Professional services terms and conditions

1. About these Terms

These Terms apply to Services provided by Virteffic Limited to a person, company, partnership, trust, foundation, board, committee or other organisation receiving the Services (the “Client”).

A reference to the “Contract” means these Terms together with the relevant Agreement and any schedules or documents expressly incorporated into it.

The Client’s instruction to Virteffic to commence or continue Services following receipt of an Agreement or these Terms constitutes acceptance of the Contract.

2. Our Services

Virteffic may provide services including:

• flexible governance resource;
• company secretarial support;
• board and committee support;
• minutes and meeting support;
• governance reviews and governance support;
• independent Board Effectiveness Reviews;
• governance frameworks, policies and documentation;
• Virteffic Academy training and professional development;
• governance projects and remediation support;
• administrative and project support connected with the above Services; and
• such other professional support as may be agreed in writing.

The precise scope, timing and Deliverables will be set out in the applicable Agreement or otherwise agreed between Virteffic and the Client in writing.

3. Nature and limits of our role

Virteffic provides governance, company secretarial support, board support, administration and related professional support services in a support capacity only.

Virteffic is not regulated or licensed under the Financial Services (Jersey) Law 1998, as amended, and does not provide regulated financial services. Where regulated services are required, the Client is responsible for engaging an appropriately licensed service provider.

Virteffic does not act as the statutory company secretary, director, fiduciary, administrator, registered office provider or other regulated service provider of the Client or any related entity.

Virteffic does not provide legal, tax, accounting, audit, investment, regulatory or other specialist professional advice.

Where specialist advice is required, the Client remains responsible for obtaining advice from an appropriately qualified adviser.

Responsibility for reviewing, approving and implementing any work product remains with the relevant directors, company secretary, officers or authorised representatives of the Client.

Nothing in the Contract transfers to Virteffic any statutory, fiduciary, regulatory or decision-making responsibility which properly belongs to the Client, its board, committees, directors, officers, company secretary, employees or authorised representatives.

4. Client responsibilities

The Client remains responsible for its business, governance, legal and regulatory obligations and for decisions made by its board, committees, officers and authorised representatives.

Unless expressly agreed otherwise, all Deliverables prepared by Virteffic are provided for review and approval by the Client.

The Client is responsible for confirming the factual accuracy, completeness and suitability of Deliverables before they are approved, signed, executed, filed, published, circulated, relied upon or implemented.

The Client shall:

• provide timely, accurate and complete instructions;
• provide all information reasonably required for the Services;
• identify applicable deadlines and known regulatory requirements;
• notify Virteffic promptly of material changes affecting the Services;
• ensure that persons instructing Virteffic are properly authorised; and
• review and approve Deliverables within a reasonable period.

5. Instructions and information

Virteffic may rely upon information, instructions, documents, recordings, transcripts, representations, explanations and approvals supplied by or on behalf of the Client without independently verifying them unless verification expressly forms part of the agreed Services.

Virteffic shall not be responsible for any loss arising from inaccurate, incomplete, misleading, late or withheld information or instructions provided by the Client or any person acting on its behalf.

Virteffic may seek clarification where instructions are incomplete, inconsistent or unclear and may suspend the affected work pending clarification.

6. Our team

Virteffic may allocate appropriately experienced members of its team to undertake the Services and may replace or reallocate personnel where reasonably required.

Virteffic may use its employees (including those operating under a zero-hours contract) in connection with the delivery of the Services, subject to appropriate confidentiality, data protection and information security requirements.

Where an Agreement, side letter, supplemental agreement or other written arrangement agreed with the Client imposes specific requirements concerning personnel, sub-contracting, access to Client systems, data processing or service providers, those requirements shall prevail to the extent of any inconsistency with this section.

Unless expressly stated in the Agreement, the engagement is with Virteffic Limited and is not dependent upon any particular individual.

