The short version

In plain English. You own the content you put into Yone. We hold it and process it only to run the Service for you, on your instructions, and nothing else. It's stored in the United Kingdom. A small number of named suppliers help us run the Service — they're all listed in Annex III, and we'll tell you 30 days before that list changes. We don't train AI on your content and neither does our AI provider. If something goes wrong we'll tell you within 48 hours. When you leave, you have 30 days to export everything, then we delete it. You can get all of this in a countersigned copy if your procurement team needs one.

The rest of this document is the legally precise version of those promises. Where the plain-English boxes and the clause text differ, the clause text governs.

Part 1 — The agreement

1. Definitions

"Agreement" means the Yone IT Ltd Terms of Service, or any signed order form or subscription agreement, between the parties.

"Customer", "you" means the entity that has subscribed to the Service.

"Customer Personal Data" means Personal Data contained within Customer Data that Yone Processes on behalf of the Customer under the Agreement.

"Data Protection Law" means all laws relating to the Processing of Personal Data applicable to a party, including the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, the EU GDPR (Regulation (EU) 2016/679), the Swiss FADP, and applicable US state privacy laws.

"EU SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.

"IDTA" means the International Data Transfer Agreement issued by the Information Commissioner under s.119A of the Data Protection Act 2018, and "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued under the same section.

"Personal Data", "Controller", "Processor", "Data Subject", "Processing", "Personal Data Breach" and "Supervisory Authority" have the meanings given in the UK GDPR, and equivalent terms in other Data Protection Law are read accordingly.

"Service" means the Yone SaaS platform provided under the Agreement.

"Sub-Processor" means any third party engaged by Yone to Process Customer Personal Data.

"Yone", "we", "us" means Yone IT Ltd, a company registered in England and Wales (Company No. 13073396), registered office 60 Cookridge Drive, LS16 7HW Leeds, United Kingdom.

Capitalised terms not defined here have the meaning given in the Agreement.

2. Scope, Roles and Order of Precedence

In plain English. For the content you put into Yone, you're in charge and we act on your instructions. For our own account and billing records, we're in charge. This document applies automatically — you don't have to sign anything, though you can if you want to.

2.1 Roles

For Customer Personal Data:

• the Customer is the Controller (or, where the Customer is itself a processor for a third party, a processor acting on that third party's instructions), and
• Yone is the Processor.

The Customer warrants that where it acts as a processor for a third-party controller, it has that controller's authority to enter into this Addendum and to give the instructions it gives.

2.2 Yone as Controller

Yone acts as an independent Controller in respect of account, billing, tax, business-verification, support and usage data described in its Privacy Policy. That Processing is outside the scope of this Addendum and is governed by the Privacy Policy.

2.3 Incorporation and precedence

This Addendum forms part of the Agreement and applies automatically from the date the Customer accepts the Agreement. No signature is required, although the parties may execute the signature block below.

In the event of conflict, the order of precedence is: (1) Annex IV and any applicable transfer clauses, (2) this Addendum, (3) the Agreement, (4) the Privacy Policy.

2.4 Changes

Yone may update this Addendum where required by a change in Data Protection Law, a change to the Service, or a change to transfer mechanisms, provided the update does not materially reduce the protection given to Customer Personal Data. Yone will give [30] days' notice of material updates.

3. Processing Instructions

In plain English. We only do what you tell us to. Your instructions are this contract plus however you and your users configure and use the product. If you ask us to do something outside the product, we can charge for it. If you ask us to do something unlawful, we'll say so and can pause until it's sorted.

3.1 Documented instructions

Yone will Process Customer Personal Data only on the Customer's documented instructions, including in relation to international transfers, unless required to do otherwise by law applicable to Yone. Where such a legal requirement applies, Yone will inform the Customer before Processing unless the law prohibits it on important grounds of public interest.

3.2 What constitutes an instruction

The Customer's documented instructions comprise:

• the Agreement and this Addendum, including Annex I;
• the Customer's and its authorised users' configuration and use of the Service through its documented interfaces and features; and
• any further written instruction agreed in writing between the parties.

