1. About these Terms
These Terms of Service (“Terms”) govern access to and use of the ARYZ website, platform, applications, integrations, software subscriptions, AI features, credits, add-ons and managed services (together, the “Services”).
The Services are supplied by DR Rent Ltd, trading as ARYZ:
- Company number: 17279894
- Registered in: England and Wales
- Registered office: 1 Walpole Road, Slough, England, SL1 6AU
- Email: hello@aryz.co.uk
“ARYZ”, “we”, “us” and “our” mean the entity above. “You”, “your” and “Customer” mean the person or organisation entering into the contract. “Authorised User” means a person the Customer permits to use its account.
By creating an account, clicking to accept, placing an order, starting a paid plan or using the Services, the Customer agrees to these Terms.
2. Business use only
The Services are intended for businesses and persons acting wholly or mainly for purposes relating to their trade, business, craft or profession. By entering into this contract, you confirm that:
- you are not acting as a consumer;
- you are at least 18 years old;
- you have authority to bind the Customer; and
- the information supplied during registration and checkout is complete and accurate.
If ARYZ expressly agrees to supply a Service to a consumer, separate consumer terms and statutory cancellation information may apply.
3. Contract documents and order of precedence
The contract may include:
- an order form, checkout page, proposal or statement of work accepted by the Customer (the “Order”);
- these Terms;
- any service-specific terms;
- the Data Processing Terms in Schedule 1;
- the Privacy Policy;
- the Acceptable Use requirements in these Terms; and
- any plan limits or feature descriptions displayed at checkout.
If there is a conflict, the documents apply in the order above, except that the Data Processing Terms take priority for the processing of Customer Personal Data.
Marketing pages and demonstrations are descriptive only unless a feature or commitment is expressly included in the Order.
4. Accounts and Authorised Users
4.1 Account registration
The Customer must provide accurate information and keep it updated, and is responsible for:
- all activity under its account;
- choosing suitable administrators and users;
- assigning appropriate permissions;
- removing users who no longer require access;
- maintaining the confidentiality of credentials;
- using multi-factor authentication where available; and
- notifying ARYZ promptly of suspected unauthorised access.
4.2 Workspace ownership
The Customer controls its workspace and may authorise employees, contractors, virtual assistants, agencies or other users. The Customer is responsible for the acts and omissions of its Authorised Users as if they were the Customer’s own. An Authorised User must not access a workspace after their authority ends.
4.3 Account transfer
Accounts and subscriptions may not be sold, transferred, shared between unrelated businesses or used as a service bureau without ARYZ’s written permission.
5. The Services
ARYZ may provide features for:
- Business DNA, Company Brain and brand context;
- content drafting and image generation;
- screenshot and opportunity analysis;
- social-media and Google Business Profile publishing;
- review import and reply drafting;
- calendars, approvals and scheduling;
- lead capture and outreach;
- Search Console, Google Analytics and channel reporting;
- YouTube upload and channel management;
- SEO, competitor and campaign recommendations;
- credits and usage monitoring;
- team permissions; and
- managed marketing services.
The precise features, usage allowances, users, locations, channels, credits and support level are determined by the Customer’s Order and current plan.
Some features may be labelled beta, preview, early access, experimental or coming soon. Those features may be incomplete, changed or withdrawn and are provided without a service-level commitment unless the Order says otherwise.
6. Human approval and Customer responsibility
ARYZ is an assistance and workflow platform. It does not replace professional judgement.
Unless a Customer expressly enables a clearly identified automation feature, ARYZ prepares content or actions for review and does not publish or send them without approval by an Authorised User.
The Customer is responsible for:
- checking the accuracy, legality, tone and suitability of every output;
- checking names, dates, prices, claims, statistics, links and contact details;
- obtaining necessary consents and permissions;
- ensuring content complies with law, professional rules and platform policies;
- deciding whether to publish, send, rely on or act on an output; and
- maintaining appropriate human oversight.
ARYZ does not provide legal, medical, financial, tax, regulatory or other regulated professional advice.
7. Artificial intelligence
7.1 Nature of AI output
The Services may use third-party and proprietary AI systems. AI output is probabilistic and may be inaccurate, incomplete, offensive, outdated, unsuitable or similar to output produced for another user. ARYZ does not warrant that AI output:
- is factually correct;
- is unique or non-infringing;
- will comply with every law, regulation or platform rule;
- is suitable for a particular audience;
- will be accepted by a third-party platform; or
- will produce leads, revenue, rankings or any other result.