No member of the Virteffic team shall assume personal responsibility or liability to the Client in connection with the Services. The Client agrees that any claim relating to the Services shall be brought against Virteffic Limited and not against any individual employee, consultant, contractor or member of the Virteffic team, except where liability cannot lawfully be excluded.

7. Fees and payment

Fees shall be charged in accordance with the applicable Agreement, quotation, rate card or other written arrangement agreed with the Client.

Unless otherwise agreed, fees are exclusive of GST, VAT or other applicable taxes and reasonable third-party expenses.

Invoices are payable within the period stated on the relevant invoice or Agreement.

Virteffic may charge for additional work arising from changes to scope, additional meetings, additional review cycles, late provision of information, urgent deadlines or material changes to Client instructions.

Virteffic may suspend Services where undisputed invoices remain overdue after reasonable notice has been given to the Client.

8. Confidentiality

Each party shall keep confidential information received from the other party confidential and shall use such information only for purposes connected with the Contract.

Virteffic may disclose Client confidential information where reasonably necessary to:

• members of the Virteffic team involved in providing the Services;
• professional advisers, auditors and insurers;
• approved technology, IT and other service providers;
• regulators or supervisory authorities;
• law enforcement agencies or courts; or
• any person where disclosure is required by law or lawful authority.

Where appropriate, persons receiving confidential information shall be subject to confidentiality obligations or equivalent professional duties.

Confidentiality obligations shall not apply to information which is already lawfully public, was lawfully known to the receiving party without restriction, is independently developed without reference to confidential information, or is lawfully obtained from another source.

9. Data protection

Each party shall comply with applicable data protection legislation, including, where applicable, the Data Protection (Jersey) Law 2018, the Data Protection (Bailiwick of Guernsey) Law 2017 and other applicable privacy and data protection legislation (“Data Protection Laws”).

Depending on the Services, Virteffic may process personal data as an independent controller, joint controller or processor acting on behalf of the Client.

Where Virteffic processes personal data as a processor on behalf of the Client, the Data Processing Terms at section 23 of these Terms shall apply.

The Client warrants that personal data and other information supplied to Virteffic has been collected and disclosed lawfully and may lawfully be processed for the purposes contemplated by the Contract.

Where AI or automated technology is used to process personal data, Virteffic shall apply its applicable data protection, information security and AI governance policies and procedures, having regard to the nature, purpose and risks of the processing.

Unless otherwise agreed in writing, the Client remains responsible for giving any notices to data subjects and establishing any lawful basis or other legal condition necessary for its collection, disclosure and processing of personal data in connection with the Services.

Each party shall be responsible for its own compliance with applicable Data Protection Laws when acting as an independent controller.

Where the parties act as joint controllers in relation to a particular processing activity, the parties shall agree such further arrangements as may be required by applicable Data Protection Laws.

10. Technology and artificial intelligence

Virteffic may use approved technology, software, automation, transcription tools and artificial intelligence-assisted systems (“AI Tools”) in connection with the Services where Virteffic considers their use appropriate for the relevant assignment.

Virteffic operates a controlled and human-led approach to the use of AI. The use of AI Tools is subject to Virteffic’s internal policies, procedures, access controls, information security requirements and quality assurance processes.

Where Client or confidential information is processed using AI Tools, Virteffic will use approved systems and environments in accordance with its applicable policies and procedures. Virteffic’s primary approved enterprise AI environment is Microsoft Copilot within its Microsoft 365 environment, together with such other tools as may be approved by Virteffic from time to time following appropriate security, privacy, confidentiality and risk assessment.

Virteffic does not permit members of its team to input Client confidential information into unapproved public or consumer AI tools.

Human review and professional oversight

AI Tools may assist with tasks including initial drafting, transcription, summarisation, document comparison, structuring, categorisation, consistency checks and other preparatory or administrative activities.

AI Tools do not replace professional judgement. Outputs generated or assisted by AI shall remain subject to reasonable and proportionate human review, validation and quality assurance having regard to the nature, sensitivity, purpose and agreed scope of the relevant Services.

