By clicking “Accept All Cookies”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts. View our Privacy Policy for more information.
Preferences
DenyAccept

Legl Services Agreement

Last updated: 1 October 2026

This Legl Services Agreement including, where applicable, the Appendices (the “LSA” or this “Agreement”) governs the Client’s acquisition and use of the Services. Capitalised terms have the definitions set forth herein.

If the Client registered for a trial of the Services, the applicable provisions of this Agreement will also govern that trial.

1.
ACCEPTANCE
1.1.
The Client shall be deemed to have accepted this LSA through any one of the following means: (i) clicking a box indicating acceptance, (ii) executing an Order Form that references this LSA; or (iii) paying the Charges set out in the relevant Order Form, and upon such acceptance the Client agrees to and shall be bound by the terms of this LSA.
1.2.
If the individual accepting this LSA is accepting on behalf of a partnership, company or other legal entity, such individual represents that they have the authority to bind such entity and its Affiliates to these terms and conditions, in which case the term “Client” shall refer to such entity. If the individual accepting this LSA does not have such authority, or does not agree with these terms and conditions, such individual must not accept this LSA and may not use the Services.
2.
COMMENCEMENT AND DURATION
2.1.
This Agreement as between the Client and Legl shall commence on the Commencement Date and shall continue in effect for the Initial Term. On expiry thereof, this Agreement shall automatically renew for periods each having the same length as the Initial Term (each, a “Renewal Term”) unless termination Notice is provided by either Party by giving at least thirty (30) day’s notice prior to the expiration of the then-current Renewal Term.  The Initial Term and Renewal Term(s) (if any) are collectively referred to as the “Order Form Term”.
3.
AMENDMENTS TO SERVICES AND CHARGES      
3.1.
Legl shall, in its absolute discretion, be permitted to make any changes it deems necessary to the Services (including the Platform and Content), including: (1) any changes necessary in order to comply with a change in applicable law, provided that any such changes do not have a materially detrimental effect on the Client's use of the Services; and (2) adding new Services or changes to the functionality of existing Services. The use or continued use of the Services by the Client after the date the Services are added or changed shall be deemed acceptance of the added or changed Service and all associated fees.
3.2.
Upon the commencement of each Renewal Term, the Client acknowledges and agrees that Legl shall be entitled to increase the Charges by an amount equal to the annual rate of inflation (as published by the Office for National Statistics in the Retail Price Index).
3.3.
Without prejudice to the generality of Clause 3.1, where: (a) any Third-Party Service Provider increases an existing charge and/or changes the basis on which it provides information, or confirmation of qualifications or membership and the cost of Legl providing a Service under this Agreement increases as a direct result; or (b) Legl wishes to make a reasonable increase in the Charges set-out in the Order Form (each, a “Cost Increase”), Legl may increase the agreed Charges set out in the Order Form by the Cost Increase. Legl will notify the Client of the Cost Increase as soon as reasonably practicable (and shall use reasonable endeavours to notify Client of the Cost Increase prior to implementing the Cost Increase). Client is liable to pay any Charges which have been increased as a result of a Cost Increase provided that these Charges are properly incurred by Legl. In the event that the Client does not wish to incur the Cost Increase, it will be permitted to terminate this Agreement in accordance with Clause 9.1 within thirty (30) days of receiving Notice from Legl of the Cost Increase in accordance with this Clause 3.3.
3.4.
From time to time, Legl may invite the Client to participate in a new version or service feature that Legl has not made generally available to clients for production use and that is designated as beta, pilot, limited release, pre-release, non-production, evaluation or similar designation which does not form part of the Services (“Beta Features”). This invitation will be communicated to the Client through the Legl dashboard and the Client may accept or decline the invitation in its sole discretion. Beta Features are provided "as is", for Legl evaluation and testing purposes, not for production use, not supported, not subject to availability obligations and may be subject to additional terms. Unless otherwise agreed, and subject to Clause 10.2, Legl will have no liability for any harm, damage or losses of any kind arising out of or in connection with Beta Features, and the Client uses them at its own risk. Legl may discontinue Beta Features at any time in its sole discretion and may choose not to make them generally available.
4.
LEGL’S OBLIGATIONS
4.1.
Subject to the terms of Clause 6 of this Agreement, Legl represents and warrants that:
4.1.1.
it will make the Services available during the Order Form Term;
4.1.2.
the Services will conform with all descriptions, standards and specifications set out in each Order Form;
4.1.3.
it will perform the Services in accordance with this Agreement and with reasonable skill and care in accordance with Good Industry Practice;
4.1.4.
it will not knowingly introduce, and shall use all reasonable endeavours to avoid the introduction of, any viruses into the Client’s network and information systems via the Services or otherwise;
4.1.5.
it has and will maintain all necessary licences, consents, and permissions necessary for the performance of its obligations under this Agreement;
4.1.6.
it will comply with all applicable laws and regulations with respect to its obligations under this Agreement;
4.1.7.
Legl’s provision of the Services will not infringe the Intellectual Property Rights or other rights of any third-party; and
4.1.8.
it will not do or omit to do anything which may cause the Client to lose any licence, authority, consent or permission on which it relies for the purposes of conducting its business.
4.2.
Notwithstanding the foregoing, the Client hereby acknowledges and agrees that Legl may, from time to time, acting reasonably and in good faith, need to make the Services unavailable, including due to: (a) emergency or routine maintenance; (b) actual, suspected or threatened cyber security incidents; and (c) third party supplier failure.
5.
CLIENT’S OBLIGATIONS
5.1.
The Client acknowledges and agrees that:
5.1.1.
it shall provide Legl with all necessary cooperation in relation to this Agreement and access to such information as may be required in order for Client to receive the Services;
5.1.2.
it shall provide Legl with complete and accurate bank data necessary for Client to receive payments into its bank account and notify Legl as soon as reasonably practicable of any change in such bank data (it being acknowledged by the Client that any costs or losses resulting from insufficient or erroneous bank data being provided to Legl shall be borne exclusively by the Client);
5.1.3.
it may only download, view, copy and print the Content and use the Services for the Permitted Purpose;
5.1.4.
it shall not use, or allow the use of the Services in a manner that discriminates against an End User or in a manner that causes damage or injury to any person or property;
5.1.5.
the Platform's payment administration system may only be used for the exclusive purpose of receiving payment of legal fees or other professional fees and disbursements;
5.1.6.
it will not make the Services available or otherwise use the Services in any jurisdiction other than the United Kingdom if: (a) the Services are not permitted in that jurisdiction by applicable law; or (b) Legl’s provision of the Services in that jurisdiction would require Legl or Third-Party Service Providers to physically store data (of any kind) in that jurisdiction, without first obtaining Legl’s prior written consent;
5.1.7.
other than when required to do so by applicable law or any regulatory authority, the Platform, the Services and the Content may not be sold, copied, transferred, sublicensed, commercially exploited or otherwise made available to, or used for the benefit of, any third-party other than the Client;
5.1.8.
the Content shall only be made available to the Client’s personnel whose duties reasonably require such disclosure, on the condition that each such person to whom such disclosure is made, is informed of the Client’s obligation of confidentiality and non-disclosure, and is subject to equivalent obligations;
5.1.9.
where applicable to the Client, the Client shall not, under any circumstances, make available to the End User the Account Information contained in any Source of Funds Reports;
5.1.10.
it will leave in place (and not alter or obscure) all proprietary notices and licences contained in or otherwise displayed on the Platform, the Services, and the Content;
5.1.11.
it shall not adapt, alter, modify, reverse engineer, de-compile or otherwise interfere with the Platform, the Services or the Content;
5.1.12.
it will not use the Content for direct marketing services;
5.1.13.