7.2 Customer review
The Customer must independently review AI output before use. High-risk or regulated decisions must not be made solely on the basis of an ARYZ output.
7.3 Prompts and instructions
The Customer must not submit information it is not entitled to use or instruct ARYZ to deceive, impersonate, discriminate, harass, manipulate or break the law.
8. Connected accounts and third-party platforms
8.1 Authorisation
By connecting Google, Meta, Facebook, Instagram, YouTube, Canva or another service, the Customer authorises ARYZ to access the information and perform the actions shown during the connection and within the selected ARYZ feature. The Customer confirms that it owns or is authorised to manage every connected account, page, property, location or channel.
8.2 Third-party terms
Connected services are governed by the relevant provider’s terms, policies, technical limits and approval processes. The Customer must comply with them. ARYZ is not Google, Meta, YouTube, Canva, Stripe or any other third-party provider and does not control:
- API availability;
- permission changes;
- account restrictions;
- moderation decisions;
- publication delays;
- token expiry;
- platform outages;
- account suspensions;
- rate limits;
- data accuracy; or
- changes to third-party features.
8.3 Connection interruption
A connected feature may stop working if:
- the Customer revokes access;
- a token expires;
- permissions change;
- a platform blocks an action;
- the connected account is restricted;
- an API is unavailable; or
- a provider changes or withdraws its service.
The Customer must reconnect or update permissions when requested.
8.4 Publishing
The Customer is responsible for final approval and the consequences of publication. ARYZ does not guarantee that a scheduled post, video, reply or update will publish at the requested time. Where practical, ARYZ will show failure information or allow a retry.
9. Customer Content
9.1 Ownership
As between ARYZ and the Customer, the Customer retains ownership of Customer Content.
9.2 Licence to ARYZ
The Customer grants ARYZ a worldwide, non-exclusive, royalty-free licence during the contract to host, copy, transmit, transform, analyse, display and otherwise process Customer Content only as reasonably necessary to:
- provide and secure the Services;
- follow the Customer’s instructions;
- provide support;
- prevent fraud or misuse;
- comply with law; and
- create aggregated or anonymised service statistics that no longer identify the Customer or an individual.
9.3 Customer warranties
The Customer warrants that:
- it has all necessary rights, permissions and lawful bases for Customer Content;
- Customer Content and its use through ARYZ will not infringe rights or break the law;
- it will provide required privacy information to individuals;
- it will not upload unnecessary sensitive or confidential information;
- it will honour objections, opt-outs and suppression requests; and
- it will not use ARYZ to send unlawful direct marketing.
9.4 Screenshots and third-party personal data
Before uploading screenshots or conversations, the Customer must consider whether personal data can be cropped, blurred, redacted or minimised. The Customer remains responsible for the lawfulness of collecting, uploading, analysing, storing and contacting any person identified in Customer Content.
9.5 Removal
ARYZ may remove or restrict Customer Content where it reasonably believes the content:
- is illegal;
- infringes rights;
- threatens security;
- breaches these Terms;
- breaches a platform policy; or
- exposes ARYZ or another person to material risk.
Where appropriate and lawful, ARYZ will notify the Customer.
10. Acceptable use
The Customer and Authorised Users must not use the Services to:
- break any law, regulation, court order or binding code;
- spam, scrape, mass-contact or harass people;
- evade platform limits, moderation or access controls;
- publish deceptive, fraudulent or materially misleading content;
- impersonate another person or business;
- create fake reviews, endorsements, evidence, testimonials or engagement;
- process personal data without a lawful basis;
- send unlawful electronic marketing;
- discriminate unlawfully or make decisions based on protected characteristics;
- upload malware or attempt to compromise security;
- probe, scan, reverse engineer or interfere with the Services;
- access another workspace without permission;
- use bots or automated means not expressly supported by ARYZ;
- infringe intellectual-property, privacy, confidentiality or publicity rights;
- generate or distribute illegal, abusive, exploitative or harmful content;
- use ARYZ for surveillance or unlawful profiling;
- use outputs as professional advice where qualified review is required;
- resell or white-label ARYZ without written permission; or
- use the Services to develop or benchmark a competing product except with written permission.
