Terms & Conditions

Who these terms are for

Pavilion provides lead-handling software and related setup services to businesses. These terms apply to the business identified in the Order (you or the Client), not to an individual buying for personal use. The person accepting them confirms that they can bind that business. They do not govern the services your business supplies to its own customers.

Pavilion, we and us mean Pavilion AI Co Ltd, trading as Pavilion AI, incorporated in England and Wales with company number 15638345 and registered office at 114–116 Plumstead High Street, London SE18 1SJ. Contact and notices: hello@pavilionai.io.

An Order is an order form, proposal or other written service agreement accepted by both parties. The Services are the Pavilion features and work specified in that Order. Client Data means information, materials and personal data supplied by you or processed for you through the Services. A Business Day is Monday to Friday, excluding public holidays in England. Times are UK local time unless the Order states otherwise.

Your contract and what is included

The contract starts when both parties accept an Order that incorporates these terms. Acceptance may be by electronic signature or a clear written acceptance. Merely browsing the website does not create a paid subscription. We will make the applicable terms available before acceptance and retain a record of the accepted version.

The contract consists of the Order, these terms and Schedule A, the Data Processing Agreement. Mandatory international-transfer terms take priority where applicable; Schedule A takes priority on personal-data matters; the Order takes priority on other matters; then these terms apply. An Order does not reduce Schedule A's protections unless it expressly identifies a lawful amendment agreed by both parties.

Your Order must identify the enabled channels, locations, users, integrations, prices, included usage, overage rates, trial dates, paid start date, billing frequency and any minimum term. Optional work, advertising spend, bought-in data, outbound campaigns and third-party subscriptions are included only if expressly listed. Your purchase-order terms do not apply unless we expressly accept them.

Website examples show how the product may be used; they are not a list of features automatically included in every plan. We must nevertheless describe the Services accurately. Nothing here removes liability for fraud or overrides an express commitment in your Order.

Website and public demonstrations

Website content is provided to explain Pavilion and help you evaluate it. You may view and share links to it for legitimate purposes. Do not copy or commercially exploit our software or protected content, interfere with the website or misrepresent an association with us. Nothing limits uses permitted by law.

A public demo is a test environment, not a real plumbing firm or other service provider. A demonstration appointment does not reserve a real engineer or professional. Do not use it to obtain emergency help, commission actual work, submit real confidential case details or disclose someone else's sensitive information. Contact your intended service provider directly for real work.

Demo replies and outcomes are illustrative and may be wrong. We may apply reasonable usage limits or block abuse. Participation does not create a paid subscription, authorise unrelated marketing or establish a professional relationship. Information submitted to Pavilion's public demo is handled under our Privacy Notice. Any additional demo-specific conditions must be clearly shown before you start.

What Pavilion does

Depending on your Order and configuration, Pavilion receives enquiries, sends replies and follow-ups, gathers information, applies your qualification rules, offers permitted prices, checks connected calendars, makes bookings, routes matters to your team and records activity and outcomes.

You authorise Pavilion to communicate in your business's name and carry out those actions only within your documented configuration. You remain the supplier of your services. Pavilion does not perform your professional work, attend appointments or take responsibility for your customers' underlying jobs.

An outcome such as Booked, Escalated, Disqualified or No response describes the recorded workflow status. It is not a guarantee that an appointment will be attended, work will be accepted, an invoice will be paid or revenue will result. Your Order identifies the outcome labels and reporting actually supplied.

Setup and going live

We will use reasonable care and skill to configure the agreed Services. You must provide accurate business information, authorised account access, service areas, availability, prices, working hours, escalation contacts and clear limits on what the system may say or do.

Before live use, both parties will approve the configuration and complete reasonable checks of routing, replies, calendar access, permitted prices, escalation destinations and stopping rules. Approval must be recorded in writing. Testing does not waive responsibility for defects that were not reasonably apparent.

Any target to go live in days depends on timely information, account permissions, number provisioning, approvals and successful checks. Unless the Order expressly fixes a binding deadline, we will agree a revised timetable if these dependencies delay launch. We will not start the trial clock simply because internal setup has begun.

