Terms of Service

hr goat Master Subscription, Services and Data Processing Agreement · hrgoat.ai

hr goat Master Subscription, Services and Data Processing Agreement

Version 2026-10-16. Effective 1 October 2026. This version replaces every earlier version.

This is one agreement between Kepler Experience Limited (company number 13618974), trading as hr goat, and the business customer identified in the applicable Workspace, subscription or Order Form.

It has a main body, in Parts A to O, and five Schedules. All of them bind you.

You accept all of it by ticking the acceptance box at sign-up, or by using the Service. Nothing has to be signed and returned, including Schedule 2. A countersigned copy is available on request for Enterprise customers.

The Privacy Policy explains what we do with personal data in our own right. The Sub-processor List is published separately and mirrors Schedule 4.

Prices are not restated here. The current prices for every plan and currency are published on the pricing page at hrgoat.ai/pricing, and all prices exclude VAT and local sales tax.

PART A: PARTIES, SCOPE AND INTERPRETATION

1. PARTIES

1.1. Kepler

1.1.1. This Agreement is entered into between:

1.1.1.1. Kepler Experience Limited, a company incorporated in England and Wales under company number 13618974, whose registered office is at 80-83 Long Lane, London EC1A 9ET, United Kingdom, trading as hr goat; and

1.1.1.2. the business customer identified in the applicable Workspace, subscription or Order Form.

1.1.2. In this Agreement, Kepler Experience Limited is referred to as:

1.1.2.1. “Kepler”;

1.1.2.2. “hr goat”;

1.1.2.3. “we”, “us” or “our”; or

1.1.2.4. the “Service Provider”.

1.2. Customer

1.2.1. The business or organisation that creates a Workspace, purchases a subscription, accepts an Order Form or uses the Service is referred to as:

1.2.1.1. the “Customer”;

1.2.1.2. “you”; or

1.2.1.3. “your”.

1.2.2. Where the context requires, references to the Customer include its Users.

1.3. Contracting entity

1.3.1. Kepler Experience Limited is the contracting entity for the Service in all territories unless an Order Form expressly states otherwise.

1.3.2. Kepler Experience (Pty) Ltd, a wholly owned South African subsidiary, may provide engineering, product and support services to Kepler.

1.3.3. Kepler Experience (Pty) Ltd is not a party to this Agreement and does not contract directly with the Customer unless an Order Form expressly provides otherwise.

2. BUSINESS USE ONLY

2.1. Business customers

2.1.1. The Service is offered only for business, professional, organisational and institutional use.

2.1.2. The Service is not offered to consumers acting wholly or mainly outside their trade, business, craft or profession.

2.2. Customer confirmation

By accepting this Agreement, the Customer confirms that:

2.2.1. it is obtaining the Service for business purposes;

2.2.2. the person accepting this Agreement is at least 18 years old;

2.2.3. the person accepting this Agreement has authority to bind the Customer; and

2.2.4. the information provided about the Customer is accurate and complete.

2.3. Mandatory rights

Nothing in this Agreement excludes or limits a right or remedy that cannot lawfully be excluded or limited.

2.4. Mobile Apps and Messaging Channels

2.4.1. A Mobile App and a Messaging Channel are provided for use by Users in the course of the Customer’s business.

2.4.2. Downloading a Mobile App does not create a contract between Kepler and the individual for the supply of the Service, which is supplied to the Customer under this Agreement.

2.4.3. A Mobile App and a Messaging Channel may only be used with an Account provisioned by a Customer.

3. CONTRACT FORMATION

3.1. Acceptance

The Customer accepts this Agreement when the Customer or an authorised representative:

3.1.1. creates a Workspace;

3.1.2. clicks an acceptance box;

3.1.3. selects or purchases a paid plan;

3.1.4. signs or accepts an Order Form;

3.1.5. accesses or uses the Service; or

3.1.6. permits a User to access the Service.

3.2. Effective Date

3.2.1. This Agreement starts on the earliest of the dates on which the Customer takes an action listed in clause 3.1.

3.2.2. That date is the “Effective Date”.

3.3. Electronic acceptance

3.3.1. The Customer agrees that electronic acceptance is legally binding.

3.3.2. No separate signature or acceptance is required for:

3.3.2.1. this Agreement;

3.3.2.2. Schedule 1;

3.3.2.3. Schedule 2; or

3.3.2.4. any annex to Schedule 2.

4. AGREEMENT STRUCTURE AND PRECEDENCE

4.1. Contractual documents

The Agreement consists of:

4.1.1. an applicable Order Form;

4.1.2. these main terms;

4.1.3. Schedule 1;

4.1.4. Schedule 2 and its annexes;

4.1.5. the current Sub-processor List;

4.1.6. the Privacy Policy;

4.1.7. the Cookie Policy; and

4.1.8. product-specific terms presented before the Customer enables a particular feature.

4.2. Order of precedence

4.2.1. If there is a conflict between the contractual documents, the following order applies:

4.2.1.1. Schedule 2, for data protection matters only;

4.2.1.2. an Order Form;

4.2.1.3. these main terms;

4.2.1.4. Schedule 1;

4.2.1.5. the other documents incorporated by reference; and

4.2.1.6. the Documentation.

4.2.2. An Order Form overrides this Agreement only to the extent that it expressly identifies the conflicting provision or commercial term.

5. DEFINITIONS

5.1. Defined terms

In this Agreement:

5.1.1. “Account” means an individual login through which a User accesses the Service.

5.1.2. “Admin” means a User with administrative rights over a Workspace.

5.1.3. “Affiliate” means an entity that directly or indirectly controls, is controlled by or is under common control with a party.

5.1.4. “AI Features” means any functionality using artificial intelligence or machine learning to generate, summarise, analyse, classify, score, recommend, answer or perform tasks.

5.1.5. “App Store” means a third-party platform through which a Mobile App is distributed, including the Apple App Store and Google Play.

5.1.6. “Applicable Law” means any law or regulatory requirement applicable to a party, the Service or the relevant processing activity.

5.1.7. “Billing Period” means the monthly or other recurring period for which Fees are charged in advance.

5.1.8. “Confidential Information” means non-public information disclosed by or on behalf of a party that is identified as confidential or ought reasonably to be understood as confidential.

5.1.9. “Credits” means the internal units used to measure an individual User’s use of chargeable AI Features.

5.1.10. “Customer Data” means all data, Personal Data, records, files, documents, prompts, messages and other content submitted to, stored in, transmitted through or generated for the Customer through the Service.

5.1.11. “Device” means a mobile telephone, tablet or similar device on which a Mobile App is installed or through which a Messaging Channel is used.

5.1.12. “Documentation” means the user guides, technical documents, help articles and in-product descriptions made available by Kepler.

5.1.13. “Enterprise Plan” means a subscription covering 500 or more people.

5.1.14. “Everybody Else” means a User who is not an Admin.

5.1.15. “Fees” means subscription charges, Credit top-up charges and any other amounts payable under this Agreement or an Order Form.

5.1.16. “Free Plan” means the no-charge plan described in clause 10.

5.1.17. “Messaging Channel” means a third-party messaging service through which a User may interact with the Service, including WhatsApp.

5.1.18. “Mobile App” means an hr goat application for iOS or Android distributed through an App Store.

5.1.19. “Order Form” means a written or electronic ordering document agreed by the parties.

5.1.20. “Paid Plan” means a self-serve paid subscription or Enterprise Plan.

5.1.21. “Service” means the hr goat cloud platform, including its web application, the Mobile Apps, Messaging Channels, APIs, modules, AI Features, Documentation and related services.

5.1.22. “Subscription Anniversary” means the recurring day of the month corresponding to the date on which the Customer first subscribed to a Paid Plan.

5.1.23. “Super Admin” means the Admin with ultimate control over the Workspace.

5.1.24. “User” means an individual authorised by the Customer to access the Service.

5.1.25. “User Terms” means the hr goat Mobile App Licence accepted by a User on first use of a Mobile App.

5.1.26. “Workspace” means the Customer-specific environment in which Customer Data and Accounts are maintained.

5.2. Interpretation

5.2.1. References to legislation include that legislation as amended, consolidated, extended or replaced.

5.2.2. “Including” and similar expressions do not limit the words preceding them.

5.2.3. References to writing include email and in-product communications where this Agreement permits them.

5.2.4. Clause headings are included for convenience and do not affect interpretation.

PART B: THE SERVICE

6. SERVICE DESCRIPTION

6.1. hr goat platform

6.1.1. hr goat is a cloud-based human resources and people-management platform.

6.1.2. Depending on the Service’s current functionality, it may support:

6.1.2.1. employee and contractor onboarding;

6.1.2.2. employee records and document management;

6.1.2.3. human resources workflows and reminders;

6.1.2.4. performance reviews and feedback;

6.1.2.5. skills, learning and development;

6.1.2.6. employee engagement and surveys;

6.1.2.7. leave, absence and attendance administration;

6.1.2.8. compliance and policy management;

6.1.2.9. payroll preparation or administration;

6.1.2.10. employee and manager self-service;

6.1.2.11. reporting and analytics;

6.1.2.12. AI-assisted summaries, recommendations, drafting and answers; and

6.1.2.13. related HR and people-management functions.

6.2. All features included

6.2.1. Every plan includes access to every generally available feature of the Service.

6.2.2. Kepler does not price or license the Service module by module.

6.2.3. Plan differences relate principally to:

6.2.3.1. the number and type of active Users;

6.2.3.2. Credit allowances;

6.2.3.3. support levels;

6.2.3.4. service levels; and

6.2.3.5. Enterprise-specific commitments agreed in an Order Form.

7. RIGHT TO USE THE SERVICE

7.1. Access right

7.1.1. Subject to this Agreement, Kepler grants the Customer a limited, non-exclusive, non-transferable and non-sublicensable right to permit authorised Users to access and use the Service.

7.1.2. The Customer may use the Service only:

7.1.2.1. for its internal business operations;

7.1.2.2. during the applicable subscription;

7.1.2.3. within applicable plan and usage limits; and

7.1.2.4. in accordance with this Agreement.

7.2. Reservation of rights

7.2.1. The Customer receives a right to access and use the Service.

7.2.2. No ownership in the Service, software or Kepler’s intellectual property is transferred to the Customer.

7.3. Mobile App licence

7.3.1. Kepler grants each User a limited, personal, non-exclusive, non-transferable and revocable licence to install and use a Mobile App on a Device the User owns or controls, solely to access the Customer’s Workspace.

7.3.2. That licence is granted on the User Terms and ends when the User’s Account is suspended or removed, or when this Agreement ends.

7.3.3. The Customer must ensure that its Users comply with the User Terms.

8. ACCOUNTS AND WORKSPACE CONTROL

8.1. Named Accounts

8.1.1. Each Account must belong to one named individual.

8.1.2. Accounts and credentials must not be shared.

8.1.3. Generic or role-based Accounts must not be used for individual Users unless Kepler expressly supports that Account type.

8.2. Customer responsibilities

The Customer is responsible for:

8.2.1. approving its Users;

8.2.2. assigning appropriate roles and permissions;

8.2.3. removing access promptly when it is no longer required;

8.2.4. keeping administrative and billing information accurate;

8.2.5. its Users’ conduct;

8.2.6. maintaining appropriate internal HR, privacy and security policies; and

8.2.7. all activity occurring through its Accounts, except to the extent caused by Kepler’s breach of this Agreement.

8.3. Security

The Customer and its Users must:

8.3.1. keep credentials confidential;

8.3.2. use strong and unique passwords;

8.3.3. enable multi-factor authentication for Admin Accounts where available;

8.3.4. prevent unauthorised access; and

8.3.5. notify Kepler promptly of suspected unauthorised access.

8.4. Workspace control

8.4.1. The Workspace belongs to and is controlled by the Customer organisation, not an individual User.

8.4.2. Subject to Applicable Law and the Customer’s policies, Admins may:

8.4.2.1. access Customer Data;

8.4.2.2. export, amend, restrict and delete Customer Data;

8.4.2.3. change User permissions;

8.4.2.4. add, suspend and remove Users;

8.4.2.5. configure retention periods;

8.4.2.6. enable or disable AI Features; and

8.4.2.7. review activity and audit information available in the Service.