ARYZ may impose reasonable rate limits and safeguards to protect users, third parties and the platform.
11. Social outreach and electronic marketing
ARYZ may help draft comments, messages, emails, SMS or WhatsApp communications. The Customer decides whether and how they are sent. The Customer is solely responsible for:
- identifying the applicable marketing rules;
- obtaining consent where required;
- documenting legitimate interests where relied upon;
- checking corporate versus individual subscriber status;
- maintaining opt-out and suppression records;
- avoiding repeated, excessive or intrusive contact;
- complying with group rules and platform terms; and
- keeping claims fair, accurate and capable of substantiation.
ARYZ does not guarantee that a communication is lawful merely because it was generated by the Services.
12. Plans, fees and payment
12.1 Fees
Fees, billing intervals, plan allowances and taxes are shown in the Order or at checkout. Unless stated otherwise:
- prices exclude VAT and other applicable taxes;
- monthly plans are billed monthly in advance;
- annual plans are billed annually in advance;
- managed-service fees are billed as stated in the relevant Order; and
- payment is processed through the payment method selected at checkout.
12.2 Recurring billing
Subscriptions automatically renew for successive periods equal to the current billing period unless cancelled before the renewal date. By subscribing, the Customer authorises ARYZ and its payment provider to charge the payment method for recurring fees, taxes, usage charges and authorised add-ons.
12.3 Cancellation
Self-service subscriptions may be cancelled through the Billing Portal or another cancellation method stated in the Order. Cancellation normally takes effect at the end of the current paid billing period. Access continues until then unless the account is suspended or the Customer requests earlier closure. The Customer should retain confirmation of cancellation.
12.4 No general refunds
Except where required by law, expressly stated in an Order or caused by a confirmed ARYZ billing error:
- fees are non-refundable;
- cancellation does not generate a partial-period refund;
- unused time, credits or plan capacity are not redeemable for cash; and
- annual fees are not refunded merely because the Customer stops using the Services.
12.5 Failed payments
If payment fails, ARYZ may:
- retry payment;
- notify the account owner;
- restrict paid features;
- suspend the account after a reasonable grace period; and
- terminate the subscription if payment remains overdue.
The Customer remains liable for undisputed amounts due.
12.6 Taxes
The Customer is responsible for taxes, duties or charges other than taxes on ARYZ’s net income. If withholding is required by law, the Customer must provide evidence and, where legally permitted, gross up the payment so ARYZ receives the amount invoiced.
12.7 Chargebacks
Before initiating a chargeback, the Customer should contact ARYZ and allow a reasonable opportunity to investigate. Fraudulent or abusive chargebacks may result in suspension and recovery of reasonable costs.
13. Credits and usage limits
13.1 Credits
Certain AI or premium actions consume ARYZ credits. The applicable cost should be shown in the product, plan or Order. Credits:
- are a contractual usage unit, not money or stored value;
- cannot be transferred between unrelated customers;
- cannot be sold or exchanged for cash;
- may be subject to plan limits, expiry and fair-use rules;
- may vary in cost according to model, quality or processing demand; and
- are deducted when an action is initiated or successfully processed, according to the feature rules.
13.2 Included credits
Unless the Order says otherwise, credits included with a subscription reset at the start of each billing period and do not roll over.
13.3 Top-up and promotional credits
The expiry and use rules for purchased top-ups or promotional credits will be shown at purchase or grant. Promotional credits have no cash value and may be withdrawn where obtained through fraud or error.
13.4 Failed actions
Where an AI action fails before meaningful processing occurs, ARYZ will aim not to charge credits or to restore them. Credits may still be consumed where a third-party model or provider completed billable processing even if the Customer rejects the output.
13.5 Excessive use
ARYZ may apply reasonable usage, concurrency, storage or rate limits to prevent abuse, protect performance or manage third-party costs.
14. Plan changes and price changes
Upgrades may take effect immediately and may be charged on a prorated or full-period basis as shown at checkout. Downgrades normally take effect at the next renewal and may result in reduced users, storage, channels, features or allowances.
ARYZ may change prices on prior notice. For an existing paid subscription, a price change will normally apply from the next renewal occurring at least 30 days after notice, unless the change is required by law, tax or a third-party pass-through charge and a shorter period is reasonable.
