Master Terms

Master Subscription Agreement & Data Processing Agreement

Part A — Master Subscription Agreement

1. Definitions & Interpretation

"Agreement" means the Order Form, this MSA, the DPA, and any schedules. "Services" means the Sonesse conversational AI demo agent platform and related services. "Customer Data" means data submitted by or for the Customer. "Output" means content generated by the AI in response to inputs. "Authorised Users" means the Customer's personnel permitted to use the Services. "Fees" means the charges in the Order Form. "Subscription Term" means the Initial Term and any renewal. "DPA" means the Sonesse Data Processing Agreement. "Third-Party Platforms" means Zoom, Microsoft Teams, Google Meet, and other services the Services integrate with. Headings are for convenience only.

2. Access & Licence

Sonesse grants the Customer a non-exclusive, non-transferable, non-sublicensable right for its Authorised Users to access and use the Services during the Subscription Term for its internal business purposes, subject to this Agreement. The Customer is responsible for its Authorised Users' compliance and for the security of their credentials.

The Customer agrees that its purchase is not contingent on the delivery of any future functionality or features, nor dependent on any oral or written comments made by Sonesse regarding future functionality, features, or roadmap. Sonesse may modify, add, or remove features of the Services from time to time provided it does not materially reduce the core functionality the Customer has subscribed to during the Subscription Term.

3. Service Levels & Support

Sonesse will use commercially reasonable efforts to make the Services available at least 99.5% of the time each calendar month, excluding: (a) scheduled maintenance notified in advance; (b) emergency maintenance; (c) Force Majeure; (d) failures of Third-Party Platforms or the Customer's own systems; and (e) suspension permitted under this Agreement. If uptime falls below the target, the Customer's sole remedy is a service credit against future Fees, calculated pro rata to the shortfall and capped at 10% of the monthly Fee, provided the Customer claims within 30 days. Support is provided by email during UK business hours with reasonable-efforts response targets.

4. Customer Obligations & Acceptable Use

The Customer shall not, and shall ensure its Authorised Users do not: (a) use the Services unlawfully or to store or transmit infringing, defamatory, or unlawful material; (b) transmit malware; (c) attempt to gain unauthorised access to, or disrupt, the Services; (d) conduct penetration testing, vulnerability scanning, or load testing without Sonesse's prior written consent; (e) reverse-engineer or copy the Services except as permitted by law; (f) resell or make the Services available to third parties except its Authorised Users; or (g) use the Services to develop a competing product. The Customer warrants it has all rights and consents required for its Customer Data and inputs.

5. Fees, Usage & Payment

The Customer shall pay the Fees in the Order Form. The Billing Frequency and Payment Method are as stated in the Order Form, and Fees are payable in advance for each billing period. Where the Order Form specifies card or auto-charge, the Customer authorises Sonesse (or its payment processor) to charge the Fees automatically on each renewal date; where the Order Form specifies invoicing, Fees are payable within the period stated on the Order Form. Unless stated otherwise, Fees are exclusive of VAT. Overdue sums accrue interest at 4% above the Bank of England base rate under the Late Payment of Commercial Debts (Interest) Act 1998. Fees are non-refundable except as expressly stated in the Order Form or this Agreement. Sonesse may increase Fees on renewal with at least 30 days' notice. The Customer is responsible for all taxes other than Sonesse's income tax.

Usage allowances & overages

The Fees entitle the Customer to the usage allowances (such as voice minutes, conversations, or messages) stated in the Order Form. Usage above an allowance is charged at the overage rate in the Order Form or, if none is stated, at Sonesse's then-current standard rate. Sonesse may report usage and invoice overages in arrears.

Fair use

Even where no numeric allowance applies, the Customer shall use the Services in a manner consistent with normal business use and shall not place unreasonable or disproportionate load on the Services or underlying providers. If the Customer's usage materially and persistently exceeds normal use or the allowances in the Order Form, Sonesse may, on notice, propose a plan or pricing adjustment and, failing agreement, apply overage charges or reasonably throttle usage.

6. Term & Renewal

The Agreement starts on the Subscription Start Date and continues for the Initial Term stated in the Order Form. It then renews automatically for successive periods equal to the Initial Term (or, if different, the renewal period stated in the Order Form), unless either party gives written notice of non-renewal. The notice period is as stated in the Order Form or, if none is stated, at least 30 days before the end of the then-current term.

