Bolkra Terms of Service

Plain English summary

This summary explains these Terms in everyday language. It is not a substitute for the full Terms below, which are what legally apply.

• These are the rules for using Bolkra. By creating an account or using the platform, you agree to them.
• Bolkra is a business tool. You must be 18 or over and you must be using Bolkra for business purposes.
• Plans. There are six plans: Free, Solo, Starter, Pro, Agency and Enterprise. Each includes a monthly allowance of images.
• Billing. Paid plans are billed monthly and renew automatically. You can cancel at any time. Cancellation takes effect at the end of the billing period you have already paid for.
• Image caps. When you reach your monthly image allowance, generation pauses. We do not charge surprise overage fees. You can buy a one-time Boost Pack or Power Pack, upgrade your plan, or wait for your allowance to reset on the first of the month.
• Pricing changes. We can change our prices. For a material price increase we will give you at least 30 days notice.
• What you own. You own the images you generate. We do not take any commercial rights in them and we do not use your content to train AI.
• What you are responsible for. You are responsible for the prompts you write and the reference images you upload, including making sure they do not infringe anyone's rights. If you train a model on a real person, you must have that person's written consent.
• Acceptable use. Our Fair Use Policy explains what you may not generate. Breaking it can lead to account termination.
• Agencies. Agency tier customers can resell Bolkra-generated imagery to their own clients under their own brand, with extra responsibilities set out in Sections 13 and 14.
• Data protection. Schedule A at the end of these Terms is our Data Processing Agreement. It governs how we process your content as your processor and satisfies UK and EU GDPR Article 28.
• Availability and liability. We aim for high availability but do not guarantee uptime on standard plans. Our liability to you is limited, as Section 20 explains.
• Law. These Terms are governed by the law of England and Wales.

1. These Terms and who we are

Bolkra is operated by Northern Collective Limited ("Bolkra", "we", "us", "our"), a company registered in England and Wales under company number 10590386, with registered office at 33 Metcombe Way, Manchester M11 3BY, United Kingdom, trading as Bolkra.

These Terms of Service ("Terms") govern your access to and use of the Bolkra platform, websites and related services (together, the "Service"). By creating an account, by clicking to accept these Terms, or by using the Service, you agree to be bound by these Terms. If you are agreeing on behalf of a company or other organisation, you confirm that you have authority to bind that organisation, and "you" means that organisation.

These Terms are for business use of the Service. They are not consumer terms. They should be read together with our Privacy Policy and our Fair Use Policy. Schedule A at the end of these Terms is our Data Processing Agreement and applies whenever we process personal data on your behalf as a processor.

2. Definitions

In these Terms:

"Account" means the account you register to access the Service.

"Workspace" means a project environment within your Account in which content is organised. Some plans include more than one Workspace.

"Content" means everything you and your users upload to, create in, or generate using the Service, including Reference Images, prompts, trained models and Generated Images.

"Reference Images" means images you upload to the Service, including product photographs and images of people used to train models.

"Generated Images" or "Outputs" means images produced by the Service in response to your prompts and Reference Images.

"Plan" means the subscription tier you select, as described in Section 4.

"Image" has the meaning given in Section 5.

"Boost Pack" and "Power Pack" mean the one-time image top-ups described in Section 6.

"Agency tier" means the Agency Plan described in Sections 4, 13 and 14.

"End Client" means a third party to whom an Agency tier customer provides imagery or services using the Service.

"Fair Use Policy" means our acceptable use policy, published at bolkra.com/fair-use.

"Data Processing Agreement" or "DPA" means Schedule A at the end of these Terms.

3. Eligibility and accounts

Eligibility. You must be at least 18 years old to use the Service. The Service is intended for businesses, agencies, brands and professionals. It is not intended for personal or household use, and it is not intended for, or directed at, anyone under 18.

One account per legal entity. Unless you are on the Agency tier or the Enterprise plan, you may hold one Account per legal entity. Agency tier and Enterprise customers may operate multiple Workspaces, and where agreed multiple sub-accounts, in line with Sections 13 and 14 and any separate agreement.