8.5. Control disputes

8.5.1. If there is a dispute about control of a Workspace, Kepler may rely on:

8.5.1.1. the organisation identified in the Workspace;

8.5.1.2. verified domain ownership;

8.5.1.3. billing records;

8.5.1.4. the applicable Order Form; and

8.5.1.5. the Super Admin of record.

8.5.2. Kepler is not required to decide an internal employment, ownership, governance or management dispute.

8.5.3. Kepler may temporarily restrict administrative changes while a control dispute is being resolved.

9. SERVICE CHANGES AND BETA FEATURES

9.1. Service development

Kepler may develop, update or change the Service to:

9.1.1. improve functionality;

9.1.2. improve security;

9.1.3. comply with law;

9.1.4. address supplier or infrastructure changes;

9.1.5. address misuse; or

9.1.6. maintain technical performance.

9.2. Material reduction

9.2.1. Kepler will not materially reduce core paid functionality during a prepaid Billing Period without reasonable notice.

9.2.2. If Kepler permanently removes material paid functionality without providing a reasonably equivalent alternative, the Customer may:

9.2.2.1. cancel the affected Paid Plan before the change takes effect; and

9.2.2.2. receive a pro rata refund of unused prepaid recurring Fees attributable to the affected period.

9.3. Beta features

9.3.1. Kepler may offer beta, preview, pilot or experimental features.

9.3.2. Unless an Order Form says otherwise, beta features:

9.3.2.1. are optional;

9.3.2.2. may be incomplete or contain errors;

9.3.2.3. may be changed or withdrawn at any time;

9.3.2.4. are not subject to availability commitments; and

9.3.2.5. must not be used for critical decisions or critical business operations.

PART C: PLANS AND PRICING

10. FREE PLAN

10.1. Free Plan allowance

The Free Plan includes:

10.1.1. one Admin;

10.1.2. four Everybody Else Users;

10.1.3. five active seats in total;

10.1.4. every generally available feature;

10.1.5. no payment-card requirement; and

10.1.6. no time limit.

10.2. Not a trial

10.2.1. The Free Plan is a permanent no-charge plan, subject to this Agreement.

10.2.2. It is not a trial and must not be interpreted or described as a trial.

10.3. Exceeding Free Plan limits

10.3.1. A Workspace exceeds the Free Plan limit when the Customer attempts to add:

10.3.1.1. a second Admin; or

10.3.1.2. a sixth active person.

10.3.2. Kepler will clearly inform the Customer before:

10.3.2.1. the Workspace converts to a Paid Plan; or

10.3.2.2. any paid charge arises.

10.3.3. Kepler will not charge the Customer merely because the Customer attempts to exceed a Free Plan limit.

10.3.4. The Customer must affirmatively select a Paid Plan and provide an approved payment method before paid charges arise.

10.4. Free Plan service levels

10.4.1. The Free Plan has no contractual availability commitment.

10.4.2. Free Plan support is provided on a reasonable-endeavours basis.

10.5. Withdrawal of Free Plan

10.5.1. Kepler may withdraw the Free Plan on at least 30 days’ written notice.

10.5.2. Following the withdrawal date, Kepler will provide a further 30-day period during which the Customer may export Customer Data.

10.5.3. After that export period, Kepler may close the Workspace and delete Customer Data in accordance with Schedule 2.

11. SELF-SERVE PAID PLANS

11.1. Eligibility

11.1.1. Self-serve Paid Plans are available for Workspaces covering up to 499 people.

11.1.2. Enterprise pricing applies from 500 people.

11.2. Chargeable seat types

There are only two chargeable seat types:

11.2.1. Admin; and

11.2.2. Everybody Else.

11.3. Admin pricing

11.3.1. Each Admin is charged at the published Admin price for the applicable currency, as set out on the pricing page at hrgoat.ai/pricing.

11.3.2. Admin pricing is flat.

11.3.3. Admin seats are not included in the graduated Everybody Else pricing ladder.

11.3.4. The number of Admins does not affect the price of Everybody Else seats.

11.4. Everybody Else pricing

Everybody Else Users are priced using a graduated monthly ladder. The ladder steps, and the monthly price per person for each step, are those published on the pricing page at hrgoat.ai/pricing for the applicable currency at the time the Fees are charged. The published ladder forms part of this Agreement and is subject to clause 20.

11.5. Graduated pricing

11.5.1. Pricing is graduated and not flat-banded.

11.5.2. Each price applies only to people within that ladder step.

11.5.3. Adding people does not reprice the people already counted in an earlier step.

11.5.4. The Everybody Else Users counted in the first ladder step remain priced at that step’s published rate regardless of the number of additional Users.

11.6. Worked example

A worked example of this calculation, at any headcount and in any supported currency, is produced by the calculator on the pricing page at hrgoat.ai/pricing.

12. ENTERPRISE PLANS

12.1. Enterprise threshold

12.1.1. A Workspace covering 500 or more people requires an Enterprise Plan.

12.1.2. The Enterprise threshold begins at 500 people and not 501 people.

12.2. Enterprise pricing

12.2.1. Enterprise pricing is provided by individual quotation.

12.2.2. Enterprise pricing is not required to be published.

12.2.3. The applicable pricing, scope and commercial terms will be stated in an Order Form.

12.3. Enterprise term

12.3.1. The initial Enterprise subscription term will be 24 or 36 months, as stated in the Order Form.

12.3.2. Enterprise pricing is fixed for the initial term unless the Order Form expressly provides otherwise.

12.4. Enterprise renewal

12.4.1. Either party may prevent renewal by giving at least 90 days’ written notice before the end of the current term.

12.4.2. If neither party gives timely non-renewal notice, the Enterprise Plan renews for a period equal to the expiring term unless the Order Form states otherwise.

12.5. Order Form precedence

12.5.1. Enterprise cancellation and other negotiated commercial terms are governed by the Order Form.

12.5.2. The Order Form overrides these standard terms to the extent stated in clause 4.2.

PART D: BILLING AND PAYMENT

13. PAYMENT PROCESSOR

13.1. Stripe

13.1.1. Stripe is Kepler’s payment processor for the Service.

13.1.2. Self-serve Customers pay by card through Stripe.

13.1.3. Enterprise Customers are invoiced and payments are processed through Stripe unless the Order Form expressly provides otherwise.

13.2. Stripe terms

13.2.1. Payment processing is subject to Stripe’s applicable terms and privacy documentation.

13.2.2. The Customer authorises Kepler and Stripe to process the information necessary to collect Fees and applicable taxes.

13.3. Payment-card data

13.3.1. Complete payment-card information is collected and processed by Stripe.

13.3.2. Kepler may receive:

13.3.2.1. a payment token;

13.3.2.2. payment status;

13.3.2.3. card brand;

13.3.2.4. card expiry information; and

13.3.2.5. the last four digits of the card.

13.3.3. Kepler does not ordinarily receive or store complete card numbers.

14. PAYMENT TIMING

14.1. Advance payment

14.1.1. Fees are payable in advance for each Billing Period.

14.1.2. By subscribing, the Customer authorises recurring charges until cancellation takes effect.

14.2. Top-up purchases

14.2.1. A Credit top-up is a one-off purchase.

14.2.2. The applicable charge is taken at the time of purchase.

14.2.3. Credit top-ups do not create a recurring charge.

15. CURRENCIES

15.1. Supported currencies

The supported billing currencies are:

15.1.1. United States dollars;

15.1.2. pounds sterling;

15.1.3. euros; and

15.1.4. South African rand.

15.2. Source pricing

USD is Kepler’s default and source pricing currency.

15.3. Fixed local price lists

15.3.1. GBP, EUR and ZAR each have their own fixed price list.

15.3.2. Non-USD prices are derived from Kepler’s USD pricing and rounded so that displayed local prices do not include minor currency units, unless Kepler decides otherwise.

15.3.3. Kepler does not conduct live foreign-exchange conversion at checkout.

15.4. Price lock

15.4.1. The Customer’s selected currency price is fixed when the Customer subscribes.

15.4.2. The price does not fluctuate automatically with exchange-rate movements.

15.4.3. The price remains subject to a properly notified price change under clause 20.

16. TAXES

16.1. Tax-exclusive pricing

Published and quoted prices exclude:

16.1.1. VAT;

16.1.2. sales tax;

16.1.3. use tax; and

16.1.4. equivalent local transaction taxes.

16.2. Tax calculation

16.2.1. Stripe will calculate and add applicable taxes at checkout or on the applicable invoice.

16.2.2. The Customer is responsible for applicable taxes other than taxes imposed on Kepler’s net income.

16.3. Exemptions

If the Customer claims a tax exemption, the Customer must provide valid supporting documentation before the relevant charge.

17. ADDING AND REMOVING PEOPLE

17.1. Additions

If the Customer adds a person during a Billing Period:

17.1.1. the applicable seat charge is calculated pro rata for the remainder of the Billing Period;

17.1.2. the charge may be taken immediately;

17.1.3. the User receives access immediately; and

17.1.4. the User’s included Credits become available immediately.

17.2. Removals

17.2.1. Removing a person takes effect for billing purposes from the next Billing Period.

17.2.2. No refund or credit is given for the current Billing Period.

17.2.3. Removing access from a User does not, by itself, delete that person’s records from Customer Data.

18. FAILED AND OVERDUE PAYMENTS

18.1. Failed payment

If a payment fails, Kepler may:

18.1.1. retry the payment method;

18.1.2. notify the billing contact; and

18.1.3. request an alternative payment method.

18.2. Written notice

Before downgrading a Workspace for non-payment, Kepler will provide written notice and a reasonable opportunity to remedy the non-payment.

18.3. Downgrade for non-payment

18.3.1. If payment remains outstanding after notice, Kepler may downgrade the Workspace to the Free Plan.

18.3.2. A downgrade for non-payment does not delete Customer Data.

18.3.3. The Free Plan User limits will apply following the downgrade.

18.3.4. Undisputed accrued Fees remain payable.

18.4. Interest

18.4.1. Kepler may charge interest on overdue undisputed amounts at 4% per year above the Bank of England base rate, accruing daily.

18.4.2. Kepler may instead exercise any greater statutory right to interest and recovery costs available under applicable late-payment legislation.

19. REFUNDS

19.1. General rule

Fees are non-refundable except:

19.1.1. where this Agreement expressly provides otherwise;

19.1.2. where Kepler terminates a Paid Plan for convenience;

19.1.3. where the Customer terminates for Kepler’s uncured material breach;

19.1.4. following a valid unresolved objection to a new sub-processor;

19.1.5. where Kepler expressly agrees in writing; or

19.1.6. where required by Applicable Law.

19.2. No refunds for unused items

Subject to mandatory law, no refund is due for:

19.2.1. a partial Billing Period;

19.2.2. unused seats;

19.2.3. unused included Credits;

19.2.4. unused purchased Credits;

19.2.5. a downgrade during a Billing Period; or

19.2.6. failure to cancel before renewal.

20. PRICE CHANGES

20.1. Notice

Kepler may change self-serve subscription prices on at least 30 days’ written notice.

20.2. Effective date

A price change will take effect no earlier than the Customer’s first Billing Period beginning after the notice period expires.

20.3. Customer option

If the Customer does not accept the changed price, it may cancel before the changed price takes effect.

20.4. Enterprise Plans

Enterprise pricing remains fixed during the agreed term unless the Order Form expressly permits a change.

PART E: AI CREDITS

21. NATURE OF CREDITS

21.1. Usage unit

21.1.1. A Credit is the internal unit used by hr goat to measure use of chargeable AI Features.

21.1.2. Credits are not model tokens.

21.1.3. Customer-facing billing and Credit materials will not identify:

21.1.3.1. model-token counts;

21.1.3.2. per-call infrastructure costs;

21.1.3.3. Kepler’s margins; or

21.1.3.4. internal model-selection criteria.

21.2. Credit status

Credits:

21.2.1. are a usage allowance;

21.2.2. are not money or stored value;

21.2.3. have no cash value;

21.2.4. may not be sold;

21.2.5. may not be transferred;

21.2.6. may not be exchanged for money; and

21.2.7. are non-refundable, subject to mandatory law.

22. INCLUDED CREDIT ALLOWANCES

22.1. Allowances

Included Credit allowances are:

22.2. Paid resets

22.2.1. Paid Credit allowances reset monthly on the Subscription Anniversary.

22.2.2. Paid allowances do not reset on the first day of the calendar month unless the Subscription Anniversary is the first day.