it will comply with all applicable laws and regulations (including any obligation to seek prior regulatory review, approval or similar) with respect to its use of the Services, and it will not: (a) use the Services in a manner that could reasonably be expected to bring Legl and, where applicable, any Third-Party Service Provider into disrepute or otherwise harm its or their reputations; (b) act or omit to act in a way which interferes with or compromises the integrity or security of the Services; (c) access all or any part of the Services in order to build a product or service which competes with the Services; (d) amend or remove Legl Brand Features or “powered by Legl” language from the Services or the Platform and; and (e) except as may be allowed by applicable law which is incapable of exclusion by agreement between the parties: (i) attempt to copy, modify, duplicate, create derivative works from, frame, mirror, republish, download, display, transmit, or distribute all or any portion of the Services (as applicable) in any form or media or by any means to any individual or entity; or (ii) attempt to access the Services other than through the means made available to the Client by Legl. The Client acknowledges and agrees that any breach of this clause will be deemed to be a material breach.
5.2.
The Client is responsible for maintaining the confidentiality of any password(s) or security routines it is given or otherwise sets to access and use the Services, and is fully responsible for all activities that occur under the Client’s password(s) or security routines. The Client agrees to notify Legl as soon as reasonably practicable in the event of any unauthorised access or use of the Services or any other suspected or confirmed security incident in relation to the Services or other exigent circumstances.
5.3.
Legl reserves the right to immediately withdraw or suspend access to the Platform or Services and to alter the Client’s password(s) at any time if it has reasonable grounds to suspect a security incident or a breach of this Agreement. Legl will inform the Client of such an event as soon as reasonably practicable.
5.4.
No conditions, warranties or other terms apply to any Services (including the Platform and the Content) supplied by Legl under this Agreement other than the conditions, warranties and terms expressly set forth herein. Legl hereby disclaims any implied warranties whether arising under law, through course of dealing or otherwise (including any implied warranties of non-infringement, title, satisfactory quality, fitness for purpose, merchantability, or conformance with description). The Client further acknowledges and agrees that the Services, the Platform and the Content are made available on an "as is" basis and Legl does not warrant that any such software will be free from defects or that its operation will be entirely error free.
5.5.
If the Client has, pursuant to the terms of an Order Form, selected Services that include “Engage for Individuals” then the Client agrees that it shall comply with the supplemental terms set out in Appendix 1.
5.6.
If the Client has, pursuant to the terms of an Order Form, selected Services that include “Engage for Business” then the Client agrees that it shall comply with the supplemental terms set out in Appendix 2.
5.7.
If the Client has, pursuant to the terms of an Order Form, selected Services that include “DIATF” then the Client agrees that it shall comply with the supplemental terms set out in Appendix 3.
6.
THIRD-PARTY SERVICES
6.1.
This Clause pertains to certain Third-Party Services that Legl makes available via the Platform from time to time including services that: (i) enable End Users to transfer funds via a payment administration system of the Platform or make payments to the Client via an instruction to the End User’s bank; and (ii) enable the Client to conduct client due diligence checks on End Users based on the submission of Personal Data by End Users.
6.2.
The Client acknowledges and agrees that the provision of the Third-Party Services in Clause 6.1(ii) includes: (i) the sending of identity documents to a Fraud Database Service Provider; and (ii) the Fraud Database Service Provider may retain identity documents that are suspected to be fraudulent for the purpose of identifying fraud in the future.
6.3.
Neither Legl nor any of the Third-Party Service Providers: (a) give any warranties, guarantees or other commitments to the Client in respect of the functionality, performance, service levels, latency or accuracy of any Third-Party Service; (b) ensure the quality, safety or legality of any Third-Party Service; (c) give any commitment that any information or other data provided by a Third-Party Service Provider will be accurate, complete or meet the Client's specific requirements.
6.4.
Any sums paid by an End User via a Third-Party Service shall be processed by the Third-Party Service Provider in accordance with the Third-Party Service Provider's terms of service and privacy policy, and all such sums shall be passed directly from the Third-Party Service Provider to the Client. Once a payment has been processed by the Third-Party Service Provider, it may not be cancelled or recovered. This does not affect the Client’s statutory or legal rights.
6.5.
The Third-Party Services, the Platform and the Content include data, information (including Account Information) and content provided by Third-Party Service Providers (collectively, the "Third-Party Content") which Legl does not control, and the accuracy and/or completeness of which it would not be possible for Legl to guarantee. Subject to Clause 10.2, the Client agrees that neither Legl nor any of the Third-Party Service Providers will be liable for: (a) omissions, errors or false statements in any Third-Party Content; or (b) any inaccuracy, incompleteness or other error in the Services (including the Platform and the Content) which arises as a result of Third-Party Content.
6.6.
The provision of data or information (which may include Personal Data) by the End User to a Third-Party Service Provider shall be treated in accordance with the relevant Third-Party Service Provider's terms of service and privacy policy.
6.7.
In respect of any use by an End User of a Third-Party Service, the Client acknowledges and agrees that:
6.7.1.
such use is subject to: (a) the End User’s acceptance of the relevant Third-Party Service Provider’s terms applicable to such Third-Party Service; and (b) the End User providing correct and accurate details and credentials required to initiate a payment or access their Account Information;
6.7.2.
Legl does not have access to the End User's payment card or bank account details;
6.7.3.
Legl has no influence on the terms of use of the End User’s bank or financial services provider and therefore does not warrant the possibility or the exclusion of the possibility of the cancellation or recall of payments made via a Third-Party Service;
6.7.4.
an End User may withdraw any consent that the End User grants to the relevant Third-Party Service Provider in respect of the provision of the relevant Third-Party Service at any time; and
6.7.5.
in the event that the End User opts to pay the Client in instalments via a payment plan, the Client acknowledges and agrees that: (a) for the avoidance of doubt, Legl is not underwriting such payment; and (b) Legl does not have any liability in respect of a failure by the End User to make any payment due under a payment plan.
6.8.
Legl reserves the right, in its sole discretion, to withdraw or suspend Client's access via the Platform to any Third-Party Service at any time (including in circumstances where the Client is in breach of the terms of this Agreement).
6.9.
Subject to Clause 10.4, the Client shall fully indemnify Legl on demand against any damages, losses, fines, costs (including legal and other professional costs), claims or expenses of any kind and howsoever arising that Legl incurs or suffers as a result of, or in connection with, any claim made or threatened by a third party relating to the Client's or any End User's use of the Third-Party Services. Notwithstanding the foregoing, the Client shall have no obligation to indemnify Legl to the extent that any such claim arises out of or in connection with the Platform itself or Legl's material breach of this Agreement, gross negligence or wilful misconduct, and the Client shall have no liability under this indemnity in respect of any act or omission of an End User which was not within the Client's control.
6.10.
Subject to Clause 10.2, the Client acknowledges and agrees that in no event shall Legl have any liability to the Client in respect of any damages or losses of any nature (whether direct or indirect) arising out of or relating to the Third-Party Services, including (without limitation): (a) where a payment is stopped or reversed for any reason by an End User or any other third party (even, for the avoidance of doubt, at any time after the payment has been processed and/or the Client Account has been credited);  (b) refusal of the End User's bank or financial services provider to process the payment; (c) instructions or information received in respect of a Third-Party Service that are incorrect; (d) any delay in or lack of payment to the Client; and (e) any claims brought against the Client by a third party in connection with the Client's or any End User's use of a Third-Party Service.
6.11.
Where the Client is a law firm, Legl may at its sole discretion agree in writing to permit the Client to share Reports with third parties in connection with the provision of legal services, provided that the Client sharing a Report: (i) does not permit further distribution of the Report to any third party; and (ii) notifies the recipient that the Report is provided solely as evidence that an identity verification check was conducted and that neither any Third-Party Service Provider nor Legl accepts any responsibility to the recipient in connection with the Report or its results.
7.
CHARGES AND PAYMENT
7.1.
In consideration of the provision of the Services, the Client will pay the Charges in accordance with the payment terms set out in this Agreement.
7.2.
All Charges quoted to the Client will be exclusive of VAT which will (where applicable) be added to invoices at the appropriate rate.
7.3.
