potential non-compliance, including documentary or technical indications of misuse of Data;

4.4.4 notification of a relevant incident involving Data use or AI; or

4.4.5 repeated failure to comply with the transparency obligations set out in this clause 4.

4.5 Where any of the circumstances in clause 4.4 applies, and only to the extent necessary to clarify the matter, the Parties shall discuss in good faith additional verification measures, which may include a limited audit, provided that such measures are proportionate to the identified risk, strictly limited to the scope of the potential non-compliance, subject to strict confidentiality obligations and conducted in a manner that minimises disruption to the Company’s operations. An unreasonable refusal by the Company to cooperate with measures agreed or required under this clause 4.5 shall constitute a material breach of the Agreement.

4.6 Where any Approved RLD Workflow is in place, Fifty5Blue may request information and technical evidence reasonably necessary to verify compliance with the Approved RLD Workflow, including provider contractual terms, system and data-flow diagrams, architecture and configuration evidence, access-control records, API request and response structures, context window and system prompt configuration, session isolation and persistence settings, logging, caching, telemetry and prompt-history controls, retention and deletion records, output testing, reconstruction or re-identification testing, and evidence that Record-Level Data has not been used outside the approved scope.

4.7 For any Approved RLD Workflow, or where Fifty5Blue reasonably suspects a breach involving Record-Level Data, Fifty5Blue may require a technical audit limited to the relevant Approved RLD Workflow or suspected non-compliance. Such audit may include review of any of the matters listed in clause 4.6 and any other technical measures reasonably necessary to verify compliance. Fifty5Blue may appoint an independent third-party auditor subject to appropriate confidentiality obligations and the Company’s prior approval, not to be unreasonably withheld or delayed.

4.8 Any verification, additional verification measure, or audit under this clause 4 shall be limited to what is reasonably necessary to verify compliance with this AI Rider and shall be conducted in a manner that protects the Company’s confidential information, trade secrets, intellectual property, security controls and the confidential information and data of the Company’s clients, customers and other third parties. Fifty5Blue shall not require disclosure of unrelated customer data, proprietary algorithms, model weights or source code unless strictly necessary to verify the relevant compliance issue and subject to appropriate enhanced safeguards, which may include redaction, aggregation, secure review environments, independent auditor review or other protective measures agreed by the Parties.

4.9 The Company shall notify Fifty5Blue immediately, and in any event no later than 24 (twenty-four) hours, in writing upon becoming aware of any suspected or actual breach of this AI Rider or any incident that may compromise the security, confidentiality or permitted use of the Data.

5 IP Rights

5.1 The Company acknowledges that the Data represents substantial investment by Fifty5Blue and has significant commercial value, and that any unauthorised use of the Data, including any use for Model Training, may create an unauthorised derivative work and/or constitute misappropriation of Fifty5Blue’s intellectual property rights.

5.2 All rights, title, and interest in and to the Data (including but not limited to intellectual property rights, database rights, copyright and trade secrets) remain vested in Fifty5Blue and/or its licensors.

5.3 Nothing in the Agreement or this AI Rider grants the Company any right or licence to:

5.3.1 use the Data for Model Training;

5.3.2 use the Data for the development or operation of any AI System, except for Permitted Analytics or as an Additional Approved Use;

5.3.3 create derivative works or adaptations of the Data (except as expressly permitted for the Permitted Purpose);

5.3.4 reverse engineer, decompile, or disassemble the Data or any methodology used to create it; or

5.3.5 sub-license, sell, or otherwise commercialise the Data or any outputs derived from it (except as expressly permitted in the Agreement).

5.4 For the avoidance of doubt, a Derived Analytical Output generated in compliance with this AI Rider may be used for the Permitted Purpose and shall not, solely by reason of having been generated through Permitted Analytics or an Approved RLD Workflow, constitute an unauthorised derivative work. This does not apply to any output that reproduces, substitutes for, materially replicates, enables reconstruction of, or discloses the Data or any substantial part of it.

5.5 The Company shall not use the Data, any Embedding or any output to build, support or commercialise a product, dataset, model or service that competes with, substitutes for or materially reduces the need to license the Data. Any permitted sharing of outputs with a client or other third party shall comply with the Agreement and any conditions in the applicable AI Appendix, and the Company shall remain responsible for any onward use.

6 Data protection

6.1 To the extent the Data includes Record-Level Data or otherwise Personal Data, the Parties acknowledge that each Party is an independent controller in respect of its own processing of such Data and that neither Party determines the purposes or essential means of the other Party’s processing. The Parties shall comply with the Data Sharing Agreement and all applicable data protection laws.

6.2 No use of Record-Level Data under an Approved RLD Workflow may commence unless the Data Sharing Agreement is in effect and the Company has documented, as applicable, the purpose, lawful basis, necessity, proportionality, data minimisation, retention, transparency and international transfer arrangements for the processing.

6.3 The Company shall not attempt to identify or contact any respondent or panellist, link Record-Level Data to directly identifying information, or use the Data to take decisions producing legal or similarly significant effects concerning an individual, in each case whether or not such conduct would be restricted under applicable law.