The nature and extent of human review may vary depending on the assignment, the available source materials, the Client’s instructions and the intended use of the relevant Deliverable.

Virteffic does not warrant that AI Tools, automated systems, recordings or transcripts will be uninterrupted, complete or error-free. Virteffic shall use reasonable professional care in reviewing any AI-assisted content incorporated into a Deliverable issued by Virteffic.

All minutes prepared by Virteffic are subject to human review and professional oversight before being issued to the Client as a Virteffic draft. Virteffic does not rely solely upon AI-generated minutes, transcripts or summaries as the final governance record.

Where appropriate, the Virteffic reviewer may consider source materials including meeting recordings, transcripts, board or committee papers, previous minutes, governance documentation and other information made available for the assignment in order to review and refine the draft.

Responsibility for final review and approval of minutes and other Deliverables remains with the Client and, where applicable, the relevant chairperson, board, committee, company secretary, directors, officers or other authorised representatives.

AI governance and controls

Virteffic’s approach to AI is based on confidentiality, information security, accuracy, proportionality, professional judgement, human oversight and accountability.

Virteffic maintains policies and procedures governing the circumstances in which AI may be used, the systems which may be used, the information which may be processed, appropriate access controls and the level of human review required.

Virteffic may restrict or prohibit the use of AI for particular tasks where it considers that the nature of the information, legal or regulatory considerations, confidentiality, privilege, sensitivity or professional judgement make AI use inappropriate.

Client requirements

For the avoidance of doubt, where an Agreement, side letter, supplemental agreement, Client policy accepted by Virteffic or other agreed written instruction imposes stricter requirements concerning AI, technology providers, confidentiality, recording, transcription, data location, access or processing arrangements, those requirements shall prevail over this section to the extent of any inconsistency.

The Client is responsible for ensuring that any restriction notified to Virteffic has been properly authorised and accurately reflects the Client’s applicable contractual, legal, regulatory and internal policy requirements.

Virteffic shall not be responsible for a breach of a Client restriction which was not notified to Virteffic before the relevant Services were undertaken, unless Virteffic had otherwise expressly accepted that restriction in writing.

Where a restriction materially changes the agreed process, level of human input, delivery timetable, staffing requirement or cost of providing the Services, Virteffic may revise the scope, timetable and Fees accordingly.

Unless otherwise agreed in writing, the Client authorises Virteffic to use approved technology, automation and AI-assisted tools in connection with the Services in accordance with this section.

Where the Client has specific contractual, regulatory or internal policy restrictions concerning AI, technology providers, data location, recording, transcription or processing arrangements, the Client must notify Virteffic of those restrictions before the relevant Services are undertaken.

Virteffic may agree appropriate alternative working arrangements where reasonably practicable. Any resulting change in scope, process, turnaround time or Fees may be agreed with the Client.

Third-party technology

Virteffic may use reputable third-party systems and technology providers and may access systems selected, provided or mandated by the Client.

Virteffic does not warrant that any third-party technology will operate without interruption, vulnerability, delay or error. Virteffic shall not be responsible for failures or incidents attributable to third-party systems outside Virteffic’s reasonable control, provided that Virteffic has exercised reasonable care in relation to systems selected by Virteffic.

11. Information security

Virteffic shall maintain technical and organisational security measures which it considers reasonable and proportionate having regard to the nature of the Services, the information processed and reasonably foreseeable information security risks.

Virteffic maintains information security controls and may maintain recognised cyber security certifications and specialist cyber and data insurance from time to time. The existence of any certification, insurance policy, security control or technical measure does not constitute a warranty that a cyber security or information security incident cannot occur.

Information security incidents

Where Virteffic becomes aware of an information security incident materially affecting Client information, Virteffic shall take reasonable and proportionate steps to investigate, contain and remediate the incident.

Virteffic shall notify the Client without undue delay where notification is required by applicable law or the Contract and shall provide reasonable cooperation in relation to any required investigation, notification or remedial action.

