Valtura Platform Trial Agreement

1. Parties, scope and status

1.1 This Agreement is between Valtura Payments Group Ltd, company number 16319763, of 129 North Hill, Plymouth, Devon, England, PL4 8JY (“Valtura”) and the organisation identified in the Platform account (the “Subscriber”).

1.2 This Agreement governs the Subscriber's access to and use of the Valtura client portal, software, tools, reports, integrations and associated services made available as part of the trial (the “Platform”). It does not govern Valtura's public website.

1.3 Valtura's Privacy Notice explains how Valtura processes personal data as controller. Where Valtura processes Customer Personal Data on the Subscriber's behalf, the Data Processing Addendum in Schedule 1 (the “DPA”) applies.

1.4 The Subscriber confirms that it enters into this Agreement wholly for business purposes and that the accepting user has authority to bind it.

1.5 Participation in any PCI compliance programme operated by Fraud Defence First Limited, merchant referral arrangement, acquisition programme, transfer of merchant portfolio, lead-sharing programme or other Valtura group service is outside this Agreement and requires a separate agreement or express written opt-in.

2. Free trial

2.1 The trial lasts for 30 days beginning when an Authorised User first successfully signs in to the Platform (the “Trial Period”), unless Valtura extends it through the Platform or in writing. Email verification or account creation before first sign-in does not shorten the Trial Period.

2.2 No subscription fee is payable during the Trial Period. The Subscriber is not required to provide payment card or bank details and the trial does not automatically renew or convert into a paid subscription.

2.3 At the end of the Trial Period, access will be restricted unless the Subscriber separately accepts a paid Order Form and Platform Subscription Agreement. There is no obligation to upgrade.

2.4 Unless Valtura agrees otherwise, each organisation is entitled to one free trial. Valtura may vary trial functionality for new trials, but will not impose a paid subscription without the Subscriber's express acceptance.

3. Accounts and Authorised Users

3.1 The Subscriber must provide accurate business information and use a business email address. “Authorised User” means an employee, officer, contractor or agent whom the Subscriber authorises to use the Platform for its internal business purposes.

3.2 The Subscriber is responsible for its Authorised Users, permissions and credentials under its control, except to the extent unauthorised access results from Valtura's breach of this Agreement. The Subscriber must notify Valtura promptly if it reasonably suspects credential compromise or unauthorised access.

4. Licence and intellectual property

4.1 Valtura and its licensors retain all intellectual property rights in the Platform, software, documentation, interfaces, methodologies, templates, branding and other materials supplied by Valtura (“Valtura Materials”).

4.2 During the Trial Period, Valtura grants the Subscriber a limited, non-exclusive, non-transferable, non-sublicensable and revocable licence for its Authorised Users to access and use the Platform solely for the Subscriber's internal evaluation and business purposes.

4.3 The Subscriber retains all rights in data, documents and materials that it or its Authorised Users submit to the Platform (“Customer Data”). The Subscriber grants Valtura a limited right to host, copy, process, transmit and otherwise use Customer Data only as necessary to provide, secure and support the Platform and as otherwise instructed by the Subscriber.

4.4 Valtura may create and use statistics derived from Platform use only where they are aggregated and anonymised so that they do not identify the Subscriber, a merchant or an individual.

5. Customer Data, merchant-book protection and privacy

5.1 Customer Data is treated as Confidential Information. Valtura shall not sell Customer Data or use identifiable Customer Data to solicit the Subscriber's merchants for Valtura's or another ISO's payment acquiring services unless the Subscriber separately instructs Valtura to do so or expressly participates in a separately agreed referral, lead-sharing or acquisition programme.

5.2 If Customer Data contains personal data for which the Subscriber is controller, Valtura will process that personal data in accordance with the DPA.

5.3 The Subscriber is responsible for ensuring that it has the rights, permissions and lawful basis required to submit Customer Data and instruct Valtura to process it.

6. Confidentiality

6.1 Each party shall keep the other party's Confidential Information confidential and use it only to perform or receive the Platform services or exercise rights under this Agreement. Confidential Information includes merchant portfolios, residuals, payaways, pricing, commercial plans, source code, Platform architecture and security information, and information marked confidential or that a reasonable business person would understand to be confidential.

