EMMA AI Agreement

TERMS AND CONDITIONS

Please read these Terms and Conditions carefully. All contracts that OML may enter into from time to time for the provision of the EMMA AI Services and related services shall be governed by these Terms and Conditions, and OML will ask for the Customer’s express written acceptance of these Terms and Conditions before providing any such services to the Customer.

1. Definitions

1.1 In these Terms and Conditions:

“Account” means an account enabling a person to access and use the EMMA AI Services, including both administrator accounts and other user accounts;

“Affiliate” means an entity that Controls, is Controlled by, or is under common Control with the relevant entity;

“Agreement” means a contract between the parties incorporating these Terms and Conditions, and any amendments to that contract from time to time;

“Agreement Date” has the meaning given to it in the Services Order Form;

“Agreement Period” has the meaning given to it in the Services Order Form;

“Anonymised Data” means Service Data that does not constitute or contain Personal Data, where neither the Customer nor any Permitted Entity will be directly identifiable from that Service Data;

“API” means any application programming interface for the EMMA AI Services that is defined and made available by OML from time to time;

“AUP” means the acceptable use policy applying go the use of the EMMA AI Services as published and maintained by OML from time to time;

“Break Date” has the meaning given to it in the Services Order Form;

“Business Day” means any weekday other than a bank or public holiday in England;

“Business Hours” means the hours of 09:00 to 17:00 GMT/BST on a Business Day;

“Change” means those changes to the scope of the Services referred to in Schedule 2 (Change requests);

“Charges” means:

(a) the charges specified in the Services Order Form;

(b) such other charges as may be agreed in writing by the parties from time to time; and

(c) charges calculated by multiplying OML’s standard time-based charging rates (as specified in the Services Order Form and varied in accordance with the Agreement) by the time spent by OML’s personnel performing any Support Services exceeding the Included Support Hours;

“Confidential Information” means the OML Confidential Information and the Customer Confidential Information;

“Control” means the legal power to control (directly or indirectly) the management of an entity (and “Controlled” should be construed accordingly);

“Customer” means the person or entity identified as such in the Services Order Form;

“Customer Confidential Information” means:

(a) any information disclosed by or on behalf of the Customer to OML at any time before the termination of the Agreement (whether disclosed in writing, orally or otherwise) that at the time of disclosure:

(i) was marked as “confidential”; or

(ii) should have been reasonably understood by OML to be confidential;

(b) the Customer Data; and

but excluding the Anonymised Data;

“Customer Data” means:

(a) the Service Data; and

(b) all other data uploaded to or stored on the Platform by the Customer, or supplied by the Customer to OML for uploading to or storage on the Platform;

“Customer Sites” means those sites identified in the Services Order Form, subject to variations in accordance with Clause 15;

“Customer Indemnity Event” has the meaning given to it in Clause 24.3;

“Customer Personal Data” means any Personal Data that is processed by OML on behalf of the Customer in relation to the Agreement;

“Customer Representatives” means the person or persons identified as such in the Services Order Form, and any additional or replacement persons that may be appointed by the Customer via a Change request;

“Customer Systems” means the energy and/or utility consumption meters and related computer systems of the Customer that provide or will provide Service Data to the Platform as identified in the Services Order Form (subject to variations in accordance with the Agreement);

“Customisation” means a customisation of the EMMA AI Services, whether made through the development, configuration or integration of software, or otherwise;

“Data Protection Laws” means all applicable laws relating to the processing of Personal Data including, while they are in force and applicable, the United Kingdom’s Data Protection Act 2018 and the General Data Protection Regulation (Regulation (EU) 2016/679);

“Defect” means a defect, error or bug in the Platform having a material adverse effect on the functionality or performance of the EMMA AI Services, but excluding any defect, error or bug caused by or arising as a result of:

(a) any act or omission of the Customer or any person authorised by the Customer to use the Platform or EMMA AI Services;

(b) a failure of the Customer to perform or observe any of its obligations in the Agreement; and/or

(c) an incompatibility between the Platform or EMMA AI Services and any other system, network, application, program, hardware or software (excluding the Supported Web Browsers, and the Customer Systems insofar as they comply with the requirements set out in the Services Order Form);

“EMMA AI Services” means the EMMA AI services which will be made available by OML to the Customer as a service via the internet in accordance with these Terms and Conditions;

“Expenses” means the travel, accommodation and subsistence expenses that are reasonably necessary for, and incurred by OML exclusively in connection with, the performance of OML’s obligations under the Agreement;

