Terms and Conditions

IMPORTANT — PLEASE READ CAREFULLY: These Terms and Conditions govern your access to and use of the People Compass platform. By accessing or using People Compass — whether as an enterprise client, administrator, manager, or end-user employee — you agree to be bound by these Terms. If you do not agree, you must not access or use the platform.

1. Definitions

Key terms used throughout this Agreement:

2. Scope and Acceptance

These Terms constitute a legally binding agreement between DriftAI and the Client governing all access to and use of the People Compass platform, including any APIs, data connectors, dashboards, AI-generated insights, Driffy agent interactions, and associated documentation.

2.1 Acceptance

You accept these Terms by: (a) clicking “Accept” or “I Agree” within the platform; (b) executing an Order Form that references these Terms; (c) permitting any Authorised User to access the platform; or (d) continuing to use People Compass after receiving notice of updated Terms.

2.2 Authority

If you accept these Terms on behalf of an organisation, you represent and warrant that you have authority to bind that organisation. If you lack such authority, you must not accept these Terms or use the platform.

2.3 Evaluation / Trial Access

Where DriftAI grants trial access, such access is subject to these Terms and any additional conditions in a written trial agreement. During trial access, the Client must not submit actual Personal Data of its employees unless DriftAI has confirmed in writing that data processing protections (Section 5) are active for the trial period. DriftAI will delete all data submitted during an unconfirmed trial within 7 days of trial termination. DriftAI may terminate trial access at any time without liability.

3. Platform Description and Features

People Compass is a career intelligence platform that transforms fragmented HR transaction records into coherent, explainable career narratives. It is purpose-built for enterprise environments and integrates natively with SAP SuccessFactors, SAP BTP, SAP S/4HANA, and compatible HR systems.

3.1 Core Capabilities

Employee Experience — personalised career storylines, growth journey visualisations, and individual skill-confidence profiles derived from HR Data.

Manager Intelligence — promotion-readiness assessments, team-talent snapshots, and succession indicators for fair, data-backed people decisions.

Leadership & HR Insights — organisational career-velocity analytics, high-potential identification, and equity-of-opportunity monitoring.

Predictive & Skill Intelligence — forward-looking workforce-capability benchmarks and skill-gap analysis powered by the Semantic Engine.

Driffy Agent Suite — autonomous AI agent capabilities deployable on SAP BTP and Microsoft Teams (Azure Bot Framework), for HR workflow automation with mandatory human oversight (see Section 5.5).

3.2 Explainability-First Design

People Compass is engineered with transparency as a core principle. DriftAI may provide contextual indicators, historical references, confidence signals, or traceability information for certain AI-generated outputs where technically feasible. DriftAI does not guarantee universal explainability, auditability, reproducibility, or deterministic behavior for all AI-generated outputs. The platform explicitly avoids personality inference, psychological profiling, emotion recognition (prohibited under EU AI Act Article 5), or biometric categorisation not directly grounded in observable career events.

3.3 AI & Semantic Engine

The Semantic Engine interprets HR event sequences to contextualise career milestones. Outputs are intended to augment, not replace, human judgement. DriftAI does not warrant that AI-generated Career Intelligence is error-free. The Client is solely responsible for human-reviewed employment decisions (see Section 5.5).

3.4 Integrations & Authentication

People Compass connects to SAP SuccessFactors using OAuth 2.0 SAML Bearer Assertion with Principal Propagation, ensuring that data access is limited to the permissions of the authenticated individual user. DriftAI implements identity-scoped and role-based access controls wherever technically feasible and commercially reasonable. Certain integrations, APIs, support activities, administrative workflows, or infrastructure components may require privileged or service-level access for operational purposes. Integrations with SAP BTP, SAP S/4HANA, and other enterprise HR systems are via authenticated, encrypted APIs (TLS 1.2 or higher). Specific integrations depend on the Client’s licensed subscription tier and technical environment.

4. Licence Grant and Permitted Use

4.1 Grant of Licence

Subject to the Client’s compliance with these Terms and timely payment of all applicable fees, DriftAI grants the Client a limited, non-exclusive, non-transferable, revocable licence to access and use People Compass during the Subscription Term solely for the Client’s internal workforce management and HR operations.