Tell us promptly when your staff, services, prices, capacity, hours or rules change. We will implement agreed changes with reasonable care and confirm when they take effect. Until then, the last approved configuration remains in use, unless it must be paused to avoid harm or unlawful activity.

Free trial and paid activation

Where offered, the free trial lasts 14 consecutive calendar days from the agreed live activation date. We will confirm the start and end dates in writing. There is no payment-card requirement, subscription fee or automatic paid conversion during the trial.

The trial includes the usage expressly stated in the Order. We will not impose unexpected trial overage charges. If you reach the agreed allowance, we may pause the affected activity or obtain your express approval for additional paid usage before it is incurred.

You may end the trial at any time by notifying us. A paid service starts only when you expressly accept its price and billing terms. Silence, continued possession of an account or failure to cancel is not acceptance of paid service. If no paid arrangement is accepted, live processing stops at the trial's end, subject to orderly shutdown and data return.

You keep the customer relationships and bookings generated during the trial, even if you do not continue. The exit provisions below explain export, calendar records and deletion. We may restrict repeat trials by the same business or end a trial for abuse or unlawful use, but not retrospectively charge for an agreed free trial.

Fees, billing and changes to price

Fees are those expressly accepted in the Order, in pounds sterling unless otherwise stated. VAT is added where applicable. Unless the Order says otherwise, subscriptions are billed monthly in advance and approved usage charges monthly in arrears. Invoices are due within 14 days. Any direct-debit collection follows the mandate and advance-notice arrangements accepted by you.

Usage charges apply only at disclosed rates and within an agreed budget or ceiling. We will identify whether telecoms, AI usage, numbers, email, calendars and other provider costs are included or charged separately. No undisclosed fair-use fee applies. We will seek approval before exceeding a hard spending limit, or pause the affected activity.

Raise invoice concerns promptly, with reasonable details. You must pay undisputed amounts when due. We will investigate genuine disputes and will not suspend solely for withholding a reasonably disputed amount while both parties cooperate to resolve it. You must reimburse only reasonable, evidenced recovery costs that the law permits; no contractual late-payment interest is imposed by these terms.

Prices remain fixed during an agreed minimum term. Afterwards we may change them on at least 30 days' written notice, effective no earlier than the next renewal after that notice expires. You may cancel before the increase takes effect without an early-exit charge. Mandatory tax changes apply as required by law.

Subscription length and cancellation

Unless the Order expressly states a minimum term, paid service continues month to month. You may cancel at any time before the next monthly renewal, effective at the end of the current paid period. No additional notice period or cancellation fee applies. A longer minimum term must be expressly accepted in the Order, with its end date and renewal terms made clear.

Cancellation may be sent to the contact email above or through any cancellation control we provide. We will acknowledge it and confirm the end date. Cancellation does not depend on a retention call. Turning off a payment mandate alone does not tell us which Services to cancel or remove fees already properly due.

Except where the contract provides a refund or the law requires one, fees for an elapsed or partly used billing period are not refunded merely because you stop using the Services. Unused prepaid periods after a valid termination for our material breach are refunded. At the end of a minimum term, the service becomes monthly unless a new fixed term is expressly agreed.

AI, human oversight and professional boundaries

AI can misunderstand, omit information or produce an inaccurate response. Pavilion is not legal, tax, medical, financial, engineering or other regulated professional advice, an emergency service or a substitute for a professional's judgement. Do not configure it to provide advice, assurances or commitments outside its approved scope.

You must nominate people who can review escalations and exceptions, keep their contact details current and respond within the times you promise customers. A deadline shown in an escalation is a task for your team; it does not mean that a person at Pavilion is monitoring or resolving it. Unless expressly agreed, 24/7 inbound automation does not include 24/7 human support.

We will take reasonable steps to make the system follow the agreed limits and to investigate and correct reported defects. Your oversight obligations do not excuse our failure to use reasonable care and skill. If a reply is materially wrong or harmful, promptly pause the affected workflow where possible and notify us; both parties will cooperate to contain and correct the issue.

Do not use Pavilion to make solely automated decisions with legal or similarly significant effects on a person, such as deciding eligibility for credit, employment, essential healthcare or professional representation, unless separately assessed and expressly agreed in writing with the legally required safeguards. Ordinary enquiry routing must also be fair, relevant and open to human correction.