Account security. You are responsible for keeping your login credentials secure, for all activity that takes place under your Account, and for the acts and omissions of any users you invite. You must tell us promptly if you believe your Account has been accessed without authorisation. We are not liable for losses caused by your failure to keep your credentials secure.

Accurate information. You must give accurate registration and billing information and keep it up to date.

4. Plans, features and what is included

The Service is offered on the following Plans. The features and allowances of each Plan are summarised below and described more fully on bolkra.com.

"Pooled" means the monthly image allowance is shared across all of the Workspaces included in the Plan, rather than allocated separately to each.

Setup fees. The Pro Plan includes an optional setup consultancy for £750. The Agency Plan includes a setup fee of £1,000. Setup fees are one-time charges, are separate from subscription fees, and are payable in advance.

Enterprise. Enterprise customers are served under a separate written agreement. Where that agreement conflicts with these Terms, the Enterprise agreement prevails.

Currency and VAT. Prices are stated in pounds sterling.

5. Images: what counts, monthly caps and overage

What counts as one Image. One "Image" means one image file successfully generated and delivered to a Workspace. A generation request that fails for a technical reason on our side does not count towards your allowance. Each variation, edit or upscale operation that produces a new image file counts as one Image.

Monthly reset. Your monthly image allowance resets on the first day of each calendar month. Unused monthly allowance does not roll over to the next month.

At the cap. When you reach your monthly image allowance, image generation pauses for the rest of the month. We do not apply automatic overage charges and we will not bill you a surprise fee for going over. To continue generating before your allowance resets, you can buy a Boost Pack or Power Pack (Section 6) or upgrade your Plan.

Fair processing. Image allowances are intended for normal business use of the Service. We may apply reasonable technical limits, including limits on the rate of generation requests, to protect the stability of the Service for all customers.

6. Boost Packs and Power Packs

You can buy one-time image top-ups at any time:

• a Boost Pack costs £25 and adds 250 images;
• a Power Pack costs £75 and adds 1,000 images.

Boost Pack and Power Pack images are added to your balance and are drawn down after your monthly allowance for that month has been used. Boost Packs and Power Packs are one-time purchases and renew automatically only if you choose to repurchase them.

7. Billing, renewal and cancellation

Billing cycle. Paid Plans are billed monthly in advance. Your billing date is the date you first subscribe to a paid Plan, or as otherwise shown in your Account.

Automatic renewal. Paid Plans renew automatically at the end of each monthly billing cycle, at the then-current price for your Plan, until cancelled. By subscribing, you authorise us and our payment provider to charge your chosen payment method on each renewal.

Payment. Payments are processed by Stripe. You must provide a valid payment method and keep it current. If a payment fails, we may retry the charge and may suspend the Service until payment is made.

Cancellation. You can cancel a paid Plan at any time from your Account settings. Cancellation takes effect at the end of the billing cycle you have already paid for. You keep access to your paid features until the end of that cycle, and you are not billed again after it.

Refunds. Except where these Terms say otherwise or the law requires, fees already paid are non-refundable, including for partial months and for unused image allowance. We do not give pro-rata refunds when you cancel partway through a billing cycle.

Downgrades. If you downgrade your Plan, the change takes effect at the start of your next billing cycle, and your image allowance and Workspace limits change accordingly.

Free Plan. The Free Plan is provided at no charge. We may change, limit or withdraw the Free Plan, or any feature of it, at any time.

8. Changes to pricing

We may change our prices, our Plans and the allowances included in them.

For an increase in the recurring price of a paid Plan you are subscribed to, or a material reduction in the allowances of that Plan, we will give you at least 30 days notice by email or through the Service. The change takes effect at your next billing cycle after the notice period. If you do not accept the change, you may cancel before it takes effect, in which case Section 7 applies.

We may change the price of Boost Packs, Power Packs and setup fees at any time, with the new price applying to purchases made after the change. Changes to Free Plan terms may be made at any time under Section 7.

9. Your content and reference images

You keep your rights. As between you and us, you keep all rights you hold in your Content, including your Reference Images and your prompts. These Terms do not transfer ownership of your Content to us.