6.2 A party may disclose Confidential Information to its personnel, professional advisers and approved service providers who need to know it and are bound by confidentiality obligations, or where disclosure is required by law, court order or regulator. Where legally permitted, the receiving party shall give reasonable advance notice of compelled disclosure.

6.3 Confidential Information does not include information that the receiving party can demonstrate is lawfully public through no breach, was already lawfully known without restriction, is independently developed without use of the disclosing party's information, or is lawfully obtained from a third party without confidentiality restriction.

7. Acceptable use

7.1 The Subscriber shall use the Platform only for lawful business purposes and shall not gain or attempt to gain unauthorised access; interfere with the Platform; introduce malicious code; scrape or systematically extract Platform data except through authorised export features; conduct unauthorised security testing; circumvent access controls; use the Platform to infringe third-party rights; or reverse engineer, decompile or disassemble the Platform except to the extent a restriction is prohibited by applicable law.

7.2 The Subscriber must not upload special category data, criminal-offence data, full payment card numbers, card verification values, PIN or PIN blocks, magnetic-stripe or track data or other sensitive authentication data unless Valtura has expressly agreed in writing that a specific feature is designed and approved to process that category of data.

8. Platform operation, outputs and third parties

8.1 Valtura shall provide the trial Platform with reasonable care and skill. The trial is an evaluation service and no uptime service level or uninterrupted operation is guaranteed. Valtura may carry out maintenance and may suspend access where reasonably necessary for security, misuse, legal compliance or protection of the Platform.

8.2 ROI summaries, valuations, quotes, savings analyses, proposals, pricing comparisons and other calculated, AI-assisted or generated outputs depend on Customer Data and Platform assumptions. They are estimates and decision-support tools only, not guarantees of savings, valuation, acceptance, business performance or future results. The Subscriber remains responsible for reviewing outputs before relying on them or communicating them to third parties.

8.3 Nothing generated through the Platform binds an acquirer, processor, lender, buyer or other third party unless that third party separately confirms its agreement. Third-party systems and integrations are subject to their own availability and terms. Valtura is not responsible for a third party's independent acts or omissions, but this does not exclude Valtura's responsibility for its own breach of this Agreement.

9. Expiry, suspension and data exit

9.1 Either party may end the trial at any time. Valtura may suspend or terminate immediately where reasonably necessary to address fraud, unlawful use, a material security threat, serious misuse, or a legal or regulatory requirement. For other material breach, Valtura will normally give a reasonable opportunity to remedy the breach where it is capable of remedy.

9.2 When the Trial Period expires or this Agreement ends, Platform access may be restricted. Unless the Subscriber requests earlier deletion, the Subscriber instructs Valtura to retain Customer Data for up to 90 days solely for recovery and export, after which Customer Personal Data will be handled in accordance with the DPA.

10. Liability

10.1 Nothing in this Agreement excludes or limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot lawfully be excluded or limited.

10.2 Subject to clause 10.1, neither party is liable to the other for indirect or consequential loss, or for loss of profit, revenue, anticipated savings, goodwill or business opportunity, in each case to the extent such loss is indirect or was not reasonably foreseeable when this Agreement was entered into.

10.3 Subject to clauses 10.1 and 10.4, Valtura's total aggregate liability arising out of or in connection with the Trial Period shall not exceed £10,000.

10.4 Valtura's total aggregate liability for breach of clause 6 or the DPA shall not exceed £25,000, except to the extent applicable law does not permit contractual limitation. This cap is separate from, and does not increase, the cap in clause 10.3 for other claims.

10.5 The liability limits apply to all causes of action arising from the same facts in aggregate and are intended to allocate commercial risk between business parties. Nothing in this clause limits either party's liability to a regulator or data subject where such liability cannot lawfully be limited by contract.

11. General

11.1 This Agreement and the DPA constitute the entire agreement for the trial and supersede prior discussions about trial access. Neither party relies on a statement not set out in this Agreement, except that nothing limits liability for fraud or fraudulent misrepresentation.

11.2 If this Agreement conflicts with the DPA on a data-protection matter, the DPA prevails. Valtura's general website Terms of Service do not apply to authenticated Platform trial use.

11.3 Neither party may assign this Agreement without the other's prior written consent, except that Valtura may assign it to an affiliate or to a purchaser or successor of all or substantially all of the Platform business on written notice.