6.4 The Company shall ensure that outputs generated through an AI System are subject to human review before being relied upon for any decision affecting an individual or before being disclosed to any third party, and are not represented as certain, complete or free from statistical limitations, bias, or error.

7 Remedies

7.1 Any breach of this AI Rider shall constitute a material breach of the Agreement entitling Fifty5Blue to exercise any or all remedies available under the Agreement.

7.2 Where Fifty5Blue reasonably believes that continued processing creates a material risk to the Data, respondents, intellectual property, or security, Fifty5Blue may require the Company to suspend the affected AI-related use pending investigation and remediation. Fifty5Blue shall act reasonably in determining whether and when the affected use may resume. Where the relevant risk involves a breach of the RLD Restriction, Fifty5Blue may also require the Company to immediately suspend the affected AI-related use, isolate affected systems, disable the relevant workflow, preserve relevant logs and evidence, delete or segregate any Record-Level Data from unapproved systems, and provide a written remediation plan.

7.3 The Parties agree that damages alone would not be an adequate remedy in the event of breach by the Company of the provisions of this AI Rider. Accordingly, Fifty5Blue may, without proof of special damages, seek an injunction, specific performance, or other interim or equitable remedy for any threatened or actual breach of this AI Rider. The Parties further acknowledge that any unauthorised use, disclosure, exposure or retention of Record-Level Data in connection with an AI System may cause irreparable harm.

7.4 The Company shall indemnify, defend and hold harmless Fifty5Blue, Fifty5Blue Affiliates, and their respective personnel from and against any and all losses, damages, liabilities, costs, regulatory fines, and third-party claims arising out of or in connection with any breach of this AI Rider by the Company, its affiliates, contractors, or personnel. Without limiting the generality of the foregoing, such losses include losses arising from unauthorised use of Record-Level Data, re-identification, reconstruction, regulatory investigation, data subject or respondent claims, security incidents, or claims by licensors, clients, or other third parties.

7.5 The remedies in this AI Rider are cumulative and in addition to, and do not replace, the remedies available under the Agreement. The limitations and exclusions of liability in the Agreement apply to liability arising under this AI Rider, except that the indemnity in clause 7.4 is not subject to any liability cap in the Agreement.

7.6 Fifty5Blue may terminate the Agreement upon written notice if the Company or any of its affiliates, contractors, or personnel commits a material breach of this AI Rider and, where the breach is capable of remedy, fails to remedy it within any applicable cure period under the Agreement. Fifty5Blue may terminate the Agreement immediately by written notice, without a cure period, where the Company, or any of its affiliates, contractors, or personnel, commits a breach of the RLD Restriction, clause 2.2, or where a breach of this AI Rider involves unauthorised access to, use of, disclosure of or retention of Record-Level Data; exposure of Record-Level Data to a Public AI Service or unapproved AI System; generation of Synthetic Data from Record-Level Data; failure to cooperate with a technical audit under clause 4.7; failure to notify an incident involving Record-Level Data within the timeframe set out in clause 4.9; or inability to demonstrate compliance with an Approved RLD Workflow. Termination under this clause 7.6 is without prejudice to any other right or remedy available to Fifty5Blue.

8 Post-termination obligations

8.1 Upon termination or expiry of the Agreement for any reason, the Company shall:

8.1.1 immediately cease all use of the Data and any processing of Personal Data contained in the Data;

8.1.2 at Fifty5Blue’s election, notified to the Company in writing, return or securely delete all copies of the Data in its possession or control, including derived, transformed, cached or embedded versions, vector embeddings derived from the Data, and any outputs required to be deleted under the applicable AI Appendix. Copies held in backups, archives, or disaster-recovery systems that cannot be deleted immediately shall remain protected, shall not be restored or used except for disaster recovery, and shall be securely deleted in accordance with the Company’s ordinary back-up retention cycle;

8.1.3 ensure that all affiliates, contractors, sub-licensees, and other third parties who have been provided with access to the Data comply with the obligations in clauses 8.1.1 and 8.1.2;

8.1.4 provide to Fifty5Blue written confirmation of compliance with clauses 8.1.1 to 8.1.3, signed by an officer of the Company, within 20 (twenty) Business Days of the later of (a) termination or expiry, and (b) Fifty5Blue’s election under clause 8.1.2 (if any); and

8.1.5 if requested by Fifty5Blue, provide evidence of deletion, including deletion logs, certificates of destruction, or other reasonable evidence.

8.2 The Company may retain the Data and any Embeddings, outputs, or derived material to which the retention requirement applies only to the extent and for so long as required by applicable law or regulation, provided that:

8.2.1 the Company notifies Fifty5Blue in writing of the legal basis for retention and the period of retention;

8.2.2 the Data is held securely and subject to the restrictions in this AI Rider;

8.2.3 the Data is used only for the purpose required by law and is deleted as soon as the legal requirement ceases; and

8.2.4 the Company notifies Fifty5Blue within 10 (ten) Business Days upon deletion.

8.3 The obligations in this clause 8 are without prejudice to any obligations that expressly survive termination or expiry of the Agreement.