22.3. Free Plan resets

Free Plan Credit allowances reset each Monday.

22.4. No carry-over

22.4.1. Included Credits do not carry over between allowance periods.

22.4.2. Unused included Credits expire when the allowance resets.

22.5. Individual allowances

22.5.1. Credits are allocated to individual Users.

22.5.2. Credits are not pooled at Workspace level.

22.5.3. Credits may not be shared, transferred or reassigned between Users.

23. CREDIT COST OF AI ACTIONS

23.1. Current action costs

The current Credit costs are:

23.2. Reading

23.2.1. Reading through the ordinary Service interface is free and unlimited.

23.2.2. An AI document-processing action may consume Credits where the action is listed as chargeable before the User begins it.

23.3. In-product display

The current Credit cost of an action will be displayed in-product or in current Documentation.

23.4. Changes to action costs

23.4.1. Kepler may change:

23.4.1.1. the Credit allowance included in a plan; or

23.4.1.2. the number of Credits consumed by an action.

23.4.2. Kepler will provide at least 30 days’ written notice of a change.

23.4.3. The change will take effect no earlier than the next applicable Billing Period or allowance reset after the notice period.

24. RUNNING OUT OF CREDITS

24.1. No automatic billing

24.1.1. Kepler will not automatically charge a Customer or User merely because a User has exhausted their Credits.

24.1.2. There is no automatic top-up.

24.2. Effect of exhaustion

If a User exhausts their available Credits:

24.2.1. chargeable AI actions pause for that User;

24.2.2. other Users’ Credits are unaffected;

24.2.3. records, dashboards and reports remain available;

24.2.4. non-chargeable functionality continues; and

24.2.5. the User may wait for the next reset or purchase a top-up pack.

25. TOP-UP PACKS

25.1. Packs

Two top-up packs are available, a small pack and a large pack. The Credit quantity and the price of each pack, in each supported currency, are those published on the pricing page at hrgoat.ai/pricing.

25.2. Local-currency prices

25.2.1. Fixed GBP, EUR and ZAR top-up prices will be displayed before purchase.

25.2.2. Local-currency prices are not calculated using a live checkout exchange rate.

25.3. Persistence

Purchased Credits:

25.3.1. do not expire;

25.3.2. survive an included allowance reset;

25.3.3. survive cancellation of a Paid Plan;

25.3.4. survive a downgrade to the Free Plan; and

25.3.5. remain available while the applicable Account and Workspace continue to exist.

25.4. Individual allocation

25.4.1. Purchased Credits are allocated to the purchasing User.

25.4.2. Purchased Credits may not be pooled, transferred or reassigned unless the Service expressly provides functionality allowing it.

PART F: CANCELLATION AND DOWNGRADE

26. SELF-SERVE CANCELLATION

26.1. No fixed term

26.1.1. A self-serve Paid Plan has no fixed subscription term.

26.1.2. It renews for successive Billing Periods until cancelled.

26.2. No notice period

26.2.1. The Customer may cancel at any time before the next renewal.

26.2.2. No minimum notice period applies.

26.3. Cancellation method

26.3.1. The Customer cancels through the in-product billing or subscription settings.

26.3.2. No email or telephone call is required.

26.4. Continued paid access

After cancellation:

26.4.1. no further recurring charges will be taken;

26.4.2. paid access continues until the end of the Billing Period already paid for; and

26.4.3. no refund is given for the unused part of that Billing Period.

27. DOWNGRADE FOLLOWING CANCELLATION

27.1. Automatic downgrade

27.1.1. At the end of the prepaid Billing Period, the Workspace automatically downgrades to the Free Plan.

27.1.2. Cancellation does not automatically close or delete the Workspace.

27.2. Customer Data

Following downgrade:

27.2.1. Customer Data remains in the Workspace;

27.2.2. existing records, documents and reports remain available to authorised Admins;

27.2.3. retention remains subject to the Customer’s instructions, configured retention periods, Applicable Data Protection Laws and Schedule 2; and

27.2.4. the Customer may close the Workspace or request deletion through available processes.

27.3. Active Users

On the Free Plan:

27.3.1. one Admin remains active;

27.3.2. four Everybody Else Users remain active; and

27.3.3. Users beyond those limits cannot sign in.

27.4. Export rights

27.4.1. While the Workspace continues to exist, an authorised Admin retains in-product access to export Customer Data.

27.4.2. No time limit applies to that export right while the Workspace remains open.

27.5. Top-up Credits

Purchased Credit packs remain available following the downgrade.

27.6. Reactivation

27.6.1. The Customer may reactivate a Paid Plan by subscribing again.

27.6.2. Reactivation restores paid access with existing Customer Data intact, except for data that has already been lawfully deleted or anonymised.

PART G: CUSTOMER DATA AND DATA PROTECTION

28. CUSTOMER DATA OWNERSHIP

28.1. Customer ownership

As between the parties, the Customer retains all right, title and interest in Customer Data.

28.2. Limited processing right

The Customer authorises Kepler to host, copy, transmit, structure, analyse and otherwise process Customer Data only as necessary to:

28.2.1. provide the Service;

28.2.2. follow the Customer’s documented instructions;

28.2.3. provide support;

28.2.4. secure the Service;

28.2.5. prevent fraud and misuse;

28.2.6. maintain service integrity;

28.2.7. comply with Applicable Law; and

28.2.8. enforce this Agreement.

28.3. Customer responsibilities

The Customer is responsible for:

28.3.1. the accuracy of Customer Data;

28.3.2. the legality of Customer Data;

28.3.3. having authority to provide Customer Data to Kepler;

28.3.4. establishing an appropriate lawful basis;

28.3.5. providing required notices;

28.3.6. obtaining required consents;

28.3.7. establishing lawful retention periods;

28.3.8. responding to data-subject and consumer requests;

28.3.9. complying with employment and equality laws; and

28.3.10. configuring the Service appropriately.

29. DATA PROTECTION ROLES

29.1. Customer Data

For Personal Data contained in Customer Data:

29.1.1. the Customer ordinarily acts as controller, responsible party or business; and

29.1.2. Kepler ordinarily acts as processor, operator, service provider or contractor.

29.2. Kepler-controlled data

29.2.1. Kepler acts as an independent controller in relation to Personal Data processed for:

29.2.1.1. account administration;

29.2.1.2. billing and payment;

29.2.1.3. sales and relationship management;

29.2.1.4. website operation;

29.2.1.5. service security;

29.2.1.6. fraud prevention;

29.2.1.7. legal compliance; and

29.2.1.8. support administration.

29.2.2. Kepler’s Privacy Policy applies to those activities.

29.3. Data Processing Addendum

Schedule 2 governs Kepler’s processing of Personal Data on the Customer’s behalf.

30. AGGREGATED AND ANONYMISED DATA

30.1. Permitted use

Kepler may generate and use aggregated or anonymised statistics derived from use of the Service.

30.2. Standard

Kepler may use such information only where it:

30.2.1. does not identify the Customer;

30.2.2. does not identify an individual;

30.2.3. cannot reasonably be linked back to Customer Data; and

30.2.4. meets applicable standards for anonymisation or de-identification.

30.3. Purposes

Properly anonymised or aggregated information may be used for:

30.3.1. service analytics;

30.3.2. capacity planning;

30.3.3. security;

30.3.4. service improvement; and

30.3.5. statistical reporting.

PART H: AI FEATURES

31. NATURE OF AI OUTPUT

31.1. Advisory output

AI Features may generate:

31.1.1. drafts;

31.1.2. summaries;

31.1.3. classifications;

31.1.4. recommendations;

31.1.5. scores;

31.1.6. analyses; and

31.1.7. answers.

31.2. Limitations

AI output may be:

31.2.1. inaccurate;

31.2.2. incomplete;

31.2.3. outdated;

31.2.4. biased;

31.2.5. inconsistent;

31.2.6. unsuitable for the Customer’s circumstances; or

31.2.7. legally or factually incorrect.

31.3. Customer verification

The Customer must independently review AI output before:

31.3.1. relying on it;

31.3.2. communicating it;

31.3.3. publishing it; or

31.3.4. taking action based on it.

32. HUMAN OVERSIGHT

32.1. No solely automated significant decisions

The Customer must not use AI output as the sole basis for a decision producing legal or similarly significant effects on an individual.

32.2. Employment decisions

A competent human must meaningfully review and take responsibility for decisions concerning:

32.2.1. recruitment;

32.2.2. selection;

32.2.3. promotion;

32.2.4. remuneration;

32.2.5. performance assessment;

32.2.6. access to training;

32.2.7. discipline;

32.2.8. redundancy;

32.2.9. dismissal;

32.2.10. workplace benefits; or

32.2.11. another material employment outcome.

32.3. Review and challenge

Where required by Applicable Law, the Customer must provide affected individuals with:

32.3.1. meaningful information about the use of AI;

32.3.2. an opportunity to express their views;

32.3.3. human review;

32.3.4. an opportunity to challenge a decision; and

32.3.5. a process to correct inaccurate information.

33. AI TRANSPARENCY AND FAIRNESS

33.1. Customer notices

The Customer must provide legally required notices explaining:

33.1.1. that AI Features are used;

33.1.2. the relevant purposes;

33.1.3. the categories of Personal Data involved;

33.1.4. the role of human reviewers; and

33.1.5. how affected individuals may exercise their rights.

33.2. Bias and discrimination

33.2.1. The Customer must not use the Service or AI Features to unlawfully discriminate against an individual.

33.2.2. The Customer is responsible for evaluating AI output in the context in which it is used, including potential disparate or discriminatory effects.

33.3. Impact assessments

The Customer must complete any data protection, algorithmic, employment or fundamental-rights impact assessment required by Applicable Law.

34. SENSITIVE DATA

34.1. Submission restrictions

The Customer must not submit special-category or sensitive Personal Data to an AI Feature unless:

34.1.1. the processing is necessary;

34.1.2. the Customer has an appropriate lawful basis;

34.1.3. an additional legal condition applies where required;

34.1.4. any required consent has been obtained;

34.1.5. any required impact assessment has been completed; and

34.1.6. appropriate safeguards are in place.

34.2. No general requirement

Kepler does not require special-category or sensitive Personal Data for the ordinary operation of AI Features.

34.3. Channel restrictions

Special-category and sensitive Personal Data is not transmitted through a Messaging Channel or included in a Mobile App notification preview, as set out in clauses 58.5 and 59.8.

35. MODEL TRAINING AND AI PROVIDERS

35.1. No model training

Neither Kepler nor its AI sub-processors will use Customer Data to train, fine-tune or improve:

35.1.1. a foundation model; or

35.1.2. a generally available machine-learning model.

35.2. Provider disclosures

35.2.1. Customer-facing Credit and billing materials will not disclose internal model names or token counts.

35.2.2. Kepler may identify infrastructure and AI providers in:

35.2.2.1. the DPA;

35.2.2.2. the Sub-processor List;

35.2.2.3. security documentation; or

35.2.2.4. another disclosure required by law.

35.3. Model routing

Kepler may route requests between models supplied by an approved sub-processor if doing so does not:

35.3.1. materially reduce data protection;

35.3.2. change the disclosed processing location;

35.3.3. permit training on Customer Data; or

35.3.4. appoint a new sub-processor without following Schedule 2.

36. NO PROFESSIONAL ADVICE

36.1. Excluded advice

The Service and AI Features do not provide:

36.1.1. legal advice;

36.1.2. tax advice;

36.1.3. accounting advice;

36.1.4. financial advice;

36.1.5. medical advice;

36.1.6. immigration advice; or

36.1.7. another regulated professional service.

36.2. Customer responsibility

The Customer must obtain qualified professional advice where appropriate.

PART I: ACCEPTABLE USE AND SECURITY

37. GENERAL ACCEPTABLE USE

37.1. Prohibited conduct

The Customer and its Users must not use the Service:

37.1.1. unlawfully or fraudulently;

37.1.2. to infringe intellectual property, privacy, confidentiality or other rights;

37.1.3. to store or distribute unlawful, defamatory, discriminatory, harassing, abusive, obscene or harmful material;

37.1.4. to send unlawful unsolicited communications;

37.1.5. to interfere with or disrupt the Service;

37.1.6. to circumvent usage or seat limits;

37.1.7. for undisclosed or unlawful worker monitoring;

37.1.8. to obstruct an individual’s data protection rights; or

37.1.9. to retain Personal Data without a lawful purpose.

