Service Terms

1Definitions#

2The Services#

2.1OxyScale will provide the Services described in the Order Form with due care and skill, and substantially in accordance with the description in the Order Form.

2.2The Services are a managed service. OxyScale builds, hosts, operates, maintains and supports everything: the Customer has nothing to install, host or maintain.

2.4Data refreshes run at the frequency set out in the Order Form. Refresh frequency depends on what each Source System supports; where a Source System limits or interrupts access, refreshes from that system may be delayed until access is restored.

2.5OxyScale may improve, update and evolve the Services over time, including changing the technology, infrastructure and providers used to deliver them, provided the changes do not materially reduce the functionality, security or data protection of the Services.

2.6Support is included. OxyScale will respond to support requests promptly: same business day for anything critical (the platform unavailable or materially incorrect numbers), and within two business days otherwise. OxyScale targets 99.5% monthly availability for the platform. This is a target, not a guarantee, and scheduled maintenance and matters outside OxyScale's reasonable control are excluded.

2.7Connecting to Source Systems. OxyScale connects to Source Systems through whatever interfaces they make available, including APIs, database access, exports and files, and will use all reasonable endeavours to connect to each Source System listed in the Order Form. What can be drawn from a Source System, and how often, depends on what that system exposes: some systems expose all of their data, some expose part of it, and a small number expose none. If a Source System will not support a connection, or exposes materially less data than expected, OxyScale will tell the Customer promptly and the parties will agree the best available approach (for example a scheduled export, an alternative data path, or excluding that system with a fair adjustment to scope or fees if the exclusion is material). OxyScale is not responsible where a Source System provider restricts, changes or withdraws access, but will use reasonable endeavours to restore or replace the connection if that happens.

3Ask Oxy, reports and additional services#

3.1Ask Oxy is included, with the monthly question allowance set out in the Order Form. Use is subject to fair use: if usage consistently and materially exceeds the allowance, OxyScale will discuss and agree an increased allowance with the Customer. OxyScale will never charge for additional Ask Oxy usage without agreeing it with the Customer first. Ask Oxy is designed for interactive use by people; automated or scripted querying is not permitted.

3.2Ask Oxy and the monthly report use artificial intelligence to generate answers and narrative from the Customer's own data. Outputs are generated automatically and should be treated as a starting point, not a substitute for the Customer's own judgment (see clause 8).

3.3Additional Dashboards and user logins may be added at the rates in the Order Form, charged from the next billing date.

3.4Any other services (for example custom automations) may be agreed in a further Order Form signed by both parties, which forms part of this Agreement.

4Fees and payment#

4.1The Customer must pay the fees set out in the Order Form, monthly in advance, on each billing date. All fees are exclusive of GST, which is payable in addition. Each payment is a taxable supply for which OxyScale will issue a tax invoice.

4.2Where the Customer pays by direct debit, the Customer authorises OxyScale (via its payment provider) to debit the fees on each billing date. Where the Customer pays by invoice, invoices issue 7 days before the billing date and are payable on the billing date.

4.3OxyScale may increase the monthly fee once per year, by no more than the annual increase in the Consumer Price Index (All Groups, weighted average of eight capital cities), on 60 days' written notice. Any other fee change is a material change under clause 13.2.

4.4If any amount remains unpaid 14 days after it is due, OxyScale may (after written notice) suspend the Services until payment is made, and may charge interest on the overdue amount at the RBA cash rate plus 3% per annum.

5Customer responsibilities#

5.1The Customer must:

1. (a)provide the access, credentials, information and cooperation reasonably needed to build and run the Services, including the dependencies in the Order Form;
2. (b)ensure it is entitled to give OxyScale access to the Source Systems and the data in them, and that doing so does not breach any agreement with a Source System provider or any law;
3. (c)keep its login credentials secure, ensure logins are used only by the individuals they are issued to, and tell OxyScale promptly of any unauthorised access; and
4. (d)use the Services only for its own internal business purposes and lawfully.

5.2The Customer must not (and must not permit anyone else to) copy, reverse engineer, resell, or make the Services available to any third party, or use the Services to build a competing product.

5.3The Customer's Source Systems remain the Customer's systems of record. OxyScale does not control them and is not responsible for the accuracy or completeness of data as it exists in, or originates from, them.

6Customer Data: yours, always#

6.1The Customer owns Customer Data. The Customer grants OxyScale a licence to host, copy, process, transform and display Customer Data solely to provide the Services, improve the accuracy of the Services for the Customer, and comply with law. OxyScale claims no other rights in Customer Data.

6.2The Customer may request an export of its Customer Data in clean, standard formats (such as CSV) at any time during the Agreement, and OxyScale will provide it within a reasonable time at no charge.

6.3On cancellation:

1. (a)within 30 days of the end of the last paid period, OxyScale will provide a full export of Customer Data in clean, standard formats, delivered by secure link;
2. (b)OxyScale retains a copy for a further 60 days, in case anything further is needed or the Customer returns; and
3. (c)90 days after the end of the last paid period, OxyScale permanently destroys the Customer Data it holds (except where law requires retention) and will confirm destruction in writing.

