EcoBreeze Smart Portal Service Agreement

Including Authorised User Terms and Data Processing Schedule

Version 1.0  ·  Effective date: 25 August 2026  ·  Last updated: 25 August 2026

Washroom-Wizard Limited trading as EcoBreeze  ·  Contact: Kathleen Porter, Data Protection Officer  ·  support@ecobreeze.com

Contents

1. Parties, acceptance and start of the Agreement
2. Definitions and interpretation
3. Business use and authority
4. Portal licence and access
5. Organisation hierarchy, administrators and permissions
6. User accounts and security
7. Acceptable use
8. Customer Data and customer responsibilities
9. Cleaning tags and worker information
10. Activity Hub and beta functions
11. Devices, visitor counts, reports and alerts
12. Support, maintenance and changes to the Portal
13. Third-party and connectivity services
14. Intellectual property and feedback
15. Confidentiality
16. Data protection
17. Suspension
18. Termination and data at the end of service
19. Warranties and disclaimers
20. Liability
21. Customer indemnity
22. Force majeure
23. Changes, notices and electronic records
24. General terms
25. Governing law and jurisdiction

• Schedule 1 — Data Processing Terms
• Schedule 2 — Security Measures
• Schedule 3 — Current Subprocessors and Service Providers

1. Parties, acceptance and start of the Agreement

This EcoBreeze Smart Portal Service Agreement (the "Agreement") is made between Washroom-Wizard Limited trading as EcoBreeze, company number 06349554, of Unit 1, Riverside Estate, Sir Thomas Longley Road, Medway City Estate, Rochester, Kent, ME2 4DP ("EcoBreeze", "we", "us" or "our"), and the business, public authority, charity or other organisation for which Portal access is created or accepted (the "Customer").

The Agreement takes effect when an authorised Customer administrator accepts it through the Portal, when the Customer first uses the Portal after being given clear notice of these terms, or when the parties otherwise agree in writing, whichever occurs first.

A person who accepts this Agreement on behalf of a Customer confirms that they have authority to bind that Customer. If a person does not have that authority, they must not accept commercial terms on the Customer's behalf. They may nevertheless be bound personally by the Authorised User obligations that apply to their own access and conduct.

Each Authorised User must comply with the provisions concerning account security, acceptable use, customer content, confidentiality, intellectual property, disclaimers and lawful use. An Authorised User does not assume the Customer's payment, indemnity or other organisation-level obligations unless they are authorised to do so.

The Privacy Notice explains how EcoBreeze uses personal information in its own capacity as controller. The Data Processing Terms in Schedule 1 govern personal information processed by EcoBreeze on the Customer's behalf.

2. Definitions and interpretation

References to "including" or "includes" are illustrative and do not limit the words before them. A reference to writing includes email and an in-Portal notice. Headings are for convenience and do not affect interpretation. If there is a conflict between this Agreement and a separate signed agreement or order, the signed document prevails to the extent of the conflict, except that the Data Processing Terms apply to processor activities unless the signed document contains compliant replacement terms.

3. Business use and authority

The Portal is supplied for business and professional use only. It is not offered for personal, household or consumer use.

The Customer must ensure that each person it authorises to use the Portal has a genuine business need, is permitted to act for the relevant organisation or Site and is informed of the terms that apply to them.

Where a distributor creates a client, Site or user, it confirms that it has authority from the relevant client to do so. Where a client creates a user or enters information about a worker, it confirms that it is authorised and has met its own legal and contractual obligations.

4. Portal licence and access

Subject to this Agreement, EcoBreeze grants the Customer a limited, non-exclusive, non-transferable, non-sublicensable and revocable right to allow its Authorised Users to access and use the Portal for the Customer's internal business operations and management of relevant EcoBreeze products and services.

The right of access does not transfer ownership of the Portal or any underlying software, database structure, analytics method, design, documentation or intellectual property. The Customer may not make the Portal available as a service bureau, resell access or allow access by an unauthorised third party unless EcoBreeze agrees in writing.

Access is invitation based. EcoBreeze may impose technical, security, role, Site, organisation, device or usage limits that are reasonable for the service or required to protect the Portal and other customers.

5. Organisation hierarchy, administrators and permissions

The Portal uses an organisation hierarchy and role-based permissions. A distributor may create and administer its own clients, Sites and users. A client may create and administer its own users. Access to information follows the hierarchy, roles, granular permission claims and per-user restrictions configured in the Portal.