Cancellation takes effect at the end of the then-current term, and the Customer retains access until then. Any refund rights are as stated in the Order Form; unless the Order Form states otherwise, Fees are non-refundable. The Customer may upgrade its plan or add subscriptions at any time; additional or upgraded subscriptions are charged at the rate in the applicable Order Form, prorated for the remainder of the current term, and co-terminate with the existing subscription. Downgrades take effect from the next renewal.

7. Suspension

Sonesse may suspend access, in whole or part, where: (a) it reasonably believes the Services are being used in breach of Clause 4; (b) there is a security risk to the Services or other customers; (c) required by law; or (d) Fees are more than 30 days overdue. Sonesse will give notice where practicable and restore access promptly once the cause is resolved. Suspension does not relieve the Customer of payment obligations.

8. Termination

Either party may terminate on written notice if the other: (a) commits a material breach not remedied within 30 days of notice; or (b) becomes insolvent, enters administration, or ceases to trade. Sonesse may terminate on notice if the Customer repeatedly breaches Clause 4. Termination does not affect accrued rights.

9. Effect of Termination & Data Handling

On expiry or termination: (a) all licences end and the Customer shall cease use of the Services; (b) accrued Fees fall immediately due; (c) on written request made within 30 days, Sonesse will make Customer Data available for export in a commonly used format; and (d) thereafter Sonesse will delete or anonymise Customer Data within 90 days, save where retention is required by law. If the Customer terminates for Sonesse's material breach under Clause 8, Sonesse will refund any prepaid Fees covering the period after the effective date of termination. Clauses that by their nature survive (including 5, 9, 11, 14–19, 24, 26) continue after termination.

10. Customer Data & Licence

The Customer retains all right, title, and interest in Customer Data. The Customer grants Sonesse a non-exclusive, royalty-free, worldwide licence to host, copy, process, transmit, and display Customer Data solely to provide, secure, and support the Services during the Subscription Term. The Customer is responsible for the accuracy and legality of Customer Data.

11. Data Protection & Security

Each party shall comply with Data Protection Laws (UK GDPR and the Data Protection Act 2018). Where Sonesse processes personal data on the Customer's behalf it acts as processor under the DPA, which is incorporated by reference and prevails over this MSA on data-protection matters. Sonesse will maintain appropriate technical and organisational measures to protect personal data, and will notify the Customer without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach affecting Customer Data. Current sub-processors (including ElevenLabs) are listed in the Privacy Policy; Sonesse will give notice of material changes and the Customer may reasonably object.

12. AI Services — Specific Terms

Nature of Output

The Services use generative and conversational AI. Output is produced probabilistically and may be inaccurate, incomplete, or unsuitable for a given purpose. Sonesse does not warrant that Output is accurate, and the Customer shall not rely on Output as professional, legal, financial, or other advice.

Human oversight

The Customer is responsible for reviewing Output before relying on or acting on it, and for configuring the demo content and knowledge sources the agent draws upon.

Ownership of Output

As between the parties, and to the extent permitted by law, the Customer owns the Output generated from its inputs, subject to Sonesse's and its licensors' rights in the underlying models and Services.

Model training

Sonesse will not use the Customer's Customer Data or Authorised User conversation content to train foundation models without the Customer's prior written consent. Sonesse may use aggregated, de-identified operational data to maintain and improve the Services.

Acceptable AI use

The Customer shall not use the Services to generate unlawful, harmful, deceptive, or infringing content, or in any way that would breach the acceptable-use policies of the underlying model providers.

13. Third-Party Platforms

The Services integrate with Third-Party Platforms (such as Zoom, Microsoft Teams, and Google Meet) and depend on third-party providers (such as ElevenLabs). Those platforms are outside Sonesse's control and are governed by their own terms. Sonesse is not liable for the acts, omissions, availability, or changes of Third-Party Platforms, and any resulting unavailability is excluded from the service-level calculation in Clause 3. If a Third-Party Platform materially changes or withdraws access, Sonesse will use reasonable efforts to provide a comparable alternative but does not guarantee continuity.

14. Confidentiality

Each party shall keep confidential the other's non-public information and use it only to perform this Agreement, protecting it with at least reasonable care. This does not apply to information that is or becomes public without breach, is independently developed, is lawfully received from a third party, or is required to be disclosed by law or regulator (with notice where lawful). This clause survives termination for three years, and indefinitely for trade secrets.