If the Customer does not accept a price change, its remedy is to cancel before the new price takes effect.
15. Managed Growth and professional services
Managed services are governed by the applicable proposal, statement of work or Order. Unless expressly included:
- advertising spend, stock media, third-party subscriptions, travel and external production costs are excluded;
- deliverables depend on the Customer providing timely information, access, assets and approvals;
- delayed approvals may delay or reduce output during the relevant period;
- unused monthly deliverables do not automatically roll over;
- revisions are limited to the number or scope stated in the Order;
- the Customer remains responsible for final approval and legal compliance; and
- no commercial outcome is guaranteed.
Either party may terminate a managed-service Order according to its stated notice period.
16. Intellectual property
16.1 ARYZ technology
ARYZ and its licensors own all rights in:
- the Services and software;
- interfaces, workflows, databases and underlying technology;
- ARYZ trade marks, branding and documentation;
- service-generated templates and methodologies; and
- improvements, updates and derivative technology.
Except for the limited right to use the Services during the subscription, no rights are transferred to the Customer.
16.2 Customer output
Subject to payment of fees and third-party rights, ARYZ does not claim ownership of the final text, images or other output generated specifically for the Customer from its Customer Content. The Customer acknowledges that:
- AI output may not qualify for intellectual-property protection;
- similar or identical output may be generated for others;
- third-party model or stock-content terms may apply;
- ARYZ does not guarantee clearance or exclusivity; and
- the Customer must check trade marks, copyright, image rights and other legal restrictions before commercial use.
16.3 Feedback
If the Customer provides suggestions or feedback, ARYZ may use it without restriction or payment, provided ARYZ does not publicly identify the Customer without permission.
17. Confidentiality
Each party must protect the other party’s confidential information using reasonable care and may use it only to perform or receive the Services. Confidential information does not include information that:
- is public without breach;
- was lawfully known without restriction;
- is independently developed; or
- is lawfully received from a third party.
A party may disclose confidential information where required by law, after giving notice where legally permitted.
18. Data protection
Each party must comply with applicable data-protection and electronic-communications laws.
The Privacy Policy explains how ARYZ processes personal data as a controller. Where ARYZ processes Customer Personal Data as a processor, Schedule 1 applies.
The Customer is responsible for:
- determining and documenting its lawful basis;
- issuing privacy notices;
- responding to individual rights;
- complying with direct-marketing rules;
- configuring retention and access;
- giving lawful instructions; and
- ensuring Customer Content is adequate, relevant and limited to what is necessary.
19. Security
ARYZ will maintain reasonable technical and organisational safeguards appropriate to the nature of the Services and risk. The Customer acknowledges that no online service can be guaranteed completely secure or uninterrupted. The Customer must:
- use strong, unique credentials;
- protect connected accounts;
- review permissions;
- keep devices secure;
- remove departed users promptly; and
- notify ARYZ immediately of a suspected compromise.
ARYZ may take emergency action, including disconnecting an integration or suspending access, where reasonably necessary to contain a security risk.
20. Availability, maintenance and support
ARYZ aims to provide a reliable service but does not guarantee uninterrupted or error-free availability. The Services may be unavailable because of:
- planned maintenance;
- emergency maintenance;
- third-party APIs or infrastructure;
- internet or telecommunications failures;
- security incidents;
- changes required by law or platform policy; or
- events beyond reasonable control.
Support channels and response targets are described in the applicable plan or Order. A response target is not a guaranteed resolution time unless expressly stated as a service level.
21. Changes to the Services
ARYZ may update, improve, replace or discontinue features.
Where a change materially reduces the core paid functionality during a current billing period, ARYZ will provide reasonable notice where practicable and may offer an alternative, credit or right to cancel where appropriate.
ARYZ may make immediate changes to protect security, comply with law or respond to a third-party platform change.
22. Suspension
ARYZ may suspend access immediately where reasonably necessary because:
- fees are overdue;
- the Customer breaches these Terms;
- use creates a security, legal or operational risk;
- a connected platform requires action;
- activity appears fraudulent, abusive or unlawful;
- the Customer exceeds material usage limits; or
- suspension is required by law.
Where reasonable, ARYZ will explain the reason and provide an opportunity to remedy the issue. The Customer remains responsible for fees accruing during a suspension caused by its breach, except where ARYZ agrees otherwise.