Licence to operate the Service. You grant us a limited, non-exclusive, worldwide, royalty-free licence to host, store, copy, transmit, process and display your Content, and to share it with the service providers described in our Privacy Policy and Schedule A, solely to operate and provide the Service to you, to secure and back up the Service, and to comply with the law. This licence exists only so that we can run the Service for you. It ends when the relevant Content is deleted, subject to routine backups as described in our Privacy Policy. We do not use your Content to train, fine-tune or develop any AI model. Our full position on this is in the Fair Use Policy and the Privacy Policy.

Your warranties about Reference Images. You warrant that, for every Reference Image you upload, you have all rights, licences, permissions and consents necessary to upload it, to use it within the Service, and to generate Outputs from it. This includes any rights held by photographers, rights holders in any depicted products, designs or artwork, and any individuals shown in the image. We do not verify, and are not responsible for verifying, whether you hold the necessary rights in your Reference Images. That responsibility is yours.

Removal. We may remove or disable access to Content that we reasonably believe breaches these Terms, the Fair Use Policy or the law, or that exposes us or others to liability. Where practical and lawful, we will tell you when we do this.

10. Real-person likenesses

The Service can be used to train models on, and to generate, the likeness of real people. Where you do this, the following applies.

Written consent is required. If you upload Reference Images of a real, identifiable person, or train a model on the likeness of a real person, you must have that person's written consent to do so for the purposes for which you use the Service. This is a contractual requirement, not a recommendation.

Your warranties. You warrant that you hold the necessary written consent for every real person whose likeness you upload or train on, that your use is within the scope of that consent, and that you will stop using and will delete the relevant Content if consent is withdrawn.

Special category data. Training a model on the photographs of an identifiable person may involve biometric data, which is a special category of personal data under data protection law. You are the controller of that data and are responsible for meeting the legal conditions for processing it, as explained in our Privacy Policy.

Our position. We are not responsible for your failure to obtain or to honour consent. You indemnify us against claims arising from that failure, as set out in Section 21. The Fair Use Policy explains what likeness generation is prohibited outright.

11. Intellectual property in generated images

This Section sets out who owns Generated Images and on what terms. It is important, and you should read it in full alongside the Fair Use Policy.

You own your Outputs. As between you and us, you own the Generated Images you produce using the Service. You may use, reproduce, modify, adapt, publish and commercially exploit your Outputs, and you may integrate them with other work, without owing us any further fee or royalty.

We take no commercial rights in your Outputs. We do not retain any commercial rights in your Generated Images. We will not sell them, license them to others, or use them to promote Bolkra without your separate permission. We do not use your Outputs to train any AI model.

Caveats you must understand. Your ownership of Outputs is subject to the following, which reflect how AI image generation works and the current state of the law.

First, we do not warrant that any Output is original, unique, or free from third-party intellectual property claims. Outputs are shaped by your prompts and Reference Images. Similar prompts, by you or by other customers, may produce similar or substantially similar Outputs. You do not receive any exclusive right in a style, an aesthetic, or in imagery that resembles your Outputs.

Second, the law on whether AI-generated images attract copyright is unsettled and varies by country. In some jurisdictions, an image generated purely by an AI system, without sufficient human authorship, may not be protected by copyright at all. We make no representation about whether, or to what extent, copyright subsists in any Output. Our Fair Use Policy discusses this honestly.

Third, your rights in the elements you supply are unaffected. Where an Output incorporates your own Reference Images, your own products, or your own brand, your rights in those underlying elements remain yours and are not changed by these Terms.

Your responsibility for IP risk. Because your prompts and Reference Images determine your Outputs, you are in the best position to assess intellectual property risk. You are responsible for ensuring that your prompts, your Reference Images and your use of Outputs do not infringe the rights of any third party.

12. Acceptable use and the Fair Use Policy

Your use of the Service must comply with these Terms and with our Fair Use Policy, which is incorporated into these Terms by reference. The Fair Use Policy explains our positions and limits in full. In summary, you must not use the Service to create, upload, store or distribute:

• child sexual abuse material, which is absolutely prohibited and which we report to the relevant authorities;
• imagery that depicts a real, identifiable person without the consent required under Section 10, including deepfakes and non-consensual likenesses;
• imagery that infringes a third party's copyright, trademark, design rights or other intellectual property;
• imagery designed to deceive viewers, including fabricated photographic evidence of events that did not occur, and imagery passed off as the official imagery, campaign or collaboration of a brand you do not own or have a licence to use;
• imagery that facilitates or promotes violence, terrorism, or hatred against a group;
• imagery depicting or facilitating illegal activity; or
• content generated in bulk for spam, or in a way that abuses the Service or other users.