“Force Majeure Event” means an event, or a series of related events, that is outside the reasonable control of the party affected (including failures of the internet or any public telecommunications network, hacker attacks, denial of service attacks, virus or other malicious software attacks or infections, power failures, industrial disputes affecting any third party, changes to the law, disasters, explosions, fires, floods, riots, terrorist attacks, wars and epidemics);

“Included Support Hours” means the number of hours specified in the Services Order Form;

“Initial Term” means the period specified as such in the Services Order Form;

“Intellectual Property Rights” means all intellectual property rights wherever in the world, whether registrable or unregistrable, registered or unregistered, including any application or right of application for such rights (and these “intellectual property rights” include copyright and related rights, database rights, confidential information, trade secrets, know-how, business names, trade names, trade marks, service marks, passing off rights, unfair competition rights, patents, petty patents, utility models and rights in designs);

“Interim Agreement” means the EMMA AI interim agreement executed by the parties before the execution of the Agreement and referenced in the Services Order Form;

“Measurement Period” has the meaning given to it in the Services Order Form;

“OML” means Optimal Monitoring Ltd, a company incorporated in England and Wales (registration number 03788490) having its registered office at 16 Great Queen Street, Covent Garden, London, United Kingdom, WC2B 5AH;

“OML Confidential Information” means:

(a) any information disclosed by or on behalf of the OML to the Customer at any time before the termination of the Agreement (whether disclosed in writing, orally or otherwise) that at the time of disclosure was marked as “confidential” or should have been understood by the Customer (acting reasonably) to be confidential;

(b) the financial terms of the Agreement;

(d) access credentials for the EMMA AI Services;

“OML Indemnity Event” has the meaning given to it in Clause 24.1;

“OML Representatives” means the person or persons identified as such in the Services Order Form, and any additional or replacement persons that may be appointed by the OML giving to the Customer written notice of the appointment;

“Permitted Entities” means those entities identified as such in the Services Order Form;

“Permitted Purposes” means the purposes of monitoring and managing the energy consumption, utility consumption and/or carbon emissions of the Customer and each Permitted Entity at the Customer Sites;

“Personal Data” has the meaning given to it in the Data Protection Laws applicable in the United Kingdom from time to time;

“Platform” means the platform managed by OML and used by OML to provide the EMMA AI Services, including the application and database software for the EMMA AI Services, the system and server software used to provide the EMMA AI Services, and the computer hardware on which that application, database, system and server software is installed;

“Renewal Term” means a period of 12 months beginning at the end of the Initial Term or at the end of an earlier Renewal Term;

“Service Data” means energy consumption data, utility consumption data, environmental data, geographic data and/or feedback data collected by the Platform;

“Services” means any services that OML provides to the Customer, or has an obligation to provide to the Customer, under these Terms and Conditions;

“Services Order Form” means a digital or hard-copy order form signed or otherwise agreed by or on behalf of each party, in each case incorporating these Terms and Conditions by reference;

“Set Up Services” means the configuration, implementation and integration of the EMMA AI Services in accordance with the Services Order Form;

“SLA” means the service level agreement set out in Schedule 1 (SLA);

“Specification” means the specification for the Platform and EMMA AI Services set out in the Services Order Form;

“Support Services” means support in relation to the use of, and the identification and resolution of errors in, the EMMA AI Services, but shall not include the provision of training services;

“Supported Web Browser” means the current release from time to time of Microsoft Edge, Mozilla Firefox, Google Chrome or Apple Safari, providing that if any such web browser is not maintained and updated in accordance with generally accepted web browser standards it shall cease to be a Supported Web Browser;

“Term” means the term of the Agreement, commencing in accordance with Clause 2.1 and ending in accordance with Clauses 2.2, 2.3 and the other provisions of the Agreement;

“Terms and Conditions” means all the documentation containing the provisions of the Agreement, namely the Services Order Form, the main body of these Terms and Conditions and the Schedules, including any amendments to that documentation from time to time; and

“Territory” means the territory or territories identified in the Services Order Form, subject to any variations agreed by the parties in writing.

2. Term

2.1 The Agreement shall be deemed to have come into force upon the Agreement Date.

2.2 The Agreement shall continue in force for the Initial Term.

2.3 At the end of the Initial Term the Agreement shall automatically renew for the first Renewal Term, and at the end of each Renewal Term the Agreement shall automatically renew for a further Renewal Term, subject in each case to termination in accordance with any provision of these Terms and Conditions.‌

3. N/A

4. Set Up Services

4.1 OML shall provide the Set Up Services to the Customer.

4.2 OML shall use reasonable endeavours to ensure that the Set Up Services are provided in accordance with the timetable set out in the Services Order Form.

