Fig Platform Customer Subscription Agreement

These standard subscription terms apply to the organisation identified in your accepted order. Your order confirmation records the order reference, date and commercial details.

1.Agreement overview

This Subscription Agreement is between Fig Technology Limited and the customer named in the Order Form. In this agreement, Fig, we, us and Supplier mean Fig Technology Limited, and Customer, you and your mean the customer named in the Order Form.

The documents that make up the contract are:

1. (a)the accepted Order Form;
2. (b)this Subscription Agreement;
3. (c)the Data Processing Agreement;
4. (d)the Product-Specific Terms;
5. (e)the Service Level Agreement;
6. (f)the Support Policy;
7. (g)the Platform Terms of Use for individual authorised users;
8. (h)any Country Addendum that applies under the Order Form (including the US Country Addendum); and
9. (i)the Documentation.

The current public versions of the supplementary terms are available at the following addresses:

If the documents conflict, the order of priority is: (a) the Order Form, for commercial terms it expressly overrides; (b) any Country Addendum that applies under the Order Form, for the jurisdiction-specific subject matter it covers; (c) this Subscription Agreement; (d) the Data Processing Agreement; (e) the Product-Specific Terms, Service Level Agreement and Support Policy; and (f) the Documentation.

2.Order Form

Each subscription is governed by an Order Form, completed and accepted electronically, which sets out the commercial terms of the subscription. The Order Form records the parties’ details, the subscription plan, the initial and renewal terms, the start date, the Fees and payment terms, any included users, integrations, assets or other usage limits, the support tier, the Fig Software components included, and any special terms or agreed overrides.

The Order Form incorporates this Subscription Agreement and the supplementary terms listed above. Where the Order Form expressly overrides a commercial term, the Order Form prevails.

3.Definitions

In this agreement, except where a different interpretation is necessary in the context, the words and expressions set out below have the following meaning:

Capitalised terms not defined here have the meanings given in the Order Form, Product-Specific Terms or Data Processing Agreement, depending on the context.

4.Your subscription and licence

During the subscription term, and subject to payment of the Fees and compliance with this agreement, Fig grants you a non-exclusive, non-transferable, revocable right to:

1. (a)access and use the Fig Services;
2. (b)install and run the Fig Software; and
3. (c)use the Fig Services for your internal compliance, security, governance and risk-management purposes.

All rights not expressly granted to you are reserved by Fig.

5.Fair use and restrictions

You must not, and must ensure your Authorised Users do not:

1. (a)make the Fig Services available to anyone outside your organisation;
2. (b)resell, sub-license or commercially exploit the Fig Services;
3. (c)modify, reverse engineer, decompile or create derivative works from the Fig Services;
4. (d)probe, test or bypass Fig security controls without Fig’s written permission;
5. (e)use the Fig Services to build or support a competing product;
6. (f)give Fig Service access to a Fig competitor;
7. (g)introduce malicious code;
8. (h)remove Fig branding or proprietary notices;
9. (i)use the Fig Services unlawfully; or
10. (j)use the Fig Services in breach of this agreement or the supplementary terms.

Fig may suspend access immediately where we reasonably suspect a breach of this section or where continued access creates a security or legal risk. Where practical, we will notify you and limit the suspension to what is necessary.

6.Your responsibilities

You are responsible for:

1. (a)approving, managing and removing Authorised Users;
2. (b)ensuring Authorised Users comply with the Platform Terms of Use;
3. (c)giving Fig the co-operation, access and decisions reasonably needed to provide the Fig Services;
4. (d)securing your own endpoints, cloud environments, networks and credentials;
5. (e)ensuring the accuracy of your instructions and data;
6. (f)obtaining the authorisations needed for any scanning, monitoring, integrations or software deployment;
7. (g)complying with applicable law, including data protection law; and
8. (h)making your own compliance, governance and risk-management decisions.

The Fig Services are tools that support your compliance and security programme. They are not legal advice, an audit opinion or a formal certification, and they do not by themselves make you compliant with any law, standard or framework.