38. SECURITY RESTRICTIONS

38.1. Prohibited security activity

The Customer and Users must not:

38.1.1. attempt unauthorised access;

38.1.2. access another customer’s Workspace;

38.1.3. probe, scan or test vulnerabilities without written permission;

38.1.4. circumvent authentication or access controls;

38.1.5. introduce malware or harmful code;

38.1.6. use the Service to attack another system;

38.1.7. interfere with audit logging; or

38.1.8. use credentials belonging to another person.

38.2. Security research

38.2.1. Good-faith security concerns must be reported privately to legal@hrgoat.ai.

38.2.2. Kepler will not pursue legal action against good-faith research that:

38.2.2.1. does not access, alter or extract Customer Data;

38.2.2.2. does not disrupt the Service;

38.2.2.3. does not compromise another person’s Account; and

38.2.2.4. is reported privately before public disclosure.

39. COMMERCIAL AND PLATFORM RESTRICTIONS

39.1. Prohibited exploitation

The Customer and Users must not:

39.1.1. resell or sublicense the Service;

39.1.2. share named Accounts;

39.1.3. create duplicate Workspaces to obtain additional free allowances;

39.1.4. scrape the Service outside an approved API;

39.1.5. reverse engineer the Service except where a restriction is unlawful;

39.1.6. attempt to discover source code, model weights or system prompts;

39.1.7. use the Service to build or train a competing product;

39.1.8. publish performance benchmarks without written permission; or

39.1.9. remove proprietary notices.

40. AI-SPECIFIC RESTRICTIONS

40.1. Prohibited AI uses

The Customer and Users must not:

40.1.1. use AI output as the sole basis for a legally significant decision;

40.1.2. use AI Features to unlawfully discriminate;

40.1.3. attempt to extract model weights, system prompts or training data;

40.1.4. use AI output to train another machine-learning model;

40.1.5. deliberately generate unlawful or harmful output;

40.1.6. bypass AI safety controls;

40.1.7. misrepresent AI output as entirely human-authored where that would mislead an affected person; or

40.1.8. consume Credits automatically for resale, benchmarking or stress testing.

41. ENFORCEMENT

41.1. Available actions

If Kepler reasonably believes that this Part has been breached, Kepler may:

41.1.1. request corrective action;

41.1.2. restrict functionality;

41.1.3. throttle abusive activity;

41.1.4. suspend an affected User;

41.1.5. suspend a Workspace;

41.1.6. preserve relevant evidence;

41.1.7. terminate the Agreement for material breach; or

41.1.8. make a report where required by law.

41.2. Proportionality

Kepler will ordinarily take the least disruptive action reasonably sufficient to address the issue.

41.3. Immediate suspension

Kepler may suspend access immediately where there is a credible risk to:

41.3.1. the Service;

41.3.2. security;

41.3.3. another customer;

41.3.4. an individual;

41.3.5. third-party rights; or

41.3.6. compliance with law.

41.4. Export access

During suspension for a serious breach, Kepler will preserve Admin export access unless doing so would:

41.4.1. be unlawful;

41.4.2. create a security risk;

41.4.3. expose another person’s data; or

41.4.4. prejudice an investigation.

PART J: CONFIDENTIALITY AND INTELLECTUAL PROPERTY

42. CONFIDENTIALITY

42.1. Protection obligations

Each recipient of Confidential Information must:

42.1.1. use it only to exercise rights or perform obligations under the Agreement;

42.1.2. protect it using at least reasonable care;

42.1.3. disclose it only to personnel and professional advisers who need to know it; and

42.1.4. ensure those recipients are bound by suitable confidentiality obligations.

42.2. Exclusions

Confidential Information does not include information that the recipient can demonstrate:

42.2.1. is public through no breach;

42.2.2. was already lawfully known without restriction;

42.2.3. was lawfully received from a third party;

42.2.4. was independently developed; or

42.2.5. must be disclosed by law.

42.3. Compelled disclosure

Where legally permitted, the recipient must:

42.3.1. notify the disclosing party before compelled disclosure;

42.3.2. provide reasonable assistance in seeking protective treatment; and

42.3.3. disclose only the information legally required.

42.4. Duration

Confidentiality obligations continue:

42.4.1. for five years after termination; and

42.4.2. indefinitely for trade secrets and retained Personal Data.

42.5. Customer Data

Customer Data is the Customer’s Confidential Information.

43. KEPLER INTELLECTUAL PROPERTY

43.1. Ownership

Kepler and its licensors own all rights in:

43.1.1. the Service;

43.1.2. software and source code;

43.1.3. models, prompts and system configurations;

43.1.4. user interfaces and designs;

43.1.5. Documentation;

43.1.6. databases and data structures;

43.1.7. improvements and derivative works; and

43.1.8. Kepler’s names, logos and branding.

43.2. AI output

43.2.1. Subject to Applicable Law and third-party rights, the Customer may use AI output generated specifically for it for its internal business purposes.

43.2.2. Kepler does not warrant that AI output:

43.2.2.1. is unique;

43.2.2.2. does not resemble other output;

43.2.2.3. is eligible for intellectual property protection; or

43.2.2.4. is free from third-party rights.

43.3. Feedback

43.3.1. The Customer grants Kepler a perpetual, worldwide, irrevocable and royalty-free right to use feedback about the Service.

43.3.2. This clause does not transfer ownership of Customer Data.

43.4. Customer name and logo

Kepler will not publicly use the Customer’s name or logo as a customer reference without prior written consent.

PART K: THIRD-PARTY SERVICES

44. INTEGRATIONS

44.1. Third-party products

The Service may integrate with third-party products, including:

44.1.1. payment processors;

44.1.2. payroll systems;

44.1.3. identity providers;

44.1.4. communication platforms;

44.1.5. storage providers; and

44.1.6. HR and workforce systems.

44.2. Customer instruction

By enabling an integration, the Customer instructs and authorises Kepler to exchange Customer Data with the third-party provider as necessary for the integration.

44.3. Third-party responsibility

44.3.1. Third-party products are supplied under their providers’ own terms.

44.3.2. Kepler is not responsible for:

44.3.2.1. their availability;

44.3.2.2. their performance;

44.3.2.3. changes made by their providers;

44.3.2.4. their independent processing of data; or

44.3.2.5. data after it has been transferred at the Customer’s direction.

44.4. Disabling an integration

Kepler may disable an integration if it is no longer:

44.4.1. available;

44.4.2. secure;

44.4.3. legally compliant; or

44.4.4. technically supportable.

PART L: SUSPENSION AND TERMINATION

45. SUSPENSION

45.1. Grounds

Kepler may suspend all or part of the Service where reasonably necessary to:

45.1.1. address a security incident;

45.1.2. prevent unauthorised access;

45.1.3. stop unlawful activity;

45.1.4. address a serious breach;

45.1.5. protect another customer or individual;

45.1.6. comply with a legal obligation; or

45.1.7. prevent material harm to the Service.

45.2. Notice

45.2.1. Where reasonably practicable, Kepler will give notice before suspension.

45.2.2. If advance notice is not reasonably practicable, Kepler will give notice promptly afterwards unless prohibited by law.

45.3. Restoration

Kepler will use reasonable efforts to restore access after the underlying issue is resolved.

46. TERMINATION FOR BREACH

46.1. Material breach

Either party may terminate this Agreement by written notice if the other party:

46.1.1. commits a material breach that cannot be remedied; or

46.1.2. fails to remedy a remediable material breach within 30 days after written notice.

46.2. Insolvency

Either party may terminate immediately if the other:

46.2.1. becomes insolvent;

46.2.2. enters liquidation or administration;

46.2.3. ceases business; or

46.2.4. becomes subject to an equivalent formal insolvency process.

47. TERMINATION BY KEPLER FOR CONVENIENCE

47.1. Paid Plans

47.1.1. Kepler may terminate a self-serve Paid Plan on at least 90 days’ written notice.

47.1.2. Kepler will refund unused prepaid recurring Fees on a pro rata basis.

47.2. Enterprise Plans

Termination of an Enterprise Plan for convenience is governed by the Order Form.

47.3. Free Plan

Withdrawal of the Free Plan is governed by clause 10.5.

48. EFFECT OF FINAL ACCOUNT CLOSURE

48.1. Distinction between cancellation and closure

48.1.1. Cancelling a self-serve Paid Plan results in downgrade and not account closure.

48.1.2. This clause applies only where:

48.1.2.1. the Customer closes the Workspace;

48.1.2.2. the parties finally terminate the Service without downgrade;

48.1.2.3. Kepler withdraws the Free Plan and the export period ends; or

48.1.2.4. Kepler lawfully closes the account following an uncured serious breach.

48.2. Export period

The Customer may export Customer Data for 30 days after final termination or account closure, unless export access would be unlawful or create a serious security risk.

48.3. Deletion

Following the export period, Kepler will delete Customer Data in accordance with Schedule 2.

48.4. Survival

Provisions intended by their nature to survive remain effective, including provisions concerning:

48.4.1. payment;

48.4.2. confidentiality;

48.4.3. intellectual property;

48.4.4. data protection;

48.4.5. indemnities;

48.4.6. liability; and

48.4.7. dispute resolution.

PART M: WARRANTIES, INDEMNITIES AND LIABILITY

49. WARRANTIES

49.1. Mutual authority

Each party warrants that it has authority to enter into this Agreement.

49.2. Kepler warranty

For Paid Plans, Kepler warrants that it will:

49.2.1. provide the Service with reasonable skill and care; and

49.2.2. provide the Service substantially in accordance with the Documentation.

49.3. Remedy

49.3.1. If Kepler breaches clause 49.2, Kepler will use reasonable efforts to correct the affected Service.

49.3.2. If Kepler cannot correct a material breach within a reasonable period, the Customer may terminate the affected Paid Plan and receive a pro rata refund of unused prepaid recurring Fees.

50. DISCLAIMERS

50.1. General disclaimer

Except as expressly stated and to the maximum extent permitted by law, the Service is provided “as is” and “as available”.

50.2. No guarantee

Kepler does not warrant that:

50.2.1. access will be uninterrupted;

50.2.2. the Service will be error-free;

50.2.3. every defect will be corrected;

50.2.4. AI output will be accurate;

50.2.5. the Service will meet every Customer requirement;

50.2.6. the Service will achieve a particular business outcome; or

50.2.7. use of the Service will make the Customer legally compliant.

51. INDEMNITIES

51.1. Customer indemnity

The Customer will defend and indemnify Kepler against a third-party claim arising from:

51.1.1. Customer Data infringing third-party rights;

51.1.2. the Customer’s unlawful instructions;

51.1.3. the Customer’s material breach of Part I;

51.1.4. the Customer’s unlawful surveillance, discrimination or profiling;

51.1.5. an employment decision made by the Customer; or

51.1.6. the Customer’s failure to have a lawful basis for processing.

51.2. Kepler IP indemnity

Kepler will defend the Customer against a third-party claim that authorised use of the Service infringes that third party’s intellectual property rights.

51.3. IP indemnity exclusions

Kepler’s indemnity does not apply to a claim arising from:

51.3.1. Customer Data;

51.3.2. unauthorised use;

51.3.3. modifications not made by Kepler;

51.3.4. combination with products not supplied or approved by Kepler; or

51.3.5. continued use after Kepler has instructed the Customer to stop.

51.4. Indemnity procedure

51.4.1. An indemnity applies only if the indemnified party:

51.4.1.1. gives prompt notice;

51.4.1.2. does not admit liability without permission;

51.4.1.3. gives the indemnifying party control of the defence; and

51.4.1.4. provides reasonable assistance.

51.4.2. No settlement may impose non-monetary obligations or an admission of fault on the indemnified party without its consent.

52. LIMITATION OF LIABILITY

52.1. Liability not limited

Nothing limits or excludes liability for:

52.1.1. death or personal injury caused by negligence;

52.1.2. fraud or fraudulent misrepresentation;

52.1.3. wilful misconduct;

52.1.4. a Customer’s payment obligations;

52.1.5. infringement or misappropriation of the other party’s intellectual property;

52.1.6. breach of confidentiality; or

52.1.7. liability that cannot lawfully be limited.