Virteffic shall not be responsible for an information security incident caused by systems, technology, credentials, instructions or acts or omissions of the Client or a third party outside Virteffic’s reasonable control, except to the extent caused by Virteffic’s own breach of the Contract or applicable law.

The Client shall maintain appropriate security in relation to its own systems, accounts, devices, credentials and information and shall notify Virteffic promptly where the Client becomes aware of any actual or suspected incident which may affect Virteffic, the Services or information processed in connection with the Contract.

The Client shall provide individual, appropriately permissioned user accounts where Virteffic requires access to Client systems. Virteffic shall not be required to use shared credentials where this would be inconsistent with reasonable information security practice.

Unless caused by Virteffic’s breach of the Contract or applicable law, Virteffic shall not be responsible for loss arising from:

• access credentials supplied by the Client;
• inappropriate permissions configured by the Client;
• the Client’s failure to revoke or amend access;
• instructions transmitted through a compromised Client account;
• Client-mandated systems or security arrangements; or
• the Client’s failure to maintain appropriate backups or business-continuity arrangements.

12. Intellectual property

Virteffic retains ownership of all pre-existing and independently developed intellectual property, methodologies, templates, frameworks, questionnaires, assessment models, training materials, course content, checklists, know-how, processes, presentation materials, prompt libraries, tools and other proprietary materials, together with any developments or improvements to them (“Virteffic Materials”).

Unless otherwise agreed in writing and subject to payment in full of all applicable Fees, the Client receives a non-exclusive, non-transferable and non-sublicensable licence to use Deliverables prepared specifically for the Client for its own internal business, governance, regulatory and professional purposes.

The Client may share a Deliverable with its directors, officers, employees, board and committee members, professional advisers, auditors, insurers, regulators and relevant group entities where reasonably necessary for the purpose for which the Deliverable was prepared, provided that:

• the recipient is informed that no duty of care is accepted by Virteffic to that recipient;
• the recipient does not commercially exploit or further distribute Virteffic Materials;
• the disclosure does not breach confidentiality, data protection or other applicable obligations; and
• the Client remains responsible for the use made of the Deliverable.

The Client shall not, without Virteffic’s prior written consent:

• sell, license, commercially exploit, publish or distribute Virteffic Materials;
• use Virteffic Materials to provide services to a third party;
• adapt Virteffic Materials into competing training, professional support or commercial products;
• remove Virteffic branding, ownership notices or disclaimers from Virteffic Materials where their removal could create a misleading impression as to authorship or ownership; or
• use any Deliverable or Virteffic Material to train, develop, test or improve an external artificial intelligence system or machine-learning model.

Nothing prevents the Client from using Client-owned information contained within a Deliverable for its legitimate business purposes.

Unless otherwise agreed in writing, Virteffic may retain and reuse general knowledge, experience, skills, processes and learning developed during an engagement, provided that no Client confidential information, personal data or identifying information is disclosed or used improperly.

13. Minutes and meeting records

Unless expressly agreed otherwise, minutes prepared by Virteffic are intended to provide a concise and proportionate record of the material matters discussed, decisions reached and actions arising from a meeting. They are not intended to constitute a verbatim transcript.

Virteffic may exercise professional judgement in determining the level of detail, structure and drafting appropriate to the meeting, having regard to the instructions received, the nature of the meeting and the information available.

Virteffic may use recordings, transcripts, AI-assisted drafts, notes, meeting papers, previous minutes and other source materials to support the preparation and review of minutes. Any AI-assisted or automated output used in that process is treated as working material only and not as the final governance record.

All minutes issued by Virteffic as a draft are subject to human review and professional oversight before being provided to the Client.

Draft minutes remain subject to review and approval by the Client and, where applicable, the chairperson, board, committee, company secretary or other authorised decision-making body.

Virteffic does not warrant that any recording, automated transcript, third-party transcript, AI-generated content or other source material supplied to or accessed by Virteffic is complete or accurate.