7.Fees, invoicing and payment

Fees are set out in the Order Form and are invoiced at the billing frequency and payment cadence stated in the Order Form. Unless the Order Form says otherwise:

1. (a)Fees are invoiced annually in advance, and each invoice is payable within 30 days of the invoice date;
2. (b)all Fees are exclusive of VAT and other applicable taxes;
3. (c)usage above the agreed volume may be invoiced at the rates in the Order Form;
4. (d)disputed invoices must be flagged in writing within 15 days of the invoice date;
5. (e)the undisputed part of an invoice must still be paid on time;
6. (f)late payment more than 15 days overdue may attract interest at 4 per cent per annum above the Bank of England base rate; and
7. (g)late payment may lead to suspension of access.

Fig may increase Fees on each subscription anniversary by giving at least 60 days’ notice. The increase may be up to the greater of 5 per cent or the previous 12 months’ UK CPI increase. Any larger increase needs your consent.

8.Software updates and supported versions

Fig Software updates automatically by default. Fig may release improvements at its discretion and may deprecate features, provided we do not materially reduce the overall functionality ordered by you during the current subscription term or materially weaken the security measures in the Data Processing Agreement.

Fig supports the current release and the immediately preceding release of each Fig Software component. Unsupported versions may lose functionality, support and security updates. When the agreement ends, or when a component is removed from an endpoint or cloud environment, you must uninstall the relevant Fig Software within 30 days.

9.Service levels and support

Fig provides the Fig Platform in accordance with the Service Level Agreement, and support in accordance with the Support Policy. Service Credits under the Service Level Agreement are your sole remedy for a failure to meet the uptime commitment, except that this does not limit your right to terminate for material breach where the Service Level Agreement says that right applies.

10.Ownership, Customer Data and System Data

As between the parties, you own Customer Data; Fig and its licensors own the Fig Services, Fig Software, Documentation, Output and System Data; and nothing in this agreement transfers ownership of Fig’s technology to you.

You grant Fig the licence needed to host, process and use Customer Data to provide the Fig Services, resolve technical issues, comply with law, and generate System Data.

Fig may use System Data in aggregated or de-identified form to operate, secure and improve the Fig Services and to develop new products. Fig will not publish System Data in a way that identifies you or any individual. If you provide feedback, ideas or suggestions about the Fig Services, Fig may use them freely without compensation or attribution.

11.Confidentiality and non-disclosure

In this agreement, “confidential information” means all non-public information disclosed by or on behalf of one party to the other in connection with this agreement, in whatever form, that is identified as confidential or that a reasonable person would consider confidential given its nature and the circumstances of disclosure. Fig’s confidential information includes, without limitation, all non-public information relating to the Fig Services, including pricing, fees, discounts and the commercial terms of the Order Form; product features, functionality, performance and results of testing; roadmaps and release plans; services, service descriptions and delivery methods; the Documentation, security information and Trust Centre materials; and the terms of this agreement. The Customer’s confidential information includes Customer Data and its non-public business, commercial and technical information.

Each party must keep the other party’s confidential information secret, must not disclose it to any third party except as permitted by this clause, use it only to perform and exercise its rights under this agreement, and protect it with at least the same care it applies to its own confidential information of similar importance.

Confidential information may be shared with professional advisers and contractors, provided equivalent confidentiality obligations apply. Confidential information may also be disclosed where required by law or a regulator. The confidentiality obligations do not apply to information that is public, already known, independently developed, or lawfully received from a third party. These obligations survive termination for 5 years, and indefinitely for trade secrets.

12.Data protection

Each party will comply with the Data Processing Agreement for personal data processed in connection with the Fig Services. The Data Processing Agreement sets out the parties’ Controller, Processor and Sub-processor roles; the processing details; Fig’s processor obligations; breach notification commitments; security measures; Sub-processor rules; international transfer mechanisms; data retention; audit rights; and liability treatment.

The live Sub-processor List is maintained at https://www.figgroup.co.uk/subprocessors. The Trust Centre at https://docs.figgroup.co.uk contains current security, audit and assurance evidence, subject to access controls.