23. Term and termination
23.1 Term
The contract starts when the Customer accepts an Order or first uses the Services and continues until all subscriptions and Orders end.
23.2 Termination for breach
Either party may terminate immediately by written notice if the other:
- commits a material breach that cannot be remedied;
- fails to remedy a remediable material breach within 14 days after notice;
- becomes insolvent or ceases business; or
- repeatedly breaches the contract in a way that reasonably undermines trust.
23.3 Effect of termination
On termination:
- the Customer’s right to use the Services ends;
- outstanding fees become due;
- connected publishing authority may be revoked;
- the Customer should export required data before access ends;
- ARYZ may delete Customer Content according to the Privacy Policy and Schedule 1; and
- clauses intended to survive will continue, including payment, confidentiality, intellectual property, liability and dispute provisions.
ARYZ may offer a limited post-termination export period but is not obliged to retain data indefinitely.
24. Warranties
ARYZ warrants that it will provide the Services with reasonable skill and care.
Except as expressly stated and to the fullest extent permitted by law, the Services are provided “as available” and ARYZ excludes implied warranties, conditions and representations, including as to:
- merchantability;
- fitness for a particular purpose;
- uninterrupted availability;
- compatibility with every system;
- accuracy or completeness of output;
- ranking, reach, engagement, leads or revenue; and
- continued availability of a third-party integration.
Nothing in these Terms excludes obligations that cannot lawfully be excluded.
25. No guarantee of marketing results
Marketing outcomes depend on many matters outside ARYZ’s control, including competition, budget, market demand, customer service, pricing, website quality, platform algorithms and the Customer’s actions. ARYZ does not guarantee:
- leads;
- sales;
- enquiries;
- engagement;
- search rankings;
- Google map positions;
- review scores;
- social reach;
- return on investment; or
- revenue attribution accuracy.
Reports may include estimates, inferred attribution or third-party data. ARYZ will aim to label estimates and data limitations.
26. Liability
26.1 Liability that is not excluded
Nothing in these Terms excludes or limits liability for:
- death or personal injury caused by negligence;
- fraud or fraudulent misrepresentation;
- deliberate default;
- breach of any liability that cannot legally be limited; or
- any other matter where exclusion is prohibited by law.
26.2 Excluded losses
Subject to section 26.1, ARYZ will not be liable for:
- loss of profit, revenue, business, contracts or anticipated savings;
- loss of goodwill or reputation;
- loss, corruption or unauthorised publication of data caused by the Customer, an Authorised User or a third-party platform;
- business interruption;
- wasted advertising expenditure;
- penalties or account restrictions imposed by a third-party platform;
- indirect or consequential loss; or
- losses that were not reasonably foreseeable when the contract was formed.
26.3 Liability cap
Subject to section 26.1, ARYZ’s total aggregate liability arising out of or relating to the contract in any rolling 12-month period will not exceed the total fees paid or payable by the Customer to ARYZ for the affected Services during the 12 months immediately before the event giving rise to the claim.
If the Customer has used a free Service only, ARYZ’s total aggregate liability is limited to £100.
26.4 Data protection
Liability relating to data protection is subject to applicable law and Schedule 1. Nothing in this section reduces a data subject’s statutory rights.
26.5 Reasonableness
The parties agree that the exclusions and limitations reflect the fees, allocation of risk, availability of insurance and Customer’s responsibility to review outputs and maintain backups.
27. Customer indemnity
The Customer will indemnify ARYZ against third-party claims, regulatory costs, damages and reasonable legal expenses arising from:
- unlawful Customer Content;
- infringement of third-party rights by Customer Content;
- unlawful marketing or outreach conducted by the Customer;
- the Customer’s breach of platform terms;
- the Customer’s misuse of personal data; or
- an instruction or publication action initiated by the Customer, except to the extent caused by ARYZ’s breach, negligence or wilful misconduct.
ARYZ must give reasonable notice of a claim and allow the Customer reasonable control of the defence, provided no settlement admits liability for ARYZ or imposes obligations on ARYZ without consent.
28. Third-party claims and takedowns
ARYZ may respond to credible notices concerning copyright, trade marks, privacy, defamation, impersonation or illegal content.
ARYZ may remove access to disputed content while investigating. The Customer must cooperate and provide evidence of rights where requested.