For regulated or confidential work, you remain responsible for client acceptance, conflict checks, suitability, professional duties and any required consent. A booking or intake conversation alone does not create your professional engagement. Privileged or highly sensitive material may be submitted only under an expressly approved data-processing configuration; using Pavilion does not itself establish or preserve legal privilege.

Numbers, messages and connected services

Existing-number missed-call text-back depends on compatible forwarding or other approved routing, valid caller identification, permissions and carrier support. Some calls, including withheld or non-text-capable numbers, cannot receive an SMS. Voice menus, call handling and forwarding settings may affect whether a call is identified as unanswered. We will explain material known limitations during setup.

SMS, email, WhatsApp, Facebook, Instagram, calendars and other integrations are available only where included, supported and approved. Delivery and timing may be affected by provider outages, spam filtering, rate limits, account restrictions and the recipient's device or settings. We do not guarantee delivery of every message or uninterrupted access to a third-party platform.

You must comply with the applicable provider rules disclosed during onboarding and maintain accounts you control. We remain responsible for our own configuration and for subprocessors as required by Schedule A. Calling a provider a third party does not remove those duties.

You retain your pre-existing accounts and numbers. Numbers provisioned for the service are governed by the relevant provider's allocation and porting rules; neither party acquires ownership of a public telephone number merely by using it. The Order must state whose provider account holds each number. On exit we will reasonably assist an eligible transfer, disclose genuine provider charges and avoid avoidable interruption. Porting depends on the provider and is not guaranteed.

Calendar entries depend on accurate availability, calendars staying connected and the configured booking rules. You must fulfil, reschedule or cancel your customer appointments and keep your own essential business records. We will assist with correcting bookings caused by a defect in our Services.

Lawful use and customer communications

You are responsible for the lawful collection of Client Data and for your instructions, campaign content, notices and required marketing permissions. We are responsible for our own legal obligations. A missed call, form submission, bought-in contact list or reply to an enquiry is not blanket permission for unrelated marketing.

Service replies must stay relevant to the enquiry. Promotional follow-ups require the permissions and lawful basis applicable to the person, channel and subscriber type. Where consent is required, you must be able to demonstrate it. Business marketing rules differ for companies, sole traders and some partnerships. Publicly available details are not automatically permission to market.

Both parties must respect applicable objections, opt-outs and suppression lists. You must configure reasonable frequency, sending hours and stopping rules. You must not restart a suppressed marketing contact unless there is a valid lawful reason and, where required, fresh consent. Operational messages must not disguise marketing.

You must not use the Services for unlawful content, impersonation, harassment, discrimination, fraud, harmful code, unauthorised access, harvesting credentials, circumventing safety or rate limits, or contacting people deceptively. You must not resell or provide access outside the authorised business without written agreement. Lawful testing within an agreed scope is permitted.

You must tell people where appropriate that they are interacting with an automated assistant and provide an accessible route to your team. Do not instruct the system to falsely claim to be a particular human. Voicemail capture is recorded and transcribed as part of the service, with a spoken notice before recording; any other recording must be expressly agreed.

Accounts, security and support

Protect account credentials, restrict access to authorised staff, use available security controls and promptly report suspected compromise. You are responsible for actions you authorise, but not automatically for unauthorised activity caused by our failure to meet our security obligations.

We will maintain security appropriate to the processing and provide the support specified in your Order. Unless an enhanced service level is agreed, there is no guaranteed response time or uptime percentage. Planned maintenance will, where reasonably practicable, be notified and scheduled to limit disruption. We will use reasonable efforts to restore faults within our control.

We may update the Services for security, reliability or legal reasons. We will not materially reduce agreed core functionality during a paid period without providing a reasonable alternative or allowing you to end the affected Services and receive a refund for their unused prepaid period. Beta or experimental features will be identified and will not replace contracted core features without agreement.

Your data, our technology and confidentiality

As between the parties, you retain all rights in Client Data and your customer relationships. You grant us only the rights needed to provide, secure and support the Services, follow your lawful instructions and perform Schedule A. We do not acquire ownership of your leads because we handled them.

We and our licensors retain rights in Pavilion's software, general methods, templates and technology. During the contract you receive a non-exclusive, non-transferable right to use the Services for your authorised business. Ownership of bespoke deliverables, if any, must be stated in the Order. We may use voluntary product feedback without identifying you or disclosing Client Data.