52.2. Excluded losses

Subject to clause 52.1, neither party is liable for:

52.2.1. indirect or consequential loss;

52.2.2. loss of profit;

52.2.3. loss of revenue;

52.2.4. loss of anticipated savings;

52.2.5. loss of business;

52.2.6. loss of goodwill; or

52.2.7. loss or corruption of data, except for the reasonable cost of restoring Customer Data from available backups where the loss was caused by the responsible party’s breach.

52.3. General cap

Subject to clauses 52.1 and 52.2, each party’s aggregate liability arising in any 12-month period will not exceed the Fees paid or payable for the Service during that period.

52.4. Free Plan cap

Kepler’s aggregate liability relating exclusively to the Free Plan is limited to USD 1,000.

52.5. Statutory rights

Nothing in this clause limits:

52.5.1. an individual’s statutory privacy rights;

52.5.2. a regulator’s lawful powers; or

52.5.3. liability to the extent a limitation is prohibited by Applicable Law.

PART N: CHANGES, NOTICES AND GENERAL TERMS

53. CHANGES TO THIS AGREEMENT

53.1. General changes

Kepler may update these standard terms on at least 30 days’ written notice where reasonably required for:

53.1.1. changes in law;

53.1.2. security;

53.1.3. changes to the Service;

53.1.4. changes to suppliers; or

53.1.5. clarification of the parties’ rights and responsibilities.

53.2. Materially adverse changes

53.2.1. A materially adverse change will take effect no earlier than the Customer’s next Billing Period after the notice period.

53.2.2. The Customer may cancel before the change takes effect.

53.3. Immediate changes

A change may take effect sooner where reasonably necessary to:

53.3.1. comply with law;

53.3.2. respond to a regulator;

53.3.3. address an active security risk; or

53.3.4. prevent unlawful or harmful activity.

53.4. Enterprise protection

Kepler will not use an update to these standard terms to change fixed Enterprise pricing or an expressly negotiated Enterprise term during its agreed term.

54. NOTICES

54.1. Notices to Customer

Kepler may send notices to:

54.1.1. the Super Admin;

54.1.2. another Admin;

54.1.3. the billing contact;

54.1.4. an Order Form contact; or

54.1.5. the Customer through a prominent in-product notice.

54.2. Notices to Kepler

54.2.1. Notices must be sent to:

54.2.2. Formal notices of termination for cause or legal proceedings must also be sent by prepaid tracked post or courier to:

Kepler Experience Limited, 80-83 Long Lane, London EC1A 9ET, United Kingdom.

54.3. Receipt

A notice is treated as received:

54.3.1. on delivery, if delivered by hand;

54.3.2. on recorded delivery, if sent by tracked post or courier; or

54.3.3. on the next Business Day after sending, if sent by email and no delivery-failure notification is received.

55. GENERAL TERMS

55.1. Entire agreement

55.1.1. The contractual documents listed in clause 4 constitute the entire agreement concerning the Service.

55.1.2. Neither party relies on a statement not included in the Agreement.

55.1.3. This clause does not limit liability for fraud or fraudulent misrepresentation.

55.2. Assignment

55.2.1. The Customer may not assign this Agreement without Kepler’s written consent, not to be unreasonably withheld.

55.2.2. Either party may assign this Agreement to:

55.2.2.1. an Affiliate; or

55.2.2.2. a successor in connection with a merger, reorganisation or sale of substantially all relevant assets,

provided that the assignee can perform the assigning party’s obligations.

55.3. Subcontracting

55.3.1. Kepler may use subcontractors.

55.3.2. Kepler remains responsible for subcontracted obligations to the extent required by this Agreement or Applicable Law.

55.3.3. Sub-processors are governed by Schedule 2.

55.4. Force majeure

55.4.1. Neither party is liable for delay or failure caused by circumstances beyond its reasonable control.

55.4.2. The affected party must:

55.4.2.1. take reasonable steps to reduce the effect of the event; and

55.4.2.2. resume performance as soon as reasonably practicable.

55.4.3. Force majeure does not excuse payment of amounts already due.

55.5. Independent contractors

55.5.1. The parties are independent contractors.

55.5.2. Nothing creates a:

55.5.2.1. partnership;

55.5.2.2. joint venture;

55.5.2.3. agency;

55.5.2.4. fiduciary relationship; or

55.5.2.5. employment relationship between the parties.

55.6. Third-party rights

A person who is not a party has no right to enforce this Agreement under the Contracts (Rights of Third Parties) Act 1999.

55.7. Waiver

55.7.1. A delay or failure to exercise a right is not a waiver.

55.7.2. A waiver must be in writing and applies only to the matter expressly waived.

55.8. Severability

55.8.1. If a provision is invalid or unenforceable, it will be:

55.8.1.1. modified to the minimum extent necessary; or

55.8.1.2. severed if modification is not possible.

55.8.2. The remaining provisions continue in effect.

55.9. Export controls and sanctions

The Customer must not use the Service in violation of applicable export-control or sanctions laws.

55.10. Anti-bribery

Each party must comply with the Bribery Act 2010 and other applicable anti-bribery and anti-corruption laws.

55.11. Language

55.11.1. The governing version of this Agreement is the English version.

55.11.2. A translation is provided for convenience only.

PART O: GOVERNING LAW AND DISPUTES

56. DISPUTE RESOLUTION

56.1. Notice of dispute

A party must give written notice describing the dispute before commencing court proceedings.

56.2. Good-faith discussions

56.2.1. Senior representatives of the parties must attempt in good faith to resolve the dispute.

56.2.2. The discussion period is 30 days after the dispute notice.

56.3. Urgent relief

This clause does not prevent a party from seeking urgent injunctive, protective or interlocutory relief.

57. GOVERNING LAW AND JURISDICTION

57.1. Governing law

This Agreement and non-contractual obligations arising from it are governed by the laws of England and Wales.

57.2. Jurisdiction

The courts of England and Wales have exclusive jurisdiction.

57.3. Exceptions

This clause does not:

57.3.1. limit the powers of a competent regulator;

57.3.2. prevent a data subject from exercising non-excludable rights;

57.3.3. prevent enforcement of intellectual property or confidentiality rights in another competent jurisdiction; or

57.3.4. override the governing law and forum provisions of an applicable international data transfer mechanism.

PART P: ADDITIONAL TERMS FOR SPECIFIC FEATURES

58. MESSAGING CHANNELS

58.1. Availability

58.1.1. The Service may allow an authorised User to send and receive messages through a Messaging Channel.

58.1.2. A Messaging Channel is optional and may be enabled or disabled by the Customer at Workspace level.

58.2. Customer instruction

58.2.1. By enabling a Messaging Channel, the Customer instructs Kepler to transmit Customer Data to that channel and to the registered number of the authorised User who requests it.

58.2.2. That instruction is a documented instruction for the purposes of Schedule 2.

58.3. Customer responsibilities

The Customer is responsible for:

58.3.1. determining which Users may use a Messaging Channel and what data they may request through it;

58.3.2. establishing and maintaining a lawful basis for the disclosure;

58.3.3. informing its personnel that their Personal Data may be transmitted to an authorised User through a Messaging Channel;

58.3.4. completing any impact assessment required by Data Protection Laws; and

58.3.5. the conduct of its Users once a message has been delivered.

58.4. Nature of the channel

58.4.1. A Messaging Channel operates on devices and applications not controlled by Kepler.

58.4.2. Once a message has been delivered, Kepler cannot recall, restrict, delete or audit it.

58.4.3. The Customer acknowledges that message content may be stored on the recipient’s Device, included in a device or cloud backup, displayed on a locked screen, and forwarded by the recipient.

58.5. Excluded data

58.5.1. Kepler does not transmit special-category or sensitive Personal Data through a Messaging Channel.

58.5.2. This exclusion is enforced within the Service and cannot be overridden by Workspace configuration.

58.5.3. Where a request would require excluded data, the Service directs the User to the Service interface instead.

58.6. User acknowledgement

58.6.1. Before a User may use a Messaging Channel, Kepler will require that User to accept channel-specific conditions of use.

58.6.2. Kepler will record the acceptance and make the record available to the Customer on request.

58.6.3. Acceptance by a User does not reduce the Customer’s responsibilities under this clause.

58.7. Number verification and revocation

58.7.1. A Messaging Channel operates only with a number verified against a User Account.

58.7.2. Verification is revoked when the User’s Account is suspended, removed or offboarded.

58.7.3. The Customer must notify Kepler promptly, or make the change in the Service, where a User’s number is no longer in that User’s sole control.

58.8. Suspension of a channel

Kepler may suspend a Messaging Channel, for a User or a Workspace, where Kepler reasonably believes it is being misused, that a number is no longer controlled by the User, or that suspension is necessary to protect Personal Data.

59. MOBILE APPLICATIONS

59.1. Availability

59.1.1. Kepler may make Mobile Apps available through the Apple App Store and Google Play.

59.1.2. Availability on any platform, version or Device is not guaranteed and may change.

59.2. App Store terms

59.2.1. A User’s download and use of a Mobile App is also subject to the applicable App Store’s terms.

59.2.2. Where those terms conflict with the User Terms in respect of the download itself, the App Store’s terms prevail to the extent of the conflict.

59.2.3. Kepler is not responsible for an App Store, its availability, or its provider’s own processing of data.

59.3. Apple

Where a Mobile App is obtained from the Apple App Store:

59.3.1. the User Terms are between the User and Kepler only, and not with Apple;

59.3.2. Kepler alone is responsible for the Mobile App and its content;

59.3.3. Apple has no obligation to provide maintenance or support for the Mobile App;

59.3.4. if the Mobile App fails to conform to any applicable warranty, the User may notify Apple and Apple may refund the purchase price, if any, and to the maximum extent permitted by law Apple has no other warranty obligation;

59.3.5. Kepler, and not Apple, is responsible for any claim relating to the Mobile App, including product liability, failure to conform to legal requirements, and consumer protection claims;

59.3.6. Kepler, and not Apple, is responsible for the investigation, defence, settlement and discharge of any third-party claim that the Mobile App infringes intellectual property rights;

59.3.7. the User confirms that they are not located in a country subject to a United States Government embargo or designated as a terrorist-supporting country, and are not listed on any United States Government list of prohibited or restricted parties;

59.3.8. the User must comply with any applicable third-party terms when using the Mobile App; and

59.3.9. Apple and its subsidiaries are third-party beneficiaries of the User Terms and may enforce them against the User.

59.4. Google

Where a Mobile App is obtained from Google Play, the Google Play Terms of Service also apply and Google is not a party to the User Terms.

59.5. Devices and networks

59.5.1. The User is responsible for the Device, its security and its network connection, including any data charges.

59.5.2. Kepler is not responsible for a Device modified to remove manufacturer restrictions, and may restrict the Mobile App on such a Device.

59.6. Updates

59.6.1. Kepler may issue updates to a Mobile App.

59.6.2. Kepler may require a minimum supported version and may cease to support earlier versions.

59.6.3. Kepler may withdraw a Mobile App on reasonable notice, and the Service remains available through the web application.

59.7. Device permissions

59.7.1. A Mobile App may request access to Device features, including notifications, camera, photo library, files and biometric unlock.

59.7.2. Access is requested at the point of use and may be declined or withdrawn in Device settings.

59.7.3. Declining a permission may limit a feature but does not affect the Customer’s rights under this Agreement.

59.8. Notifications

59.8.1. A Mobile App may send push notifications.

59.8.2. Notification previews do not include special-category or sensitive Personal Data.

59.8.3. A User may disable notifications in the Mobile App or in Device settings.

59.9. No purchases in a Mobile App

59.9.1. Plans, seats and Credits are purchased through the Service in accordance with Part D and not within a Mobile App.

59.9.2. Clause 13 continues to apply to all payments.

59.10. Account closure requests

59.10.1. Accounts are provisioned and removed by the Customer as Workspace administrator.

59.10.2. Where a User asks Kepler to close their Account, Kepler will direct the request to the Customer and tell the User it has done so.