15. Intellectual Property

Sonesse and its licensors retain all intellectual property rights in the Services, underlying models, and all improvements. No rights are granted except the limited licence in Clause 2. Nothing transfers ownership of the Services to the Customer.

16. Feedback

If the Customer provides suggestions or feedback about the Services, Sonesse may use it without restriction or obligation, and the Customer grants Sonesse a perpetual, irrevocable, royalty-free licence to exploit it. No feedback discloses the Customer's Confidential Information unless expressly agreed.

17. Warranties

Each party warrants that it has authority to enter into this Agreement and will comply with applicable laws, including anti-bribery and anti-corruption laws (including the Bribery Act 2010). Sonesse warrants that it will provide the Services with reasonable skill and care, and that during the Subscription Term it will not materially decrease the overall security or core functionality of the Services. Except as expressly stated, the Services and Output are provided "as is", and all other warranties, whether express or implied (including satisfactory quality, fitness for purpose, and non-infringement), are excluded to the fullest extent permitted by law.

18. IP Indemnity

Sonesse will defend the Customer against third-party claims that the Services, as provided and used in accordance with this Agreement, infringe UK intellectual property rights, and will pay damages finally awarded, provided the Customer promptly notifies Sonesse, gives sole control of the defence and settlement, and reasonable assistance. If the Services are or may be found to infringe, Sonesse may at its option: (a) procure the right to continue use; (b) modify or replace the Services to be non-infringing; or (c) terminate the affected Services and refund pre-paid, unused Fees. This indemnity does not apply to, and expressly excludes, claims arising from: (i) the output, models, or technology of third-party providers (including the underlying AI language and voice models); (ii) Customer Data or inputs; (iii) modifications not made by Sonesse; or (iv) use in breach of this Agreement. In respect of third-party model or voice technology, Sonesse will pass through to the Customer the benefit of any indemnity it receives from the relevant provider, to the extent it is permitted and able to do so. This is the Customer's sole remedy for IP infringement.

18A. Customer Indemnity

The Customer shall defend, indemnify, and hold harmless Sonesse against all claims, damages, losses, and reasonable costs (including legal fees) arising from a third-party claim relating to: (a) the Customer Data, inputs, or any content the Customer or its Authorised Users load into, configure in, or generate through the Services (including any demo agent knowledge base); (b) content submitted by the Customer's prospects or end-users via a Sonesse demo agent; or (c) the Customer's use of the Services in breach of this Agreement or applicable law. Sonesse will promptly notify the Customer of any such claim, give the Customer control of the defence (subject to Sonesse's right to participate with its own counsel), and provide reasonable assistance at the Customer's expense.

19. Liability

Uncapped

Nothing excludes or limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any liability that cannot lawfully be limited.

Excluded losses

Subject to the above, neither party is liable for loss of profit, revenue, business, goodwill, anticipated savings, or for any indirect or consequential loss.

General cap

Subject to the above, each party's total aggregate liability arising out of or in connection with this Agreement is limited to the total Fees paid or payable by the Customer in the 12 months preceding the event giving rise to the claim.

Enhanced cap

The parties' respective liability for breach of Data Protection Laws or of Clause 14 (Confidentiality), and Sonesse's liability under Clause 18 (IP Indemnity), is capped at 150% of the annual Fees, and does not count toward the general cap.

20. Insurance

Sonesse shall, from the start of the Subscription Term, maintain with reputable insurers appropriate levels of professional indemnity and cyber liability insurance for a business of its size, and shall provide evidence on reasonable written request.

21. Force Majeure

Neither party is liable for failure or delay caused by events beyond its reasonable control, provided it notifies the other and takes reasonable steps to mitigate. If the event continues for more than 60 days, either party may terminate the affected Services on notice.

22. Publicity

Sonesse may identify the Customer as a customer and use its name and logo on its website and marketing materials, subject to the Customer's brand guidelines and the right to withdraw consent on reasonable notice. Any other public statement requires prior written approval.

23. Notices

Notices must be in writing and sent to the registered address or to the email address of the parties' nominated contacts. Notices are deemed received: if by email, on transmission during business hours (otherwise the next business day); if by post, two business days after posting. Notices of termination or breach must also be sent by post or recorded delivery.