We will not sell Client Data, use it to market our services to your leads or use identifiable Client Data to train a general-purpose or cross-client AI model. Any separately proposed use needs a separate lawful arrangement and express written agreement; it is not authorised by these terms. Schedule A also applies to model providers and other subprocessors.

Each party must keep the other's non-public business information confidential, use it only for the contract and disclose it only to people who need it and are bound by appropriate duties. Exceptions apply to information lawfully public, already lawfully known, independently developed or lawfully obtained from another source. Legally required disclosures must be limited, with notice where permitted. Confidentiality continues for five years after termination, and for personal data and trade secrets for as long as protection is legally required or the information remains a trade secret.

We will not publish your name, logo, customer conversations, testimonials or case studies without your prior written permission. This does not prevent disclosures required by law or to our confidential professional advisers.

Personal data

Schedule A governs personal data processed on your behalf and forms part of every Order involving that processing. It is a contractual commitment, not a substitute for your own privacy notice, lawful bases, impact assessments or professional obligations.

We separately act as controller for limited business administration, our own enquiries and marketing, billing, and other purposes described in our Privacy Notice. Controller activity is not an unrestricted right to reuse lead conversations. Our Privacy Notice explains individual rights; accepting these terms does not constitute consent to marketing, tracking or unrelated processing.

Suspension and ending for cause

Either party may end the contract by written notice if the other commits a material breach and fails to remedy it within 14 days after a notice identifying the breach and required remedy, or immediately if the breach cannot reasonably be remedied. Either party may end it for insolvency to the extent permitted by applicable law, including restrictions on termination of supply contracts.

We may suspend only the affected activity where reasonably necessary to address an immediate security risk, unlawful use, serious abuse, a binding legal requirement or a provider restriction that prevents delivery. We will explain the reason and restoration steps unless prohibited or doing so would compromise security. Suspension must be proportionate and lifted promptly once the cause is resolved.

For undisputed overdue payments, we will give at least three days' written notice and a reasonable opportunity to pay before suspension. If a suspension or inability to provide core service continues for more than 30 days for reasons not caused by you, you may end the affected Services and receive a refund of unused prepaid fees for the unavailable service.

What happens when the service ends

Live replies, follow-ups and new automated bookings stop on the agreed end date, subject to a short, agreed shutdown where needed. You keep existing bookings and relationships; cancellation does not authorise us to cancel your customers' appointments. You must take over outstanding enquiries and escalation tasks.

At your choice we will return or delete Client Data under Schedule A. You may request a standard export during the contract and within 30 days after termination, without an additional export fee. Bespoke migration work requires a separate agreed fee. We will not withhold the standard data return solely as leverage for a payment dispute.

We will explain any remaining provider-account or number steps and withdraw access when it is no longer needed. Keeping a booking does not include indefinite platform access, future automated reminders or continued operation of a number after its service ends. Data in your own calendars and systems remains subject to your retention arrangements.

Accrued payment obligations, data return and deletion, confidentiality, intellectual property, liability, disputes and other provisions intended to survive remain effective.

Liability

Nothing in the contract excludes or limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any liability that cannot lawfully be limited. Nothing limits an individual's statutory data-protection rights or a regulator's powers.

Subject to that paragraph, neither party is liable to the other for indirect or consequential loss, or for loss of profit, revenue, anticipated savings, business opportunities or goodwill, whether direct or indirect. This exclusion does not exclude reasonable direct costs of correcting defective work, restoring affected data or obtaining replacement services to the extent caused by a breach and otherwise recoverable under this contract.

For all other claims, each party's total aggregate liability arising from the contract is limited to the fees paid or payable for the Services in the 12 months preceding the first event giving rise to a claim. During a free trial no fees have been paid, so that limit is nil.

For breaches of confidentiality or Schedule A, the aggregate cap is instead the greater of £10,000 and twice those 12-month fees. These are aggregate caps for the contract, not amounts payable for each incident; payments under the ordinary cap count towards the higher cap, so the caps do not stack. The higher cap applies only to the relevant confidentiality or data-protection claims.