Yone is not obliged to comply with instructions outside the scope of the Service. Where Yone reasonably considers an instruction requires material work beyond the Service as delivered, the parties will discuss a reasonable fee before Yone performs it.

3.3 Unlawful instructions

Yone will inform the Customer if, in its opinion, an instruction infringes Data Protection Law. Yone may suspend Processing of the affected data until the instruction is confirmed, amended or withdrawn, without liability.

3.4 Customer responsibilities

The Customer is responsible for:

• the accuracy, quality and legality of Customer Personal Data and the means by which it acquired it;
• having a valid lawful basis for the Processing it instructs, and for meeting its transparency obligations to Data Subjects;
• the configuration of user roles, permissions and access within its account, and for promptly removing access for departed users;
• endpoint security on the devices its users use to access the Service, and instructing users to log out on shared or public devices, given the client-side caching described in Annex II §13;
• responding to Data Subjects in respect of Customer Personal Data.

4. Restrictions on Personal Data Submitted

In plain English. Yone is built for business architecture content, not for sensitive personal records. Please don't put health data, criminal records, children's data, card numbers or ID numbers into it. If you do, that's on you — the product isn't designed or certified for it.

The Service is designed for business architecture content. The Customer must not submit to the Service, and must not instruct Yone to Process:

• special category Personal Data within the meaning of Article 9 UK/EU GDPR (health, biometric or genetic data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation);
• Personal Data relating to criminal convictions or offences within the meaning of Article 10;
• Personal Data of children under 18;
• payment card data subject to PCI DSS, financial account numbers, government identification numbers, or equivalent;
• Personal Data whose Processing is subject to sector-specific regulatory requirements (for example HIPAA-regulated protected health information, or data subject to defence, national security or export-control restrictions),

in each case unless the parties have agreed otherwise in a signed written agreement that addresses the additional requirements.

The Service is not designed for, and Yone makes no representation as to its suitability for, such data. The Customer is solely responsible for any submission in breach of this Clause 4, and Clause 16.3 applies.

5. Confidentiality of Personnel

In plain English. Only the people who need access get it, they're all under confidentiality obligations that outlast their employment, and they're trained.

Yone will ensure that all personnel authorised to Process Customer Personal Data:

• are subject to a binding contractual or statutory duty of confidentiality that survives termination of their engagement;
• Process Customer Personal Data only as necessary to perform Yone's obligations, on a least-privilege and need-to-know basis; and
• receive appropriate data protection and security awareness training, refreshed at least annually.

6. Security

In plain English. Annex II lists exactly what we do to keep your data safe. We can improve those measures but not water them down. Your side of the line is your own passwords and who you give access to.

Yone will implement and maintain the technical and organisational measures set out in Annex II, designed to ensure a level of security appropriate to the risk, having regard to the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing.

Yone may update the measures in Annex II from time to time, provided the updated measures do not materially reduce the overall level of security.

The Customer is responsible for the security measures within its own control, including credential hygiene, enforcement of multi-factor authentication where offered, and the access rights it grants its users. Yone is not responsible for the consequences of unauthorised access resulting from the Customer's or its users' failure to protect their credentials.

7. Sub-Processors

In plain English. Annex III names every supplier that touches your data and says what each one does. We'll give you 30 days' notice before adding a new one. If you object on data protection grounds and we can't find a workaround, you can cancel the affected part and get the unused money back. We stay responsible for whatever our suppliers do.

7.1 General authorisation

The Customer gives Yone general written authorisation to engage Sub-Processors, subject to this Clause 7 and Annex III.

7.2 Current Sub-Processors

The Sub-Processors approved as at the effective date are listed in full in Annex III to this Addendum. Annex III forms part of this Addendum and is the authoritative list; no separate sub-processor page needs to be consulted. A mirror of Annex III, together with an email notification signup, is maintained at [LINK — optional, see review notes].