Unless otherwise agreed, the Client shall provide any comments or proposed amendments to draft minutes within a reasonable period. Virteffic may charge for substantial amendments, repeated review cycles or amendments requested after the minutes have been approved or treated as final.

Where comments or amendments materially alter Virteffic’s understanding of the meeting, Virteffic may request supporting information or confirmation from an authorised person before incorporating those amendments.

Virteffic shall not be required to include wording which it reasonably considers inaccurate, misleading, defamatory, unlawful or inconsistent with the available meeting record. Where the Client elects to adopt wording which has not been approved by Virteffic, the amended version shall not be represented as having been prepared or approved by Virteffic.

14. Reviews, assessments and professional judgement

Governance reviews, Board Effectiveness Reviews, observations, assessments, recommendations and benchmarking involve the exercise of professional judgement.

Findings and recommendations reflect the information made available to Virteffic, the contributions received from participants and the circumstances existing at the relevant time.

Such Services do not constitute an audit, assurance engagement, regulatory inspection, legal opinion, certification of compliance or guarantee of future board, governance or organisational performance.

Recommendations are provided for consideration by the Client. Decisions concerning whether, when and how recommendations are implemented remain the responsibility of the Client and its authorised decision-makers.

Virteffic does not warrant that information provided through interviews, questionnaires, observations or documents is complete or independently verified unless independent verification expressly forms part of the Services.

The Client is responsible for determining how findings and recommendations are communicated, disclosed and implemented, subject to any agreed confidentiality or reporting arrangements.

Unless otherwise agreed, Virteffic may update or correct an issued report where a material factual error is identified. Virteffic shall not be required to update findings or recommendations solely because circumstances, personnel, law, regulation or guidance subsequently change.

15. Conflicts and other clients

Virteffic provides Services to multiple organisations, including businesses operating in the same industries and markets. This shall not of itself constitute a conflict of interest.

Virteffic shall maintain appropriate confidentiality arrangements and shall consider actual or potential conflicts which become known to it.

Where Virteffic considers that an actual conflict materially prevents it from continuing to provide the affected Services appropriately, Virteffic may decline, suspend or terminate those Services.

16. Reliance on Deliverables

Deliverables are prepared solely for the Client and for the purpose agreed with Virteffic.

Unless Virteffic expressly agrees otherwise in writing, no third party may rely upon a Deliverable and Virteffic accepts no duty of care or responsibility to any third party in respect of it.

The Client shall not use a Deliverable for a materially different purpose from that for which it was prepared without first considering whether further professional advice or updated work is required.

Permitted disclosure of a Deliverable does not create a duty of care or contractual relationship between Virteffic and the recipient.

Where the Client requests that Virteffic accepts reliance by a third party, Virteffic may require a separate reliance letter, an agreed limitation of liability and payment of an additional fee.

17. Liability

Nothing in the Contract excludes or limits any liability which cannot lawfully be excluded or limited.

Subject to the paragraph above, Virteffic shall not be liable for any indirect or consequential loss, loss of profit, loss of revenue, loss of anticipated savings, loss of business opportunity, loss of goodwill, reputational loss or loss arising from business interruption, whether arising in contract, tort (including negligence), breach of statutory duty or otherwise.

Virteffic shall not be liable to the extent that any loss, liability, cost or expense arises from or is increased by:

• inaccurate, incomplete, misleading, late or withheld information supplied by or on behalf of the Client;
• inaccurate or incomplete recordings, transcripts, documents or source materials supplied to Virteffic;
• an act, omission, instruction or decision of the Client or any third party;
• failure by the Client to review, approve or act upon a Deliverable appropriately;
• use of a Deliverable for a purpose other than the purpose for which it was prepared;
• alteration of a Deliverable by any person other than Virteffic;
• implementation, or failure to implement, any observation, recommendation or suggestion made by Virteffic;
• changes in law, regulation, regulatory guidance, industry practice or circumstances occurring after the relevant Services or Deliverable were provided;
• failure, interruption, error, compromise or unavailability of systems, software, technology or services supplied or controlled by a third party and outside Virteffic’s reasonable control; or
• any event outside Virteffic’s reasonable control.