Unless otherwise specified in the Order Form, the Client will pay each invoice submitted to it by Legl in full within fourteen (14) days of the date of the invoice. The Client may not withhold payment of any invoice or other amount due to Legl by reason of any right of set-off or counterclaim which the Client may have, or allege to have, for any reason whatsoever.
7.4.
Should an individual wish to enquire about cancelling or obtaining a refund in respect of all or part of a payment, they will contact the Client directly. The Client may request in turn that Legl facilitate a refund to that individual, in which case Legl may, in its sole discretion and pursuant to the refund policy it has in place at the time, decide to issue a refund.
7.5.
The Client accepts liability for any chargebacks raised against transactions processed using the Services (each a “Chargeback”). Should any Chargeback occur, the Client will be liable to Legl for the full amount of the Chargeback, the Chargeback fee set out in the Order Form, and any associated costs or charges imposed on Legl by the Third-Party Service Provider in connection therewith. This amount will be invoiced by Legl, and payable by the Client within fourteen (14) days of the date of the invoice. Without prejudice to any other rights or remedies that Legl may have, a failure by the Client to pay any such invoice within fourteen (14) days will give Legl the right to terminate this Agreement by providing written notice to the Client, at which time all unpaid amounts will become immediately due and payable to Legl.
8.
PROPRIETARY RIGHTS
8.1.
As between Legl and the Client, all Intellectual Property Rights and all other rights in and to the Services (including the Platform and the Content) will be owned by Legl. Subject to the terms and conditions set out in this Agreement, Legl grants the Client a limited, non-exclusive, non-transferable and non-sublicensable right to access and use the Services (including the Platform and the Content) during the applicable Order Form Term.
8.2.
As between Legl and the Client, all Intellectual Property Rights and all other rights in and to the Client Data will be owned by the Client, and Legl shall treat all Client Data as the Client's Confidential Information.
8.3.
Upon receipt of prior written consent from the Client, Legl may add the Client (including Client’s Brand Features) as a reference in any advertising or promotional material (including on the Platform).
9.
TERMINATION
9.1.
Without prejudice to any other rights or remedies which the parties may have, and subject to any special terms in the Order Form, either party may suspend, terminate or partially terminate this Agreement and the applicable Order Form without liability to the other party immediately on giving Notice to the other party if:
9.1.1.
the other party fails to pay any amount due under an Order Form on the due date for payment and remains in default not less than fourteen (14) days after being notified to make such payment;
9.1.2.
the other party is in material breach of this Agreement and such breach is incapable of remedy, or where such breach is remediable, the other party fails to remedy such breach within fourteen (14) days after receiving written Notice to do so;
9.1.3.
the other party enters into an arrangement with or for the benefit of its creditors, goes into administration, receivership or administrative receivership, is declared bankrupt or insolvent or is dissolved or otherwise ceases to carry on any Services;
9.1.4.
in the case of the Client, the circumstances in Clause 3.3 apply; or
9.1.5.
required pursuant to a change in applicable law.
9.2.
On termination of the Agreement, the accrued rights and liabilities of the parties at termination and the continuation of any provision expressly stated to survive or implicitly surviving termination, will not be affected.
9.3.
On any termination of this Agreement, without prejudice to any other rights or remedies that Legl may have, then all sums outstanding under this Agreement will become immediately due and payable to Legl.
10.
LIMITATION OF LIABILITY
10.1.
Subject to the provisions of Clause 6 with respect to the provision of Third-Party Services and Clause 10.2, this Clause 10 sets out the entire financial liability of each party (including any liability for the acts or omissions of either party’s employees, agents and sub-contractors) in respect of: (a) any breach of this Agreement; (b) any use made by the Client of the Services (including the Platform and the Content) or any part of them; and (c) any representation, statement or tortious act or omission (including negligence) or breach of statutory duty arising under or in connection with the Agreement.
10.2.
Nothing in this Agreement limits or excludes either party's liability: (a) for death or personal injury; (b) for fraud or fraudulent misrepresentation; (c) for wilful misconduct; or (d) for payment of sums properly due and owing to the other in the course of normal performance of this Agreement.
10.3.
Subject to Clauses 10.1 and 10.2, neither party will be liable under or in connection with this Agreement (whether in contract, tort or otherwise) for any: (a) loss of profit; (b) loss of anticipated savings; (c) loss of business opportunity; (d) loss of or corruption of data; (e) loss of reputation or goodwill; or (f) special, indirect or consequential losses; in each case whether suffered or incurred by the other party (whether or not such losses were within the contemplation of the parties at the date of this Agreement).
10.4.
Subject to Clauses 10.5 and 10.6 each party’s total aggregate liability in each contract year, in contract, tort (including negligence or breach of statutory duty), misrepresentation, restitution or otherwise arising out of or in connection with the performance or contemplated performance of this Agreement will be limited to 100% of the total amount paid by the Client under the applicable Order Form in the relevant contract year.
10.5.
Notwithstanding any other Clause in this Agreement, in the event the Client breaches Clause 12.4.1 in respect of obtaining consent for the processing of biometric information, the Client shall indemnify Legl on demand against any loss or liability (including full reimbursement of any legal and professional costs) Legl incurs or suffers as a result of, or in connection with such breach, up to a maximum of £1,000,000.
10.6.
Subject to Clause 10.2, the Client assumes sole responsibility for its use of the Services (including the Platform and the Content) and for any and all liability arising out of its use of the same to the extent not directly caused by an act, error or omission of Legl. It shall be liable for the acts and omissions of its authorised users as if such acts and omissions were those of the Client itself.
11.
CONFIDENTIALITY
11.1.
The recipient of any Confidential Information will not disclose that Confidential Information, except to: (i) employees, affiliates, professional advisors and/or third party service providers where and only to the extent required for the proper performance of this Agreement (conditional upon any such persons being informed of the confidential nature of the Confidential Information and agreeing (or in the case of professional advisors being otherwise bound) to keep such information confidential); and (ii) to the extent that such Confidential Information is required to be disclosed by law, provided that the other party (if it is lawful to do so), is notified in advance that such disclosure is to be made (such advance notice to be given as soon as reasonably practicable).
11.2.
Following termination of this Agreement, the recipient of any Confidential Information shall, if requested to do so by the disclosing party, as soon as reasonably practicable, procure that all Confidential Information in its possession or under its control is returned, deleted or destroyed (save to the extent prohibited by relevant laws or regulations) in accordance with the written instructions of the disclosing party.  Each party may nevertheless retain a copy of the Confidential Information to the extent required by its record retention policies or by applicable law or regulation, provided that any Confidential Information so retained remains subject to the confidentiality obligations in this Clause 11.
11.3.
The parties’ confidentiality obligations as set out in this Agreement shall survive the termination of this Agreement.
12.
DATA PROTECTION
12.1.
In this Clause 12, the terms "data controller", "data processor", "personal data" and "processing" shall be as defined in the Privacy Laws.
12.2.
Each party agrees that it will at all times comply with all of its own obligations, and all requirements applicable to it, under the Privacy Laws.  Where any aspect of the Account Information is considered Personal Data, the Client shall handle such Account Information in accordance with applicable Privacy Laws.
12.3.
For the purposes of the Privacy Laws, the Client will be the data controller and Legl will be the data processor when processing Personal Data in the course of providing the Services to the Client under this Agreement.
12.4.
Where Legl collects or obtains any Personal Data from the Client under or in connection with this Agreement, the Client agrees that Legl has general authorisation to process that Personal Data on the Client's behalf, and the Client represents and warrants that:
12.4.1.
it has taken all required steps to ensure that Legl and the Third-Party Service Providers may lawfully obtain and process the Personal Data, for the purpose of providing the Services in accordance with Privacy Laws, including by having obtained all necessary consents (which shall include receipt of specific consent to process the End User’s biometric information) and provided all necessary notices, where required; and
12.4.2.
it will direct the subjects of the Personal Data to Legl's Privacy Policy, made available on the Platform.
12.5.
Where Legl acts as a data processor on behalf of the Client in respect of the Personal Data, Legl may perform the following processing:

Subject-matter of processing: the processing of Personal Data by Legl shall be that which is necessary to comply with Legl's obligations under the Agreement.

Duration of processing: the duration of the processing shall be the term of the Agreement and a reasonable period thereafter for record-keeping purposes and compliance with Clause 12.6.10.

Type of Data: the Personal Data processed by Legl shall be as defined above.

Categories of data subjects: the data subjects shall be the subjects of the Personal Data as defined above.

12.6.
Where acting as a data processor on behalf of the Client in respect of the Personal Data, Legl agrees that it shall:
12.6.1.
process Personal Data in accordance with this Agreement and any other documented instructions from the Client, unless:
12.6.1.1.
required to do so by applicable law, in such a case Legl shall inform the Client of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; or
12.6.1.2.
in its opinion, an instruction given by or on behalf of the Client infringes the Privacy Laws, in which instance Legl shall immediately inform the Client of such opinion (and for the avoidance of doubt, Legl shall not be in breach of its instructions or its obligations under this Agreement by failing to observe any such instructions);
12.6.2.
taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, take all measures required pursuant to Article 32 of the GDPR;
12.6.3.
take reasonable steps to ensure the reliability of its personnel who have access to the Personal Data and ensure that access to the Personal Data is limited to such authorised personnel only who require access to it for the purpose of complying with the obligations under this Agreement and who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
12.6.4.
in addition to the measures put in place by the Client, and taking into account the nature of the processing, implement and maintain all appropriate technical and organisational security measures to assist the Client, insofar as possible, in the fulfilment of its obligations to respond to requests from data subjects to exercise their rights of access, rectification, erasure, restriction of Processing, data portability, objection to Processing, or any other rights available to a data subject under Privacy Laws (collectively "Data Subject Rights"), and Client agrees that Legl may disclose Client's name and contact information to any data subject seeking to exercise their Data Subject Rights so that they may directly exercise their Data Subject Rights with the Client;
12.6.5.
assist the Client in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR taking into account the nature of processing and the information available to Legl;
12.6.6.
other than as set-out in Legl’s Privacy Policy, unless required by applicable law, not disclose or otherwise make available any Personal Data to any new third-party without first: (i) publishing details of the proposed appointment on Legl's list of third-party service providers in accordance with paragraph (iii) below, which publication shall constitute Notice to the Client for the purposes of this Clause 12.6.6, and giving the Client thirty (30) days from the date of publication in which to object on reasonable data protection grounds, failing which the Client shall be taken to have consented to the appointment; (ii) imposing contractual obligations on the third-party recipient that are substantially similar to those imposed on Legl under this Agreement; and (iii) including the third party on Legl’s list of third-party service providers set out at Legl’s Sub-Processor Policy, and Legl shall remain liable to the Client in respect of any breach of this Clause 12 that is caused by an act, error or omission of such third-party. If Client objects to any third-party service provider, Client acknowledges that the inability to use such service provider may result in a delay in performing the Services (for which Legl shall have no liability).  Where the Client objects on reasonable data protection grounds to the replacement of an existing third-party service provider with a provider of materially equivalent services, and the parties are unable to resolve that objection within thirty (30) days, the Client's sole remedy shall be to terminate the affected Services on written Notice and Legl shall not be prevented from making the replacement.
12.6.7.
ensure that all Personal Data residing in the UK is not transferred out of the UK unless (where required under the Privacy Laws) Legl has put in place such measures and entered into such agreements as are required to ensure that the transfer complies with the requirements of the Privacy Laws (including, where appropriate, executing the Standard Contractual Clauses approved by the relevant UK authority);
12.6.8.
keep at its normal place of business detailed, accurate and up-to-date records relating to the processing of Personal Data by Legl. Upon sixty (60) days' written Notice, no more than once per contract year and during normal business hours, Legl will make available to the Client such access to its books and records as is reasonably necessary for audit purposes to demonstrate Legl’s compliance with its obligations under Privacy Laws. Any audit requests in excess of those set out in this Clause 12.6.8 will be permitted at Legl’s discretion, and at the Client's sole cost (except where the audit reveals a breach by Legl of Privacy Laws). All audits are subject to the confidentiality obligations set out in this Agreement. Legl shall use reasonable endeavours to promptly resolve all data protection and security issues discovered by the Client and reported to Legl that reveal a breach or potential breach by Legl of any of its obligations under this Agreement or Privacy Laws;
12.6.9.
in the event Legl confirms any breach of security involving its facilities, networks or systems and any unauthorised disclosure of, or access to, Personal Data (each, a "Security Breach"), (i) promptly notify the Client of the Security Breach; and (ii) provide all reasonable help for the Client to investigate and remedy the Security Breach; and
12.6.10.
to the extent Legl obtains Personal Data not necessary for the provision of the Services or the fulfilment of its obligations under this Agreement, delete such Personal Data without further notice to the Client. Either upon request by the Client or when Legl no longer needs to process Personal Data to fulfil the purposes for processing identified in this Agreement (whichever is earlier), Legl will (a) cease all use of Personal Data; and (b) destroy all Personal Data (unless storage of any Personal Data is required by applicable law, including Privacy Laws).
13.
AGREEMENT AMENDMENTS
13.1.
Legl may update or amend this LSA from time to time, provided such updates or amendments do not: (i) result in a material degradation of the overall security of the Services; (ii) expand the scope of or remove any restrictions on Legl’s processing of the Client Personal Data; or (iii) have a material adverse impact on the Client’s rights under this LSA.
