Confidentiality and Non-Disclosure Terms

1. Who and What These Terms Cover

1.1 These terms are between Innovective Ltd ("Innovective", "we") and each organisation that shares information with us in connection with our services (the "Client", "you"). They form part of our Terms and Conditions and our Portal Service Terms, and apply from your first enquiry, before any agreement is signed, through every engagement and after it ends.

1.2 "Confidential Information" means all information you or anyone on your behalf discloses to us, in any form and by any means (including through the client portal, email, calls and meetings, and access to your systems), that is marked confidential or that a reasonable person would understand to be confidential. It includes your source code, systems, credentials, data, business plans, finances, customers and suppliers, and any personal data you share with us ("Client Data").

1.3 Confidential Information does not include information that:

• is or becomes public other than through a breach of these terms;
• we already lawfully held, without a duty of confidence, before you disclosed it;
• we receive lawfully from someone else who is free to disclose it; or
• we develop independently, without using your Confidential Information.

Personal data is always treated as confidential, whichever of these applies.

2. Our Commitment

2.1 We will:

• keep your Confidential Information confidential, and protect it with at least the care we take of our own, and no less than reasonable care;
• use it only to assess, quote for and carry out work for you, and to manage our relationship with you (the "Purpose");
• not sell, rent or trade it, or use it for our own marketing (a testimonial or case study is published only under our Testimonial and Marketing Release); and
• not disclose it to anyone, except as set out in section 3.

2.2 Within Innovective, only the employees, contractors and subcontractors who need your Confidential Information for the Purpose have access to it. Each is bound by written confidentiality obligations at least as protective as these terms, and we are responsible for anything they do with it. We may use subcontractors for our services unless your agreement with us expressly prohibits it.

3. When Information Leaves Innovective

3.1 Your Confidential Information does not leave Innovective, except that we may disclose it:

• to the subprocessors listed in section 3.1 of our Privacy Policy (for hosting, databases, email and productivity tools, authentication, analytics and AI services), under written terms that require them to protect it, and only as far as each needs it to provide its service to us;
• to a third party you have asked us, or agreed in writing, to share it with, such as your hosting provider, another of your suppliers, or someone you ask us to work alongside;
• to our professional advisers, auditors and insurers, who owe us a duty of confidence; and
• where the law, a court or a regulator requires it, in which case we will, where we lawfully can, tell you first and disclose only what is required.

3.2 Before we add or replace a subprocessor that will handle Client Data, we will update the Privacy Policy. Where an Engagement Agreement gives you a right to be told of, or object to, a new subprocessor, that right applies.

3.3 Where your information is transferred outside the UK, it is protected as set out in the Privacy Policy.

4. Security, Credentials and Incidents

4.1 We protect Client Data with appropriate technical and organisational measures, including access controls, encryption in transit, and limiting access to the people who need it.

4.2 Passwords, keys and other access you give us to your systems are kept in a secure credential store, used only for the Purpose, and never shared outside Innovective. We recommend you revoke or rotate them when a piece of work ends.

4.3 If we become aware of unauthorised access to, or loss or disclosure of, your Confidential Information, we will tell you without undue delay, give you the information we have, and take reasonable steps to contain it and stop it happening again.

5. Returning and Deleting Information

5.1 When our relationship ends, or earlier if you ask in writing, we will return or delete your Confidential Information, except that we may keep:

• what the law requires us to keep, and our business records (contracts, invoices, correspondence) for the periods set out in the Privacy Policy; and
• copies in routine backups until they are overwritten in the normal cycle.

5.2 Anything we keep remains subject to these terms for as long as we hold it.

6. Our Confidential Information

6.1 The terms of every agreement between us, including its fees, rates and special conditions, and our quotes, proposals, estimates, prices, methods, the client portal's content and design, and any unpublished material we share with you, are our confidential information, even though you know them. You will use them only to consider and manage your work with us, and share them only with your staff, advisers, auditors and insurers who need them, under a duty of confidence, or as the law requires.

6.2 In particular, you will not share our terms or prices with another supplier of services like ours, or use them to benchmark or negotiate with one, and you will not try to work out our rates, estimating methods or margins from what we send you.

7. How Long These Terms Last

7.1 These obligations continue for five years after our relationship with you ends. For trade secrets, credentials and personal data, they continue for as long as the information is held.

8. Your Retainer or Project Agreement Prevails

8.1 Where a Retainer Agreement or Project Agreement is in place, its confidentiality and data protection clauses govern the information shared under it, and prevail over these terms if they conflict. These terms continue to cover anything outside such an agreement, including information shared before it was signed.

8.2 If you and we have signed a separate non-disclosure agreement, that agreement prevails over these terms for the information it covers.

9. Remedies and Law

9.1 Each party accepts that damages alone may not be an adequate remedy for a breach of these terms, and that the other may seek an injunction or other equitable relief as well as any other remedy.

9.2 These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. Questions about them can be sent to [email protected].