The Customer is responsible for:

• appointing suitable administrators and limiting administrator access;
• checking that each user's organisation, role, additional role and access scope are correct;
• deciding whether a user receives full or custom access;
• reviewing permissions when a role changes and removing access when a person leaves or no longer needs it;
• making sure users can see only the clients, Sites, devices and content they are authorised to see; and
• monitoring its own administrators' use of account-creation and permission functions.

EcoBreeze administrators may access information across the Portal where reasonably necessary for account administration, onboarding, support, device servicing, troubleshooting, security, misuse investigation, legal compliance, system maintenance or enforcement of this Agreement. EcoBreeze will apply access controls and confidentiality obligations to that access.

6. User accounts and security

Each Authorised User must use their own account and provide accurate business account information. Accounts, passwords, authentication codes and trusted-device settings must not be shared.

The Portal supports password authentication and may support Microsoft or Google sign-in. Optional authenticator-app two-factor authentication is available for individual users. The Customer should require or strongly encourage two-factor authentication for administrators and other higher-risk accounts.

The Customer and each Authorised User must:

• use a strong, unique password and protect any linked Microsoft or Google account;
• keep contact and account details accurate;
• take reasonable steps to secure devices used to access the Portal;
• sign out or otherwise secure unattended sessions;
• notify EcoBreeze promptly of suspected loss, compromise, misuse or unauthorised access; and
• cooperate with reasonable steps to investigate and contain a security issue.

The Customer is responsible for activity carried out through its accounts to the extent caused by its failure or an Authorised User's failure to comply with these obligations. This does not make the Customer responsible for a security breach caused solely by EcoBreeze or its providers.

7. Acceptable use

The Customer and Authorised Users must use the Portal lawfully, fairly and only for the permitted business purposes. They must not:

• access or attempt to access an organisation, Site, account, system or data outside their authorised scope;
• share credentials, impersonate another person or misrepresent authority;
• circumvent security, permissions, usage restrictions or technical controls;
• introduce malware, harmful code, automated attacks or content designed to disrupt or overload the Portal;
• scrape, bulk extract, probe, scan, reverse engineer, decompile, copy or derive source code or non-public technical information, except where a restriction cannot lawfully apply;
• use the Portal to harass, discriminate against, unfairly monitor or unlawfully make decisions about a worker or other person;
• upload content that is unlawful, defamatory, threatening, obscene, infringing, confidential without authority or harmful to another person;
• upload special category data, criminal-offence information, National Insurance numbers, payment card data, bank details, medical records or children's information unless EcoBreeze has expressly agreed the processing in writing and appropriate safeguards are in place;
• use a free-text field or optional employee reference to store sensitive identifiers or information unrelated to the Portal purpose;
• use reports, counts or alerts as the sole control for life safety, emergency response, statutory compliance or another safety-critical purpose; or
• resell, sublicense, commercially exploit or provide the Portal to an unauthorised third party.

EcoBreeze may investigate suspected misuse and may remove, restrict or preserve content where reasonably necessary to protect the Portal, comply with law, respond to a complaint or enforce this Agreement.

8. Customer Data and customer responsibilities

8.1 Ownership and licence

As between the parties, the Customer retains its rights in Customer Data. The Customer grants EcoBreeze and its providers a non-exclusive right to host, copy, transmit, display, organise, analyse, back up and otherwise process Customer Data only as needed to provide, secure, support and improve the Services, comply with law and exercise legal rights, in each case subject to this Agreement and the Privacy Notice.

8.2 Customer responsibility

The Customer is responsible for the lawfulness, accuracy, quality and relevance of Customer Data and for obtaining any permissions, notices, consents or other authority required to enter it, share it through the hierarchy and instruct EcoBreeze to process it.

The Customer must take reasonable steps to keep Customer Data accurate, correct errors, remove obsolete content and avoid collecting more personal information than is necessary. EcoBreeze does not verify the accuracy or completeness of Customer Data and is not responsible for errors supplied by the Customer or its users.

8.3 Exports and independent records

The Customer may use available Portal functions to export reports or information. The Customer should maintain any independent records, evidence or business-continuity arrangements it reasonably needs. The Portal is not intended to be the Customer's sole legal, payroll, employment, health and safety, facilities-compliance or emergency record.