13.2.
Legl will provide written Notice to the Client of any material updates to this LSA.
14.
GENERAL
14.1.
If any provision of this Agreement (or part of any provision) is found by any court or other authority of competent jurisdiction to be invalid, illegal or unenforceable, that provision or part-provision will, to the extent required, be deemed not to form part of the LSA or Order Form (as applicable) and (a) the parties will immediately commence good faith negotiations to remedy such invalidity; and (b) the validity and enforceability of the other provisions of the LSA or Order Form (as applicable) will not be affected.
14.2.
This Agreement constitutes the whole agreement between the parties and supersedes any previous arrangement, understanding or agreement between them relating to the subject matter of this Agreement. Each party acknowledges that in entering into this Agreement it has not relied upon any oral or written statements, collateral or other warranties, assurances, representations or undertakings which were made by or on behalf of the other party in relation to the subject-matter of this Agreement at any time before its signature other than those which are set out in this Agreement. Furthermore and for the avoidance of doubt, Client understands its business needs and has determined independently that the Services will meet its needs.
14.3.
Neither party will be liable for any delay or non-performance of its obligations under this Agreement to the extent that such delay or non-performance is a result of any condition beyond its reasonable control (a “Force Majeure Event”). To the extent that a Force Majeure Event occurs, Client acknowledges that Legl may be required (and will be permitted) to change the manner in which it provides the Services, and that such modifications will not be deemed to be a breach of this Agreement.
14.4.
Except as expressly stated otherwise, nothing in this Agreement will create an agency, partnership or joint venture of any kind between the parties. Neither party will have authority to act in the name of or on behalf of the other, or to enter into any commitment or make any representation or warranty or otherwise bind the other in any way.
14.5.
Legl reserves the right to assign any or all of its rights or transfer any or all of its obligations under this Agreement by providing written notice to the Client. The Client shall not be permitted to assign any of its rights or obligations under this Agreement without the prior written consent of Legl, which consent shall not be unreasonably withheld or delayed.
14.6.
The Client acknowledges and agrees that the supply of the Reports and Services by Legl and their use by the Client is governed by laws and regulatory requirements and that these laws and regulatory requirements may be altered from time to time. The Client agrees that Legl may: (a) modify; or (b) cease to provide the Services (including the Platform and the Content) to the Client if necessary to comply with the legal or regulatory requirements, and that such modifications or a cessation will not be deemed to be a breach of this Agreement.
14.7.
All notices must be in English, in writing, addressed to the other party’s primary contact and sent by (a) first class post to the other party’s registered address (or such other address as either party has notified the other in accordance with this clause); and (b) in the case of Legl, delivered by email to legalnotices@legl.com (each a “Notice”).
14.8.
The parties will: (i) comply with all applicable Anti-Corruption Laws; (ii) promptly report to the other party any request or demand for any undue financial or other advantage of any kind received by it in connection with the performance of this Agreement; (iii) cooperate regarding investigations by the other party into any matters related to bribery and corruption in connection with this Agreement.
14.9.
Except in respect of any transfer of staff pursuant to applicable law, neither party shall (except with the prior written consent of the other party) directly or indirectly solicit or entice away (or attempt to solicit or entice away) from the employment of the other party any person employed or engaged by such other party in the provision of the Services or (in the case of the Client) in the receipt of the Services at any time during the Order Form Term or for a further period of 3 months after the termination of this Agreement other than by means of a national advertising campaign open to all and not specifically targeted at any of the staff of the other party.
14.10.
The Client understands that aspects of the Services rely on data and services from third-party suppliers. Neither Legl nor its third party suppliers will be liable for any loss, damage or claim relating to errors, omissions, or inaccuracies in any information, data, or materials provided by or on behalf of the Client in connection with the Services, or any actions taken by Legl in accordance with the Client’s specifications, directions, or instructions. If any required third-party dataset becomes unavailable to Legl, Legl may suspend or discontinue the affected Services upon thirty (30) days’ prior written notice to the Client. Any such suspension or discontinuation shall not constitute a breach of the LSA.
14.11.
Any and all claims for loss arising under this Agreement will be subject to a general obligation of the parties to use all reasonable efforts to mitigate such losses.
14.12.
Subject to any express provision to the contrary in an Appendix to this Agreement, a person who is not a party to this Agreement may not enforce any of its provisions under the Contracts (Rights of Third Parties) Act 1999.
14.13.
This Agreement and all claims arising out of or in connection with it are governed by English law. With the sole exception of any application for injunctive relief, the parties irrevocably agree that the courts of England have exclusive jurisdiction to settle any dispute or claim (whether contractual or non-contractual) arising out of or in connection with this Agreement (including its subject matter or formation).
15.
DEFINITIONS
15.1.
In this LSA, unless the context otherwise requires, the following definitions and rules of interpretation will apply:

Account Information means information regarding an End User’s financial transactions provided by a Third-Party Service Provider.

Affiliate means in relation to a party, any entity that directly or indirectly controls, is controlled by, or is under common control with that party from time to time.

Agreement means this LSA and each Order Form entered into pursuant hereto.

Anti-Corruption Laws means any applicable anti-corruption or anti-bribery laws or regulations in any jurisdiction including (without limitation) the UK Bribery Act 2010.