4.3 The Customer acknowledges that a delay in the Customer performing its obligations in the Agreement may result in a delay in the performance of the Set Up Services; and subject to Clause 25.1 OML will not be liable to the Customer in respect of any failure to meet the Set Up Services timetable to the extent that that failure arises out of a delay in the Customer performing its obligations under these Terms and Conditions.

4.4 Subject to any written agreement of the parties to the contrary, any Intellectual Property Rights that may arise out of the performance of the Set Up Services by OML shall be the exclusive property of OML.

5. EMMA AI Services

5.1 OML hereby grants to the Customer a worldwide, non-exclusive licence to use the EMMA AI Services by means of:

(a) a Supported Web Browser;

for the Permitted Purposes during the Term.

5.2 The licence granted by OML to the Customer under Clause 5.1 is subject to the following limitations:

(a) the EMMA AI Services may only be used, via a Supported Web, by the officers, employees, agents and subcontractors of either the Customer or an Affiliate of the Customer; and

(b) the EMMA AI Services may only be used, via the API, by the Customer Systems.

5.3 Except to the extent expressly permitted in these Terms and Conditions or required by law on a non-excludable basis, the licence granted by OML to the Customer under Clause 5.1 is subject to the following prohibitions:

(a) the Customer must not sub-license its right to access and use the EMMA AI Services;

(b) the Customer must not permit any unauthorised person to access or use the EMMA AI Services;

(c) the Customer must not without the prior written consent of OML resell the EMMA AI Services or use the EMMA AI Services to provide services to third parties;

(d) the Customer must not republish or redistribute any content or material from the EMMA AI Services (excluding reports relating to the Customer’s energy use, utility use, and/or carbon emissions, generated by means of the EMMA AI Services);

(e) the Customer must not make any alteration to the Platform, excluding alterations to the Customer Data; and

(f) the Customer must not conduct or request that any other person conduct any load testing or penetration testing on the Platform or EMMA AI Services without the prior written consent of OML.

5.4 The Customer shall use reasonable endeavours, including reasonable security measures relating to access credentials for the EMMA AI Services, to ensure that no unauthorised person may gain access to the EMMA AI Services.

5.5 The parties acknowledge and agree that Schedule 1 (SLA) shall govern the availability of the EMMA AI Services.

5.6 The Customer must not use the EMMA AI Services in any way that causes, or may cause, damage to the EMMA AI Services or Platform or impairment of the availability or accessibility of the EMMA AI Services.

5.7 The Customer must not use the EMMA AI Services:

(a) in any way that is unlawful, illegal, fraudulent or harmful; or

(b) in connection with any unlawful, illegal, fraudulent or harmful purpose or activity.

5.8 The Customer shall comply with the AUP and shall ensure that all persons using the EMMA AI Services with the Customer’s authorisation or access credentials, or on behalf of the Customer, comply with the AUP.

5.9 For the avoidance of doubt, the Customer has no right to access the software code (including object code, intermediate code and source code) of the Platform, either during or after the Term.

6. Customisations

6.1 OML and the Customer may agree that OML shall design, develop and implement a Customisation or Customisations in accordance with a specification and project plan agreed in writing by the parties.

6.2 All Intellectual Property Rights in the Customisations shall, as between the parties, be the exclusive property of OML.

6.3 From the time and date when a Customisation is first delivered or made available by OML to the Customer, the Customisation shall form part of the Platform, and accordingly from that time and date the Customer’s rights to use the Customisation shall be governed by Clause 5.

6.4 The Customer acknowledges that OML may make any Customisation available to any of its other customers or any other third party.

7. Support Services

7.1 OML shall provide the Support Services to the Customer in accordance with Schedule 1 (SLA).

8. Customer obligations

8.1 The Customer must:

(a) act in good faith in relation to the supply of Service Data and use all reasonable endeavours to ensures that the Customer Systems provide accurate Service Data to the Platform; and

(b) provide to OML, promptly following receipt of a request from OML, any requested half-hourly consumption data (which may include billing information) relating to the consumption monitored by the EMMA AI Services.