8.4 Content visibility

Customer Data may be visible to other users within the Customer's authorised hierarchy according to roles and permissions. The Customer must consider the audience before entering personal or confidential information and must not assume that a free-text field, message, media item or report is private from all administrators.

9. Cleaning tags and worker information

EcoBreeze may supply cleaning tags identified by a number. The Customer may choose to leave a tag unassigned, add a name to it or formally assign it to a named user account for a period. The Portal may then attribute a cleaning session to that individual and record the associated Site, zone or device, time and duration.

The tag detects Bluetooth proximity to an EcoBreeze device. It does not itself collect GPS location, audio, photographs, facial images or biometric identifiers. The Customer must not describe a named or assignable tag record as anonymous.

Where the Customer links tags or sessions to workers, the Customer is responsible for:

• identifying a lawful, specific and proportionate purpose;
• providing workers with clear and accessible privacy information;
• determining whether a data protection impact assessment or consultation is required;
• limiting access and use to what is necessary;
• checking records before relying on them and allowing relevant context or challenge;
• not making a solely automated employment decision from the data; and
• meeting employment, equality, consultation, data protection and confidentiality obligations.

EcoBreeze provides the technical capability and does not direct the Customer to use named cleaning data for attendance, performance management, discipline or any other employment decision.

10. Activity Hub and beta functions

The Activity Hub includes messages, sessions, rota, media, teams and related functions. Functions identified as beta are being developed and may change, contain defects, be withdrawn or have limited support. The Customer must assess whether a beta function is suitable before using it for important operations.

Users are responsible for the content they create, upload or share. They must respect confidentiality, intellectual property, worker privacy and the permissions configured by their organisation. The Customer must establish its own rules for appropriate use, moderation and retention of messages, media and rota information.

EcoBreeze may access or remove Activity Hub content where reasonably necessary for support, security, legal compliance, misuse investigation or operation of the service. EcoBreeze does not undertake to monitor all user content and does not endorse content supplied by a Customer or user.

11. Devices, visitor counts, reports and alerts

11.1 Device and connectivity information

The Portal receives information from connected Devices and related services. Availability and accuracy may be affected by power, hardware condition, installation, Bluetooth proximity, 4G or other network coverage, SIM performance, third-party services, configuration, maintenance or environmental conditions.

11.2 Visitor counting

Visitor counts are generated through passive infrared sensing and are intended as anonymous numerical estimates. The function does not capture photographs, video, audio, facial data, biometric identifiers or visitor-device identifiers. Counts may be affected by movement patterns, placement, environment or technical conditions and are not guaranteed to represent unique individuals.

11.3 Reports, detections and alerts

Reports, cleaning detections, device status, charts, exports and alerts are operational management aids. They may be delayed, incomplete, duplicated, unavailable or inaccurate. An alert may not be delivered because of email filtering, connectivity, configuration, provider failure or another cause.

The Customer must use appropriate human judgment and independent checks before making operational, contractual, employment, safety, compliance or legal decisions. The Customer remains responsible for inspections, cleaning standards, statutory duties, service delivery and any action taken or not taken in response to Portal information.

12. Support, maintenance and changes to the Portal

12.1 Support

EcoBreeze provides onboarding and ongoing customer care by telephone and email during normal UK office hours. Support requests may be sent to support@ecobreeze.com. Support is provided on a reasonable-efforts basis and no response or resolution time is guaranteed unless separately agreed in writing.

12.2 Maintenance and availability

EcoBreeze may perform planned or emergency maintenance, updates, security work, migrations and changes to the Portal. Where practicable, users will be notified of planned work that is expected to materially affect access. The Portal does not carry a guaranteed uptime or service-level commitment unless a separate signed agreement expressly provides one.

12.3 Changes to features

EcoBreeze may add, change, replace, limit or discontinue a feature to improve the service, address security or legal requirements, reflect provider or technology changes, manage capacity or develop the product. EcoBreeze will use reasonable care to avoid unnecessary material disruption and will communicate material changes in an appropriate way.

13. Third-party and connectivity services

The Portal depends on Microsoft Azure, Microsoft 365, Power BI, Microsoft and Google sign-in, Twilio SendGrid, Thinger.io, Accelleronix, telecommunications networks and other infrastructure. Those services may be subject to their own operational limits, terms and outages.

EcoBreeze selects and contracts with providers appropriate to the service and remains responsible for its processor obligations where Data Protection Laws apply. However, EcoBreeze does not control the public internet, mobile networks, a Customer's equipment, a user's external identity account or events outside EcoBreeze's reasonable control.