Beta Features has the meaning attributed to it in Clause 3.4.

Brand Features means the identifying trade marks, trading names and logos of an entity, which, in the case of Legl, shall include the word mark "Legl".

Charges means the charges for the Services payable by the Client and as set out in an Order Form.

Chargeback has the meaning attributed to it in Clause 7.5.

Client Data means all data and information submitted to the Platform by, or on behalf of, the Client or an End User, excluding Third-Party Content.

Commencement Date means the date on which the Initial Term of an Order Form commences, as set out in the applicable Order Form.

Confidential Information means information disclosed by (or on behalf of) one party to the other party that is marked as confidential or, from its nature, content or the circumstances in which it is disclosed, might reasonably be supposed to be confidential, including a party’s data, information, and material relating to the business, customers, internal policies, systems or affairs of that party, its representatives or its customers and shall include Account Information. It does not include: (i) information that was rightfully in the possession of the recipient and acquired on a non-confidential basis from sources other than the disclosing party; or (ii) any information which is in the public domain otherwise than as a result of a breach of this Agreement by the recipient.

Content means all information, text, graphics, data or other materials (including all Intellectual Property Rights therein) that are provided or made available by Legl to the Client in connection with the provision of the Services and including, for the avoidance of doubt, the Reports and any Third-Party Content.

Cost Increase has the meaning attributed to it in Clause 3.3.

data controller has the meaning attributed to it in Clause 12.1.

data processor has the meaning attributed to it in Clause 12.1.

Data Subject Rights has the meaning attributed to it in Clause 12.6.4.

DIATF means the UK Digital Identity and Attributes Trust Framework available here: https://www.gov.uk/government/publications/uk-digital-identity-and-attributes-trust-framework-04/uk-digital-identity-and-attributes-trust-framework-gamma-04-pre-release (as may be amended and/or restated from time to time);

End User means a client or potential client of the Client.

Force Majeure Event has the meaning attributed to it in Clause 14.3.

Fraud Database Service Provider means a government body or other third party service provider that checks whether an identity document has been previously identified to them as lost, stolen, fraudulent, or otherwise compromised.

Good Industry Practice means the exercise of that degree of skill, care, prudence, efficiency, foresight and timeliness as would be expected from a leading company within the relevant industry or business sector.

Initial Term means the initial term of an Order Form, as set out in the applicable Order Form.

Intellectual Property Rights means copyright, design rights, rights in databases, moral rights, trademarks, service marks, trade and business names, patents, rights in inventions and other intellectual property rights, in each case whether registered or unregistered and including applications for the grant of the foregoing and all rights or forms of protection having equivalent or similar effect to any of the foregoing which may subsist anywhere in the world.

Notice has the meaning attributed to it in Clause 14.7.

Order Form means each fully executed Legl order form entered into between Legl and the Client pursuant to this LSA that describes the Services to be provided by Legl from time to time.

Order Form Term has the meaning attributed to it in Clause 2.1.

party means each of the Client and Legl (and "parties" shall be construed accordingly).

Permitted Purpose means the Client's own legitimate, professional, internal business operations purposes, including for the purpose of compliance, data verification and due diligence purposes, but not in any event for the purpose of reselling or otherwise making the Services available to any third parties.

Personal Data has the meaning attributed to it in Clause 12.1.

Platform means the cloud-based platform via which the Services are made available by Legl.

Privacy Laws means any applicable rules, laws, regulations, directives and governmental requirements applicable from time to time relating to the processing of personal data and/or privacy, as in force at the date of this Agreement or as re-enacted, applied, amended, superseded, repealed or consolidated, including the UK Data Protection Act 2018, the UK General Data Protection Regulation (the "GDPR"), and the Privacy and Electronic Communications (EC Directive) Regulations 2003.

processing has the meaning attributed to it in Clause 12.1.

Renewal Term has the meaning attributed to it in Clause 2.1.

Report means a report, produced pursuant to the provision of the Services, setting out information that has been requested by the Client.

Security Breach has the meaning attributed to it in Clause 12.6.9.

Services means, to the extent the subject of an Order Form, the services made available for use by the Client via the Platform from time to time (including, as applicable, any Third-Party Service).

Source of Funds Report(s) means a Report that sets out Account Information.

Third-Party Content has the meaning attributed to it in Clause 6.5.

Third-Party Services means any Service that is made available for use by the Client via the Platform, but which is administered by a Third-Party Service Provider.

Third-Party Service Provider means any third-party that administers a Third-Party Service (and which may include payment processors and payment initiation service providers).

VAT means value added tax chargeable under English law.

15.2.
Where the words include(s), including or in particular are used in this Agreement, they are deemed to have the words without limitation following them.
15.3.
References to Clauses are to the Clauses of this LSA.
15.4.
A reference to a party includes its successors and permitted assigns.
15.5.
A person includes a natural person, corporate or unincorporated body (whether or not having separate legal personality).
15.6.
A reference to a company includes any company, corporation or other body corporate, wherever and however incorporated or established.
15.7.
Unless the context otherwise requires, words in the singular include the plural and in the plural include the singular.
15.8.
A reference to legislation or a legislative provision (a) is a reference to it as amended, extended or re-enacted from time to time and (b) includes all subordinate legislation made from time to time under that legislation or legislative provision.
15.9.
A reference to writing or written includes email.
15.10.
Any obligation on a party not to do something includes an obligation not to allow that thing to be done.
15.11.
A reference to this Agreement or to any other agreement or document is a reference to this LSA or that other agreement or document, in each case including all appendices and schedules thereto and as varied or novated from time to time.

Appendix 1

Supplemental Terms: Engage for Individuals

1.
DEFINITIONS
1.1.
Capitalised terms used but not defined in this Appendix have the meanings given in the LSA. In the event of a conflict, the terms of this Appendix prevail over the LSA solely to the extent necessary to satisfy the requirements set out herein.
1.2.
In this Appendix, unless the context otherwise requires, the following definitions will apply:

Entrust means Onfido Limited, a company incorporated and registered in England and Wales with company number 07479524.

Entrust Services means the identity verification services and/or products offered by Entrust from time to time.

Entrust Terms means Legl’s agreement with Entrust or any other terms or conditions imposed by Entrust.