8.2 Save to the extent that the parties have agreed otherwise in writing, the Customer must provide to OML, or procure for OML, such:

(a) co-operation, support and advice; and

(b) information and documentation,

as are reasonably necessary to enable OML to perform its obligations under the Agreement.

8.3 The Customer must provide to OML, or procure for OML, such access to the Customer’s computer hardware, software, networks and systems as may be reasonably required by OML to enable OML to perform its obligations under the Agreement.

8.4 The Customer shall ensure that the Customer Systems comply, and continue to comply during the Term, with the requirements of the Services Order Form in all material respects, subject to any changes agreed in writing by OML.

9. Data

9.1 The Customer warrants to OML that the Customer Data will not infringe the Intellectual Property Rights or other legal rights of any person, and will not breach the provisions of any law, statute or regulation.

9.2 The Customer hereby grants to OML non-exclusive licences to:

(a) use Customer Data during the Term to the extent reasonably required for the provision of the Services and the performance of OML’s other obligations under the Agreement;

(b) anonymise Service Data during the Term, and promptly following the end of the Term, in order to produce Anonymised Data;

(c) use Service Data during the Term for the purposes of operating the Platform generally, including providing services to other OML customers, providing that the only Service Data that may be provided or made available to other OML customers will be Anonymised Data; and

(d) use Anomymised Data during and after the Term (on a perpetual basis) for the purposes of operating, maintaining and improving the Platform and the services provided by OML generally, including providing services to other OML customers.

9.3 The Customer also grants to OML the right to sub-license the rights licensed in Clause 9.2 to its hosting, connectivity and telecommunications service providers, subject to any express restrictions elsewhere in Agreement.

Back-ups

10.1 OML shall create a back-up copy of the Customer Data stored in the principal database for the EMMA AI Services at least daily, shall ensure that each such copy is sufficient to enable OML to restore the EMMA AI Services to the state they were in at the time the back-up was taken, and shall retain and securely store each such copy for a minimum period of 30 days.

10.2 Within the period of 1 Business Day following receipt of a written request from the Customer, OML shall use all reasonable endeavours to restore to the Platform the Customer Data stored in any back-up copy created and stored by OML in accordance with Clause 10.1. The Customer acknowledges that this process will overwrite Customer Data stored on the Platform prior to the restoration.

11. N/A

12. No assignment of Intellectual Property Rights

12.1 Nothing in these Terms and Conditions shall operate to assign or transfer any Intellectual Property Rights from OML to the Customer, or from the Customer to OML.

13. Representatives

13.1 OML shall ensure that all instructions given by OML in relation to the matters contemplated in the Agreement will be given by an OML Representative to a Customer Representative, and the Customer:

(a) may treat all such instructions as the fully authorised instructions of the OML; and

(b) may decline to comply with any other instructions in relation to that subject matter.

13.2 The Customer shall ensure that all instructions given by the Customer in relation to the matters contemplated in the Agreement will be given by a Customer Representatives to an OML Representatives, and the OML:

(a) may treat all such instructions as the fully authorised instructions of the Customer, providing that the instruction is within the defined authority level for the relevant Customer Representative; and

(b) may decline to comply with any other instructions in relation to that subject matter.

14. Management

14.1 The parties shall hold management meetings at each party’s offices, by telephone conference or using internet-based conferencing facilities:

(a) in accordance with the Services Order Form (or otherwise by the parties in writing); and

(b) at the reasonable request of either party.

14.2 A party requesting a management meeting shall give to the other party at least 10 Business Days’ written notice of the meeting.

14.3 Wherever necessary to enable the efficient conduct of business, OML shall be represented at management meetings by at least 1 OML Representative and the Customer shall be represented at management meetings by at least 1 Customer Representative.

15. Changes

15.1 The Customer may request a Change at any time; and the provisions of this Clause 15 shall apply to each Change requested by the Customer.

15.2 When requesting a Change, the Customer shall provide to OML the information specified in Schedule 2 (Change requests) in the manner specified in that Schedule.

15.3 Following receipt of a Change request, OML shall promptly:

(a) accept the Change request, by giving to the Customer written notice of that acceptance;

(b) reject the Change request, in which case OML must inform the Customer of this rejection; or

and the Charges with respect to any Change shall be in accordance with Services Order Form, except that new Charges (to be agreed by the parties) may be payable with respect to any change in the Territory or any Customer Sites that are not within the Territory.