4.2 Permitted Users

The Client may permit Authorised Users to access the platform. The Client is responsible for ensuring all Authorised Users comply with these Terms. The number of Authorised Users must not exceed the seat count in the applicable Order Form.

4.3 Restrictions

The Client and its Authorised Users must not:

use People Compass for any purpose other than the Client’s own internal HR and workforce-management operations;

resell, sublicense, distribute, or make the platform available to any third party without DriftAI’s prior written consent;

reverse engineer, decompile, disassemble, or attempt to derive the source code or algorithms of the platform, including the Semantic Engine;

reproduce, copy, modify, adapt, or create derivative works based on the platform or its output;

use platform outputs, screenshots, exports, prompts, metadata, workflows, interfaces, generated responses, or other platform-derived material to train, fine-tune, benchmark, or improve any competing AI, analytics, HR technology, or machine-learning system;

circumvent, disable, or otherwise interfere with security features of the platform;

access the platform by automated means (scraping, crawling, bots) except via DriftAI-sanctioned APIs;

use Career Intelligence outputs to make automated employment decisions without appropriate human oversight, in breach of applicable employment or AI-governance law (including GDPR Article 22 and EU AI Act Article 14);

upload or process data relating to individuals under 18 years of age (except where the Client has verified applicable legal consent for employees lawfully engaged under 18).

5. Data Protection, Privacy & Processing Terms

GDPR ARTICLE 28 COMPLIANCE: This Section 5 constitutes the data processing agreement between DriftAI (as Data Processor) and the Client (as Data Controller / Data Fiduciary) required by GDPR Article 28, UK GDPR, DPDPA 2023, LGPD, and equivalent laws. No separate DPA document is required where these Terms are in force via a signed Order Form.

5.1 Data Controller / Processor Roles

The Client acts as data controller (or data fiduciary under DPDPA 2023) with respect to Personal Data of its employees contained in HR Data. DriftAI acts as data processor, processing HR Data strictly on the Client’s documented instructions and solely for the purpose of delivering People Compass functionality. DriftAI will not process HR Data for any other purpose, including DriftAI’s own commercial purposes, without the Client’s prior written consent.

5.2 Subject Matter and Nature of Processing

Subject matter: Delivery of AI-powered career intelligence, workforce analytics, HR workflow automation, and related platform features as described in Section 3 and the applicable Order Form.

Nature of processing: Collection, storage, organisation, structuring, analysis, interpretation, retrieval, use, disclosure, and deletion of HR Data.

Purpose: Providing the People Compass platform and Driffy agent suite services as contracted.

Duration: The Subscription Term as specified in the Order Form.

Type of Personal Data: Employee job histories, career milestones, compensation changes, reporting lines, performance data, skill profiles, and succession data, as submitted by the Client.

Categories of Data Subjects: Employees, contractors, and agents of the Client whose HR Data is submitted to the platform.

5.3 Client Data Responsibilities

The Client warrants that it has obtained all necessary consents, authorisations, and legal bases required under applicable law to share HR Data with DriftAI for processing through People Compass. The Client is solely responsible for:

the accuracy, quality, and completeness of HR Data submitted to the platform;

communicating to its employees how their HR Data is used in People Compass, including providing a compliant privacy notice under GDPR Articles 13–14, UK GDPR, and equivalent laws;

configuring appropriate role-based access controls within the platform to limit visibility of Career Intelligence outputs;

notifying workers and workers’ representatives before deploying People Compass, as required by EU AI Act Article 26(7).

5.4 DriftAI’s Processing Obligations (GDPR Article 28 Compliance)

As data processor, DriftAI shall:

process HR Data only on the documented instructions of the Client, unless required to do so by applicable law, in which case DriftAI will notify the Client of this requirement before processing unless prohibited by law;

ensure that personnel authorised to process HR Data are bound by confidentiality obligations;

implement the technical and organisational security measures described in Section 5.6;

not engage any sub-processor without prior written notice to the Client, including the sub-processors listed in Section 5.9 of these Terms;

assist the Client in responding to requests from data subjects exercising their rights under applicable data protection law, including GDPR Articles 15–22, UK GDPR, CCPA/CPRA, LGPD, PDPA, POPIA, and DPDPA 2023;