7.3 Obligations on Sub-Processors

Before engaging a Sub-Processor, Yone will carry out reasonable due diligence on its technical and organisational measures, and will impose on it by written contract data protection obligations no less protective than those in this Addendum, including obligations of confidentiality, security and assistance.

Yone remains fully liable to the Customer for the performance of each Sub-Processor's obligations.

7.4 New Sub-Processors, notice and objection

The process for changing Annex III is set out in Annex III, Part B, and forms part of this Clause 7. In summary: [30] days' advance notice, a [15] day objection window on reasonable data protection grounds, good-faith discussion, and — if no alternative can be agreed — termination of the affected part of the Service with a pro-rata refund as the Customer's sole remedy.

7.5 Emergency replacement

Where a Sub-Processor must be replaced urgently for security, legal or availability reasons, Yone may do so immediately and will notify the Customer as soon as reasonably practicable, at which point the objection process in Annex III, Part B applies retrospectively.

8. Assistance with Data Subject Rights

In plain English. If one of your people asks to see, correct, export or delete their data, the product already lets you do that yourself. Where it doesn't, we'll help. If a data subject writes to us directly, we won't answer for you — we'll pass it straight to you.

Taking into account the nature of the Processing, Yone will assist the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling its obligation to respond to requests by Data Subjects to exercise their rights of access, rectification, erasure, restriction, portability, and objection.

The Service provides functionality allowing the Customer to access, correct, export and delete Customer Personal Data directly. Yone's assistance obligation is discharged where the Customer can perform the action itself using that functionality.

If Yone receives a request directly from a Data Subject relating to Customer Personal Data, Yone will not respond to it substantively, and will promptly forward it to the Customer and direct the Data Subject to the Customer.

Yone may charge a reasonable fee for assistance that is manifestly excessive, repetitive, or requires material engineering effort beyond the Service's functionality.

9. Assistance with Security, Breaches and Impact Assessments

In plain English. If you need to run a DPIA, answer a regulator, or handle a breach, we'll give you the information you need. Annex II and our security documentation usually cover it.

Taking into account the nature of Processing and the information available to it, Yone will provide reasonable assistance to the Customer in complying with its obligations under Articles 32 to 36 UK/EU GDPR, including:

• security of Processing (Article 32);
• notification of Personal Data Breaches to the Supervisory Authority and to Data Subjects (Articles 33 and 34);
• data protection impact assessments (Article 35); and
• prior consultation with a Supervisory Authority (Article 36).

Yone will make available the information reasonably necessary for these purposes, including its security documentation and Annex II. Clause 12 applies to requests for further information. Yone may charge a reasonable fee for assistance beyond the provision of standard documentation.

10. Personal Data Breach Notification

In plain English. If your data is breached, we tell you within 48 hours of finding out — not "eventually". You'll get what we know at the time, and updates as we learn more. You handle telling the regulator and the individuals, because you're the controller. Neither of us names the other publicly without agreeing first.

Yone will notify the Customer without undue delay, and in any event within [48] hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

The notification will include, to the extent known at the time and supplemented as further information becomes available:

• the nature of the breach, including where possible the categories and approximate number of Data Subjects and records concerned;
• the likely consequences of the breach;
• the measures taken or proposed to address the breach and mitigate its effects; and
• the name and contact details of a point of contact at Yone.

Yone will take reasonable steps to contain and remediate the breach and will cooperate with the Customer's reasonable investigation. Notification is not an acknowledgement of fault or liability.

The Customer is responsible for any notification to a Supervisory Authority or to Data Subjects in respect of Customer Personal Data. Neither party will name the other in a public statement about a breach without prior written consent, unless legally required.

11. Data Residency and International Transfers

In plain English. Your content is stored in the UK. Some of our suppliers are abroad — Annex III says which, and Annex IV says what legal protections cover those transfers. EU customers are covered by the UK's adequacy decision, and if that ever lapses, EU Standard Contractual Clauses kick in automatically without either of us having to do anything. If a government asks us for your data, we tell you and push back where we can.