This is a summary. The Fair Use Policy is the full statement of what is and is not permitted. If the Fair Use Policy and this summary appear to differ, the Fair Use Policy governs.

We may investigate suspected breaches and may suspend or terminate Accounts under Section 22. For serious breaches, including any involving child safety, we may act immediately and without refund.

13. Agency tier and reselling

This Section applies to Agency tier customers. It sets the baseline position. The full commercial relationship for agencies should be governed by a separate Agency Master Agreement.

You are our customer. If you are on the Agency tier, you are the direct Bolkra customer. Your End Clients are not Bolkra customers and have no contractual relationship with us. Your relationship with each End Client is yours to manage.

Reselling Outputs. You may provide and resell Generated Images, and imagery services built on the Service, to your End Clients under your own brand. You may do so as part of your own paid engagements.

You cannot grant more than you have. You may not grant any End Client rights in the Service or in Outputs that are greater than the rights we grant you under these Terms. Any licence or permission you give an End Client must be consistent with, and no broader than, these Terms and the Fair Use Policy.

Your client agreements are your responsibility. You are responsible for having appropriate agreements with your End Clients, including terms that pass down the relevant restrictions in these Terms and the Fair Use Policy, terms on intellectual property, and terms on consent for any real-person likenesses.

You are responsible for your End Clients. You are responsible and liable for all activity in any Workspace you control, including activity by your End Clients and by anyone you give access to. A breach of these Terms or the Fair Use Policy by your End Client in a Workspace you control is treated as a breach by you. Your indemnity in Section 21 covers claims arising from your End Clients' activity.

14. White-label

This Section applies to Agency tier customers using the white-label features of the Service.

Removing Bolkra branding. White-label features let you present the imagery and, where offered, the client-facing surfaces of the Service to your End Clients under your own brand, without visible Bolkra branding. You may remove Bolkra branding from delivered imagery and from the customer-facing surfaces that the white-label feature is designed to cover.

Attribution we retain. We may retain Bolkra identification in technical and administrative surfaces that are not customer-facing, for example in system metadata, API responses, billing and administrative communications sent to you as our customer, and internal logs. You may not remove, obscure or alter Bolkra branding or notices outside the surfaces that the white-label feature is designed to cover, and you may not misrepresent the Service as having been built by you.

Agency-branded communications. Where the Service sends communications that reach your End Clients, and the white-label feature allows those to be sent under your brand, you are responsible for the accuracy of the branding and contact details you configure, and for ensuring those communications comply with applicable law, including marketing and electronic communications law.

15. API access

API access is available on the Agency tier and the Enterprise plan, and is not available on other Plans.

Use of the API. If you use the API, you must comply with these Terms, the Fair Use Policy, and any technical documentation and rate limits we publish. We may apply and change rate limits and other technical limits to protect the stability and fair use of the Service.

API credentials. API keys are confidential. You are responsible for keeping them secure and for all activity carried out using them.

No independent resale of API access. You may use the API to build and deliver your own services to your End Clients in line with Section 13. You may not resell, sublicense, or provide raw API access itself as a standalone product, separately from your underlying subscription and the services you build on it. Access to the API is tied to an active, paid subscription.

Changes to the API. We may change, deprecate or withdraw API features. Where a change is likely to materially affect your integration, we will give reasonable notice where we can.

16. Service availability

We work to keep the Service available and reliable. We aim for monthly availability of at least 99.5%, measured excluding scheduled maintenance and events outside our reasonable control.

This is a target, not a guarantee, on standard Plans. We do not offer a contractual service level commitment, service credits, or uptime guarantee on the Free, Solo, Starter, Pro or Agency Plans. The Service is provided on those Plans on an "as available" basis.

Enterprise. A contractual service level agreement, including defined availability commitments and remedies, is available to Enterprise customers under a separate agreement.