These caps apply regardless of whether a claim is in contract, tort including negligence, misrepresentation, indemnity or otherwise, subject always to liabilities that cannot lawfully be limited. They do not limit your duty to pay properly due service fees, our duty to return unused prepaid fees where required, or either party's obligation to return property or data. Each party must take reasonable steps to reduce its loss. There is no double recovery for the same loss.

Third-party claims

You will reimburse us for sums finally awarded or reasonably agreed in settlement of a third-party claim directly caused by your unlawful content, infringement in materials you supplied, or unlawful instructions given in breach of this contract, together with reasonable legal defence costs. This does not cover loss caused by our breach, negligence, unauthorised modification or processing outside your instructions.

We will defend a third-party claim that your authorised use of Pavilion's own software in the UK infringes that party's copyright or trade mark, and pay damages finally awarded or reasonably settled. This does not cover your materials, unauthorised modifications or a combination not supplied or approved by us where the claim would otherwise not arise. We may obtain continued-use rights, modify the affected feature without materially reducing it, or end that feature and refund unused prepaid fees if neither is reasonably practicable.

The party seeking protection must notify the other promptly, permit reasonable control of the defence and cooperate at the defending party's reasonable expense. No settlement may admit fault, require non-monetary obligations or restrict the protected party without its reasonable consent. These protections are subject to the Liability section. Neither party automatically assumes the other's regulatory fines or criminal liability.

Events outside reasonable control

Neither party is responsible for delay caused by an event genuinely outside its reasonable control, provided it takes reasonable steps to prevent and mitigate disruption and promptly informs the other. This does not excuse inadequate security, routine resource shortages, payment for Services already supplied, or duties which data-protection law requires regardless of the event.

If the event prevents core service for more than 30 days, either party may end the affected Services. We will refund prepaid fees for the period of service that cannot be supplied after termination.

General terms and disputes

We may amend these terms for future Orders. For an existing Order, material changes require at least 30 days' written notice and take effect at the next renewal after that period, with a right to cancel before they apply. Changes needed urgently by law or security may apply earlier to the extent necessary, with prompt explanation and an exit right where they materially disadvantage you. No change applies retrospectively to accrued rights or disputes.

Neither party may transfer the contract without the other's consent, not unreasonably withheld, except to a successor acquiring the relevant business who assumes the obligations and does not materially reduce the other's protections. We remain responsible for subcontracted performance where the contract or law makes us responsible. Schedule A controls subprocessor appointments.

This contract records the parties' agreement on its subject matter and supersedes earlier discussions, without excluding fraud or liability for a representation that cannot lawfully be excluded. Amendments and waivers must be in writing. If a provision is unenforceable, it is severed to the minimum necessary; the rest continues. A delay in enforcing a right is not a waiver. Nothing creates a partnership, employment relationship or agency beyond the limited communication and booking authority expressly granted here.

No third party may enforce these terms under the Contracts (Rights of Third Parties) Act 1999, except where mandatory transfer terms expressly give rights to individuals. This does not affect rights individuals have under law.

Contract notices may be sent to the email contacts in the Order. They are treated as received on the next Business Day after sending unless a delivery failure is received. This rule does not extend statutory deadlines or govern formal service of court proceedings.

A party with a dispute should first send a written account of the issue and requested resolution. Authorised representatives will seek to resolve it within 20 Business Days. This does not prevent urgent relief, statutory complaints or steps needed to protect a limitation period. English law governs the contract and non-contractual disputes; the courts of England and Wales have exclusive jurisdiction, subject to mandatory law.

Roles, scope and instructions

For personal data processed for your lead-handling and related Services, you are the controller and Pavilion is the processor. If you act as a processor for someone else, Pavilion is your subprocessor and you confirm that you have that controller's authority. This Schedule does not change roles that applicable law assigns based on actual activities.

Data Protection Law means the UK GDPR, Data Protection Act 2018 and PECR, as amended, and any other data-protection law that applies to the relevant processing. Personal data, controller, processor, personal data breach and data subject have their meanings in that law.

We will process personal data only on your documented lawful instructions, including this Schedule, the Order and approved configuration, unless UK law requires otherwise. If legally compelled, we will inform you before processing unless the law prohibits that notice. We will promptly tell you if we believe an instruction infringes Data Protection Law and may pause the affected processing while it is resolved.