A user who chooses Microsoft or Google sign-in also deals directly with that identity provider for the security and availability of the external account. The Customer must ensure that external accounts are promptly disabled or secured when a user leaves or credentials are compromised.

14. Intellectual property and feedback

EcoBreeze and its licensors own all rights in the Portal, software, user interface, designs, databases, documentation, device integrations, report templates, methods, algorithms, branding and improvements, other than Customer Data and third-party material.

The Customer may view, download and use reports generated for it for its internal business purposes and may share them with its own clients or advisers where authorised and lawful. EcoBreeze branding, copyright notices and data-source notices must not be removed or altered without written permission.

If the Customer or a user gives EcoBreeze feedback or suggestions, EcoBreeze may use them without restriction or payment, provided it does not publicly identify the Customer or disclose confidential Customer Data without permission.

15. Confidentiality

Each party must keep the other party's non-public business, technical, commercial and security information confidential and use it only for the Agreement. Confidential information does not include information that is public through no breach, was lawfully known without restriction, is independently developed or is lawfully received from another source.

A party may disclose confidential information to its employees, contractors, providers, professional advisers and authorities who need it for the Agreement and are subject to appropriate confidentiality duties, or where disclosure is required by law. Where lawful, the disclosing party will be informed before a compulsory disclosure.

Portal credentials, non-public security information, Customer Data and information about other customers must always be treated as confidential.

16. Data protection

Each party must comply with Data Protection Laws for the personal information it controls. The Customer is responsible for its decision to collect, enter, assign, disclose or use Customer Data, including worker-linked cleaning records and Activity Hub content. EcoBreeze is responsible for its own controller activities and for complying with the processor obligations in Schedule 1.

The Customer must provide all privacy information and other notices required for its processing, respond to individuals where it is controller, and give EcoBreeze only lawful documented instructions. The Customer must not instruct EcoBreeze to process personal information in a manner that violates Data Protection Laws.

The Portal Privacy Notice is available through the Portal and explains EcoBreeze's controller processing, cookies, service providers, international processing and individual rights.

17. Suspension

EcoBreeze may suspend or restrict an account, organisation, feature, Site, Device or the Portal where reasonably necessary to:

• protect security, personal information, the Portal, a provider, another customer or the public;
• investigate suspected unauthorised access, misuse, fraud or a breach of this Agreement;
• prevent unlawful, harmful, infringing or excessive processing;
• carry out maintenance, respond to a technical incident or avoid damage;
• comply with law, a court order, a regulator or a provider requirement;
• address non-payment or termination under the underlying EcoBreeze commercial relationship; or
• respond to a material risk that cannot reasonably be managed while access continues.

EcoBreeze may act without advance notice where urgent action is reasonably required. Where appropriate and lawful, EcoBreeze will explain the reason and allow the Customer to remedy the issue. Suspension does not waive any other right and does not make EcoBreeze liable for losses arising from a suspension permitted by this clause.

18. Termination and data at the end of service

This Agreement continues while the Customer is authorised to use the Portal or receives the relevant EcoBreeze products or services. It may end when that underlying relationship ends, when EcoBreeze withdraws access, when the Customer asks to close the service, or when either party exercises a termination right in a separate signed agreement.

EcoBreeze may terminate or permanently disable access where the Customer materially or repeatedly breaches this Agreement, uses the Portal unlawfully, creates an unacceptable security or legal risk, becomes insolvent, fails to pay sums due under the underlying relationship or no longer has a legitimate entitlement to use the Portal.

Before or after closure, the Customer may use available export functions or request a reasonable export of Customer Data, subject to identity, authority, security, legal and technical requirements. EcoBreeze does not guarantee that every technical log, derived value, provider record or proprietary system record is exportable.

At the end of processor services, Customer personal information will be returned, deleted or anonymised in accordance with the Customer's lawful choice, Schedule 1, applicable law and the operation of protected backup and recovery systems. Soft-deleted information may remain inaccessible in protected systems until securely removed or anonymised through the applicable processes.

Clauses intended by their nature to continue after termination remain effective, including confidentiality, intellectual property, restrictions, data protection, disclaimers, liability, indemnities, governing law and accrued rights.

19. Warranties and disclaimers

Each party warrants that it has authority to enter into this Agreement. The Customer also warrants that it has authority to provide Customer Data and to permit the processing described in this Agreement.