29. Export controls and sanctions
The Customer must not use the Services in breach of applicable export-control, trade-sanctions or anti-bribery laws.
The Customer confirms it is not prohibited from receiving the Services and will not make the Services available to a prohibited person or territory.
30. Publicity
ARYZ will not use the Customer’s name or logo as a public customer endorsement without permission.
The Customer may identify itself as an ARYZ customer while the subscription is active, provided it does not imply partnership, certification or endorsement.
31. Notices
Legal notices to ARYZ must be sent to hello@aryz.co.uk and to the registered office above.
Notices to the Customer may be sent to the account owner’s email address or displayed prominently in the Services. Routine product, billing and security messages are not formal legal notices unless stated.
32. Changes to these Terms
ARYZ may update these Terms.
Material changes will normally be notified at least 30 days before they take effect for an existing paid Customer. Changes required for law, security or third-party platform compliance may take effect sooner.
Continued use after the effective date constitutes acceptance. If the Customer does not accept a material change, it may cancel before the change takes effect.
33. General
- Force majeure — neither party is liable for delay or failure caused by events beyond reasonable control, excluding payment obligations.
- Assignment — the Customer may not assign the contract without ARYZ’s written consent. ARYZ may assign it to an affiliate or in connection with a merger, financing, sale or reorganisation, provided this does not materially reduce the Customer’s rights.
- Subcontracting — ARYZ may use subcontractors and remains responsible for its contractual obligations, subject to these Terms.
- No partnership — the contract does not create a partnership, franchise, employment, fiduciary or agency relationship.
- No third-party rights — a person who is not a party has no right to enforce the contract under the Contracts (Rights of Third Parties) Act 1999, except where expressly stated.
- Waiver — a delay or failure to enforce a right is not a waiver.
- Severability — if a provision is invalid or unenforceable, it will be modified to the minimum extent necessary or removed, and the remaining provisions will continue.
- Entire agreement — the contract is the entire agreement about the Services and replaces prior discussions or representations, except for fraud.
- Interpretation — headings do not affect interpretation. “Including” means “including without limitation”. References to writing include email.
34. Governing law and disputes
The contract and any non-contractual dispute are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.
Before issuing proceedings, each party should give written details of the dispute and allow at least 14 days for senior representatives to attempt resolution, unless urgent relief is required.
35. Contact
Questions about these Terms should be sent to:
- DR Rent Ltd trading as ARYZ
- Email: hello@aryz.co.uk
- Registered office: 1 Walpole Road, Slough, England, SL1 6AU
Schedule 1 — Data Processing Terms
1. Scope
This Schedule applies where ARYZ processes Customer Personal Data on behalf of the Customer. “Customer Personal Data” means personal data contained in Customer Content for which the Customer is controller and ARYZ is processor. The terms “controller”, “processor”, “personal data”, “processing”, “data subject” and “personal data breach” have the meanings given in applicable UK data-protection law.
2. Processing details
Subject matter: provision of the ARYZ Services, including hosting, storage, analysis, content generation, connected integrations, communications workflows, reporting, support, security and deletion.
Duration: for the term of the relevant Service and the deletion or return period after termination.
Nature and purposes: collection, recording, organisation, structuring, storage, retrieval, consultation, analysis, extraction, adaptation, generation, transmission, publishing at the Customer’s direction, restriction, deletion and other processing necessary to provide the Services.
Categories of data subjects may include:
- the Customer’s prospects, customers and contacts;
- social-media users, reviewers and message senders;
- employees, contractors, agents and Authorised Users;
- suppliers and business contacts;
- tenants, landlords, homeowners, contractors or other sector-specific contacts;
- website visitors and leads; and
- any other individual whose data the Customer lawfully submits.
Types of personal data may include:
- names and identifiers;
- business and contact details;
- social-media handles;
- messages, comments, reviews and communications;
- images, audio, video and screenshots;
- location and property-related information;
- marketing preferences and engagement history;
- lead and opportunity records;
- connected-platform identifiers and metrics;
- technical and audit information; and
- other data selected by the Customer.
The Services are not intended for routine special-category or criminal-offence data unless expressly agreed.
3. Customer instructions
ARYZ will process Customer Personal Data only:
- on the Customer’s documented instructions;
- as necessary to provide the Services;
- as described in the contract; or
- where required by UK law.