11.4 Neither party is liable for delay caused by events beyond its reasonable control, except that this does not excuse obligations concerning confidentiality or protection of personal data to the extent those obligations remain capable of performance.

11.5 Failure or delay in exercising a right is not a waiver. If a provision is unenforceable, it shall be modified to the minimum extent necessary and the remainder continues in force. No person other than the parties has rights under the Contracts (Rights of Third Parties) Act 1999.

11.6 Nothing creates a partnership, joint venture, fiduciary relationship or agency between the parties or authorises either party to bind the other.

11.7 Notices may be sent by email to the Subscriber's account administrator and to platform@valturaplatform.co.uk. A notice is treated as received on the next Business Day after transmission unless the sender receives a delivery failure notice. “Business Day” means a day other than Saturday, Sunday or public holiday in England when banks in London are open for business.

11.8 Valtura may update these trial terms for future trials. A material change to an active Trial Period will be notified before taking effect unless an earlier change is reasonably required by law or to address an urgent security risk. No change will create a paid subscription without the Subscriber's express acceptance.

11.9 This Agreement and any non-contractual obligations arising from it are governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction.

Schedule 1 — Data Processing Addendum

This DPA forms part of the Agreement whenever Valtura processes Customer Personal Data on the Subscriber's behalf.

D1. Scope and roles

D1.1 For Customer Personal Data, the Subscriber is the controller and Valtura is the processor, except to the extent the parties are required by Data Protection Legislation to have different roles for a specific processing activity.

D1.2 Each party shall comply with Data Protection Legislation applicable to it. “Data Protection Legislation” means the UK GDPR, the Data Protection Act 2018 and other applicable UK data protection and privacy legislation as amended from time to time, including amendments made by the Data (Use and Access) Act 2025.

D1.3 The processing details and the Subscriber's standing documented instructions are set out in the Processing Details below. Additional instructions may be given in writing, including through configured Platform features, support requests or email, provided they are consistent with the Agreement and applicable law.

D2. Processing on instructions

D2.1 Valtura shall process Customer Personal Data only on the Subscriber's documented instructions, including in relation to international transfers, unless UK law requires otherwise. Where legally permitted, Valtura shall inform the Subscriber before processing required by law.

D2.2 If Valtura reasonably considers that an instruction infringes Data Protection Legislation, it shall immediately inform the Subscriber and may suspend the affected processing until the instruction is amended or the issue is resolved.

D3. Confidentiality and security

D3.1 Valtura shall ensure that persons authorised to process Customer Personal Data are bound by confidentiality obligations and receive access only to the extent necessary for their role.

D3.2 Taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing and the risks to individuals, Valtura shall implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, that data.

D3.3 Those measures shall include, as appropriate to the risk, access controls and privilege management; measures designed to preserve confidentiality, integrity, availability and resilience; secure backup and recovery arrangements; vulnerability, incident and change-management processes; and procedures for regularly assessing the effectiveness of security measures. This clause is a contractual minimum standard and does not represent that any particular certification is held unless Valtura confirms it separately in writing.

D4. Sub-processors

D4.1 The Subscriber gives Valtura general written authorisation to appoint sub-processors reasonably necessary to provide the Platform. Valtura shall maintain a current list at https://valturaplatform.co.uk/subprocessors.

D4.2 Valtura shall give at least 30 days' prior notice of a new sub-processor where the change may materially affect Customer Personal Data. The Subscriber may object during that period on reasonable data-protection grounds. The parties shall work in good faith to address the objection; if a reasonable solution is not available, either party may terminate the affected service without penalty before the new sub-processor begins processing the Subscriber's Customer Personal Data.

D4.3 Valtura shall impose on each sub-processor data protection obligations that provide an equivalent level of protection for Customer Personal Data as the relevant obligations in this DPA and remains responsible to the Subscriber for the sub-processor's performance of those obligations.

D5. International transfers

D5.1 Valtura shall not transfer Customer Personal Data outside the United Kingdom, or permit a sub-processor to do so, unless the transfer is permitted by Data Protection Legislation and any required adequacy regulation, recognised safeguard, standard data protection clause, addendum or other lawful transfer mechanism is in place.

D6. Assistance and breaches

D6.1 Taking into account the nature of processing, Valtura shall provide reasonable assistance through appropriate technical and organisational measures to enable the Subscriber to respond to requests from individuals exercising their data-protection rights.