11.1 Data residency

Customer Personal Data is hosted and stored at rest in the United Kingdom. Yone may add further hosting regions and will update Annex I and its Privacy Policy before doing so.

Limited Processing takes place outside the United Kingdom where a Sub-Processor listed in Annex III is located elsewhere, as identified in that Annex. Yone does not warrant that the Service satisfies data localisation requirements outside the United Kingdom.

11.2 Transfers from the EEA to the United Kingdom

The European Commission renewed its adequacy decision for the United Kingdom on 19 December 2025, effective until 27 December 2031. Transfers of Customer Personal Data from the EEA to Yone in the United Kingdom are therefore made on the basis of that adequacy decision.

If the adequacy decision is withdrawn, suspended, invalidated or allowed to lapse, the EU SCCs (Module Two: controller to processor) are deemed incorporated into this Addendum and take effect automatically, completed as set out in Annex IV, without further action by either party.

11.3 Transfers from the United Kingdom to third countries

Where Yone transfers Customer Personal Data to a Sub-Processor outside the United Kingdom, it will do so only where one of the following applies:

• the destination is covered by UK adequacy regulations;
• the IDTA or the UK Addendum to the EU SCCs is in place, supported by a documented data protection test (transfer risk assessment); or
• another lawful transfer mechanism under Chapter V UK GDPR applies.

The mechanism relied on for each Sub-Processor is identified in Annex III. Copies are available to the Customer on request.

11.4 Government access requests

If Yone receives a legally binding request from a public authority for disclosure of Customer Personal Data, it will:

• notify the Customer promptly, unless legally prohibited;
• use reasonable efforts to obtain a waiver of any prohibition on notification, and to redirect the authority to request the data directly from the Customer;
• challenge the request where there are reasonable grounds to consider it unlawful; and
• disclose only the minimum amount of data required.

Yone will, where permitted, publish aggregate statistics on such requests.

12. Audit and Information Rights

In plain English. You can audit us, but start with the documentation — that answers most questions. If you need more, you can inspect once a year with 30 days' notice, during working hours, limited to systems that touch your data. You pay, unless we turn out to be in material breach.

Yone will make available to the Customer all information reasonably necessary to demonstrate compliance with Article 28 UK/EU GDPR, and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by it.

The parties agree that this obligation is satisfied in the first instance by Yone providing:

• this Addendum, including Annex II;
• its then-current security documentation and policies; and
• any available third-party audit report or certification held — e.g. ISO 27001, SOC 2 Type II, Cyber Essentials.

Where the above is insufficient to demonstrate compliance, or following a Personal Data Breach, the Customer may request an on-site or remote audit, subject to the following:

• at least [30] days' prior written notice;
• no more than once in any 12-month period, except where required by a Supervisory Authority or following a Personal Data Breach;
• conducted during normal business hours, in a manner that does not unreasonably disrupt Yone's operations;
• limited in scope to systems and records relating to Customer Personal Data, and not extending to any data of Yone's other customers, Yone's own confidential or commercially sensitive information, or physical access to third-party data centres;
• the auditor must not be a competitor of Yone and must sign a reasonable confidentiality undertaking;
• findings are the Confidential Information of both parties; and
• the Customer bears its own and Yone's reasonable costs, at Yone's then-current professional services rates, except where the audit reveals a material breach by Yone.

13. Deletion and Return of Customer Personal Data

In plain English. Export whenever you like. After you leave you have 30 days to get everything out. Then we delete it from live systems within 30 days and from backups within another 7 as they rotate. We keep invoices for six years because tax law requires it — nothing else.

On termination or expiry of the Agreement, Yone will, at the Customer's election, delete or return Customer Personal Data, and delete existing copies, unless required to retain it by law applicable to Yone.

In practice:

Data held in backups pending rotation remains subject to this Addendum and to Annex II. Any data retained under a legal obligation remains subject to the confidentiality and security obligations in this Addendum and will be Processed only for the purpose requiring its retention.