24. Governing Law & Jurisdiction

This Agreement and any dispute or claim arising out of it (including non-contractual disputes) are governed by the laws of England and Wales. The parties submit to the exclusive jurisdiction of the courts of England and Wales. Before commencing proceedings, the parties shall use good-faith efforts to resolve any dispute through escalation to senior representatives.

25. General

Order of precedence

In case of conflict, the order is: (1) the DPA (data-processing matters only); (2) the Order Form; (3) this MSA; (4) any schedule or policy referenced. The Order Form governs the commercial terms of the subscription (including plan, fees, billing frequency, payment method, term, renewal, notice periods, usage allowances, and overages); where this MSA and the Order Form differ on any of these, the Order Form prevails.

Entire agreement

This Agreement is the entire agreement and supersedes all prior discussions. Each party confirms it has not relied on any statement not set out in this Agreement, but nothing limits liability for fraud.

Variation

Sonesse may update these terms from time to time. For material changes, Sonesse will give the Customer at least 30 days' notice (by email or via the Services), and the updated terms take effect at the Customer's next renewal. If the Customer does not agree to a material change, it may cancel with effect from the end of the then-current billing period by notice given before the change takes effect. Non-material updates (including operational policies referenced by URL) may be made on reasonable notice. Any Customer-specific variation to the Order Form requires written agreement by both parties.

Assignment & subcontracting

Neither party may assign or transfer this Agreement without the other's prior written consent, not to be unreasonably withheld, except that Sonesse may assign to a successor in connection with a merger, reorganisation, or sale of assets. Sonesse may subcontract provided it remains responsible for its subcontractors.

Waiver & severance

No failure to enforce is a waiver. If any provision is held invalid, it is severed and the remainder continues in force.

Non-solicitation

During the term and for 6 months after, neither party will knowingly solicit for employment the other's personnel directly involved in the Services, save through general advertising.

Relationship

The parties are independent contractors; nothing creates a partnership, agency, or employment relationship.

Third-party rights

A person who is not a party has no rights under the Contracts (Rights of Third Parties) Act 1999.

Counterparts

This Agreement may be executed in counterparts, including by electronic signature, each of which is an original and together one instrument.

26. Trials & Beta Services

Free trials and proofs of concept

Where Sonesse makes the Services, or a build of the Services (including a free demo agent build), available on a trial, pilot, or proof-of-concept basis, it is provided free of charge for the period stated or, if none, until Sonesse ends it on notice. Trial access may be modified, suspended, or withdrawn by Sonesse at any time. Any configuration or demo build created during a trial is provided to enable evaluation only; the underlying Services, models, and tooling remain Sonesse's property under Clause 15. Clauses 10, 11, 14, and 19 apply to trials; the service levels in Clause 3 do not.

Beta and early-access features

Sonesse may designate certain features as beta, preview, early-access, or "coming soon". Such features are provided "as is" and "as available", are excluded from the service-level commitment in Clause 3 and from the warranties in Clause 17, may be changed or withdrawn at any time, and may not have reached production quality. The Customer uses beta features at its own risk and should not rely on them for production purposes.

Part B — Data Processing Agreement

Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of, and is incorporated into, the Master Subscription Agreement between Sonesse Ltd ("Sonesse", "Processor") and the Customer ("Controller"). It governs the Processing of Personal Data by Sonesse on the Customer's behalf. UK GDPR · Article 28 + annexes.

1. Definitions

"Data Protection Laws" means the UK GDPR, the Data Protection Act 2018, and all applicable data-protection laws. "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing", and "Sub-processor" have the meanings given in the UK GDPR. Terms not defined here have the meaning in the Agreement.

2. Roles & Scope

For the Personal Data processed under the Agreement, the Customer is the Controller and Sonesse is the Processor. Sonesse shall process Personal Data only for the purpose of providing the Services and as set out in Annex 1. Where either party independently determines the purposes and means of processing, it acts as an independent Controller for that processing.