You determine the purposes, lawful bases, notices, recipients, retention requirements and any special-category conditions for Client Data. You must provide lawful instructions and the information we reasonably need to carry them out. You may amend instructions in writing; material additional work may require agreed charges, but charges will not prevent us meeting our own legal duties.

Processing description

Subject matter and duration: providing the Services for your business during the Order, followed only by the agreed return, deletion and legally required retention periods. Processing is ongoing when the relevant channel is enabled.

Nature and purpose: collecting, receiving, transmitting, storing, organising, matching, retrieving and analysing enquiries; generating replies; qualification and routing under your rules; booking and updating appointments; follow-up; authorised human review; troubleshooting, security, export and deletion.

Individuals: your prospects, customers, people making enquiries for them, authorised users, staff, contractors and named escalation contacts. Information about other individuals may appear within an enquiry and must be minimised.

Data categories: names, contact details, business or household details relevant to the enquiry, addresses and postcodes, channel identifiers, message content, service requests, approved quotes, availability, booking records, assigned staff, timestamps, communication preferences, consent and suppression records, conversation history and recorded workflow outcomes. Voice audio and transcripts are excluded unless expressly enabled in an agreed processing specification.

Sensitive data: routine intake may incidentally reveal health information or other sensitive matters. Intentional processing of special-category data, criminal-offence data, children's data or legally privileged material requires a documented, expressly approved configuration identifying the necessity, additional legal conditions, access controls, retention and any impact assessment. You must not upload passwords, payment-card security codes or identity documents unless a separate secure workflow is agreed. We will help you restrict, remove or safely route unexpected sensitive content.

Approved processing locations, recipients and providers must be recorded in the processing register supplied with the Order before processing begins. A general product feature description is not approval for an unlisted provider to receive Client Data.

Confidentiality and security

We will restrict access to people who need it for the agreed processing and who are bound by confidentiality duties. We will maintain appropriate technical and organisational measures under Article 32, taking account of the data, risks and state of the art, and will not materially reduce agreed protection during the contract.

The minimum contractual security measures are: access permissions limited by role; multi-factor authentication for privileged access where technically available; encryption in transit and at rest for stores under our control; secure handling and rotation of credentials; separation of client access; authenticated integration endpoints; relevant audit and security logs; vulnerability and patch management; tested recovery arrangements; staff confidentiality and security training; and an incident-response process. Provider-specific controls and any technically necessary alternatives must be documented in the agreed security specification before use.

We will provide information reasonably needed to assess these measures. This Schedule does not claim a security certification, independent audit, UK-only hosting or zero data retention by AI providers unless separately evidenced and expressly stated.

Subprocessors and international transfers

You generally authorise only the subprocessors identified in the register provided before the relevant processing starts. The register must state each legal entity, function, categories of data, processing locations and transfer safeguard. Providers you contract with directly are not automatically our subprocessors; the register must explain the actual arrangement.

We will give at least 30 days' written notice of a proposed new or replacement subprocessor before it receives your personal data. You may object during that period on reasonable data-protection grounds. We will work in good faith on a suitable alternative. If none is reasonably available, either party may end the affected Services before the change, with a refund of unused prepaid fees. We will not send your data to the objected-to provider while the objection is unresolved.

We will impose written obligations on subprocessors that provide the protection required by Article 28, assess appropriate guarantees and remain responsible to you for their performance of those obligations. Provider terms must not permit use of Client Data inconsistent with your instructions, including independent general-model training.

We will not make a restricted international transfer, including relevant overseas access, without your documented authorisation and a lawful transfer mechanism. This may be applicable UK adequacy regulations or an appropriate safeguard such as a properly completed UK International Data Transfer Agreement or UK Addendum to the EU standard contractual clauses, with the required data protection test and supplementary measures where necessary.

Listing a safeguard here does not execute it or establish that a transfer is compliant. Required transfer documents and assessments must be completed before that transfer. Mandatory transfer terms prevail over inconsistent commercial terms. If a safeguard ceases to be valid, we will suspend the affected transfer until a lawful solution is in place.