59.10.3. Kepler publishes a route for such requests, as required by App Store policies.

Schedule 1: Service Levels and Support

1. PURPOSE

1.1. This Schedule describes Kepler’s standard support and availability commitments.

1.2. An Enterprise Order Form may provide enhanced commitments and remedies.

2. SUPPORT

2.1. Support channels

Support is available through:

2.1.1. the in-product support function; and

2.1.2. sos@hrgoat.ai.

2.2. Support hours

2.2.1. Standard support hours are 08:00 to 17:00 UK time on Business Days.

2.2.2. A “Business Day” is Monday to Friday, excluding public holidays in England and Wales.

2.3. Support scope

Standard support covers:

2.3.1. guidance concerning standard functionality;

2.3.2. investigation of reproducible defects;

2.3.3. Account and access assistance; and

2.3.4. incident communications.

2.4. Excluded services

Unless separately agreed, support does not include:

2.4.1. custom development;

2.4.2. data migration;

2.4.3. data entry or cleansing;

2.4.4. bespoke configuration;

2.4.5. third-party system configuration;

2.4.6. legal or HR consulting; or

2.4.7. training beyond standard Documentation.

3. AVAILABILITY

3.1. Paid Plan target

3.1.1. Kepler targets 99.5% monthly availability for Paid Plans.

3.1.2. This is a target and not a financial service-level warranty unless an Enterprise Order Form states otherwise.

3.2. Free Plan

The Free Plan has no availability commitment.

3.3. Beta features

Beta and preview functionality is excluded from availability commitments.

3.4. Availability calculation

Monthly availability is calculated as:

3.4.1. total minutes in the month;

3.4.2. minus unavailable minutes;

3.4.3. divided by total minutes in the month; and

3.4.4. multiplied by 100.

3.5. Excluded downtime

Unavailable minutes exclude downtime caused by:

3.5.1. scheduled maintenance;

3.5.2. emergency maintenance;

3.5.3. the Customer’s systems or configuration;

3.5.4. the Customer’s internet connection;

3.5.5. a third-party integration not controlled by Kepler;

3.5.6. a permitted suspension;

3.5.7. beta functionality; or

3.5.8. force majeure.

4. INCIDENT PRIORITIES

4.1. Priority 1

4.1.1. Priority 1 means:

4.1.1.1. a complete production outage;

4.1.1.2. widespread inability to access or save data; or

4.1.1.3. a critical security event affecting the Service.

4.1.2. The target initial response time is four Business Hours.

4.2. Priority 2

4.2.1. Priority 2 means material degradation or failure of important functionality affecting multiple Users without a reasonable workaround.

4.2.2. The target initial response time is one Business Day.

4.3. Priority 3

4.3.1. Priority 3 means a non-critical defect for which a reasonable workaround exists.

4.3.2. The target initial response time is three Business Days.

4.4. Priority 4

4.4.1. Priority 4 means a general question, cosmetic issue or feature request.

4.4.2. The target initial response time is five Business Days.

4.5. Response versus resolution

4.5.1. Response times are targets for acknowledgement and initial triage.

4.5.2. They are not guaranteed resolution times.

4.5.3. A target pauses while Kepler reasonably awaits information or access from the Customer.

5. MAINTENANCE

5.1. Planned maintenance

Kepler will use reasonable efforts to:

5.1.1. schedule planned maintenance outside normal UK business hours;

5.1.2. minimise disruption; and

5.1.3. give at least 48 hours’ notice where reasonably practicable.

5.2. Emergency maintenance

Kepler may conduct emergency maintenance at any time where reasonably necessary to address:

5.2.1. a security vulnerability;

5.2.2. a data integrity risk; or

5.2.3. a material threat to service stability.

6. RESILIENCE

6.1. Controls

Kepler maintains:

6.1.1. documented business continuity procedures;

6.1.2. disaster recovery procedures;

6.1.3. automated encrypted backups; and

6.1.4. periodic restore testing.

6.2. Objectives

6.2.1. Kepler’s design objectives are:

6.2.2. These are design objectives and not warranties unless an Enterprise Order Form expressly states otherwise.

Schedule 2: Data Processing Addendum

1. SCOPE AND PARTIES

1.1. Incorporation

1.1.1. This Schedule forms part of the Agreement.

1.1.2. It applies automatically to every plan, including the Free Plan.

1.1.3. No separate signature is required.

1.2. Parties

This Schedule is between:

1.2.1. the Customer, as Controller; and

1.2.2. Kepler Experience Limited, as Processor.

1.3. Customer acting as processor

If the Customer acts as a processor for another controller:

1.3.1. Kepler acts as the Customer’s sub-processor; and

1.3.2. the Customer confirms that it is authorised to appoint Kepler.

2. DEFINITIONS AND APPLICABLE LAWS

2.1. Data Protection Laws

“Data Protection Laws” means, to the extent applicable:

2.1.1. the UK GDPR;

2.1.2. the Data Protection Act 2018;

2.1.3. the Data (Use and Access) Act 2025;

2.1.4. the Privacy and Electronic Communications Regulations 2003;

2.1.5. the EU GDPR;

2.1.6. applicable EEA member-state privacy laws;

2.1.7. the Protection of Personal Information Act 4 of 2013 of South Africa;

2.1.8. the California Consumer Privacy Act, as amended;

2.1.9. applicable US state comprehensive privacy laws;

2.1.10. applicable US data breach notification laws; and

2.1.11. another privacy or data protection law applicable to the processing.

2.2. Equivalent terms

2.2.1. Under POPIA:

2.2.1.1. “Controller” includes a responsible party;

2.2.1.2. “Processor” includes an operator;

2.2.1.3. “Personal Data” includes personal information; and

2.2.1.4. “special-category data” includes special personal information.

2.2.2. Under applicable US privacy laws:

2.2.2.1. the Customer is the business or controller; and

2.2.2.2. Kepler is the service provider, contractor or processor.

3. PROCESSING INSTRUCTIONS

3.1. Documented instructions

The Customer instructs Kepler to process Personal Data to:

3.1.1. provide the Service;

3.1.2. secure and support the Service;

3.1.3. operate enabled features and integrations;

3.1.4. operate AI Features selected by the Customer;

3.1.5. follow the Customer’s configuration and use;

3.1.6. comply with further written instructions agreed by the parties;

3.1.7. operate a Messaging Channel enabled by the Customer; and

3.1.8. operate the Mobile Apps deployed to the Customer’s Users.

3.2. Unlawful instructions

3.2.1. Kepler will notify the Customer if it reasonably believes an instruction infringes Data Protection Laws.

3.2.2. Kepler may suspend the affected instruction until it is corrected or withdrawn.

4. CUSTOMER RESPONSIBILITIES

4.1. Controller obligations

The Customer is responsible for:

4.1.1. establishing lawful bases and conditions;

4.1.2. providing privacy notices;

4.1.3. ensuring data accuracy;

4.1.4. data minimisation;

4.1.5. configuring retention periods;

4.1.6. responding to data-subject and consumer requests;

4.1.7. employment-law compliance;

4.1.8. conducting required impact assessments;

4.1.9. complying with workplace-monitoring laws; and

4.1.10. ensuring its instructions are lawful.

5. PURPOSE LIMITATION AND US RESTRICTIONS

5.1. Permitted processing

Kepler will process Personal Data only:

5.1.1. on the Customer’s documented instructions;

5.1.2. for the purposes stated in the Agreement; or

5.1.3. where required by law.

5.2. Restricted activities

Kepler will not:

5.2.1. sell Personal Data;

5.2.2. share Personal Data for cross-context behavioural advertising;

5.2.3. use Personal Data for targeted advertising;

5.2.4. retain, use or disclose Personal Data outside the direct business relationship except as legally permitted;

5.2.5. process Personal Data for a commercial purpose unrelated to the Service;

5.2.6. combine Personal Data with data received from another customer, except as legally permitted to provide or secure the Service; or

5.2.7. use Personal Data to train a foundation or generally available machine-learning model.

5.3. Certification

Kepler certifies that it understands and will comply with the restrictions in clause 5.2.

5.4. Verification and remediation

5.4.1. The Customer may take reasonable steps to verify Kepler’s compliance.

5.4.2. Following notice of unauthorised processing, Kepler will take reasonable steps to stop and remediate it.

6. CONFIDENTIALITY AND SECURITY

6.1. Personnel confidentiality

Kepler will ensure that persons authorised to process Personal Data:

6.1.1. are bound by confidentiality;

6.1.2. receive appropriate training; and

6.1.3. access Personal Data only on a need-to-know basis.

6.2. Security measures

6.2.1. Kepler will implement and maintain the measures in Schedule 5 to this Schedule.

6.2.2. The measures will be appropriate to the risk and consistent with:

6.2.2.1. Article 32 of the UK GDPR and EU GDPR;

6.2.2.2. section 19 of POPIA; and

6.2.2.3. applicable US security requirements.

6.3. Updates

Kepler may update the security measures if the overall level of protection is not materially reduced.

7. DATA-SUBJECT AND CONSUMER REQUESTS

7.1. Assistance

Kepler will provide reasonable assistance with requests concerning:

7.1.1. access;

7.1.2. correction;

7.1.3. deletion;

7.1.4. restriction;

7.1.5. portability;

7.1.6. objection;

7.1.7. opt-out rights; and

7.1.8. automated decision-making rights.

7.2. Self-service tools

The Customer must use available self-service tools in the first instance.

7.3. Direct requests

If Kepler receives a request concerning Customer Data directly from an individual, Kepler will:

7.3.1. forward the request to the Customer;

7.3.2. direct the individual to the Customer; and

7.3.3. not respond substantively unless instructed or required by law.

7.4. Disproportionate assistance

Kepler may charge reasonable, pre-agreed fees for bespoke, repetitive or disproportionate assistance.

8. PERSONAL DATA BREACHES

8.1. Notice

Kepler will notify the Customer without undue delay and, in any event, within 48 hours after becoming aware of a Personal Data Breach affecting Customer Data.

8.2. Information

As information becomes available, Kepler will provide:

8.2.1. the nature of the breach;

8.2.2. affected categories of Personal Data;

8.2.3. approximate numbers of affected individuals and records;

8.2.4. likely consequences;

8.2.5. containment and remediation measures; and

8.2.6. a contact for further information.

8.3. Cooperation

Kepler will reasonably assist the Customer with notification, investigation and remediation obligations.

8.4. No admission

A breach notice is not an admission of fault or liability.

9. SUB-PROCESSORS

9.1. General authorisation

The Customer gives general written authorisation for Kepler to appoint sub-processors.

9.2. List

Kepler will maintain a current Sub-processor List identifying:

9.2.1. the sub-processor;

9.2.2. its function;

9.2.3. relevant processing locations; and

9.2.4. applicable transfer safeguards.

9.3. Notice

Kepler will give at least 30 days’ notice before a new sub-processor begins processing Customer Personal Data.

9.4. Objection

9.4.1. The Customer may object within the notice period on reasonable data protection grounds.

9.4.2. The parties will attempt to resolve the objection in good faith.

9.4.3. If no reasonable alternative is available within 30 days, the Customer may terminate the affected Service and receive a pro rata refund of unused prepaid Fees attributable to that Service.

9.5. Sub-processor obligations

9.5.1. Kepler will impose written data protection obligations no less protective than the relevant obligations in this Schedule.

9.5.2. Kepler remains responsible for a sub-processor’s performance to the extent required by Data Protection Laws.

10. IMPACT ASSESSMENTS AND REGULATORS

10.1. Assistance

Kepler will provide reasonable assistance with:

10.1.1. data protection impact assessments;

10.1.2. algorithmic or AI impact assessments;

10.1.3. prior consultation with a regulator; and

10.1.4. regulatory enquiries relating to the Service.

10.2. Scope

10.2.1. Assistance may include information about:

10.2.1.1. architecture;

10.2.1.2. security measures;

10.2.1.3. data flows;

10.2.1.4. sub-processors; and

10.2.1.5. AI safeguards.

10.2.2. Kepler is not responsible for completing the Customer’s assessment.

11. AUDITS

11.1. Standard assurance

Kepler will provide information reasonably necessary to demonstrate compliance, ordinarily through:

11.1.1. security documentation;

11.1.2. technical and organisational measures;

11.1.3. relevant audit reports or certifications;

11.1.4. penetration-test summaries; and

11.1.5. a reasonable security questionnaire.