assist the Client in ensuring compliance with its obligations under GDPR Articles 32–36 (security, breach notification, DPIA, prior consultation), including by providing the information necessary for the Client to conduct a Data Protection Impact Assessment;

at the Client’s election, securely delete or return all HR Data upon termination or expiry of the Subscription Term and delete existing copies (see Section 5.8);

make available all information necessary to demonstrate compliance with this Section 5. Any audit rights granted to Client shall be limited to no more than once annually, during normal business hours, upon at least thirty (30) days’ prior written notice, at Client’s expense, and in a manner that does not materially disrupt DriftAI operations or compromise security. DriftAI may satisfy audit requests through third-party reports, questionnaires, certifications, or controlled reviews. Source code, security tooling, penetration-test details, and confidential infrastructure information are excluded from audit scope.

5.5 AI Ethics, Autonomous Actions & Employment Law Compliance

People Compass Career Intelligence is designed as a decision-support tool. The Client acknowledges that:

All final employment decisions — including promotions, role assignments, performance management actions, redundancy selections, and compensation changes — must be made by qualified human decision-makers and must not be based solely on platform output, in compliance with GDPR Article 22 and EU AI Act Article 14.

Driffy AI agent actions that modify HR system records, initiate workflows, or send communications on behalf of an employee require explicit per-action human approval before execution, unless the Client has configured and documented a compliant autonomous workflow with appropriate audit logging.

The Client is responsible for configuring approval workflows within People Compass and Driffy to ensure no employment-significant action is taken autonomously without human confirmation.

DriftAI implements commercially reasonable governance, security, and operational practices intended to support evolving regulatory and enterprise security expectations. Compliance obligations remain subject to the Client’s own legal, regulatory, technical, and operational assessment.

The Client is responsible for ensuring its configuration and use of People Compass complies with applicable employment law, equal-opportunity obligations, anti-discrimination law, and AI-governance regulations in its operating jurisdictions.

DriftAI does not participate in, direct, supervise, or control employment-related decisions made by Client. Client assumes sole responsibility for all employment, compensation, promotion, succession, workforce planning, classification, redundancy, disciplinary, performance-management, and HR-related decisions arising from or connected to use of the platform.

DriftAI commits to providing bias and fairness information about the Semantic Engine’s data governance practices upon written request by the Client.

5.6 Security

DriftAI implements the following technical and organisational security measures, aligned with SOC 2 Type II criteria (formal third-party certification in progress):

End-to-end encryption in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent).

Role-based access controls (RBAC) and principle of least privilege.

Multi-factor authentication (MFA) for all internal systems and administrator access.

Continuous security monitoring, vulnerability scanning, and periodic penetration testing.

Zero-Trust Architecture governing network access.

Documented incident response plan with breach-notification procedures.

OAuth 2.0 SAML Bearer Assertion with Principal Propagation for all SuccessFactors connections — ensuring data access is scoped to the authenticated individual user.

5.7 Data Breach Notification

DriftAI will notify the Client without undue delay and in any event within 48 hours of becoming aware of a Personal Data breach affecting HR Data, providing:

a description of the nature of the breach, including categories and approximate number of data subjects and HR Data records affected;

contact details of DriftAI’s privacy contact (information@driftal.tech);

a description of likely consequences and measures taken or proposed to address the breach.

DriftAI will cooperate with the Client to enable the Client to meet its obligations under GDPR Article 33 (72-hour supervisory authority notification), UK GDPR, LGPD Article 48, PDPA (Singapore) 3-day notification, POPIA (South Africa) Regulator notification, and equivalent obligations under applicable law.

5.8 Data Residency, Retention & Deletion

HR Data is processed on SAP BTP infrastructure (operated by SAP SE). International transfers are subject to the mechanisms described below. Upon termination or expiry of the Subscription Term, DriftAI will, at the Client’s election and within 30 days of written request, either securely delete or return all HR Data. Anonymised, aggregated, and de-identified benchmarking insights that cannot be attributed to any individual or organisation may be retained by DriftAI for platform improvement.