13.Warranties and disclaimers

Each party warrants that it is duly incorporated or validly existing, has authority to enter into this agreement, and will comply with applicable law when performing this agreement.

Fig warrants that the Fig Services will be provided materially in accordance with the Documentation; the Fig Services will not knowingly contain harmful code; and Fig will maintain the security measures described in the Data Processing Agreement.

If Fig breaches the Documentation warranty and you notify Fig within 30 days of becoming aware, Fig will re-perform the affected service. If re-performance is not reasonably possible, Fig may terminate the affected element and refund unused prepaid Fees for that element. This is your sole remedy for that warranty breach.

Except for the express warranties above, the Fig Services are provided “as is” and “as available”. Fig does not warrant that the Fig Services will be uninterrupted or error-free, that they will detect every security issue, or that using them will achieve or maintain compliance with any law, standard or certification. Implied warranties are excluded to the fullest extent permitted by law.

14.Term and renewal

This agreement starts on the start date in the Order Form and continues for the Initial Subscription Term stated in the Order Form. The Initial Subscription Term may be of any length agreed in the Order Form, including a period of three months or less.

Renewal operates as stated in the Order Form. Unless the Order Form says otherwise, at the end of the Initial Subscription Term the agreement renews automatically for successive renewal periods, each equal in length to the Initial Subscription Term, unless either party gives written notice of non-renewal before the end of the then-current term by the notice period stated in the Order Form (or, if none is stated, at least 60 days). The Order Form may instead specify a different renewal period, or that the agreement does not renew automatically and simply ends at the close of the Initial Subscription Term.

If the Order Form specifies a minimum committed term and the Customer terminates before the end of that committed term other than for Fig’s material breach or by validly exercising a break right under clause 15, the Fees for the remainder of the committed term become immediately due. The parties agree this is a genuine pre-estimate of Fig’s loss and not a penalty. Where the Order Form specifies no minimum committed term, no such early-termination charge applies.

15.Termination

15.1 Termination for convenience (break)

Either party may terminate this agreement for convenience by giving the other written notice. Unless the Order Form states a different notice period, the notice period is at least 60 days; except that, where notice of termination is given within the first three months of the subscription (measured from the start date), the notice period is at least 30 days. Unless the Order Form provides otherwise, this break right may be exercised at any time during the subscription. Where the Order Form specifies a minimum committed term or one or more break dates, those terms apply. Termination under this clause does not trigger the early-termination charge in clause 14, provided it is exercised in accordance with this clause and the Order Form.

15.2 Termination for breach or insolvency

Either party may terminate immediately if the other party commits a material breach that cannot be remedied; commits a material breach that can be remedied but is not remedied within 30 days of written notice; or becomes insolvent. Non-payment of undisputed Fees more than 30 days overdue is a material breach.

15.3 Change of control

Fig may terminate on 30 days’ notice if you undergo a change of control to a direct competitor of Fig.

16.What happens when the agreement ends

On termination, your right to use the Fig Services ends; you must stop using the Fig Services; you must remove the Fig Software within 30 days; accrued but unpaid Fees remain payable; and provisions that are intended to survive continue to apply, including confidentiality, data protection, ownership, liability and dispute resolution.

You may request an export of Customer Data within 30 days of termination. Fig will provide the export in a common machine-readable format within a further 30 days, subject to payment of outstanding Fees. After that export window, Fig will delete Customer Data in line with the retention periods in the Data Processing Agreement.

17.Fig IP indemnity

Fig will defend you against a third-party claim that your authorised use of the Fig Services infringes that party’s UK, US or EU intellectual property rights. Fig will pay damages and costs finally awarded by a court or agreed in settlement.

If the Fig Services become subject to an IP claim, Fig may procure a licence; modify the affected service so it is non-infringing; or terminate the affected element and provide a pro-rata refund for unused prepaid Fees.

This indemnity does not apply where the claim arises from unauthorised modification; combination with third-party products; use outside the Documentation; or your own data or instructions.