11.2. Additional audit

If the standard information is insufficient, the Customer may request an audit:

11.2.1. on at least 30 days’ notice;

11.2.2. no more than once in a 12-month period, unless required by a regulator or following a breach;

11.2.3. during business hours;

11.2.4. without unreasonable disruption;

11.2.5. through an independent auditor bound by confidentiality; and

11.2.6. at the Customer’s cost, including Kepler’s reasonable support costs.

11.3. Audit restrictions

An audit must not:

11.3.1. expose another customer’s data;

11.3.2. compromise security; or

11.3.3. disclose information prohibited by another legal obligation.

12. INTERNATIONAL TRANSFERS

12.1. Production hosting

12.1.1. Production Personal Data is hosted in Google Cloud’s europe-west1 region in St Ghislain, Belgium.

12.1.2. The hosting location is within the European Economic Area.

12.2. AI processing

12.2.1. AI Features are served through Google Vertex AI within the same Google Cloud region and environment.

12.2.2. Customer Data does not leave that environment for model inference.

12.3. UK to EEA transfers

UK-origin Personal Data may be transferred to the EEA in reliance on applicable UK adequacy regulations.

12.4. EEA data

EEA-origin Personal Data remains in the EEA for production hosting.

12.5. South African access

12.5.1. Kepler Experience (Pty) Ltd provides engineering, product and support personnel who may remotely access the Belgian environment.

12.5.2. Its registered address is 1 Sturdee Avenue, Rosebank, Johannesburg, South Africa.

12.6. United States access

12.6.1. Anthropic, PBC provides an internal engineering tool used by Kepler personnel, which may process Personal Data where a development, quality assurance or support task requires it.

12.6.2. Its processing location is the United States.

12.7. Transfer mechanisms

For restricted transfers to South Africa and the United States:

12.7.1. the UK International Data Transfer Addendum applies to UK-origin Personal Data; and

12.7.2. the EU Standard Contractual Clauses under Decision (EU) 2021/914 apply to EEA-origin Personal Data.

12.8. SCC modules

12.8.1. Module Two applies where the Customer is a controller.

12.8.2. The appropriate module applies where the Customer is itself a processor.

12.8.3. Schedules 3, 4 and 5 to the Agreement complete the relevant transfer details.

12.9. Supplementary safeguards

Kepler will maintain appropriate transfer risk assessments and safeguards, including:

12.9.1. encryption;

12.9.2. least-privilege access;

12.9.3. multi-factor authentication;

12.9.4. access logging; and

12.9.5. contractual confidentiality.

12.10. POPIA transfers

Transfers from South Africa will comply with section 72 of POPIA through binding agreements and appropriate safeguards.

12.11. Change in hosting location

12.11.1. Kepler will not move primary production hosting outside the EEA without at least 30 days’ notice.

12.11.2. The Customer may object on reasonable data protection grounds using the process in clause 9.4.

12.12. Invalid transfer mechanism

If a transfer mechanism becomes invalid, the parties will cooperate to implement a valid replacement without undue delay.

12.13. Messaging and notification providers

12.13.1. Where a Messaging Channel is enabled, Meta Platforms Ireland Limited processes message content in connection with the WhatsApp Business Platform. Its primary establishment is in Ireland, within the European Economic Area.

12.13.2. Where a Mobile App is used, Apple Distribution International Ltd and Google Ireland Limited process notification tokens and payloads for delivery to Devices.

12.13.3. Where those providers transfer Personal Data outside the EEA, they do so under their own transfer mechanisms, including the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.

13. GOVERNMENT REQUESTS

13.1. Response

If Kepler receives a binding government request for Customer Personal Data, Kepler will, where lawful:

13.1.1. notify the Customer;

13.1.2. seek a waiver of any prohibition on notice;

13.1.3. challenge unlawful, overbroad or disproportionate requests;

13.1.4. disclose only the minimum information legally required; and

13.1.5. document the request and response.

14. AI PROCESSING

14.1. Data minimisation

When AI Features are enabled, Kepler will submit only the Personal Data reasonably necessary for the requested function.

14.2. No training

Neither Kepler nor an AI sub-processor will use Customer Data to train, fine-tune or improve a foundation or generally available machine-learning model.

14.3. Retention by AI provider

Customer Data submitted to an AI Feature will not be retained by the AI sub-processor beyond what is necessary to return the output and any disclosed security or abuse-monitoring period.

14.4. Human oversight

14.4.1. AI output is advisory.

14.4.2. The Customer must ensure meaningful human review of material employment decisions.

14.5. Disablement

An Admin may disable AI Features at Workspace level where that functionality is available.

15. RETENTION, RETURN AND DELETION

15.1. Continued Workspace

15.1.1. Customer Data may remain in the Workspace while the Workspace continues to exist.

15.1.2. Continued storage is subject to:

15.1.2.1. the Customer’s documented instructions;

15.1.2.2. configured retention periods;

15.1.2.3. data minimisation;

15.1.2.4. deletion requests;

15.1.2.5. legal holds;

15.1.2.6. account closure; and

15.1.2.7. Applicable Data Protection Laws.

15.1.3. Downgrade to the Free Plan must not be interpreted as permission to retain Personal Data indefinitely without a lawful purpose.

15.2. Customer deletion controls

Kepler will provide practical processes through which an authorised Customer may:

15.2.1. delete records;

15.2.2. configure retention;

15.2.3. export Customer Data; and

15.2.4. close the Workspace.

15.3. Restricted deletion state

15.3.1. Deleted records may enter a restricted, non-queryable state for a Customer-configurable period between 7 and 90 days.

15.3.2. The default restricted period may be 30 days.

15.3.3. At the end of the applicable period, the record will be:

15.3.3.1. securely destroyed;

15.3.3.2. archived where a lawful retention rule applies; or

15.3.3.3. verifiably de-identified.

15.4. Legal holds

15.4.1. A legal hold may suspend deletion only while it remains justified.

15.4.2. Legal holds must be documented and periodically reviewed.

15.5. Final termination or closure

On final account closure or termination without downgrade:

15.5.1. the Customer may export Customer Data for 30 days;

15.5.2. Kepler will delete Customer Data from live production systems within 90 days after the export period; and

15.5.3. backup copies will be overwritten on a rolling cycle within 35 days after deletion from live systems.

15.6. Backups

Until overwritten, backup copies will:

15.6.1. remain encrypted;

15.6.2. remain beyond ordinary operational use;

15.6.3. be accessible only for disaster recovery; and

15.6.4. remain subject to this Schedule.

15.7. Required retention

15.7.1. Kepler may retain Personal Data where required by law or a valid legal hold.

15.7.2. Retained data will be restricted to storage and deleted when the legal requirement or hold ends.

15.8. Deletion confirmation

On written request, Kepler will provide reasonable confirmation of deletion.

16. LIABILITY AND PRECEDENCE

16.1. Liability

16.1.1. Liability under this Schedule is subject to clause 52 of the main Agreement.

16.1.2. Nothing limits an individual’s statutory rights under Data Protection Laws.

16.2. Precedence

If this Schedule conflicts with another part of the Agreement on a data protection matter, this Schedule prevails.

17. MESSAGING CHANNELS

17.1. Scope

Where the Customer enables a Messaging Channel, Customer Personal Data is transmitted to the messaging provider and to the Device of the authorised User who requested it.

17.2. Role

Kepler processes that Personal Data as processor, on the Customer’s instruction, up to the point of delivery.

17.3. After delivery

17.3.1. Kepler has no control over Personal Data once delivered to a recipient Device.

17.3.2. Deletion, restriction and data-subject rights in respect of delivered messages are matters for the Customer and the recipient.

17.4. Minimisation

17.4.1. Message content is limited to the information reasonably necessary to answer the request.

17.4.2. Special-category and sensitive Personal Data is excluded at the data layer.

17.4.3. Where a request cannot be answered within those limits, the Service directs the User to the Service interface.

17.5. Controls

Kepler applies number verification, revocation on offboarding, per-User and per-Workspace enablement, rate limiting, and logging of each message event.

17.6. Logging

17.6.1. Kepler logs the requesting User, the time, the record type requested and the delivery outcome.

17.6.2. Message content is not retained in the log beyond the period necessary for delivery, support and abuse detection.

18. MOBILE APPLICATIONS

18.1. Scope

Where a User installs a Mobile App, Kepler processes Personal Data on the Device and through the Mobile App in order to provide the Service.

18.2. Additional data

In addition to the categories in Schedule 3, the following may be processed:

18.2.1. Device type, operating system and application version;

18.2.2. a push notification token issued by the platform provider;

18.2.3. application and crash diagnostics; and

18.2.4. authentication and session data held in the Device’s secure storage.

18.3. Biometric unlock

18.3.1. Where a User enables biometric unlock, authentication is performed by the Device operating system.

18.3.2. Kepler does not receive, process or store biometric data.

18.4. Notification content

Notification previews are limited to information necessary to identify the event and exclude special-category and sensitive Personal Data.

18.5. On removal

When a User’s Account is suspended or removed, the Mobile App session is invalidated and locally cached Customer Data is cleared on next launch.

Schedule 3: Details of Processing

1. SUBJECT MATTER

1.1. Description

Provision of the hr goat cloud HR platform for:

1.1.1. people management;

1.1.2. employment records;

1.1.3. skills and learning;

1.1.4. performance;

1.1.5. engagement;

1.1.6. compliance;

1.1.7. reporting;

1.1.8. payroll-related administration where enabled; and

1.1.9. AI Features.

2. DURATION

2.1. Processing period

Processing continues:

2.1.1. for the term of the Agreement;

2.1.2. while the Workspace remains open; and

2.1.3. during applicable export, deletion, backup, legal-hold and legally required retention periods.

3. NATURE AND PURPOSE

3.1. Processing activities

Processing may include:

3.1.1. collection;

3.1.2. recording;

3.1.3. organisation;

3.1.4. structuring;

3.1.5. storage;

3.1.6. retrieval;

3.1.7. consultation;

3.1.8. use;

3.1.9. analysis;

3.1.10. generation of summaries and other output;

3.1.11. authorised disclosure;

3.1.12. restriction;

3.1.13. export;

3.1.14. erasure; and

3.1.15. destruction.

4. DATA SUBJECTS

4.1. Categories

Data subjects may include:

4.1.1. employees;

4.1.2. workers;

4.1.3. contractors;

4.1.4. agency staff;

4.1.5. applicants and candidates;

4.1.6. former personnel;

4.1.7. managers;

4.1.8. Admins; and

4.1.9. authorised Users.

5. PERSONAL DATA

5.1. Categories

Personal Data may include:

5.1.1. identity and contact information;

5.1.2. employee or worker numbers;

5.1.3. employment status and contract type;

5.1.4. job titles, roles, departments and managers;

5.1.5. work location and working patterns;

5.1.6. start and end dates;

5.1.7. performance objectives, reviews and feedback;

5.1.8. skills, learning, qualifications and certifications;

5.1.9. survey and engagement data;

5.1.10. policy acknowledgements and compliance records;

5.1.11. leave, attendance and absence information;

5.1.12. compensation, payroll and banking data where enabled;

5.1.13. User IDs, IP addresses, device and browser information;

5.1.14. access and audit logs;

5.1.15. content submitted to AI Features;

5.1.16. push notification tokens and Device operating system and application version;

5.1.17. application and crash diagnostics; and

5.1.18. message content and delivery metadata where a Messaging Channel is enabled.

6. SPECIAL-CATEGORY OR SENSITIVE DATA

6.1. Conditional processing

6.1.1. The Service does not require sensitive data for every function.

6.1.2. Where the Customer chooses to submit such data, it may include:

6.1.2.1. health information relating to sickness, disability or workplace adjustments;

6.1.2.2. racial or ethnic origin for lawful diversity monitoring;

6.1.2.3. trade-union information;

6.1.2.4. biometric data where a separately enabled feature lawfully requires it; or

6.1.2.5. other sensitive information entered by the Customer.

6.1.3. The Customer is responsible for establishing the required lawful condition and safeguards.

Schedule 4: Sub-Processors

1. CURRENT SUB-PROCESSORS

1.1. Google Cloud EMEA Limited

1.1.1. Function: Cloud hosting, databases, storage, backup, infrastructure and AI inference through Google Vertex AI.

1.1.2. Data subjects: Employees, workers, applicants, former personnel, Admins and authorised Users.

1.1.3. Data: Customer Data processed through the Service.

1.1.4. Primary processing location: Belgium, EEA.

1.1.5. Safeguards: Google Cloud data processing terms, applicable Standard Contractual Clauses, security measures and certifications.