5.9 Sub-Processors

The Client authorises DriftAI to engage the following sub-processors for the delivery of People Compass:

DriftAI will notify the Client at least 30 days in advance of any change to this sub-processor list (addition or replacement). The Client may object to a new sub-processor within 14 days of notification on reasonable data protection grounds. If the parties cannot resolve the objection, the Client may terminate the Agreement without penalty.

5.10 DPIA Assistance

DriftAI acknowledges that People Compass may trigger the requirement for a Data Protection Impact Assessment (DPIA) under GDPR Article 35 and equivalent laws, given its systematic AI-based processing of employee data. DriftAI will: (a) provide the Client with all technical information necessary to conduct a DPIA upon written request; (b) maintain and make available upon request DriftAI’s own DPIA for the Semantic Engine processing activities.

6. Intellectual Property

6.1 DriftAI Ownership

DriftAI and its licensors own all right, title, and interest in and to People Compass, including the Semantic Engine, platform architecture, AI models, algorithms, software code, documentation, user interface designs, and all Career Intelligence methodologies. Nothing in these Terms transfers any ownership rights to the Client.

6.2 Client Data Ownership

The Client retains all ownership rights in its HR Data. By providing HR Data to People Compass, the Client grants DriftAI a limited, non-exclusive licence to process HR Data solely to provide the contracted platform services during the Subscription Term.

6.3 Derived Outputs

Career Intelligence outputs generated by the Semantic Engine from the Client’s HR Data are licensed (not sold) to the Client for internal use during the Subscription Term. DriftAI retains all rights in the underlying methodologies and models.

6.4 Feedback

If the Client or any Authorised User provides DriftAI with suggestions, feedback, or ideas relating to People Compass (“Feedback”), the Client grants DriftAI a perpetual, irrevocable, royalty-free licence to use such Feedback to improve DriftAI products and services, without obligation of compensation or attribution. To the extent any Feedback contains Personal Data, such Personal Data will be anonymised before use. This licence applies only to the non-personal aspects of Feedback and does not override DriftAI’s data protection obligations under Section 5.

6.5 Trademarks & Marketing Reference

Neither party may use the other’s name, logo, or trademarks without prior written consent. DriftAI may reference the Client as a customer in marketing materials only if the Client has provided express written consent in advance. No reference will be made without such consent.

7. Confidentiality

Each party agrees to: (a) hold the other’s Confidential Information in strict confidence using at least the same degree of care it applies to its own confidential information (but no less than reasonable care); (b) use Confidential Information only to perform its obligations or exercise its rights under this Agreement; and (c) not disclose Confidential Information to any third party without prior written consent, except to employees, contractors, or advisors with a need to know who are bound by equivalent confidentiality obligations.

These obligations survive termination for five (5) years. Confidential Information does not include information that: (i) is or becomes publicly known without breach; (ii) was rightfully known before disclosure; (iii) is independently developed without reference to the disclosing party’s information; or (iv) must be disclosed by law or court order, provided the disclosing party receives prompt written notice.

8. Fees, Billing, and Payment

8.1 Subscription Fees

Fees for People Compass are set out in the applicable Order Form. All fees are in the currency stated in the Order Form and are exclusive of applicable taxes (including GST / VAT / sales tax) unless otherwise stated.

8.2 Invoicing & Payment

DriftAI will invoice the Client per the billing schedule in the Order Form. Unless otherwise agreed, invoices are due and payable within thirty (30) days of the invoice date.

8.3 Late Payment

Amounts not paid by the due date accrue interest at the rate of 1.5% per month (or the maximum rate permitted by applicable law, whichever is lower), calculated from the due date until actual payment.

8.4 Suspension for Non-Payment

DriftAI may suspend access to People Compass with seven (7) days’ written notice if any undisputed invoice remains unpaid after the due date, without prejudice to DriftAI’s other rights and remedies. In addition, DriftAI may suspend or restrict access to the platform immediately where reasonably necessary to address security risks, regulatory exposure, abusive usage, excessive consumption, unlawful conduct, third-party claims, operational instability, or suspected violations of these Terms.

8.5 Taxes

The Client is responsible for all taxes, duties, levies, and similar charges arising from its use of People Compass. If DriftAI is required to collect or withhold taxes, such amounts will be added to the invoice unless the Client provides a valid tax-exemption certificate.