18.Customer indemnity

You will indemnify Fig for losses arising from your breach of the restrictions in section 5; your compliance obligations; or unauthorised scanning, monitoring or use of the Fig Services.

Each indemnity depends on prompt notice, the indemnifying party having control of the defence, and reasonable co-operation. Each indemnity is the sole remedy for the matters it covers.

19.Limitation of liability

Nothing in this agreement limits liability for death or personal injury caused by negligence; fraud; breach of statutory implied terms as to title; or any liability that cannot lawfully be limited.

Subject to that, neither party is liable for loss of profits; loss of revenue; loss of business; loss of goodwill; or indirect or consequential loss.

Each party’s total liability in any 12-month period is capped at 125 per cent of the Fees paid or payable in that period (the General Cap). Liability for breach of confidentiality, data protection obligations, or Fig’s security obligations is capped at 2 times the General Cap. The Customer acknowledges that these limits are reasonable and reflected in the pricing of the Fig Services.

20.General terms

20.1 Force majeure

Neither party is liable for delays caused by events beyond its reasonable control, provided it notifies the other promptly. Either party may terminate if the event continues for more than 60 days.

20.2 Assignment and subcontracting

You may not assign or subcontract this agreement without Fig’s consent. Fig may assign this agreement to a group company or to a successor on a merger or sale of its business. Fig may subcontract to approved Sub-processors while remaining responsible for their acts.

20.3 Changes, waiver and severance

Changes must be agreed in writing. A failure to enforce a right is not a waiver of that right. If a provision is found unenforceable, it will be modified to the minimum extent necessary and the rest of the agreement will continue.

20.4 No partnership

Nothing in this agreement creates a partnership, joint venture or agency between the parties.

20.5 Third-party rights

No third party may enforce any term of this agreement.

20.6 Entire agreement

This agreement, the Order Form and the incorporated documents listed above form the entire agreement between the parties for the Fig Services.

20.7 Compliance

Each party will comply with applicable anti-bribery, modern slavery, export control and sanctions law in performing this agreement.

20.8 Publicity

Neither party will issue a press release naming the other without consent. Fig may list the Customer as a partner or user on its website and sales materials unless the Customer opts out in writing.

20.9 Insurance

Fig maintains commercial general liability and cyber/technology errors and omissions insurance appropriate to its business. Certificates are available on reasonable request.

21.Governing law, Country Addendum and disputes

This agreement is governed by the law, and subject to the courts, stated in the Order Form. Unless the Order Form specifies otherwise, this agreement is governed by the law of England and Wales and the English courts have exclusive jurisdiction over disputes. Where the Order Form specifies the law of a United States jurisdiction (for example, the State of New York), this agreement is instead governed by that law and the courts of that jurisdiction have exclusive jurisdiction.

Where the Order Form identifies the Customer as established or primarily operating in the United States, or selects a United States governing law, the US Country Addendum applies and forms part of this agreement. The US Country Addendum is available at https://www.figgroup.co.uk/terms-and-conditions. Where a Country Addendum applies, it prevails over the body of this agreement to the extent of any conflict on jurisdiction-specific subject matter, including governing law, jurisdiction, tax, privacy, insurance and sanctions.

Before starting court proceedings, other than for urgent injunctive relief, the parties will use reasonable efforts to escalate the dispute to senior commercial contacts for resolution within 15 Business Days.

22.Notices

Notices must be in writing and sent to the address in the Order Form or by email. Notices to Fig must copy legal@figgroup.co.uk. Notices are deemed received on delivery, if delivered by hand; at 9am on the second Business Day after posting; or on email transmission, provided no bounce-back is received. This notice clause does not apply to service of legal proceedings.

Electronic acceptance

You accept these terms on behalf of the organisation identified in your order by completing the electronic acceptance presented during checkout or by signing an Order Form that incorporates them. You confirm that you are authorised to enter into this agreement for that organisation. No handwritten signature is required for an order accepted through checkout. The accepted order and its recorded commercial details form the Order Form for that subscription.