Yone will confirm deletion in writing on the Customer's written request.

14. Artificial Intelligence Features

In plain English. When your users invoke an AI feature, the content of that request goes to our AI provider to generate an answer and comes straight back. It is not used to train any model — not ours, not theirs. Nothing is decided automatically about anyone; a human always reviews the output before it's saved.

Where the Customer or its users invoke the Service's AI Features, Customer Personal Data contained in the submitted content is transmitted to the AI Sub-Processor identified in Annex III for the purpose of generating a response. In relation to that Processing:

• Customer Personal Data and prompts are not used to train or fine-tune any AI model, and Yone will contractually prohibit its AI Sub-Processors from doing so;
• content is Processed transiently to serve the request. Retention beyond that point varies by AI Sub-Processor: Anthropic (used for Claude models) automatically deletes inputs and outputs within 30 days of receipt or generation, save that content flagged by its automated Trust & Safety systems as a potential violation of its usage policy may be retained for up to 2 years; Microsoft (used for other models via Azure AI Foundry) does not store prompts or completions in the model itself and does not use them to train or improve its models, but may retain a sample for abuse-monitoring review in accordance with its own published data-processing terms. Neither retains content to train or fine-tune any model without our express permission. Current detail for each Sub-Processor is at Annex III;
• the AI Features do not carry out automated decision-making producing legal or similarly significant effects on Data Subjects within the meaning of Article 22 UK/EU GDPR; all output is presented to a human user for review, amendment or rejection before it is saved;
• transfer of content to an AI Sub-Processor outside the United Kingdom is subject to Clause 11.3;
• the Customer instructs Yone to carry out this Processing by its users' use of the AI Features, and Clause 4 applies to the content submitted.

15. California and Other US State Privacy Laws

In plain English. For US customers: we're your service provider, we don't sell or share your data, and we don't use it for anything except running the Service for you.

Where the California Consumer Privacy Act as amended by the CPRA ("CCPA") applies to Customer Personal Data:

• the Customer is a Business and Yone is a Service Provider as those terms are defined in the CCPA;
• Yone will not sell or share Customer Personal Data as those terms are defined in the CCPA;
• Yone will not retain, use or disclose Customer Personal Data for any purpose other than performing the services specified in the Agreement, or as otherwise permitted by the CCPA, and will not do so outside the direct business relationship between the parties;
• Yone will not combine Customer Personal Data with personal information received from or on behalf of another person, except as permitted by the CCPA;
• Yone certifies that it understands and will comply with these restrictions;
• Yone will notify the Customer if it determines it can no longer meet its obligations under the CCPA, and the Customer may take reasonable steps to stop and remediate unauthorised use.

Equivalent obligations apply, and Yone acts in the equivalent role, under the comprehensive privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other US states, to the extent applicable.

16. Liability

In plain English. The liability cap in the Terms covers this document too — it's one shared cap, not two. Nothing here limits what a regulator or an individual can claim against either of us directly. If you break Clause 4 and put sensitive data in, you cover the consequences.

16.1 Cap

Each party's liability arising out of or in connection with this Addendum is subject to the exclusions and limitations of liability set out in the Agreement. The limitations in the Agreement apply to the parties' aggregate liability under the Agreement and this Addendum taken together, and not separately to each.

16.2 Statutory liability preserved

Nothing in this Clause 16 limits either party's liability to a Data Subject or to a Supervisory Authority under Data Protection Law, or any liability that cannot lawfully be limited.

16.3 Customer indemnity

The Customer will indemnify Yone against all losses, damages, liabilities, fines, costs and expenses (including reasonable legal fees) arising from:

• the Customer's breach of Clause 4 (Restrictions on Personal Data Submitted);
• the Customer's instructions where those instructions infringe Data Protection Law;
• the Customer's failure to have a valid lawful basis for the Processing it instructs, or to meet its transparency obligations to Data Subjects; or
• any claim by a Data Subject or third-party controller arising from the Customer's own acts or omissions.