Except for an express commitment in this Agreement, and to the fullest extent permitted by law, the Portal and Services are provided "as available" and without warranties, conditions or representations, whether express, implied, statutory or otherwise. EcoBreeze does not warrant that the Portal will be uninterrupted, error free, compatible with every device or network, free from all security vulnerabilities, or that every report, count, detection, status or alert will be complete, timely or accurate.

The Portal is not an emergency service, alarm system, life-safety system, statutory compliance system, payroll system, time-and-attendance system or substitute for human inspection, professional advice, contractual supervision or the Customer's own records and controls.

The Customer is responsible for deciding whether the Portal is suitable for its purposes and for configuring and using it appropriately. Any description, demonstration, roadmap or beta feature is illustrative unless expressly incorporated into a signed agreement.

20. Liability

20.1 Liabilities that are not excluded

Nothing in this Agreement excludes or limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot lawfully be excluded or limited. Nothing in this Agreement removes a right that an individual has directly under Data Protection Laws.

20.2 Excluded losses

Subject to clause 20.1 and to the fullest extent permitted by law, EcoBreeze is not liable, whether in contract, tort (including negligence), breach of statutory duty, misrepresentation, restitution or otherwise, for:

• loss of profit, revenue, business, contracts, opportunity, anticipated savings, goodwill or reputation;
• business interruption, management time or the cost of substitute systems, inspections or services;
• loss, corruption or unavailability of data, except to the extent a liability cannot lawfully be excluded;
• indirect, special, incidental or consequential loss;
• a missed, delayed, duplicated or inaccurate report, visitor count, cleaning detection, device status or alert;
• a decision or failure to act based on Portal information;
• an outage or failure of power, internet, 4G, Bluetooth, telecommunications, Customer equipment, email delivery, an external identity account or another third-party service;
• incorrect configuration, excessive permissions, inaccurate Customer Data, unlawful worker monitoring or use by an unauthorised person where caused by the Customer or its users; or
• an event outside EcoBreeze's reasonable control.

20.3 Overall cap

Subject to clause 20.1, EcoBreeze's total aggregate monetary liability arising out of or in connection with the Portal and this Agreement is limited to the total charges paid specifically and separately for the right to access the Portal under the applicable written order or agreement. Portal access is ordinarily included with relevant EcoBreeze products and services at no separate charge. Where no separate Portal charge has been paid, the applicable monetary cap is nil to the fullest extent permitted by law.

20.4 Allocation of risk

The Customer acknowledges that the Portal is supplied at no separate charge, that the limitations in this clause reflect that commercial basis, and that the Customer can reduce risk by maintaining appropriate insurance, permissions, independent records, human checks and business-continuity arrangements. Each limitation applies separately and survives failure of an exclusive remedy.

21. Customer indemnity

The Customer will indemnify EcoBreeze against third-party claims, regulatory costs, damages, liabilities and reasonable professional expenses arising from:

• Customer Data or instructions that are unlawful, infringe another person's rights or are supplied without required authority or notice;
• the Customer's worker monitoring, employment decision, named cleaning-tag use or disclosure of worker information;
• content uploaded or shared by the Customer or its Authorised Users;
• the Customer's material breach of the acceptable-use, confidentiality, data-protection or account-security obligations; or
• use of the Portal outside the authorised scope.

The indemnity does not apply to the extent the claim was caused by EcoBreeze's own breach of this Agreement, negligence, unlawful instruction or wilful misconduct. EcoBreeze will give reasonable notice of an indemnified claim where lawful, allow the Customer reasonable participation in the defence and not agree an admission or settlement that imposes a non-monetary obligation on the Customer without consent, not to be unreasonably withheld.

22. Force majeure

Neither party is liable for delay or failure caused by an event outside its reasonable control, including power or network failure, telecommunications outage, cloud or provider disruption, natural disaster, fire, flood, epidemic, war, terrorism, civil disorder, industrial dispute, governmental action, legal restriction, supply-chain failure or widespread cyber incident, provided the affected party takes reasonable steps to reduce the effect and resume performance.

23. Changes, notices and electronic records

23.1 Changes to this Agreement

EcoBreeze may update this Agreement to reflect changes in law, security, providers, Portal functions or business practice. The current version will be available through the Portal. Material changes will be brought to the Customer's attention in an appropriate way and may require renewed acceptance by an authorised administrator. Continued use after clear notice may constitute acceptance where lawful.