9. Service Availability and Support

9.1 Availability

DriftAI targets a 99.9% monthly uptime for People Compass, measured by DriftAI’s monitoring systems, excluding scheduled maintenance windows and force-majeure events. Specific uptime SLAs, where applicable, are set out in the Order Form. No uptime commitment is made in DriftAI’s Privacy Statement or any document other than the applicable Order Form.

9.2 Maintenance

DriftAI will provide at least 48 hours’ advance notice of scheduled maintenance expected to cause service interruption. Emergency maintenance may be performed with shorter or no notice where required to address security threats or critical defects.

9.3 Support

DriftAI provides technical support in accordance with the support tier purchased, as described in the Order Form.

9.4 Updates & Enhancements

DriftAI may update, enhance, or modify People Compass (including the Semantic Engine) from time to time. DriftAI will use commercially reasonable efforts to ensure updates do not materially degrade existing functionality. Material changes affecting the Client’s use will be communicated with at least 30 days’ notice.

10. Warranties and Disclaimers

10.1 DriftAI Warranties

DriftAI warrants that: (a) it has the right and authority to grant the licence in Section 4; (b) People Compass will perform materially in accordance with its documentation during the Subscription Term; (c) DriftAI will implement and maintain the security measures described in Section 5.6; and (d) DriftAI will comply with applicable laws in providing the platform.

10.2 Client Warranties

The Client warrants that: (a) it has authority to enter into this Agreement; (b) it has obtained all necessary rights, consents, and authorisations to submit HR Data to the platform; (c) HR Data does not infringe any third-party rights; and (d) it will use People Compass only in accordance with these Terms and applicable law.

10.3 Disclaimer of AI Outputs

CAREER INTELLIGENCE OUTPUTS GENERATED BY THE SEMANTIC ENGINE ARE PROVIDED FOR INFORMATIONAL AND DECISION-SUPPORT PURPOSES ONLY. AI-GENERATED OUTPUTS MAY CONTAIN INACCURACIES, PROBABILISTIC INTERPRETATIONS, INCOMPLETE CONTEXTUAL UNDERSTANDING, GENERATED SUMMARIES, INFERRED ASSOCIATIONS, OMISSIONS, OR UNINTENDED RESULTS. CLIENT ACKNOWLEDGES THAT AI OUTPUTS REQUIRE INDEPENDENT HUMAN REVIEW AND VALIDATION PRIOR TO RELIANCE. DRIFTAI DOES NOT WARRANT UNINTERRUPTED AVAILABILITY, COMPLETENESS, ACCURACY, RELIABILITY, LEGALITY, OR SUITABILITY OF AI-GENERATED OUTPUTS FOR EMPLOYMENT, COMPENSATION, PROMOTION, SUCCESSION, OR WORKFORCE-RELATED DECISIONS. DRIFTAI DOES NOT WARRANT THE FITNESS FOR ANY PARTICULAR PURPOSE OF AI-GENERATED INSIGHTS. THE CLIENT IS SOLELY RESPONSIBLE FOR HOW IT USES CAREER INTELLIGENCE IN EMPLOYMENT DECISIONS. AI OUTPUTS MUST NOT BE USED AS THE SOLE BASIS FOR ANY EMPLOYMENT DECISION.

10.4 General Disclaimer

EXCEPT AS EXPRESSLY SET OUT IN SECTION 10.1, PEOPLE COMPASS IS PROVIDED “AS IS” AND “AS AVAILABLE.” DRIFTAI EXPRESSLY DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW.

11. Limitation of Liability

11.1 Exclusion of Consequential Loss

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES — INCLUDING LOSS OF PROFITS, REVENUE, GOODWILL, DATA, OR BUSINESS OPPORTUNITY — ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

11.2 Aggregate Cap

EACH PARTY’S TOTAL AGGREGATE LIABILITY UNDER OR IN CONNECTION WITH THIS AGREEMENT, WHETHER IN CONTRACT, TORT, STATUTE, OR OTHERWISE, WILL NOT EXCEED THE TOTAL FEES PAID OR PAYABLE BY THE CLIENT TO DRIFTAI DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

11.3 Exceptions

Nothing in this Section limits liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; (c) breach of confidentiality obligations under Section 7; (d) infringement of the other party’s intellectual property rights; (e) DriftAI’s breach of its data protection obligations under Section 5 that results in regulatory fines or penalties imposed on the Client as a direct result of DriftAI’s failure as data processor; or (f) any liability that cannot be excluded or limited by applicable law (including Australian Consumer Law, UK Consumer Rights Act analogues applicable to SMEs, and mandatory EU consumer protection provisions).