17. Term and Survival

This Addendum takes effect on the effective date of the Agreement and continues until Yone has ceased all Processing of Customer Personal Data in accordance with Clause 13.

Clauses 5, 6, 10, 11, 13, 16 and 18 survive termination for as long as Yone retains any Customer Personal Data.

18. General

• Severability. If any provision is held invalid or unenforceable, it is modified to the minimum extent necessary or severed, and the remainder continues in force.
• Governing law and jurisdiction. As set out in the Agreement (England and Wales), except where a transfer mechanism in Annex IV requires otherwise, in which case that mechanism prevails for disputes arising under it.
• Notices. Data protection notices to Yone: contact@yone.co.uk, marked for the attention of [PRIVACY CONTACT]. Notices to the Customer: the account contact email, or the data protection contact the Customer has notified in writing.
• Yone's EU representative (Article 27). [INSERT — appointed representative's legal entity name, EU company registration number and EU address. See review notes before completing.]

Part 2 — The annexes

Annex I — Details of Processing

A. Parties

B. Subject matter and nature of the Processing

Provision of a cloud-based business architecture SaaS platform, comprising hosting, storage, structuring, retrieval, organisation, display, transmission, backup, and — where the Customer's users invoke them — analysis and content generation by AI Features, together with support, security monitoring and deletion.

C. Purpose of the Processing

To provide, secure, maintain and support the Service in accordance with the Agreement, and as further instructed by the Customer through its use of the Service.

D. Categories of Data Subjects

The Customer determines what it submits. Typically:

• the Customer's employees, contractors and authorised users of the Service;
• individuals named within business architecture content, such as process owners, system owners, data owners, approvers and accountable persons;
• the Customer's stakeholders, suppliers, vendors and business contacts;
• any other individuals whose Personal Data the Customer's users choose to include in Customer Data.

E. Categories of Personal Data

• Account and user data: name, business email address, job title, organisation, user role and permissions, authentication data, login and activity logs, IP address.
• Content data: business contact details and identifiers, role and responsibility assignments, and any Personal Data the Customer's users include in free-text fields, uploaded documents, notes, requirements or AI prompts.

F. Special category data

None. The Customer is prohibited from submitting special category or criminal offence data under Clause 4.

G. Frequency of Processing

Continuous, for the duration of the Agreement.

H. Duration of Processing

For the term of the Agreement, plus the Grace Period and deletion periods in Clause 13, plus any statutory retention period.

I. Location of Processing

Storage at rest: United Kingdom. Additional Processing locations as identified in Annex III.

Client-side caching: the Service caches unsaved drafts, interface preferences and recently viewed content in browser storage on the Customer's own end-user devices, to provide autosave and resilience against connection loss. That storage is under the Customer's control, not Yone's. Yone clears it on logout. See Annex II §14 and the Cookie and Similar Technologies Policy.

J. Sub-Processors

See Annex III.

Annex II — Technical and Organisational Measures

Reviewer's note: every line below must be true today. Delete anything you do not actually do — an aspirational Annex II is a misrepresentation, and it is the first document a customer's security team will test you against.

1. Access control

• Role-based access control within the Service, administered by the Customer for its own users.
• Least-privilege access for Yone personnel; production access restricted to named individuals with a documented business need.
• Multi-factor authentication enforced on all Yone administrative and production systems.
• Access rights reviewed at least [quarterly] and revoked promptly on role change or departure.
• Passwords stored using bcrypt, a modern salted hashing algorithm.

2. Encryption

• Encryption in transit using TLS 1.2 or above for all connections to the Service and between the Service and Sub-Processors.
• Encryption at rest for databases, object storage and backups using AES-256, applied by default by our hosting provider.
• Key management via Microsoft Azure's platform-managed keys (database and object storage encryption keys are managed by Azure, not by Yone); application secrets (API keys, credentials) are separately held in Azure Key Vault.
• Where we act as a broker or intermediary to a third-party AI Sub-Processor, we do not warrant or guarantee that Sub-Processor's own internal encryption practices beyond what we contractually require of it as a Sub-Processor.