Rights requests and compliance assistance

Taking account of the processing, we will provide appropriate assistance with access, correction, deletion, restriction, portability, objections and other applicable individual rights. We will forward requests relating to your data without undue delay and normally within three Business Days, and will not decide them on your behalf unless authorised or legally required.

We will assist, taking account of the information available to us, with security assessments, breach duties, impact assessments and prior consultation with the regulator. We will supply relevant records and information reasonably needed to demonstrate Article 28 compliance. You control communications with individuals and regulators about your processing unless law requires us to communicate directly.

Routine assistance and help required because of our breach are included. Any substantial additional work may be charged only at a reasonable rate agreed in advance. A fee dispute does not relieve us of a statutory obligation or justify obstructing your compliance deadline.

Personal data breaches

We will notify your nominated security contact without undue delay after becoming aware of a personal data breach affecting Client Data. Our contractual target is within 24 hours of awareness; we will not delay an initial notice while investigating every detail.

As information becomes available, we will describe the nature of the breach, affected data and people, likely consequences, mitigation and a contact for follow-up. We will contain and investigate the breach, preserve relevant evidence and cooperate with your response. Notification is not itself an admission of liability.

You decide whether to notify the regulator or affected people for processing you control, within applicable deadlines. We will not make that decision for you or use our contractual notification target to extend any legal deadline.

Audits and records

We will make available the information needed to demonstrate compliance and allow and contribute to audits, including inspections, by you or an independent auditor you appoint. Relevant reports and remote review may be used first where they adequately answer the request.

Ordinary audits should use reasonable notice, confidentiality safeguards and arrangements that avoid exposing another client's data or unnecessarily disrupting service. They will normally occur no more than once per year, but this does not restrict additional audits reasonably needed following an incident, credible non-compliance concern or regulator request. Reasonable urgent access will be allowed where necessary. No certification or supplier report is an absolute substitute for your statutory audit rights.

Each party normally bears its own costs. We bear reasonable additional audit costs caused by our material non-compliance. We will keep the processing records required by law and cooperate with competent supervisory authorities.

Return, retention and deletion

During service, we will follow the retention schedule recorded in your Order and processing register. You should not treat Pavilion as the sole archive for regulated records or professional files. A longer retention period must have a documented purpose and appropriate access restrictions.

At your choice, we will return or delete personal data when the Services end and delete copies unless law requires retention. Unless you instruct earlier deletion, standard export is available for 30 days after termination. Active copies will then be deleted by day 60 after termination. Residual backup copies will be isolated from ordinary use and removed on the next applicable deletion cycle, no later than day 90 after termination, unless law requires otherwise. Restoring a backup will not reactivate deleted data for ordinary processing.

Where legal retention is required, we will tell you the legal basis where permitted, restrict use to that purpose and delete the information when the requirement ends. We will confirm completion of deletion on reasonable request and ensure equivalent downstream deletion instructions reach relevant subprocessors.

AI use and separation of client data

Client Data may be supplied to an authorised AI provider only to perform the agreed Services under the provider register and this Schedule. We will not authorise training of a general-purpose or cross-client model on identifiable Client Data. Operational inference, temporary context and provider security or abuse logs must be described accurately in the register; a no-training restriction does not mean that no provider retains any data.

We will not deliberately combine different clients' lead histories to identify people across businesses. Identity matching within your authorised account must use relevant identifiers and reasonable safeguards against mistaken matches. Any proposed secondary use of personal data requires separate instructions, a lawful basis and appropriate transparency; general service-improvement wording does not authorise it.

Genuinely anonymous statistics may be used only where individuals cannot reasonably be identified and your confidential business information is protected. Pseudonymised, hashed or coded data is not treated as anonymous merely because direct names were removed.

Required processing register

Before live processing, the parties must complete and retain: the Client's controller identity and privacy/security contacts; enabled channels and purposes; sensitive-data authorisations if any; the retention schedule; the security specification; the named subprocessor register with locations and transfer mechanisms; and any required transfer documents. Changes follow this Schedule.

Controller privacy/security contact: as recorded in the applicable Order. Pavilion privacy/security contact: security@pavilionai.io. Current subprocessor register and security specification: the provider register at /legal/subprocessors. No live Client Data may be sent to a provider until its appointment and transfer arrangements are approved under this Schedule.