2.
DATA PROTECTION
2.1.
The Client represents and warrants that it will not provide or transfer to Entrust any Excluded Data, except if expressly required in the Entrust Terms. "Excluded Data" means: (i) special category data under the EU GDPR; (ii) PCI-DSS cardholder data; or (iii) data regulated under HIPAA, GLBA, or similar current or future laws in any applicable jurisdiction.
2.2.
The Client agrees and acknowledges that Entrust shall process Personal Data relating to End Users as Controller under Privacy Laws in accordance with the applicable Entrust Product Privacy Notice and warrants that its End User agreements permit all applicable Personal Data processing.
2.3.
U.S. Users of any Entrust Service are subject to the ‘Additional Obligations’ regarding U.S. Users Exhibit available at: https://www.entrust.com/sites/default/files/documentation/licensingandagreements/entrust-identity-verification-additional-obligations.pdf.
3.
COMPLIANCE WITH APPLICABLE LAWS
3.1.
In this clause: “Denied Parties” means persons subject to trade sanctions or restrictions by the U.S., Canada, U.K., U.N., E.U., or other jurisdictions, including those on OFAC’s Specially Designated Nationals list or the U.S. Commerce Entities List and “Restricted Country” means any country where Entrust prohibits business due to sanctions, including those listed at https://www.entrust.com/legal-compliance/sanctioned-countries.
3.2.
The Client warrants that: (a) it is not located in or resident of a Restricted Country; (b) it is not a Denied Party; (c) it will comply with all applicable export and trade control laws; (d) it will not use Entrust Services for prohibited purposes; (e) its affiliates, officers, directors, and employees are not Denied Parties or connected to Restricted Countries; and (f) it is legally distinct from any Denied Party.
3.3.
The Client shall immediately notify Legl if it breaches this Section 3.
3.4.
Legl and Entrust are not responsible for service interruptions on third-party devices (e.g., Huawei mobile phones) where trade compliance, legal, or security obligations prevent compatibility.
4.
OTHER ENTRUST TERMS
4.1.
The Client will not and will not permit its End Users to: (a) resell, lease, license, distribute, or allow third-party exploitation of the Entrust Services except as expressly permitted by this Agreement; (b) copy, modify, decompile, disassemble, or derive source code from the Entrust Services, except as explicitly permitted by law and this Agreement; (c) circumvent security mechanisms, test vulnerabilities, conduct unauthorized penetration/load testing without prior written consent, or use automated means (e.g., bots) to gain access; (d) build competing products, benchmark against the services, or misappropriate features or non-public content; (e) transmit illegal, infringing, harmful, malicious (e.g., malware, viruses), deceptive, or spam content, or engage in denial-of-service (DoS) attacks; (f) use the services for High Risk Applications (e.g., nuclear, aviation, life support) where failure could cause death or severe damage; Entrust disclaims all fitness for such uses; or (g) remove branding, use APIs without required attribution (e.g., "powered by Entrust/Onfido"), violate applicable laws/regulations, or operate in restricted jurisdictions without consent.
4.2.
The Client acknowledges and agrees that Entrust is an express third-party beneficiary of this Agreement, owing no direct obligations to the Client or End Users.
4.3.
The Client will defend, indemnify, and hold harmless Legl, Entrust, their affiliates, and representatives against all claims, losses, damages, and expenses (including attorneys' fees) arising from: (a) breaches of U.S. Biometric Data Protection Laws, compliance sections, or data protection warranties/obligations by the Client; and (b) Client data inaccuracies, misuse of services, or uploaded content infringing third-party rights (intellectual property, privacy, confidentiality).
4.4.
The Client acknowledges and agrees that Entrust uses AI for identity verification. AI outputs can be fallible; the Client must exercise independent judgment and provide human intervention for negative impacts. The Client will not use any Entrust services, data, or outputs to train, test, or improve machine learning algorithms or competing AI systems, nor upload confidential information to external AI applications.
5.
GENERAL TERMS

Clause 10 of the LSA applies to this Appendix, save that the standard liability caps do not apply to breaches of Section 3 of this Appendix (Compliance with Applicable Laws) or any infringement of Entrust’s Intellectual Property Rights. Client liability for data protection breaches is capped at 500% of annual fees paid or payable.

Appendix 2

Supplemental Terms: Engage for Business

Capitalised terms used but not defined in this Appendix have the meanings given in the LSA. In the event of a conflict, the terms of this Appendix prevail over the LSA solely to the extent necessary to satisfy the requirements set out herein.

1.1.
In this Appendix, unless the context otherwise requires, the following definitions will apply:

Equifax means Equifax Limited, a credit reference agency incorporated and registered in England and Wales with company number 2425920 and authorised and regulated by the Financial Conduct Authority.

Equifax Content means any information or data provided by Equifax that the Client is authorised to receive via Legl, including county court and bankruptcy judgements and debt collection search results.

1.2.
The Client acknowledges and agrees that it shall not use the Equifax Content in relation to the provision of credit information services to an individual or recipient of credit.
1.3.
In respect of the Equifax Content, the Client acknowledges and agrees that:
1.3.1.
Equifax is not liable for any loss or damage arising from any inaccuracies, faults or omissions in, or in the provision of the Equifax Content unless caused by Equifax’s negligence or wilful default;
1.3.2.
the information forming part of the Equifax Content is provided to Equifax by third-parties over which neither Legl nor Equifax have control, in particular in relation to the accuracy or completeness of such information;
1.3.3.
the volume and nature of the information on Equifax databases makes it impractical for Equifax and Legl to verify the information;
1.3.4.
the Client shall provide to Legl and Equifax any information reasonably requested in order to assess whether the Client’s use of the Equifax Content is in compliance with the Clauses related to the Equifax Content in this LSA; and
1.3.5.
Equifax may cease to make the Equifax Content available to the Client in the event the Client commits a material breach of the terms related to the Equifax Content, or the provision or intended use of Equifax Content by the Client is or is likely to be or become unlawful due to a change in applicable law, regulatory guidance or court ruling, or otherwise constitute a breach of Equifax’s contractual arrangements.
1.4.
Subject to clause 6.11, in the event the Client breaches Clauses 5.1.7, 5.1.8 and 5.1.9 in respect of the Equifax Content, the Client shall indemnify Legl on demand against any loss or liability (including full reimbursement of any legal and professional costs) Legl incurs or suffers as a result of, or in connection with such breach, up to a maximum of £500,000.
1.5.
Notwithstanding Clause 12.3 of the LSA, in respect of the Equifax Content only, the Client and Equifax shall each be independent controllers of any Personal Data contained within the Equifax Content.
1.6.
Further to Clause 12.4, the Client represents and warrants that it will notify the End User that their personal data will be disclosed to Equifax, which may keep a record of that information and provide it (and the fact that a search was made) to its other customers to verify identity, assess the risk of giving credit, prevent fraud and money laundering, and trace debtors, and provide the End User with a copy of the CRA Information Notice.

Appendix 3

Supplemental Terms: UK Digital Identity and Attributes Trust Framework

Capitalised terms used but not defined in this Appendix have the meanings given in the LSA. In the event of a conflict, the terms of this Appendix prevail over the LSA solely to the extent necessary to satisfy the requirements set out herein.

1.
UK DIGITAL IDENTITY AND ATTRIBUTES TRUST FRAMEWORK

This section of the Appendix summarises the mandatory “flow-down terms” which are set out in clause 12.9 of the DIATF.