If law requires processing beyond the Customer’s instructions, ARYZ will inform the Customer before processing unless prohibited by law. ARYZ will notify the Customer if, in its reasonable opinion, an instruction infringes applicable data-protection law.
4. Customer obligations
The Customer warrants that:
- it has all required rights and lawful bases;
- its instructions are lawful;
- it has provided required privacy notices;
- it will not instruct ARYZ to process excessive or irrelevant data;
- it will not upload special-category or criminal-offence data without lawful grounds and appropriate safeguards;
- it will respond to data-subject requests and regulatory enquiries; and
- it will use appropriate account permissions and security settings.
5. Confidentiality
ARYZ will ensure that personnel authorised to process Customer Personal Data are bound by confidentiality obligations and receive appropriate data-protection and security guidance.
6. Security
ARYZ will maintain appropriate technical and organisational measures having regard to the nature, scope, context and purpose of processing and the risk to individuals. Measures may include:
- encryption in transit and at rest;
- logical workspace separation;
- role-based and least-privilege access;
- secure authentication;
- logging and monitoring;
- vulnerability and patch management;
- backups and recovery;
- incident management;
- confidentiality obligations;
- supplier assessment; and
- regular review of control effectiveness.
7. Subprocessors
The Customer gives general written authorisation for ARYZ to use subprocessors to provide the Services. ARYZ will:
- maintain a current subprocessor list at aryz.co.uk/subprocessors;
- impose data-protection obligations offering an equivalent level of protection;
- remain responsible for the subprocessor’s performance of those obligations; and
- provide reasonable advance notice of a material new subprocessor where practicable.
The Customer may object on reasonable data-protection grounds within 10 business days of notice. The parties will work in good faith on a solution. If no reasonable solution is available, ARYZ may permit termination of the affected Service.
8. International transfers
ARYZ will not transfer Customer Personal Data outside the United Kingdom except:
- on the Customer’s documented instructions; or
- using a lawful transfer mechanism and appropriate safeguards.
9. Data-subject rights
Taking into account the nature of processing, ARYZ will provide reasonable assistance to enable the Customer to respond to requests relating to access, correction, deletion, restriction, objection, portability and automated decision-making. If ARYZ receives a request directly relating to Customer Personal Data, it will normally refer the request to the Customer unless law requires otherwise.
10. Security incidents
ARYZ will notify the Customer without undue delay after becoming aware of a confirmed personal-data breach affecting Customer Personal Data. The notice will include available information reasonably needed by the Customer to meet its legal duties. Information may be provided in stages as the investigation progresses. Notification is not an admission of fault or liability.
11. Compliance assistance
Taking into account the nature of processing and information available, ARYZ will provide reasonable assistance with:
- security obligations;
- breach assessment and notification;
- data-protection impact assessments;
- prior consultation with a regulator; and
- demonstrating compliance with Article 28 requirements.
ARYZ may charge reasonable fees for assistance that is excessive, repeated or outside standard support, unless the request results from ARYZ’s breach.
12. Audits
ARYZ will make available information reasonably necessary to demonstrate compliance with this Schedule. The Customer may conduct an audit no more than once in any 12-month period, except following a material incident or regulator request, provided that:
- at least 30 days’ notice is given;
- the audit occurs during normal business hours;
- it does not disrupt operations;
- the auditor is independent and bound by confidentiality;
- it does not expose another customer’s data or ARYZ security secrets; and
- the Customer bears its own and ARYZ’s reasonable costs unless a material breach is found.
ARYZ may satisfy an audit request through current independent reports, certifications, questionnaires or summaries where reasonably sufficient.
13. Return and deletion
At the end of the Services, ARYZ will, at the Customer’s choice and subject to product functionality:
- permit export of available Customer Personal Data; and
- delete or return Customer Personal Data.
ARYZ may retain data where required by law or to establish, exercise or defend legal claims. Data remaining in backups will be protected, placed beyond ordinary use and deleted through the normal backup cycle.
14. Regulatory cooperation
Each party will cooperate reasonably with the Information Commissioner’s Office or another competent regulator in relation to processing under this Schedule.
15. Liability
Liability under this Schedule is subject to the liability provisions in the Terms, except to the extent a limitation is prohibited by applicable data-protection law.