Subject to any liability which cannot lawfully be limited, Virteffic’s total aggregate liability arising out of or in connection with an engagement, whether arising in contract, tort (including negligence), breach of statutory duty, misrepresentation or otherwise, shall not exceed the total Fees paid or payable by the Client to Virteffic in respect of the relevant engagement during the 12 months immediately preceding the event giving rise to the claim.

Where an engagement has been in place for less than 12 months, the liability cap shall be the total Fees paid or payable in respect of that engagement during the period from commencement to the date of the event giving rise to the claim.

Where more than one claim arises from the same or substantially the same act, omission, event or series of connected events, those claims shall be treated as a single claim for the purposes of the liability cap.

Any liability of Virteffic shall be reduced to the extent that the Client or any other person has caused or contributed to the relevant loss.

18. Client indemnities

The Client shall indemnify Virteffic against reasonable losses, liabilities, costs and third-party claims incurred to the extent arising from:

• unlawful instructions provided by or on behalf of the Client;
• material supplied by the Client which infringes third-party rights;
• the Client’s breach of applicable Data Protection Laws;
• materially inaccurate or misleading information supplied by the Client;
• unauthorised alteration, publication or distribution of a Deliverable; or
• use of a Deliverable outside the purpose for which it was prepared.

This indemnity shall not apply to the extent that the relevant loss results from Virteffic’s own negligence, fraud or wilful misconduct.

The Client shall notify Virteffic promptly of any third-party claim which may give rise to an indemnity under this section and shall provide reasonable cooperation and information.

Virteffic shall not settle a third-party claim in a manner which imposes a material admission or non-monetary obligation on the Client without the Client’s prior written consent, such consent not to be unreasonably withheld or delayed.

The indemnities in this section shall survive termination of the Contract.

19. Suspension and termination

Either party may terminate Services in accordance with the applicable Agreement or, where no termination period is stated, by giving reasonable written notice.

Virteffic may suspend or terminate Services immediately where:

• continued performance may breach law, regulation or professional obligations;
• an actual conflict prevents Virteffic from acting appropriately;
• the Client requires Virteffic to undertake an unlawful or inappropriate act;
• material information required to undertake the Services is withheld;
• the Client commits a material breach of the Contract; or
• undisputed fees remain materially overdue following reasonable notice.

Termination does not affect accrued rights, liabilities or fees relating to Services performed before termination.

20. Records

Virteffic may retain engagement records for such period as it considers reasonably necessary for legal, regulatory, insurance, operational or professional purposes, subject to applicable law and Virteffic’s retention policies.

Following completion or termination of an engagement, Virteffic may delete or destroy records after expiry of the applicable retention period unless continued retention is legally required or otherwise agreed.

21. General provisions

21.1 Force majeure

Virteffic shall not be liable for delay or failure caused by circumstances beyond its reasonable control, including interruption to utilities, communications, transport, third-party technology, cyber incidents, natural events, government action or other comparable events.

21.2 Variation of these Terms

Virteffic may update these Terms from time to time.

Updated versions shall take effect upon publication on the Virteffic website unless otherwise stated.

By continuing to use the Services following publication of updated Terms, the Client is deemed to accept the updated Terms.

The version of the Terms published on the Virteffic website shall be the version applicable to the Contract unless otherwise agreed in writing.

Updates shall not retrospectively alter rights, obligations or liabilities that arose before the effective date of the relevant update.

21.3 Assignment

The Client may not assign or transfer its rights under the Contract without Virteffic’s prior written consent.

Virteffic may assign or transfer the Contract as part of a bona fide reorganisation, business transfer or succession arrangement, subject to applicable law.