D6.2 Taking into account the nature of processing and information available to it, Valtura shall provide reasonable assistance with the Subscriber's obligations concerning security of processing, personal data breach notifications, data protection impact assessments and prior consultation with the ICO where required.

D6.3 Valtura shall notify the Subscriber without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data and shall provide available information reasonably required for the Subscriber to assess and respond to it. Valtura may provide that information in stages as it becomes available.

D7. Return, export and deletion

D7.1 The Subscriber may request an export of Customer Data in a format reasonably available through the Platform or Valtura's standard export process.

D7.2 On expiry or termination, the Subscriber instructs Valtura to retain Customer Personal Data for up to 90 days solely to permit account recovery and export, unless the Subscriber requests earlier deletion or return. At the end of that period, or earlier on the Subscriber's documented instruction, Valtura shall delete or return Customer Personal Data at the Subscriber's choice and delete existing copies, unless UK law requires retention.

D7.3 Customer Personal Data contained in secure backups may remain until overwritten in the ordinary backup cycle, provided it is protected, not restored except for disaster recovery or legal necessity, and deleted in accordance with Valtura's normal backup lifecycle.

D8. Information and audits

D8.1 Valtura shall make available information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR and this DPA.

D8.2 The Subscriber may audit Valtura's compliance with this DPA no more than once in any 12-month period on at least 10 Business Days' written notice, unless a Personal Data Breach, regulator request or reasonable evidence of material non-compliance justifies a more immediate or additional audit. Audits must be proportionate, during normal business hours, avoid unreasonable disruption and protect other customers' confidential information. Valtura may satisfy an audit request in the first instance through current independent assurance reports or equivalent compliance information where those materials reasonably address the request.

D9. Subscriber responsibilities

D9.1 The Subscriber is responsible for determining the lawfulness of its collection and use of Customer Personal Data, providing required privacy information, establishing an appropriate lawful basis, responding to individuals and ensuring its instructions to Valtura comply with Data Protection Legislation.

D9.2 The Subscriber shall not upload personal data that the Platform is not intended to process, including the categories identified as excluded by default in the Processing Details, unless Valtura has expressly agreed otherwise in writing.

D10. Valtura controller data

D10.1 Where Valtura processes business contact, account administration, billing, security, fraud-prevention or similar personal data for its own purposes, Valtura acts as controller and its Privacy Notice applies. Retention periods in that Privacy Notice do not override Valtura's processor obligations for Customer Personal Data under this DPA.

D11. Precedence and liability

D11.1 If this DPA conflicts with another part of the Agreement on a data-protection matter, this DPA prevails to the extent of the conflict. Liability between the parties arising under this DPA is subject to the liability provisions in the Agreement, except to the extent applicable law does not permit contractual limitation.

Processing Details

Subject matter: Hosting, operating, supporting and securing the Valtura Platform and processing Customer Personal Data submitted or generated through it.

Duration: The Trial Period or Subscription Term (as applicable), plus any agreed export or recovery period and the time reasonably required to complete secure deletion from active systems and backup cycles.

Nature and purpose: Storage, organisation, retrieval, analysis, reporting, document and proposal generation, AI-assisted analysis and generation where the Subscriber uses an AI feature, payaway and residual processing, user administration, support, troubleshooting, security, backup and recovery, in each case only to provide the Platform on the Subscriber's documented instructions.

Data subjects: Subscriber personnel and Authorised Users; merchants and merchant personnel; prospective merchants or other business contacts whose details the Subscriber lawfully uploads; and other individuals whose personal data is included in Customer Data.

Personal data: Names, work contact details, job roles, user and account identifiers, merchant and business identifiers, correspondence, proposal information, residual and payaway information where it relates to an identifiable individual or sole trader, usage and access logs, and other personal data the Subscriber elects to submit within the permitted scope of the Platform.

Excluded by default: Special category personal data, criminal-offence data, full payment card numbers, card verification values, PIN or PIN blocks, magnetic-stripe or track data, and other sensitive authentication data must not be uploaded unless Valtura has expressly agreed in writing that a specific Platform feature is designed and approved to process it.

Controller instructions: Provide the Platform and associated support; maintain security, availability, backups and recovery; create requested outputs; make approved disclosures to authorised sub-processors; return, export or delete data as instructed; and comply with applicable law.