Maintenance. We may carry out scheduled and emergency maintenance, and may suspend the Service where necessary to do so. We will give reasonable notice of scheduled maintenance where we can.

Third-party dependencies. The Service depends on third-party providers, including AI inference, hosting and storage providers. Interruptions or changes at those providers may affect the Service, and where they are outside our reasonable control they are not our responsibility.

17. Support

We provide customer support through the channels described on bolkra.com. Support scope and response targets may differ by Plan. Support response targets are targets, not contractual commitments, except where a separate Enterprise agreement says otherwise.

18. Confidentiality

Each party may receive non-public information from the other that is marked confidential or that should reasonably be understood to be confidential ("Confidential Information"). Each party will keep the other's Confidential Information confidential, will use it only to perform or use the Service, and will protect it with reasonable care. This does not apply to information that is or becomes public through no fault of the receiving party, that the receiving party already held or independently developed, or that must be disclosed by law. Your Content is your Confidential Information, and we handle it as described in these Terms, the Privacy Policy and Schedule A.

19. Warranties and disclaimers

We warrant that we will provide the Service with reasonable skill and care.

Except as expressly stated in these Terms, and to the fullest extent permitted by law, the Service and all Outputs are provided "as is" and "as available", and we exclude all other warranties, conditions and terms, whether express or implied, including any implied terms as to satisfactory quality, fitness for a particular purpose, and non-infringement.

In particular, and without limiting Section 11, we do not warrant that the Service will be uninterrupted or error-free, that Outputs will meet your expectations or requirements, that Outputs will be accurate, original or unique, or that Outputs will be free from third-party intellectual property claims.

Nothing in this Section limits the warranties or rights that cannot be excluded under English law.

20. Liability

Nothing in these Terms limits or excludes either party's liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot be limited or excluded under the law of England and Wales. Your indemnity obligations in Section 21 are not subject to the limits in this Section.

Subject to the paragraph above:

Excluded losses. We are not liable to you for any loss of profits, loss of revenue, loss of business, loss of anticipated savings, loss of goodwill, or loss of or damage to data, or for any indirect or consequential loss, in each case whether or not foreseeable and however arising.

Cap on liability. Our total aggregate liability to you arising out of or in connection with these Terms and the Service, whether in contract, tort including negligence, breach of statutory duty, or otherwise, is limited to the total fees you paid to us for the Service in the 12 months immediately before the event giving rise to the claim.

This Section reflects the allocation of risk between us, which is reflected in our pricing. You are responsible for arranging your own insurance and backups where appropriate.

21. Indemnity

You will indemnify and hold us harmless against all losses, damages, liabilities, costs and expenses, including reasonable legal fees, that we incur arising out of or in connection with:

• your use of the Service in breach of these Terms or the Fair Use Policy;
• your Content, including any claim that your prompts, your Reference Images, or your use of Outputs infringe the intellectual property rights or other rights of a third party;
• any claim relating to a real person's likeness arising from your failure to obtain or honour the consent required under Section 10;
• your breach of the acceptable use requirements in Section 12 and the Fair Use Policy; and
• where you are an Agency tier customer, the acts and omissions of your End Clients and any users in Workspaces you control, and any claim brought by an End Client.

We will tell you promptly of any claim covered by this Section, will not settle it without your consent where that consent is not unreasonably withheld, and will give you reasonable cooperation in dealing with it.

22. Suspension and termination

Your right to terminate. You can terminate a paid Plan at any time by cancelling it, as described in Section 7. Termination takes effect at the end of the billing cycle you have paid for.

Our right to suspend or terminate. We may suspend or terminate your Account, a Workspace, or your access to all or part of the Service, with immediate effect, if:

• you materially breach these Terms or the Fair Use Policy and, where the breach can be remedied, you do not remedy it within a reasonable period after we ask you to;
• you fail to pay fees when due and do not pay within a reasonable period after we ask you to;
• you use the Service in a way that we reasonably believe is unlawful, abusive, or harmful to us, to the Service, or to other users; or
• we are required to do so by law.

For serious breaches, including any breach involving child safety, unlawful content, or conduct that exposes us or others to immediate risk, we may suspend or terminate immediately and without notice, and without refund of any fees, including subscription fees and setup fees.