23.2 Notices

A notice may be given through the Portal, to the email address associated with the relevant account or organisation, or to another business contact notified in writing. The Customer must keep contact details current and ensure that notices reach an appropriate administrator.

23.3 Electronic records

The parties agree that electronic acceptance, account records, audit records, emails and in-Portal notices may be used to evidence the Agreement, authority, instructions and communications. EcoBreeze may retain the Agreement version, account, organisation, date, time and related technical record associated with acceptance or acknowledgement.

24. General terms

24.1 Entire agreement

This Agreement, the Privacy Notice, the Data Processing Terms and any separate signed order or agreement form the entire agreement concerning Portal access and replace earlier discussions or statements on that subject. This clause does not exclude liability for fraud or fraudulent misrepresentation.

24.2 Assignment and subcontracting

The Customer may not assign, transfer or sublicense this Agreement without EcoBreeze's written consent. EcoBreeze may assign it as part of a business reorganisation, financing, sale or transfer of the relevant business, provided the successor assumes the applicable obligations. EcoBreeze may use providers and Subprocessors in accordance with Schedule 1.

24.3 No partnership or agency

Nothing in this Agreement creates a partnership, joint venture, employment relationship, fiduciary relationship or agency between the parties. Neither party may bind the other except as expressly agreed.

24.4 Waiver and cumulative rights

A delay or failure to exercise a right is not a waiver. A waiver must be in writing and applies only to the particular circumstance. Rights and remedies are cumulative unless expressly stated otherwise.

24.5 Severability

If a provision is invalid or unenforceable, it will be limited or modified to the minimum extent necessary and the remaining provisions will continue. The parties will replace it with a lawful provision that most closely reflects the original commercial purpose.

24.6 Third-party rights

Except for an Authorised User's direct obligations and any express right of a provider or successor, a person who is not a party has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce this Agreement. The parties may vary or end the Agreement without the consent of a third party.

25. Governing law and jurisdiction

This Agreement and any non-contractual obligation arising from it are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction, except that EcoBreeze may seek urgent protective or enforcement relief in another jurisdiction where necessary to protect accounts, confidential information, intellectual property, personal information or systems.

Schedule 1 — Data Processing Terms

This Schedule applies where EcoBreeze processes personal information on behalf of the Customer. It is intended to satisfy the written-contract requirements applying between a controller and processor under Data Protection Laws.

1. Roles and scope

For Customer personal information, the Customer is controller and EcoBreeze is processor, unless the parties expressly identify a different role for a particular processing activity. Each party remains independently responsible for processing it carries out as controller.

The subject matter, nature, purpose, types of personal information and categories of individuals are described in the Processing Details below. Processing continues for the duration of the Services and afterwards only to return, delete, anonymise, secure or lawfully retain information as permitted by this Schedule and Data Protection Laws.

2. Documented instructions

EcoBreeze will process Customer personal information only on the Customer's documented instructions, unless United Kingdom law requires otherwise. The Agreement, the Customer's configuration and use of the Portal, authorised support requests and other written directions constitute documented instructions.

If EcoBreeze believes an instruction infringes Data Protection Laws, it may notify the Customer and suspend the affected processing while the parties clarify or amend the instruction. Where law requires processing without the Customer's instruction, EcoBreeze will inform the Customer before processing unless the law prohibits that notice on important public-interest grounds.

3. Confidentiality and personnel

EcoBreeze will ensure that personnel authorised to process Customer personal information are subject to confidentiality obligations and receive access only as needed for their functions. EcoBreeze will apply role-based and per-user restrictions appropriate to the processing.

4. Security

EcoBreeze will implement appropriate technical and organisational measures designed to protect Customer personal information, taking into account the state of the art, implementation costs, nature, scope, context and purposes of processing and the risks to individuals. Current measures are summarised in Schedule 2. EcoBreeze may update a measure where the replacement maintains an appropriate level of protection.

5. Subprocessors

The Customer gives EcoBreeze general written authorisation to use the Subprocessors and service providers listed in Schedule 3 and to appoint replacements or additional providers needed for the Services.

EcoBreeze will place data protection obligations on a Subprocessor that are materially equivalent to the obligations applicable to the relevant processing under this Schedule. EcoBreeze remains responsible to the Customer for the Subprocessor's performance of those obligations as required by Data Protection Laws.