21.4 Third-party rights

Unless expressly stated otherwise, no person who is not a party to the Contract shall have any right to enforce its terms.

21.5 Severability

If any provision of the Contract is held invalid, unlawful or unenforceable, that provision shall be treated as modified to the minimum extent necessary to make it valid and enforceable where legally possible. The remaining provisions shall continue in full force and effect.

21.6 Entire agreement

The Contract constitutes the agreement between the parties concerning the relevant Services and supersedes prior discussions, correspondence or representations relating to those Services, except in the case of fraud.

21.7 Publicity and use of names

Neither party may use the other party’s name, logo or trademarks publicly in connection with an engagement without prior consent, except where disclosure is required by law.

Virteffic may refer to the nature of work undertaken on an anonymised and aggregated basis provided that the Client cannot reasonably be identified.

21.8 Non-solicitation and direct engagement

During an engagement and for 12 months following its completion, the Client shall not, without Virteffic’s prior written consent, directly or indirectly solicit, employ, engage or contract with any Virteffic team member who was materially involved in providing Services to the Client.

This restriction shall not prevent a person from responding independently to a general recruitment advertisement which was not targeted at that person, provided that the Client did not encourage or facilitate the application in order to avoid this section.

Where the Client wishes to employ or directly engage a relevant Virteffic team member, Virteffic may consent subject to payment of a recruitment or introduction fee.

Unless otherwise agreed, that fee shall be an amount equal to 30% of the person’s anticipated gross annual remuneration or, where the engagement is not employment, 30% of the anticipated fees payable to that person during the first 12 months of direct engagement.

This section shall survive termination of the Contract.

21.9 Notices and communications

Notices or other formal communications relating to the Contract may be delivered by email to the contact details specified in the applicable Agreement.

Notices to Virteffic may be sent to info@virteffic.com.

A party shall notify the other party of any change to its contact details. An email shall be treated as received when transmitted, provided that the sender does not receive an automated notification that delivery has failed. An email sent outside normal business hours shall be treated as received on the next Business Day.

21.10 Complaints and concerns

Virteffic encourages the Client to raise any concern regarding the Services promptly so that it may be considered and, where appropriate, addressed.

A formal complaint should be provided in writing and should include reasonable details of the relevant Services, circumstances and outcome sought.

Virteffic shall consider complaints in accordance with its applicable complaints procedure.

Raising a complaint does not entitle the Client to withhold payment of an undisputed invoice.

21.11 No waiver

A failure or delay by either party to exercise any right or remedy under the Contract shall not constitute a waiver of that or any other right or remedy.

22. Governing law and jurisdiction

The Contract and any dispute or non-contractual obligation arising out of or in connection with it shall be governed by the laws of Jersey.

The courts of Jersey shall have exclusive jurisdiction to determine any dispute arising out of or in connection with the Contract.

Nothing in the Contract requires Virteffic to undertake Services in any jurisdiction where doing so would cause Virteffic to breach applicable legal or regulatory requirements.

23. Data processing terms

This section applies where Virteffic processes personal data as a processor on behalf of the Client.

23.1 Processing instructions

Virteffic shall process personal data only on documented instructions from the Client, including as set out in the Contract, unless processing is required by applicable law.

23.2 Subject matter, duration and purpose

The subject matter and duration of processing shall be determined by the Services and the period during which Virteffic provides those Services and retains relevant records in accordance with the Contract and applicable law.

Processing may include accessing, reviewing, organising, recording, transcribing, drafting, storing, retrieving, transmitting, amending, compiling and otherwise using personal data to the extent reasonably necessary to provide the Services.

23.3 Categories of personal data and data subjects

Personal data processed may include names, contact details, professional and employment information, meeting contributions, governance records, correspondence, identification information and other personal data contained in materials supplied by or on behalf of the Client.

Data subjects may include directors, officers, employees, shareholders, investors, clients, advisers, service providers, meeting participants and other individuals whose information is contained within Client materials.