Setup fees. Setup fees are non-refundable once the related setup work has begun.

Effect of termination. When your access ends, you must stop using the Service. Your Content is dealt with as described in our Privacy Policy and Schedule A. In summary, after an Account is closed, workspace data is retained for 90 days and then deleted, which gives you a window to export your Content. We recommend you export anything you need before that window closes. Termination does not affect any rights or liabilities that arose before it, and Sections that by their nature should survive, including Sections 9, 11, 18, 19, 20, 21, 23 and 24, survive termination, along with the surviving provisions of Schedule A.

23. Changes to these Terms

We may change these Terms from time to time, for example to reflect changes to the Service, to our business, or to the law.

For a material change that is to your disadvantage, we will give you at least 30 days notice by email or through the Service before the change takes effect. For other changes, we will update these Terms and change the "Last updated" date at the top.

If you do not accept a material change, you may cancel your paid Plan before the change takes effect, and Section 7 applies. If you continue to use the Service after a change takes effect, you are taken to have accepted the updated Terms.

24. Governing law and jurisdiction

These Terms, and any dispute or claim arising out of or in connection with them or their subject matter, including non-contractual disputes or claims, are governed by and construed in accordance with the law of England and Wales.

The courts of England and Wales have exclusive jurisdiction to settle any such dispute or claim.

25. General

Force majeure. Neither party is liable for any failure or delay in performing its obligations, other than an obligation to pay, caused by an event beyond its reasonable control, including failures of third-party providers, internet and infrastructure failures, acts of government, and natural events.

Severability. If any provision of these Terms is found to be invalid or unenforceable, the rest of the Terms remain in effect, and the invalid provision is treated as modified to the least extent needed to make it valid, or removed if it cannot be.

Entire agreement. These Terms, together with the Privacy Policy, the Fair Use Policy, Schedule A, and any separate Enterprise or Agency Master Agreement, are the entire agreement between you and us about the Service, and replace any earlier agreement or understanding on that subject. Nothing in this Section limits liability for fraud.

No waiver. A failure or delay by either party in exercising a right under these Terms is not a waiver of that right, and a single or partial exercise of a right does not prevent its further exercise.

Assignment. You may not assign or transfer your rights or obligations under these Terms without our prior written consent. We may assign or transfer our rights and obligations to a successor of our business, or as part of a reorganisation, on notice to you.

No partnership or agency. Nothing in these Terms creates a partnership, joint venture, or relationship of employer and employee or principal and agent between you and us.

Third-party rights. A person who is not a party to these Terms has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce any of them.

Notices. We may give you notices by email to the address on your Account, or through the Service. You can contact us using the details below.

Contact us

Questions about these Terms can be sent to:

• Email: stewart@northern-collective.co.uk
• Post: Legal, Northern Collective Limited, 33 Metcombe Way, Manchester M11 3BY, United Kingdom

Schedule A — Data Processing Agreement

This Schedule forms part of the Bolkra Terms of Service and applies where we process personal data on your behalf as a processor in connection with the Service. It satisfies our obligations under Article 28 of the UK GDPR and the EU GDPR.

In this Schedule, "Customer", "you" and "your" mean the controller, and "Bolkra", "we", "us" and "our" mean the processor.

A1. Roles and instructions

For Content you submit to the Service that contains personal data, you are the controller and we are your processor. We process that personal data only on your documented instructions, which consist of:

• these Terms and this Schedule;
• the configuration of your Account and Workspaces;
• the generation, training and other operational requests you make through the Service or its API; and
• any further written instructions you give us, where we agree they are within the scope of the Service.

If we cannot comply with an instruction, or we believe an instruction infringes data protection law, we will tell you without undue delay.

A2. Subject matter, duration, nature and purpose of processing

Subject matter and purpose. We process personal data contained in your Content to provide the Service to you, including hosting, storage, generation, model training, retrieval, search, editing and delivery of Generated Images.

Duration. Processing continues for the duration of your Account and the retention periods described in our Privacy Policy.

Nature of processing. Collection, recording, organisation, structuring, storage, retrieval, use, transmission to sub-processors, restriction, erasure, and otherwise as needed to operate the Service.