3. Network and infrastructure security

• Hosting in the United Kingdom (UK South region) with Microsoft Azure, in facilities covered by Microsoft's own ISO 27001, SOC 2 Type II and other published Azure compliance certifications.
• Segregation of production, staging and development environments; no Customer Personal Data in non-production environments.
• Firewalling and network segmentation (private networking between application and database); administrative interfaces not publicly exposed.
• Azure's baseline (always-on) network-layer DDoS protection applies to all public endpoints. No dedicated WAF or enhanced DDoS Protection product is currently provisioned.

4. Logical separation

• Customer Data resides in a single shared multi-tenant database. Logical separation between Customers, and between Organisations within a single Customer, is enforced at the application layer: every data record is tagged with an organisation and/or client identifier, and every API request is authenticated and scoped to verify the requesting user's membership of that organisation or client before any data is returned or modified. Attempts to access another tenant's data return a not-found response rather than a permission-denied response, so as not to confirm or deny the existence of another tenant's data.

5. Availability and resilience

• Automated backups taken daily, retained for 7 days, encrypted at rest and stored in the United Kingdom (not geo-redundant outside the UK).
• Restore procedures tested at least annually.

6. Logging and monitoring

• Audit logging of authentication events and administrative actions, retained for [12] months.
• Monitoring and alerting for anomalous access, error rates and availability.
• Logs protected against unauthorised alteration and access.

7. Secure development and vulnerability management

• Version control, peer code review, and separation of duties for production deployment.
• Dependency scanning and prompt remediation of known vulnerabilities, prioritised by severity.
• Documented change management for production changes.

8. Personnel

• Background checks on personnel with production access, where lawful.
• Written confidentiality obligations surviving termination.
• Data protection and security awareness training at onboarding and at least annually.

9. Sub-processor management

• Due diligence before engagement, written data protection terms, and periodic review.
• Sub-processor register maintained at Annex III, with the change process at Annex III Part B.

10. Incident response

• Documented incident response procedure covering detection, triage, containment, eradication, recovery, notification and post-incident review.
• Defined roles and escalation path; procedure reviewed at least annually.

11. Data minimisation and deletion

• Retention periods applied as set out in Clause 13 and the Privacy Policy.
• Documented deletion procedures covering live systems and backup rotation.

12. Physical security

• Physical security is the responsibility of the hosting provider and is covered by its certifications. Yone does not operate its own data centres.
• Yone personnel use full-disk-encrypted devices with screen lock and remote wipe capability.

13. Client-side storage

• The session token is held in an httpOnly, Secure, SameSite cookie and is not accessible to scripts running in the browser. No authentication token or credential is written to browser storage.
• Unsaved drafts, interface preferences and recently viewed content are cached in browser storage on the end-user's device to provide autosave and offline resilience. This cache may contain Customer Personal Data.
• Yone clears this cache on logout. Where a session ends without an explicit logout, the cache persists on the device until the next login or until the user clears their browser data.
• Devices are outside Yone's infrastructure controls. The Customer is responsible for endpoint security on the devices its users use, including disk encryption, screen locks, and instructing users to log out on shared or public machines.
• No analytics, advertising or tracking technology operates within the authenticated Service.

14. Certifications

None currently held

Annex III — Sub-Processors

In plain English. This is the complete list of outside companies that touch data you put into Yone. Part A is the list. Part B is what happens when it changes. Part C names companies people often assume are on the list but aren't, and explains why.

Part A — Current Sub-Processors

Last reviewed: [01-Septmber-2026]

Yone may also disclose Customer Personal Data to professional advisers, auditors and insurers under confidentiality obligations, and to law enforcement or regulators where legally required. These are not Sub-Processors.

Part B — How this list changes

This Part forms part of Clause 7 and is binding.

1. Notice. Yone will notify the Customer at least [30] days before adding or replacing a Sub-Processor, by email to the account contact and, where maintained, by updating the mirror page and notifying subscribers to it.