Where required for the agreed Services, materials may also contain special category or otherwise sensitive personal data.

23.4 Confidentiality

Virteffic shall ensure that persons authorised to process Client personal data are subject to appropriate confidentiality obligations.

23.5 Security

Virteffic shall implement appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and accidental loss, destruction, damage or disclosure, having regard to the nature and risks of the processing.

23.6 Sub-processors

The Client provides general authorisation for Virteffic to appoint appropriate sub-processors required to provide the Services, including providers of cloud hosting, communications, collaboration, transcription, information technology, security and professional support services.

Virteffic shall impose appropriate data protection obligations on sub-processors where required by applicable Data Protection Laws.

Virteffic remains responsible for compliance with its applicable processor obligations in relation to processing undertaken on its behalf by a sub-processor.

Virteffic may add, replace or remove sub-processors from time to time.

Information concerning material categories of sub-processors shall be made available to the Client on reasonable request.

Where applicable Data Protection Laws require the Client to be given an opportunity to object to a proposed new sub-processor, the Client must raise any reasonable and substantiated objection promptly.

Where the parties cannot reasonably resolve an objection, Virteffic may propose an alternative arrangement, amend the scope or Fees, suspend the affected processing or terminate the affected Services.

23.7 International transfers

Where personal data is transferred internationally, Virteffic shall ensure that the transfer is made in accordance with applicable Data Protection Laws and shall use an appropriate lawful transfer mechanism where required.

23.8 Data subject rights

Taking into account the nature of the processing, Virteffic shall provide reasonable assistance to the Client in responding to requests from data subjects where required by applicable Data Protection Laws.

Where Virteffic receives a request directly from a data subject relating to personal data processed solely on behalf of the Client, Virteffic may refer the request to the Client unless applicable law requires otherwise.

23.9 Personal data breaches

Virteffic shall notify the Client without undue delay after becoming aware of a personal data breach affecting personal data processed by Virteffic on behalf of the Client where notification is required under applicable Data Protection Laws.

Virteffic shall provide such information concerning the breach as is reasonably available and reasonably required to enable the Client to comply with its own applicable notification obligations.

23.10 Compliance assistance

Taking into account the nature of the processing and information available to Virteffic, Virteffic shall provide reasonable assistance with the Client’s applicable obligations relating to security, breach notification, data protection impact assessments and regulatory consultation.

Unless the assistance is required because of Virteffic’s breach of the Contract or applicable Data Protection Laws, Virteffic may charge its reasonable fees and costs for material or extensive assistance provided under this section.

23.11 Return and deletion

On termination of the relevant Services, Virteffic shall delete or return personal data processed on behalf of the Client where reasonably requested, except to the extent continued retention is permitted or required by law, regulatory requirements, professional obligations, insurance requirements or legitimate record-retention purposes.

23.12 Information and audit

Virteffic shall make available such information as is reasonably necessary to demonstrate compliance with its applicable processor obligations.

Any audit requested by the Client shall be proportionate, subject to reasonable prior notice, confidentiality and security requirements, and conducted during normal business hours so as to minimise unnecessary disruption to Virteffic’s business and protect the confidentiality, security and information of other clients.

Unless required by applicable law or a regulator, the Client shall first consider whether information, certifications, policies, audit reports or other evidence supplied by Virteffic reasonably satisfies the purpose of the proposed audit before requiring an onsite inspection.

Unless an audit identifies a material breach by Virteffic of its applicable processor obligations, the Client shall bear its own costs and Virteffic’s reasonable costs of responding to or facilitating the audit.

An audit shall not require Virteffic to:

• disclose information concerning another client;
• provide access which would compromise information security;
• disclose legally privileged information;
• disclose commercially sensitive information unrelated to the Client’s processing; or
• permit access to Virteffic systems where a less intrusive method can reasonably demonstrate compliance.

No audit may be conducted by a direct competitor of Virteffic without Virteffic’s prior written consent.