12. Indemnification

12.1 DriftAI Indemnity

DriftAI will defend, indemnify, and hold harmless the Client from any third-party claim alleging that People Compass (excluding HR Data and Client modifications) infringes any patent, copyright, trademark, or trade secret, provided the Client: (a) promptly notifies DriftAI in writing; (b) grants DriftAI sole control of the defence; and (c) provides reasonable cooperation. If a claim arises or is likely, DriftAI may procure continued use rights, modify the platform to remove the alleged infringement, or terminate the relevant subscription and refund pre-paid fees on a pro-rata basis.

12.2 Client Indemnity

The Client will defend, indemnify, and hold harmless DriftAI from any third-party claim arising from: (a) the Client’s HR Data, including any alleged breach of privacy or data-protection law; (b) the Client’s use of Career Intelligence in employment decisions; (c) the Client’s breach of these Terms; or (d) violation of applicable employment, equal-opportunity, or anti-discrimination law by the Client.

13. Term and Termination

13.1 Subscription Term

This Agreement commences on the date the Client first accesses People Compass or executes an Order Form (whichever is earlier). Unless an Order Form specifies otherwise, subscriptions automatically renew for successive twelve-month terms unless either party provides written notice of non-renewal at least 60 days before the end of the then-current term. DriftAI will send a written renewal reminder to the Client’s designated contact at least 75 days before each renewal date.

13.2 Termination for Cause

Either party may terminate immediately on written notice if: (a) the other party commits a material breach not cured within 30 days of written notice; (b) the other party becomes insolvent or is subject to insolvency proceedings not dismissed within 60 days; or (c) the other party ceases to carry on business.

13.3 Termination for Convenience

The Client may terminate for convenience by providing 60 days’ written notice. Fees for the remaining Subscription Term remain payable. No refund of pre-paid fees will be issued except where required by applicable mandatory law (including Australian Consumer Law, UK consumer protection provisions applicable to the Client’s jurisdiction, or equivalent EU member state law).

13.4 Effect of Termination

On termination or expiry: (a) all licences immediately cease; (b) the Client must cease all use of People Compass and destroy any downloaded outputs; (c) DriftAI will comply with its data-deletion obligations under Section 5.8; and (d) all accrued payment obligations survive.

13.5 Survival

Sections 1, 5 (data protection obligations), 5.8 (deletion), 6, 7, 8 (accrued fees), 10, 11, 12, 13.4, 13.5, 14, and 15 survive termination or expiry of this Agreement.

14. EU AI Act Compliance & Regulatory Framework

Certain deployments or use cases of People Compass may fall within categories regulated under applicable AI governance laws, including employment-related AI regulations such as the EU AI Act. DriftAI makes no representation that any specific deployment of the platform independently satisfies all regulatory obligations applicable to the Client. The following provisions apply:

14.1 DriftAI’s Obligations as Provider

DriftAI maintains technical documentation for People Compass consistent with EU AI Act Article 11 requirements.

DriftAI implements and maintains a risk management system for People Compass throughout its lifecycle, consistent with EU AI Act Article 9.

DriftAI establishes quality management and data governance for the Semantic Engine consistent with EU AI Act Articles 10 and 17.

DriftAI maintains logs of People Compass operations to the extent technically feasible, consistent with EU AI Act Article 12.

DriftAI will register People Compass in the EU AI system database as required by EU AI Act Article 16 and Article 49 before the platform is placed on the market or put into service for EU users.

14.2 Client’s Obligations as Deployer

The Client must notify workers and workers’ representatives before deploying People Compass in the workplace, as required by EU AI Act Article 26(7). This obligation applies where the Client has users in the EU/EEA.

The Client must ensure human oversight of all AI-generated Career Intelligence before any employment decision is made, as required by EU AI Act Article 14.