2. Objection window. The Customer may object in writing within [15] days of notice, on reasonable grounds relating to data protection. An objection must state those grounds. Silence within the window is acceptance.

3. Resolution. The parties will discuss the objection in good faith. Yone will use reasonable efforts to offer a commercially reasonable alternative, workaround, or configuration that avoids the objected-to Sub-Processor.

4. If no resolution. If no alternative is agreed within [30] days of the objection, the Customer may terminate the affected part of the Service on written notice. Yone will refund prepaid fees covering the period after termination on a pro-rata basis. This is the Customer's sole and exclusive remedy in respect of the objection.

5. Emergency changes. Where a Sub-Processor must be replaced urgently for security, legal or availability reasons, Yone may act immediately and give notice as soon as reasonably practicable. Steps 2 to 4 then apply from the date of that notice.

6. Removals. Removing a Sub-Processor, or narrowing the data one can access, does not require notice or trigger an objection right.

Part C — Not Sub-Processors of Customer Personal Data

These are named because customers frequently ask, and because they appear in Yone's Privacy Policy in a different role.

Part D — AI Model Routing Table

This table is the single source of truth for which AI model, provider and deployment configuration handles a given request. Other clauses (Clause 8 and Clause 17 of the Terms of Service, and Clause 14 above) refer to this table rather than restating it.

Note on deployment type and data location: deployment type governs where processing occurs, not just where the resource is created. "Global Standard" deployments store data at rest within the UK Azure geography, but prompt/response processing may occur in any Azure region worldwide where that model is available, per Microsoft's own Global Standard terms. "n/a" (Anthropic direct) means Anthropic's own infrastructure applies instead of Azure's — currently US-based, with no region selection available.

Dedicated key (a client-specific model configuration and key, administrator-provisioned) is available on request but is not a self-service option. Dedicated deployment (an isolated environment with guaranteed capacity) is available on request, subject to a separate agreement, and is not a standing self-service feature.

Annex IV — Transfer Mechanisms

1. EEA to United Kingdom

Primary mechanism: the European Commission's adequacy decision for the United Kingdom of 19 December 2025, in force until 27 December 2031.

Fallback, effective automatically if adequacy ceases to apply: the EU SCCs, Module Two (controller to processor), incorporated by reference and completed as follows:

• Clause 7 (docking clause): applies.
• Clause 9 (sub-processors): Option 2, general written authorisation, with a notice period of [30] days, as set out in Annex III Part B.
• Clause 11 (redress): the optional independent dispute resolution paragraph does not apply.
• Clause 17 (governing law): the law of [Ireland].
• Clause 18(b) (forum): the courts of [Ireland].
• Annex I: as set out in Annex I of this Addendum. Annex II: as set out in Annex II of this Addendum. Annex III: as set out in Annex III Part A of this Addendum.

2. United Kingdom to third countries

For onward transfers to Sub-Processors outside the United Kingdom, Yone relies on the IDTA, or the UK Addendum to the EU SCCs with the EU SCCs completed as above, supported by a documented data protection test. Where the Sub-Processor is certified under the EU–US Data Privacy Framework and the UK Extension, Yone may rely on that framework instead. The mechanism applying to each Sub-Processor is identified in Annex III Part A.

3. Switzerland

Where the Swiss FADP applies, references to the GDPR are read as references to the FADP, the competent authority is the FDPIC, and the term "member state" does not exclude Data Subjects in Switzerland from enforcing their rights in their place of habitual residence.

Signature (optional)

This Addendum applies automatically on acceptance of the Agreement and does not require signature. Where the Customer requires a countersigned copy:

Yone IT Ltd

Name: ______________________ Title: ______________________

Signature: ______________________ Date: ______________

Customer

Entity name: ______________________________________________

Name: ______________________ Title: ______________________

Signature: ______________________ Date: ______________

© 2026 Yone IT Ltd · Company No. 13073396 · Terms · Privacy · Cookies · DPA