EcoBreeze will provide appropriate notice of a material new Subprocessor through the Portal, email, an updated Schedule or another reasonable channel. The Customer may object on reasonable and documented data protection grounds. The parties will work in good faith to address the concern, which may include a reasonable alternative or ending the affected function where no suitable solution is available.

6. International transfers

The Customer authorises the processing locations and support access described in Schedule 3 and the Privacy Notice. EcoBreeze will not make a restricted transfer of Customer personal information unless an applicable lawful transfer mechanism is in place, such as United Kingdom adequacy regulations, the United Kingdom International Data Transfer Agreement, the United Kingdom Addendum to approved standard contractual clauses or another safeguard recognised by Data Protection Laws.

EcoBreeze will take reasonable steps to ensure that a provider supporting an international transfer maintains contractual, security and organisational protections appropriate to its role.

7. Individual rights

Taking into account the nature of the processing, EcoBreeze will provide reasonable technical and organisational assistance to help the Customer respond to requests to exercise data protection rights. If EcoBreeze receives a request relating primarily to Customer personal information, it may refer the requester to the Customer and will not respond on the Customer's behalf unless instructed or legally required.

The Customer remains responsible for deciding whether and how a right applies and for communicating with the individual. Assistance beyond the standard Portal functions may be subject to reasonable costs where permitted by law, particularly where a request is unusually complex or arises from the Customer's configuration or instructions.

8. Security incidents and personal data breaches

EcoBreeze will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal information. The notice will include information reasonably available to EcoBreeze about the nature of the breach, likely consequences, affected information or individuals and measures taken or proposed. Information may be provided in stages as the investigation develops.

EcoBreeze will take reasonable steps to contain, investigate and remediate the breach and will assist the Customer with notifications where required. A notification does not by itself amount to an admission of fault or liability. The Customer is responsible for any notification decision for which it is controller.

9. Compliance assistance

Taking into account the nature of processing and information available, EcoBreeze will provide reasonable assistance with the Customer's obligations concerning security, personal data breach notification, data protection impact assessments and prior consultation with the Information Commissioner's Office. The Customer is responsible for its own assessment of named cleaning-tag use, worker monitoring and other high-risk purposes.

10. Information and audits

EcoBreeze will make available information reasonably necessary to demonstrate compliance with this Schedule. The Customer may request an audit or inspection where reasonably required by Data Protection Laws or a substantiated compliance concern.

Audits must be proportionate, not unreasonably frequent, subject to confidentiality and security controls, avoid access to another customer's information, minimise disruption and use independent auditors where appropriate. The Customer bears its reasonable audit costs unless the audit identifies a material breach by EcoBreeze. EcoBreeze may satisfy a request through current certifications, provider reports, questionnaires, policies, summaries or remote evidence where those reasonably address the issue.

11. Return, deletion and end of processing

At the Customer's lawful choice following the end of the relevant processor service, EcoBreeze will return, delete or anonymise Customer personal information and delete existing copies, unless United Kingdom law requires continued storage or the information is retained in EcoBreeze's separate capacity as controller.

Customer Data may first be soft deleted and removed from normal visibility. Residual copies may remain in protected live, audit, recovery or backup systems until securely removed or anonymised through applicable processes. During that period, the information will remain protected and will not be restored or used except for recovery, security, legal compliance or another lawful purpose.

The Customer must identify the information and authority relevant to a return or deletion request and use available export or deletion functions where appropriate. EcoBreeze may retain evidence that an instruction was received and carried out, provided that evidence contains no more personal information than reasonably necessary.

12. Controller instructions and responsibility

The Customer warrants that its instructions are lawful and that it has provided all required notices and obtained all required authority. The Customer will not instruct EcoBreeze to process special category or criminal-offence information without prior written agreement on the purpose, legal basis, condition, safeguards and any appropriate policy document.

13. Processing Details

Schedule 2 — Security Measures

EcoBreeze applies the following current measures to the Portal. The measures may evolve as the system and risks change, provided that the overall protection remains appropriate.

Schedule 3 — Current Subprocessors and Service Providers

The following providers support the Portal as at the date of this Agreement. A provider is a Subprocessor only to the extent that it processes personal information on EcoBreeze's behalf for the Customer. Device or connectivity information may not always identify an individual, but it is treated under appropriate controls where it is personal information.

EcoBreeze may update this Schedule as providers or technical arrangements change. The current Privacy Notice will describe material processing locations and the method for receiving notice of relevant changes.