Types of personal data. Personal data contained in:

• Reference Images, including images of identifiable people, biometric data where applicable, and any metadata embedded in the files;
• prompts and other text you submit;
• trained models that may incorporate biometric features of identifiable people; and
• Generated Images.

Categories of data subjects. Individuals depicted in Reference Images and Generated Images, including your own staff, paid models, customers, agency End Clients, and other individuals you choose to include.

A3. Our obligations as processor

We will:

• process only on instructions as described in A1, except where law requires us to process otherwise, in which case we will tell you (unless the law prohibits us from doing so);
• ensure confidentiality by making sure that people authorised to process the personal data are under appropriate confidentiality obligations;
• implement appropriate security measures as described in A5;
• engage sub-processors only as described in A6;
• assist you in responding to data subject rights requests, in carrying out data protection impact assessments where you require, and in consulting with supervisory authorities where required, to the extent reasonable and proportionate;
• notify you without undue delay if we become aware of a personal data breach affecting your Content, with sufficient information for you to meet your own breach-notification obligations;
• return or delete your Content at the end of the Service as described in A7;
• make available to you the information necessary to demonstrate our compliance with this Schedule, and allow for audits as described in A8.

A4. Your obligations as controller

You will:

• ensure you have a valid lawful basis for the personal data in your Content, including any special category data such as biometric data;
• ensure you have any consents required, including written consent for real-person likenesses as required by Section 10 of the Terms;
• provide all required notices to data subjects whose personal data is in your Content;
• give us lawful, accurate and complete instructions through the configuration and use of the Service;
• not use the Service to process personal data in a way that breaches data protection law.

A5. Security measures

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including those described in Section 16 of the Privacy Policy. These include encryption of data in transit and at rest, access controls, segregation of customer Workspaces, authentication and multi-factor authentication, logging and monitoring, and regular review of our security practices. We assess and update these measures from time to time to reflect the evolving threat landscape and developments in best practice.

A6. Sub-processors

You provide us with general written authorisation to engage sub-processors to process personal data in connection with the Service. The categories of sub-processors we engage are described in Section 10 of our Privacy Policy. A current named list is available to you on request from stewart@northern-collective.co.uk.

When we engage a new sub-processor, or replace an existing one, in a way that affects our processing of your personal data, we will notify you with reasonable notice before the change takes effect. You may object on reasonable data protection grounds within 14 days of our notice. If you do, we will work with you in good faith to find a workable resolution, and if we cannot, you may terminate the affected part of the Service.

We impose on each sub-processor data protection obligations no less protective than those in this Schedule. We remain responsible to you for the performance of each sub-processor's obligations.

A7. Return and deletion of personal data

On termination of the Service, or otherwise on your request, we will, at your choice, return or delete your Content containing personal data, unless we are required by law to retain some or all of it. The standard retention windows and deletion timing are set out in Section 12 of the Privacy Policy. Routine backups that contain deleted data are overwritten in the ordinary course.

A8. Audits

We will, on reasonable written request and no more than once in any 12-month period (or more frequently following a personal data breach affecting your Content or where required by law or a supervisory authority), make available to you the information reasonably necessary to demonstrate compliance with this Schedule. We will respond to reasonable written queries from you within a reasonable period.

Where on-site audits are required by law or by a supervisory authority, we will allow for them on reasonable advance written notice, during business hours, at your cost, subject to reasonable confidentiality and security requirements and conducted in a way that minimises disruption to the Service.

A9. International transfers

To the extent we transfer personal data outside the UK or the EEA in our processing for you, we will rely on a transfer mechanism recognised by applicable data protection law, as described in Section 12 of the Privacy Policy, including Standard Contractual Clauses, the UK Addendum or the UK International Data Transfer Agreement, or an applicable adequacy decision.

A10. Order of precedence and survival

In the event of a conflict between this Schedule and the rest of the Terms in respect of the processing of personal data, this Schedule prevails. The provisions of this Schedule survive termination of the Terms to the extent necessary for us to fulfil our remaining obligations or to comply with applicable law.

These Terms should be read together with the Bolkra Privacy Policy and the Bolkra Fair Use Policy.