The Client confirms that it understands all DIATF roles, responsibilities and obligations applicable to it and that it will comply with all mandatory DIATF flow-down terms (as may be updated from time to time) including:

1.1.
Fraud Management: The Client will implement and maintain robust fraud management systems to detect, prevent, and report fraudulent activity in accordance with the DIATF and cooperate with Legl to investigate any suspected fraud related to identities or attributes.
1.2.
Information Security: The Client will maintain appropriate technical and organisational measures to ensure the security of DIATF data. This includes protecting against unauthorised or unlawful processing and against accidental loss, destruction, or damage and notifying Legl without undue delay of any incidents. It will fully cooperate with Legl in respect of any remediation efforts. Security measures must meet the standards required by the DIATF.
1.3.
Data Retention: The Client will not retain personal data for longer than is necessary for the purposes for which it was collected, or as otherwise required by the DIATF or applicable law. All data no longer required must be securely deleted or anonymised by the Client, and the Client must confirm such disposal in writing to Legl on request.
1.4.
Personal Data Processing: The Client will process Personal Data lawfully, fairly, and transparently. The Client acts as data controller of the personal data it processes under this Appendix, whilst Legl acts as data processor (on behalf of the Client). Data must only be processed for the specific purposes permitted by the DIATF and must not be further processed without a lawful basis and appropriate notice to data subjects. The Client must update its data protection impact assessment, privacy policies and data subject rights procedures to reflect the requirements of the DIATF and ensure ongoing compliance with these policies and procedures.
1.5.
Data Minimisation: Client will adhere to data minimisation principles, ensuring that data collection and processing are adequate, relevant, and limited to what is necessary for the specified purposes and that its practices are reviewed periodically. Excessive processing of personal data is prohibited.
1.6.
Identity Repair: The Client will maintain a documented process to support users who are victims of identity theft, which meets the requirements of the DIATF, and cooperate with Legl to the extent the issue is attributable to or best addressed by Legl’s certified service. Each party remains responsible for repair actions within its control.
1.7.
Complaint Resolution: The Client will ensure the timely resolution of incidents and complaints and have clear, accessible policies and procedures in place. Each party must notify the other of any security incidents that may impact the other party's compliance with the DIATF or the security of user data and cooperate to resolve complaints. Records must be maintained and shared between each party on request.
1.8.
Service Retirement: Upon receipt of a DIATF withdrawal or retirement from Legl, the Client will cooperate to ensure an orderly transition and notify affected users. Both Parties will comply with their data disposal requirements and cease any representations of certification under the DIATF.
1.9.
Accurate Representation: Each party will ensure that any references to certification under the DIATF are accurate and limited.
2.
National SIRA (System for Inter-Referral Activity) Service

This section of the Appendix sets out the data protection-related obligations that the Client agrees to comply with in relation to the National SIRA Service (managed by Legl's third party provider, Synectics Solutions Limited "Synectics").

2.1.
Data protection fee: To the extent required by Privacy Laws, the Client shall pay to the Information Commissioner a data protection fee as provided for under Section 137 of the Data Protection Act 2018.
2.2.
Assistance: The Client agrees to provide the following categories of personal data as required for Legl to comply with its obligation to assist Synectics in its provision of the National SIRA service: full names, dates of birth, current addresses, telephone numbers and email addresses (and any other personal data as Legl may require from time to time).
2.3.
Joint Data Controllers: The Client acknowledges and agrees that it shall act as a joint data controller with Synectics (the "Joint Data Controllers") in respect of the National SIRA data which is stored and processed by Synectics within the National SIRA Service.
2.4.
Client joint data controller responsibilities: The Client acknowledges and agrees that it is responsible for all duties in respect of enquiries, submissions and records which Legl submits to the National SIRA Service, as required by Privacy Laws. This shall include, but is not limited to:
2.4.1.
providing appropriate information to data subjects to ensure fair processing and transparency, including complying with the obligations and responsibilities required as joint data controller pursuant to clause 2.3 of this Appendix;
2.4.2.
all obligations in respect of data subject rights, as set out in Articles 16, 17, 18, 19, 21 and 22 of Chapter 3 of the GDPR;
2.4.3.
ensuring that the personal data comprised in records obtained from the National SIRA Service is used solely for the purposes of: (i) preventing and detecting fraud, financial crime and money laundering; (ii) carrying out regulatory compliance checks, identity verification and related risk management;
2.4.4.
to the extent required by Privacy Laws, notifying data breaches to the relevant data subject; and
2.4.5.
complying with all obligations under the GDPR, in particular the requirements set out in Article 32 in respect of any processing which Legl carries out on the Client's behalf.
2.5.
Data subject access requests: In the event that a data subject submits a data subject access request ("DSAR") to Legl, the Client shall be responsible for managing and responding to the DSAR and the Client acknowledges that, in respect of National SIRA data, the DSAR shall be limited to the personal data submitted to the National SIRA Service by Legl. Legl shall, in accordance with clause 12.6.4 of the LSA, assist the Client with responding to a DSAR.
2.6.
Notification to data subjects: The Client shall ensure that it notifies any data subjects whose personal data is submitted to the National SIRA Service in accordance with Article 13 or 14 (as applicable) of the GDPR. Such notification shall include, without limitation, details of the Joint Data Controllers, as identified in clause 2.3 of this Appendix.
2.7.
Access to National SIRA data from outside of the UK / EEA: The Client acknowledges and agrees that the data comprised in the National SIRA Service may not be accessed (or otherwise transferred) outside of the UK / EEA without Synectics' prior written consent, and such consent may only be granted in respect of countries which are deemed to have an adequate level of data protection or where mechanisms have been put in place which ensure compliance with Privacy Laws.
3.
GENERAL TERMS
3.1.
Liability: Clause 10 of the LSA applies to this Appendix, save that the Client accepts full responsibility for: (a) its actions and omissions in respect of its allocated responsibilities set out in this Appendix; and (b) any losses arising from its failure to comply with this Appendix or the LSA.
3.2.
Indemnification: The Client shall indemnify and hold harmless Legl against any losses, damages, costs, and expenses (including reasonable legal fees) arising from or in connection with: (a) any misleading or inaccurate representation by the Client regarding DIATF certification; (b) Client’s failure to comply with its obligations under this Appendix that results in a loss of, or threat to, Legl’s certification; (c) any claim or losses arising from the Client’s breach of its obligations under this Appendix.
3.3.
Survival. The clauses in this Appendix on Data Retention (1.3), Identity Repair (1.6), Service Retirement (1.8), Accurate Representation (1.9), Liability (3.1) and Indemnification (3.2) shall survive the termination or expiry of this Appendix and the LSA.
3.4.
Amendments. Legl may update this Appendix from time to time to reflect changes to the DIATF and/or the National SIRA Service. Legl shall provide the Client with reasonable written notice of any material changes to this Appendix. The Client’s continued use of the certified service after such changes shall constitute acceptance of the updated Appendix. The Client acknowledges and agrees that it is responsible for ensuring ongoing adherence to: (i) the DIATF rules applicable to it (as may be updated online from time to time); and (ii) the National SIRA Service applicable to it (as informed by Legl).