15.4 A proposed Change will not take effect until such time as OML has approved the relevant Change request in writing.

16. Charges

16.1 The Customer shall pay the Charges to OML.

16.2 All amounts stated in or in relation to these Terms and Conditions are, unless the context requires otherwise, stated exclusive of any applicable value added taxes, which will be added to those amounts and payable by the Customer to OML.

16.3 OML may increase the Charges upon and from each anniversary of the Agreement Date, by a percentage up to the lesser of:

(a) the annual percentage increase in the Retail Price Index (all items); and

(b) the annual percentage increase in the Consumer Price Index,

(in each case as published by the UK Office for National Statistics) with respect to annual period ending in the calendar month preceding that anniversary.

17. Expenses

17.1 The Customer shall reimburse OML in respect of any Expenses, providing that OML must obtain the prior written authorisation of the Customer before incurring any Expenses exceeding such limitations as may be agreed in writing by the parties from time to time.

17.2 OML must collect and collate evidence of all Expenses, and must retain such evidence during the Term and for a period of 90 days following the end of the Term.

17.3 Within 10 Business Days following receipt of a written request from the Customer to do so, OML must supply to the Customer such copies of the evidence for the Expenses in the possession or control of OML as the Customer may specify in that written request.

18. Payments

18.1 OML shall issue invoices for the Charges to the Customer on or after the invoicing dates set out in the Services Order Form.

18.2 Save to the extent that the Services Order Form provides otherwise, the Customer must pay the Charges to OML within the period of 30 days following the issue of an invoice.

18.3 The Customer must pay the Charges by bank transfer (using such payment details as are notified by OML to the Customer from time to time).

18.4 If the Customer does not pay any amount properly due to OML under these Terms and Conditions, OML may:

(a) charge the Customer interest on the overdue amount at the rate of 8% per annum above the Bank of England base rate from time to time (which interest will accrue daily until the date of actual payment and be compounded at the end of each calendar month); or

(b) claim interest and statutory compensation from the Customer pursuant to the Late Payment of Commercial Debts (Interest) Act 1998.

18.5 OML may suspend the provision of any of the Services if any amount due to be paid by the Customer to OML under the Agreement is overdue, and OML has given to the Customer at least 30 days’ written notice, following the amount becoming overdue, of its intention to suspend Services on this basis.‌

19. Confidentiality obligations

19.1 OML must:

(a) keep the Customer Confidential Information strictly confidential;

(b) not disclose the Customer Confidential Information to any person without the Customer’s prior written consent, and then only under conditions of confidentiality no less onerous than those contained in these Terms and Conditions;

(c) use the same degree of care to protect the confidentiality of the Customer Confidential Information as OML uses to protect OML’s own confidential information of a similar nature, being at least a reasonable degree of care; and

(d) act in good faith at all times in relation to the Customer Confidential Information.

19.2 The Customer must:

(a) keep the OML Confidential Information strictly confidential;

(b) not disclose the OML Confidential Information to any person without the OML’s prior written consent, and then only under conditions of confidentiality no less onerous than those contained in these Terms and Conditions;

(c) use the same degree of care to protect the confidentiality of the OML Confidential Information as the Customer uses to protect the Customer’s own confidential information of a similar nature, being at least a reasonable degree of care; and

(d) act in good faith at all times in relation to the OML Confidential Information.

19.3 Notwithstanding Clauses 19.1 and 19.2, a party’s Confidential Information may be disclosed by the other party to that other party’s officers, employees, professional advisers, insurers, agents and subcontractors who have a need to access the Confidential Information that is disclosed for the performance of their work with respect to the Agreement and who are bound by a written agreement or professional obligation to protect the confidentiality of the Confidential Information that is disclosed.

19.4 No obligations are imposed by this Clause 19 with respect to a party’s Confidential Information if that Confidential Information:

(a) is known to the other party before disclosure under these Terms and Conditions and is not subject to any other obligation of confidentiality;

(b) is or becomes publicly known through no act or default of the other party; or

(c) is obtained by the other party from a third party in circumstances where the other party has no reason to believe that there has been a breach of an obligation of confidentiality.

19.5 The restrictions in this Clause 19 do not apply to the extent that any Confidential Information is required to be disclosed by any law or regulation, by any judicial or governmental order or request, or pursuant to disclosure requirements relating to the listing of the stock of either party on any recognised stock exchange.

19.6 The provisions of this Clause 19 shall continue in force indefinitely following the termination of the Agreement.

20. Publicity

20.1 Neither party may make any public disclosures relating to the Agreement or the subject matter of the Agreement (including disclosures in press releases, public announcements and marketing materials) without the prior written consent of the other party, such consent not to be unreasonably withheld or delayed.