1.2. Kepler Experience (Pty) Ltd

1.2.1. Function: Restricted remote engineering, product and support access.

1.2.2. Data subjects: Employees, workers, applicants, former personnel, Admins and authorised Users.

1.2.3. Data: Customer Data accessed only as necessary for authorised support, engineering and product services.

1.2.4. Processing location: South Africa.

1.2.5. Safeguards: Intra-group data processing agreement, EU Standard Contractual Clauses, UK International Data Transfer Addendum, POPIA section 72 safeguards, transfer risk assessment and supplementary security controls.

1.3. Stripe Payments UK Ltd

1.3.1. Function: Payment processing, subscription billing, invoicing and tax calculation.

1.3.2. Data subjects: Customer billing contacts, Account owners and persons making payments.

1.3.3. Data: Billing contact information, invoice information, payment tokens, card metadata, payment status and tax-related information.

1.3.4. Processing location: United Kingdom.

1.3.5. Safeguards: Stripe’s data processing terms and applicable international transfer mechanisms.

1.4. Customer.io (Peaberry Software, Inc.)

1.4.1. Function: Delivery of product, lifecycle and system email to Admins and Users.

1.4.2. Data subjects: Admins, authorised Users and recipients of Service communications.

1.4.3. Data: Name, email address, workspace identifiers, message content and delivery, open and engagement metadata.

1.4.4. Processing location: European Union data centre, Ireland, EEA.

1.4.5. Safeguards: Customer.io data processing terms, EU Standard Contractual Clauses, UK International Data Transfer Addendum and applicable UK adequacy regulations for UK-origin Personal Data.

1.5. Amazon Web Services EMEA SARL (Amazon SES)

1.5.1. Function: Transactional and system email delivery.

1.5.2. Data subjects: Admins, authorised Users and recipients of Service communications.

1.5.3. Data: Name, email address and the content of transactional messages.

1.5.4. Processing location: Ireland, eu-west-1, EEA.

1.5.5. Safeguards: AWS data processing terms, EU Standard Contractual Clauses, UK International Data Transfer Addendum and applicable UK adequacy regulations for UK-origin Personal Data.

1.6. Phiresky (Pty) Ltd

1.6.1. Function: Supply of Flaredeck for issue tracking and project management, Sceneflow for quality assurance and automated testing, and Cnjure for data visualisation, dashboards and reporting.

1.6.2. Data subjects: Employees, workers, applicants, former personnel, Admins and authorised Users.

1.6.3. Data: Customer Data included in a support or engineering ticket, test data, and Customer Data presented in dashboards and reports.

1.6.4. Processing locations: Europe, Google Cloud. The supplier is established in South Africa and support access may occur from South Africa.

1.6.5. Safeguards: Data processing agreement, EU Standard Contractual Clauses, UK International Data Transfer Addendum, POPIA section 72 safeguards, transfer risk assessment and supplementary security controls.

1.7. Anthropic, PBC

1.7.1. Function: Internal engineering tool used for development, quality assurance, debugging and reporting. Not part of the Service and not in the path of any Customer request.

1.7.2. Data subjects: Employees, workers, applicants, former personnel, Admins and authorised Users.

1.7.3. Data: Customer Data only where an engineering, quality assurance or support task requires access to data containing it. Synthetic or anonymised data is used wherever the task permits.

1.7.4. Processing location: United States.

1.7.5. Safeguards: Anthropic commercial terms and data processing addendum, EU Standard Contractual Clauses, UK International Data Transfer Addendum, transfer risk assessment, restricted and logged access, and contractual prohibition on model training.

1.8. Meta Platforms Ireland Limited (WhatsApp Business Platform)

1.8.1. Function: Transmission of messages between the Service and authorised Users through the WhatsApp Business Platform, where the Customer has enabled the Messaging Channel.

1.8.2. Data subjects: Employees, workers, applicants, former personnel, Admins and authorised Users.

1.8.3. Data: Message content requested by an authorised User, the User’s registered telephone number, and message delivery metadata. Special-category and sensitive Personal Data is excluded.

1.8.4. Processing location: Ireland, EEA, with onward processing by Meta in accordance with its own documentation.

1.8.5. Safeguards: WhatsApp Business Platform terms and data processing terms, EU Standard Contractual Clauses, UK International Data Transfer Addendum, exclusion of special-category data at the data layer, number verification and message event logging.

1.9. Apple Distribution International Ltd (Apple Push Notification service)

1.9.1. Function: Delivery of push notifications to Users’ iOS Devices.

1.9.2. Data subjects: Admins and authorised Users of the Mobile Apps.

1.9.3. Data: Push notification token and notification payload. Previews exclude special-category and sensitive Personal Data.

1.9.4. Processing location: Ireland, EEA, with onward processing by Apple in accordance with its own documentation.

1.9.5. Safeguards: Apple Developer Program terms and applicable data processing terms, EU Standard Contractual Clauses, UK International Data Transfer Addendum.

1.10. Google Ireland Limited (Firebase Cloud Messaging)

1.10.1. Function: Delivery of push notifications to Users’ Android Devices.

1.10.2. Data subjects: Admins and authorised Users of the Mobile Apps.

1.10.3. Data: Push notification token and notification payload. Previews exclude special-category and sensitive Personal Data.

1.10.4. Processing location: As stated in Google’s applicable data processing documentation.

1.10.5. Safeguards: Google data processing terms, EU Standard Contractual Clauses, UK International Data Transfer Addendum.

Schedule 5: Technical and Organisational Measures

1. INFRASTRUCTURE AND SEGREGATION

1.1. Hosting

The Service is hosted on Google Cloud Platform in europe-west1, St Ghislain, Belgium.

1.2. Environment segregation

Production, test and development environments are logically separated.

1.3. Tenant segregation

Workspaces are isolated through tenant-level controls at the application and data layers.

2. ENCRYPTION

2.1. Data in transit

External connections use TLS 1.2 or higher.

2.2. Data at rest

Data at rest uses AES-256 or an equivalent standard.

2.3. Key management

Encryption keys are managed through restricted cloud key-management services.

2.4. Passwords

2.4.1. Passwords are salted and hashed using a computationally expensive one-way algorithm.

2.4.2. Passwords are not stored in recoverable plain text.

3. ACCESS CONTROL

3.1. Role-based access

Production access is role-based and follows the principle of least privilege.

3.2. Multi-factor authentication

Multi-factor authentication is mandatory for personnel with production access.

3.3. Reviews

Production access rights are reviewed at least quarterly.

3.4. Leavers

Access is revoked promptly when personnel leave or no longer require it.

3.5. Shared Accounts

Shared or generic production Accounts are prohibited.

3.6. Support access

Support access to Customer Data is:

3.6.1. limited to authorised personnel;

3.6.2. time-limited where practicable;

3.6.3. granted only where necessary; and

3.6.4. logged.

3.7. Logging

3.7.1. Administrative production access is logged.

3.7.2. Production administrative logs are retained for at least 12 months.

4. APPLICATION AND NETWORK SECURITY

4.1. Development controls

Kepler maintains secure development practices, including:

4.1.1. peer code review;

4.1.2. environment-specific credentials;

4.1.3. managed secret storage;

4.1.4. dependency scanning;

4.1.5. vulnerability scanning;

4.1.6. static analysis;

4.1.7. rate limiting; and

4.1.8. abuse detection.

4.2. Secrets

Production secrets are not stored in source code.

4.3. Network controls

Kepler applies appropriate network restrictions and protections against common web attacks.

5. TESTING AND INCIDENT MANAGEMENT

5.1. Security testing

Kepler performs:

5.1.1. automated security scanning; and

5.1.2. independent penetration testing at least annually and following a material architecture change.

5.2. Incident response

Kepler maintains:

5.2.1. a documented incident-response plan;

5.2.2. severity-based escalation;

5.2.3. named incident responsibilities; and

5.2.4. post-incident corrective-action reviews.

6. BACKUP, RESILIENCE AND DELETION

6.1. Backups

6.1.1. Kepler maintains automated encrypted backups.

6.1.2. Backups are held in a separate failure domain from production where supported by the infrastructure design.

6.2. Restore testing

Restore procedures are tested at least annually.

6.3. Continuity

Kepler maintains business continuity and disaster recovery procedures supporting the objectives in Schedule 1.

6.4. Deletion controls

Deletion uses:

6.4.1. staged restriction;

6.4.2. secure destruction;

6.4.3. controlled archival where lawfully required; or

6.4.4. verified de-identification.

6.5. Backup restoration

6.5.1. Backups are not surgically edited.

6.5.2. An opaque deletion-suppression index may be reapplied before a restored system accepts production traffic.

6.6. Legal holds

Legal holds are documented, assigned to an owner and periodically reviewed.

7. PERSONNEL AND SUPPLIER MANAGEMENT

7.1. Personnel controls

Authorised personnel are subject to:

7.1.1. confidentiality obligations;

7.1.2. appropriate background screening;

7.1.3. annual privacy and security training; and

7.1.4. documented joiner, mover and leaver procedures.

7.2. Supplier controls

Sub-processors are subject to:

7.2.1. due diligence;

7.2.2. written data protection terms;

7.2.3. confidentiality obligations;

7.2.4. security requirements; and

7.2.5. periodic review.

8. AI PROCESSING CONTROLS

8.1. AI environment

AI Features are served through Google Vertex AI in the same Belgian Google Cloud environment used for the Service.

8.2. Data minimisation

Customer Data submitted to an AI Feature is limited to information reasonably necessary for the requested function.

8.3. No training

Customer Data is not used to train a foundation or generally available machine-learning model.

8.4. Disablement

AI Features may be disabled by an Admin where Workspace-level controls are available.

8.5. Human review

8.5.1. AI output is presented as advisory.

8.5.2. Material employment actions require meaningful human review.

9. GOVERNANCE

9.1. Governance measures

Kepler maintains:

9.1.1. records of processing activities where required;

9.1.2. privacy-by-design review;

9.1.3. information security policies;

9.1.4. incident procedures;

9.1.5. supplier management procedures; and

9.1.6. a data protection contact at legal@hrgoat.ai.

9.2. Updates

Kepler may update these measures if the overall level of protection is not materially reduced.

10. MESSAGING CHANNEL CONTROLS

10.1. Enablement

The Messaging Channel is disabled by default and enabled per Workspace and per User.

10.2. Identity binding

A number is verified against a User Account before use and re-verified periodically.

10.3. Revocation

Verification is revoked automatically when an Account is suspended, removed or offboarded.

10.4. Excluded fields

Special-category and sensitive fields are excluded from channel responses by a deny-list enforced at the data layer, which Workspace configuration cannot override.

10.5. Scope of response

Responses are limited to records the requesting User is authorised to view in the Service.

10.6. Rate limiting

Requests are rate limited and unusual volume or pattern raises an alert.

10.7. Logging

Each request and delivery is logged with the requesting User, time, record type and outcome.

10.8. Session expiry

A messaging session expires after a period of inactivity and requires re-authentication.

11. MOBILE APPLICATION CONTROLS

11.1. Transport security

All Mobile App traffic uses TLS 1.2 or above with certificate validation enforced.

11.2. Local storage

Authentication tokens and session data are held in the iOS Keychain or Android Keystore. Customer Data is not written to unprotected local storage.

11.3. Session management

Sessions expire after a defined period of inactivity and are invalidated server-side when an Account is suspended or removed.

11.4. Device integrity

The Mobile App detects jailbroken and rooted Devices and may restrict functionality on them.

11.5. Notification content

Previews exclude special-category and sensitive fields by the same deny-list applied elsewhere in the Service.

11.6. Screen protection

Screens displaying personal data are excluded from the application switcher preview, and screenshot restrictions are applied where the platform supports them.

11.7. Local data clearing

Cached Customer Data is cleared on sign-out, on session invalidation and on next launch after Account removal.

11.8. Release integrity

Mobile Apps are signed, distributed only through official App Stores, and dependency scanning runs in the build pipeline.

11.9. Minimum versions

A minimum supported application version is enforced.