6.4The Warehouse and the Platform are hosted and operated in OxyScale's own cloud environment as part of the managed service. The export under this clause is of the Customer Data; the infrastructure, pipelines and Platform are not transferred.

7Privacy and security#

7.1Each party must comply with the Privacy Act 1988 (Cth), including the Australian Privacy Principles, in connection with this Agreement.

7.2OxyScale will:

1. (a)use Personal Information only to provide the Services;
2. (b)hold Customer Data encrypted in transit and at rest, in a private per-customer database, in the Australia East (New South Wales) cloud region;
3. (c)restrict access on a least-privilege basis, log access, and maintain geo-redundant backups;
4. (d)apply data minimisation: the Services are designed so that sensitive personal fields not needed for any metric (such as candidate contact details, dates of birth, and bank or tax identifiers) are not loaded into the Warehouse; and
5. (e)not disclose Personal Information to anyone except the subprocessors in Schedule 1, its professional advisers, or as required by law.

7.3AI processing is designed to be free of Personal Information. The data layer that AI features (including Ask Oxy and report narratives) read from is constructed and tested to exclude Personal Information, so what is sent for AI processing is business metrics and schema, not personal records.

7.4The Customer is responsible for having made the notifications and obtained the consents required under the Privacy Act for the personal information in its Source Systems, including for its disclosure to OxyScale for analytics and reporting.

7.5The Customer should not provide sensitive information (as defined in the Privacy Act) to OxyScale outside the ordinary operation of the Source Systems, except by agreement.

7.6If OxyScale becomes aware of a data breach involving Customer Data that is likely to result in serious harm, OxyScale will notify the Customer without undue delay, take reasonable steps to contain and investigate it, keep the Customer informed, and cooperate on any notifications required under the Notifiable Data Breaches scheme. Where a regulatory notification concerns the Customer's data, the parties will agree its content before it is made, acting reasonably and promptly.

7.7OxyScale uses the subprocessors listed in Schedule 1. OxyScale may change a subprocessor that handles Personal Information on 30 days' written notice; if the Customer reasonably objects on data protection grounds and the parties cannot resolve the objection, the Customer may cancel under clause 10 without penalty. OxyScale may change providers that do not handle Personal Information without notice, subject always to clause 2.5.

7.8OxyScale maintains a written security and data-handling policy and will provide a summary of its security practices, and certificates of currency for its insurance, on reasonable request.

8Nature of the Services#

8.1The Services provide reporting, analysis and decision support drawn from the Customer's own data. They are a tool to inform the Customer's decisions, not a substitute for them.

8.2The Customer acknowledges that:

1. (a)the accuracy and completeness of the Services depend on the accuracy, completeness and availability of data in the Source Systems. If data is missing, wrong or late in a Source System, it will be missing, wrong or late in the Services;
2. (b)any alerts, flags or checks (including any relating to compliance, expiry dates or outstanding actions) can only surface what the underlying data supports. They assist the Customer's own processes; they do not replace them, and OxyScale does not warrant that every relevant matter will be detected or surfaced;
3. (c)outputs generated by AI features should be reviewed before being relied on or used; and
4. (d)the Customer remains solely responsible for its own business decisions and for complying with its own legal, regulatory, employment, tax and contractual obligations. The Services do not constitute legal, financial, accounting or compliance advice.

8.3OxyScale is not responsible for the availability, performance, security or conduct of any Source System or other third-party platform, which remain governed by the Customer's own arrangements with those providers.

8.4Except as expressly set out in this Agreement, and to the maximum extent permitted by law, all other conditions, warranties and guarantees are excluded. Nothing in this Agreement excludes, restricts or modifies any consumer guarantee or other right under the Australian Consumer Law that cannot lawfully be excluded.

9Intellectual property#

9.1OxyScale owns the Platform, and everything OxyScale creates in delivering the Services other than Customer Data, including data models, pipeline logic, dashboard designs and configurations. The Customer receives a non-exclusive, non-transferable licence to use the Platform, for its own internal business purposes, for the duration of the Agreement.

9.2Nothing in this Agreement transfers any intellectual property in Customer Data to OxyScale, or any intellectual property in the Platform to the Customer.

9.3The Customer warrants that the Customer Data and materials it provides, and OxyScale's use of them as contemplated by this Agreement, will not infringe any third party's rights, and indemnifies OxyScale against loss arising from a breach of this warranty.

9.4OxyScale will defend the Customer against any third-party claim that the Customer's use of the Platform in accordance with this Agreement infringes that third party's intellectual property rights, and will pay any resulting damages finally awarded or agreed in settlement, provided the Customer notifies OxyScale promptly, gives OxyScale control of the defence, and provides reasonable assistance. If such a claim arises, OxyScale may modify or replace the affected part of the Platform or, if that is not reasonably practicable, cancel the Agreement and refund any fees paid for the period after cancellation.

9.5OxyScale may identify the Customer by name and logo as a customer. Any case study or description of results requires the Customer's prior consent. Either side may withdraw consent at any time.