21. Data protection

21.1 Each party shall comply with the Data Protection Laws with respect to the processing of the Customer Personal Data.

21.2 The Customer warrants to OML that it has the legal right to disclose all Personal Data that it does in fact disclose to OML under or in connection with the Agreement.

21.3 The Customer shall only supply to OML, and OML shall only process, in each case under or in relation to the Agreement:

(a) the Personal Data of data subjects falling within the categories specified in Schedule 3 (Data processing information); and

(b) Personal Data of the types specified in Schedule 3 (Data processing information).

21.4 OML shall only process the Customer Personal Data for the purposes specified in Schedule 3 (Data processing information).

21.5 OML shall only process the Customer Personal Data during the Term and for not more than 30 days following the end of the Term, subject to the other provisions of this Clause 21.

21.6 OML shall only process the Customer Personal Data on the documented instructions of the Customer (including with regard to transfers of the Customer Personal Data to any place outside the European Economic Area and the United Kingdom), as set out in these Terms and Conditions or any other document agreed by the parties in writing.

21.7 The Customer hereby authorises OML to make the following transfers of Customer Personal Data:

(a) OML may transfer the Customer Personal Data to its sub-processors in the jurisdictions identified in Schedule 3 (Data processing information), providing that such transfers must be protected by any appropriate safeguards identified therein; and

(b) OML may transfer the Customer Personal Data to a country, a territory or sector to the extent that the competent data protection authorities have decided that the country, territory or sector ensures an adequate level of protection for Personal Data.

21.8 OML shall promptly inform the Customer if, in the opinion of OML, an instruction of the Customer relating to the processing of the Customer Personal Data infringes the Data Protection Laws.

21.9 Notwithstanding any other provision of the Agreement, OML may process the Customer Personal Data if and to the extent that OML is required to do so by applicable law. In such a case, OML shall inform the Customer of the legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

21.10 OML shall ensure that persons authorised to process the Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

21.11 OML and the Customer shall each implement appropriate technical and organisational measures to ensure an appropriate level of security for the Customer Personal Data.

21.12 OML must not engage any third party to process the Customer Personal Data without the prior specific or general written authorisation of the Customer. In the case of a general written authorisation, OML shall inform the Customer at least 14 days in advance of any intended changes concerning the addition or replacement of any third party processor, and if the Customer objects to any such changes before their implementation, then the Customer may terminate the Agreement on 7 days’ written notice to OML, providing that such notice must be given within the period of 7 days following the date that OML informed the Customer of the intended changes. OML shall ensure that each third party processor is subject to equivalent legal obligations as those imposed on OML by this Clause 21.

21.13 OML is hereby authorised by the Customer to engage, as sub-processors with respect to Customer Personal Data, the third parties, and third parties within the categories, identified in Schedule 3 (Data processing information).

21.14 OML shall, insofar as possible and taking into account the nature of the processing, take appropriate technical and organisational measures to assist the Customer with the fulfilment of the Customer’s obligation to respond to requests exercising a data subject’s rights under the Data Protection Laws.

21.15 OML shall assist the Customer in ensuring compliance with the obligations relating to the security of processing of personal data, the notification of personal data breaches to the supervisory authority, the communication of personal data breaches to the data subject, data protection impact assessments and prior consultation in relation to high-risk processing under the Data Protection Laws. OML may charge the Customer at its standard time-based charging rates for any work performed by OML at the request of the Customer pursuant to this Clause 21.15.

21.16 OML must notify the Customer of any Personal Data breach affecting the Customer Personal Data without undue delay and, in any case, not later than 36 hours after OML becomes aware of the breach.

21.17 OML shall make available to the Customer all information necessary to demonstrate the compliance of OML with its obligations under this Clause 21 and the Data Protection Laws. OML may charge the Customer at its standard time-based charging rates for any work performed by OML at the request of the Customer pursuant to this Clause 21.17, providing that no Charges shall be levied with respect to the completion by OML (at the reasonable request of the Customer, not more than once per calendar year) of the standard information security questionnaire of the Customer.

21.18 OML shall, at the choice of the Customer, delete or return all of the Customer Personal Data to the Customer after the provision of services relating to the processing, and shall delete existing copies save to the extent that applicable law requires storage of the relevant Personal Data.

21.19 OML shall allow for