3. Processor Obligations

• Instructions. Process Personal Data only on the Customer's documented instructions, unless required by law (in which case Sonesse will inform the Customer unless legally prohibited).
• Confidentiality. Ensure that persons authorised to process Personal Data are bound by confidentiality obligations.
• Security. Implement and maintain the technical and organisational measures set out in Annex 2, appropriate to the risk, in accordance with Article 32 UK GDPR.
• Sub-processors. Comply with Clause 4 in respect of engaging Sub-processors.
• Data Subject rights. Taking into account the nature of Processing, assist the Customer by appropriate measures, insofar as possible, to respond to requests to exercise Data Subject rights under Chapter III UK GDPR.
• Assistance. Assist the Customer in ensuring compliance with Articles 32 to 36 UK GDPR (security, breach notification, impact assessments, prior consultation), taking into account the nature of Processing and information available to Sonesse.
• Deletion or return. At the Customer's choice, delete or return all Personal Data at the end of the provision of the Services, and delete existing copies unless retention is required by law.
• Records & audits. Make available information reasonably necessary to demonstrate compliance with Article 28 UK GDPR and allow for and contribute to audits under Clause 7.

4. Sub-processors

The Customer provides general authorisation for Sonesse to engage the Sub-processors listed in Annex 3. Sonesse shall give prior notice of the addition or replacement of any Sub-processor, giving the Customer a reasonable opportunity to object on reasonable data-protection grounds; if unresolved, the Customer may terminate the affected Services. Sonesse shall impose on each Sub-processor, by written contract, data-protection obligations no less protective than those in this DPA, and remains fully liable for each Sub-processor's performance.

5. International Transfers

Sonesse shall not transfer Personal Data outside the United Kingdom unless the transfer is lawful under Data Protection Laws. Where transferred to a country without UK adequacy status, the transfer shall be governed by the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses with the UK Addendum, or another lawful mechanism. Current transfers include Processing by Sub-processors located in the United States, as identified in Annex 3.

6. Personal Data Breach

Sonesse shall notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting the Customer's Personal Data. The notification shall describe, to the extent known, the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed. Sonesse shall take reasonable steps to mitigate and remediate the breach and cooperate with the Customer regarding any notification to the ICO or affected Data Subjects.

7. Audit

Sonesse shall make available information necessary to demonstrate compliance with this DPA and shall allow for audits, including inspections, by the Customer or its mandated auditor, on at least 30 days' written notice, no more than once in any 12-month period (unless required by a supervisory authority or following a Personal Data Breach), during business hours, and without disrupting operations. Sonesse may satisfy audit requests by providing current certifications, third-party audit reports, or completed security questionnaires where these reasonably address the request.

8. Liability

Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Agreement, including the enhanced cap applicable to breaches of Data Protection Laws.

9. Term & Termination

This DPA takes effect on the same date as the Agreement and continues for as long as Sonesse processes Personal Data on the Customer's behalf. Termination of the Agreement automatically terminates this DPA, subject to the survival of obligations relating to deletion, return, and confidentiality of Personal Data.

10. Governing Law

This DPA is governed by the laws of England and Wales, and the parties submit to the exclusive jurisdiction of its courts. In the event of conflict between this DPA and the Agreement on matters of data protection, this DPA prevails.

Annex 1 — Details of Processing

Annex 2 — Technical & Organisational Measures

Sonesse maintains measures appropriate to the risk, including:

• Access control — role-based access, least-privilege principles, and unique credentials for personnel.
• Encryption — encryption of Personal Data in transit (TLS) and at rest.
• Authentication — enforced strong passwords and multi-factor authentication for administrative access.
• Network security — firewalls, segregation, and monitoring of the hosting environment.
• Resilience — regular backups and measures to restore availability after an incident.
• Confidentiality — confidentiality undertakings and data-protection training for personnel.
• Vendor management — assessment of Sub-processors and contractual data-protection controls.
• Incident response — documented procedures for detecting, reporting, and responding to Personal Data Breaches.
• Testing — periodic review and testing of the effectiveness of security measures.

Annex 3 — Approved Sub-processors

The following sub-processors process personal data to provide the Services. Sonesse maintains the current list and notifies the Customer of changes under Clause 4.

Sonesse will keep this list current and notify the Customer of changes in accordance with Clause 4. Only those sub-processors that process personal data are listed; providers that do not process personal data are excluded.

Upstream providers. Sonesse's sub-processors engage their own sub-processors ("upstream providers") to deliver their services. These are not engaged by Sonesse directly and are disclosed in each provider's own published sub-processor list, including Anthropic (anthropic.com), ElevenLabs (elevenlabs.io), and, where used, Sonesse's hosting provider. Sonesse does not independently control these upstream providers; they are governed by the data-protection terms between Sonesse's sub-processors and their own vendors.