The Client must monitor People Compass for unexpected risks on the basis of data provided by DriftAI and report any serious incidents to the relevant national market surveillance authority.

The Client must maintain records of its use of People Compass for at least six months, consistent with EU AI Act Article 26(5) and applicable national implementing measures.

14.3 Broader Regulatory Compliance Table

The Client is solely responsible for ensuring its configuration and use of People Compass complies with the laws of its operating jurisdictions, including any sectoral regulations applicable to its industry.

15. General Provisions

15.1 Governing Law

This Agreement is governed by and construed in accordance with the laws of India, without regard to conflict-of-laws principles, subject to the following jurisdiction-specific overrides:

For clients domiciled in the EU, mandatory EU consumer and data-protection laws (including GDPR and EU AI Act) apply in addition to the governing law selected above.

15.2 Dispute Resolution

The parties will attempt to resolve any dispute through good-faith negotiations for 30 days after written notice. If unresolved, disputes will be submitted to binding arbitration under the rules of the forum specified in Section 15.1 for the Client’s jurisdiction, with proceedings conducted in English. Notwithstanding the foregoing, either party may seek urgent injunctive relief from a court of competent jurisdiction.

15.3 Entire Agreement

This Agreement (including the applicable Order Form and any Statements of Work) constitutes the entire agreement between the parties relating to People Compass and supersedes all prior and contemporaneous agreements, representations, or understandings, written or oral. Section 5 of these Terms constitutes the parties’ data processing agreement for the purposes of GDPR Article 28, UK GDPR, DPDPA 2023, and equivalent laws.

15.4 Amendments

DriftAI may update these Terms from time to time. For material changes, DriftAI will provide at least 30 days’ advance written notice. Continued use of People Compass after the effective date of updated Terms constitutes acceptance. Clients under active Order Forms will not be subject to materially adverse changes until renewal.

15.5 Assignment

The Client may not assign or transfer this Agreement without DriftAI’s prior written consent. DriftAI may assign this Agreement in connection with a merger, acquisition, or sale of substantially all its assets, provided DriftAI gives the Client at least 60 days’ prior written notice. The Client may terminate within 30 days of such notice without penalty if the Client reasonably determines that the acquiring entity does not meet equivalent data protection standards, provided termination notice is given before the assignment becomes effective. This provision satisfies the requirement for controller notification under GDPR Article 28 in the event of a change of processor.

15.6 Severability

If any provision is held invalid or unenforceable, such provision will be modified to the minimum extent necessary, and the remaining provisions will continue in full force.

15.7 Waiver

Failure or delay to enforce any provision will not constitute a waiver of that party’s right to enforce it subsequently.

15.8 Force Majeure

Neither party will be liable for delay or failure resulting from causes beyond its reasonable control, including acts of God, natural disasters, war, terrorism, pandemics, government actions, or widespread internet outages, provided the affected party: (a) notifies the other as soon as practicable; and (b) uses reasonable efforts to mitigate the impact.

15.9 Notices

Notices under this Agreement must be in writing and sent to the addresses in the applicable Order Form (for the Client) and to information@driftal.tech (for DriftAI). Notices are effective on receipt when sent by email with read-receipt confirmation or by registered post.

15.10 No Third-Party Beneficiaries

These Terms are for the sole benefit of the parties and their permitted successors and assigns. Nothing herein creates rights in any third party, including individual employees whose HR Data is processed through People Compass.

15.11 Relationship of Parties

The parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, employment, or franchise relationship.

15.12 Export Controls

The Client will comply with all applicable export-control laws and regulations in connection with its use of People Compass, and will not use or permit use of the platform in any country or jurisdiction where such use is prohibited.

15.13 No Legal or Compliance Advice

DriftAI does not provide legal, regulatory, employment, tax, compliance, or HR advisory services. Client is solely responsible for obtaining independent professional advice regarding applicable laws, regulations, workforce obligations, and AI-governance requirements.

16. Contact Information

AGREED AND ACCEPTED: By executing the Order Form referencing these Terms, the Client confirms it has read, understood, and agrees to be bound by this Agreement, including the data processing obligations in Section 5 which constitute the data processing agreement required by GDPR Article 28 and equivalent laws.