10Cancellation#

10.1Either party may cancel this Agreement at any time by written notice. Cancellation takes effect at the end of the month already paid for. Fees paid are not refunded and are not pro-rated.

10.2Either party may cancel immediately by written notice if the other:

1. (a)materially breaches this Agreement and does not remedy the breach within 14 days of written notice;
2. (b)becomes insolvent, enters administration or liquidation, or ceases to carry on business; or
3. (c)in the case of cancellation by OxyScale, fails to pay any undisputed amount within 14 days of a written reminder.

10.3On cancellation, the Customer's access ceases at the effective date, any unpaid amounts for the period up to that date become payable, and clause 6.3 (data export and destruction) applies.

10.4Clauses 6, 7, 8, 9, 11, 12 and 14, and any other clause which by its nature should survive, survive cancellation.

11Confidentiality#

11.1Each party must keep confidential all non-public information received from the other in connection with this Agreement, use it only for the purposes of this Agreement, and not disclose it except to its personnel and advisers who need it (and who are bound to keep it confidential), or as required by law.

11.2This clause does not apply to information that is or becomes public other than through a breach, was already lawfully known, or is independently developed.

12Liability#

12.1To the maximum extent permitted by law, neither party is liable to the other for loss of profits, loss of revenue, loss of business or anticipated savings, loss of goodwill, or any indirect or consequential loss, however arising.

12.2To the maximum extent permitted by law, OxyScale's total aggregate liability arising out of or in connection with this Agreement, however arising, is limited to the fees paid by the Customer in the 12 months before the event giving rise to the claim.

12.3Nothing in this Agreement limits or excludes liability for death or personal injury caused by negligence, for fraud, or any liability that cannot be limited or excluded by law. Where liability under a non-excludable consumer guarantee can be limited, OxyScale's liability is limited (at OxyScale's option) to resupplying the relevant services or paying the cost of resupply.

12.4Each party's liability is reduced to the extent the loss was caused or contributed to by the other party.

12.5Neither party is liable for delay or failure to perform (other than payment obligations) caused by events beyond its reasonable control, including outages of third-party platforms, provided it takes reasonable steps to mitigate and resume performance.

13Changes to these terms#

13.1OxyScale may make minor changes to these terms (clarifications, or changes that do not disadvantage the Customer) by written notice.

13.2For any material change, OxyScale will give at least 30 days' written notice. If the Customer does not accept a material change, it may cancel before the change takes effect, with effect from the end of the period already paid for, and the change will not apply to it before then.

14General#

14.1Notices. Notices must be in writing and are validly given by email to the contact email in the Order Form (for the Customer) or jordan@oxyscale.ai (for OxyScale). A notice sent by email is taken to be received when sent, unless the sender receives an automated non-delivery message.

14.2Assignment. Neither party may assign this Agreement without the other's consent (not to be unreasonably withheld), except that OxyScale may assign it to a related body corporate or as part of a sale of its business, on notice.

14.3Relationship. The parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, employment or agency relationship.

14.4Entire agreement. This Agreement is the entire agreement between the parties about its subject matter and supersedes all prior discussions and documents, including any proposal.

14.5Waiver and severance. A right is only waived in writing. If any provision is unenforceable it is severed to the extent necessary, and the rest of the Agreement remains in force.

14.6Insurance. OxyScale maintains professional indemnity insurance and cyber liability insurance during the term of this Agreement.

14.7Disputes. Before starting proceedings (except for urgent relief or debt recovery), the parties must first attempt to resolve any dispute through good-faith discussion between senior representatives for at least 20 business days after one party notifies the other of the dispute.

14.8Governing law. This Agreement is governed by the law of Victoria, Australia, and the parties submit to the non-exclusive jurisdiction of its courts.

Schedule 1: Security and Subprocessors

Where the Customer's data lives

Customer Data is held in a private database provisioned for the Customer alone, with its own credentials, in Microsoft Azure's Australia East region (New South Wales). It is encrypted in transit and at rest, protected by network-level restrictions, and backed by geo-redundant backups with point-in-time restore. No customer's data is ever held in a shared table with another customer's.

Access controls

• Separate credentials per customer; a credential for one customer's database cannot access any other customer's data.
• Least-privilege by design: the application layer and Ask Oxy have read-only access to the reporting layer only, and cannot write to or read raw data.
• Secrets are held in a managed vault with per-secret access controls; all secret access is logged.
• Staff access to customer environments is logged and time-boxed.
• Multi-factor authentication is available and can be enforced across the Customer's users on request.

AI processing

The data layer that AI features read from is constructed and tested to exclude Personal Information. What is sent for AI processing is aggregated business metrics and database schema: not candidate or employee personal records, and never credentials. Customer Data is not used to train AI models. For customers with specific data-residency requirements, in-region AI processing (Sydney) is available on request.

Subprocessors

Provider certifications: Microsoft Azure holds ISO 27001, ISO 27017, ISO 27018, SOC 1/2/3 and IRAP assessment; Clerk holds SOC 2 Type II; Anthropic holds SOC 2 Type II and ISO 27001. Certification details are the relevant provider's and are current as at the version date of these terms. Changes to this list are handled under clause 7.7 of the terms.