Terms of Service

1. Introduction, structure and definitions

1.1. We are PCIFIC Marketplaces Limited, company number 16802447, doing business as PCIFIC ("PCIFIC", "Company", "we", "us", or "our"). We are registered in England and Wales and our registered office is at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.

1.2. We operate https://business.pcific.ai and the related business dashboard, application programming interface (API, the connection your software uses to call our tools), embeds, integrations, demonstrations, support channels and licensed tools that refer to these Terms (the "Services").

1.3. "Customer", "you" and "your" mean the business contracting for the Services. An "Authorised User" is a person that business permits to use its account. A "Shop" is a configured business integration or workspace resource. "Content" includes submitted text, photographs, documents, product data, listing information, questions and support materials. "Outputs" are results generated or returned by the Services. An "Order" is an expressly agreed order or service agreement identifying purchased Services, fees and any agreed variation.

1.4. By accepting these Terms through an account or order process that presents them, or entering an Order incorporating them, you agree to them on behalf of the Customer. You must have authority to bind that business. Merely publishing revised terms does not retrospectively replace a different agreement or remove rights already acquired.

1.5. We recommend that you save or print a copy of these Terms, your Order and the Modules that apply to you. A new Module applies to an existing paid service only in accordance with the agreed change process; launching a new product does not automatically impose its charges on you.

2. Eligibility and account terms

2.1. Business account holders must be at least 18 years old, legally capable of entering a contract and authorised by the Customer. Customer-facing integrations do not make every end user a business account holder. You remain responsible for the eligibility and notices needed for your own service.

2.2. Information you provide about your business, account, users and integrations must be true, accurate, current and complete. Keep it up to date and notify us promptly if authority over the account changes.

2.3. Protect account credentials, API keys, provider keys and recovery codes. Give each colleague the access their role requires and remove it when no longer needed. You are responsible for activity you authorise and failures to protect credentials within your control, except to the extent caused by our breach or failure to use reasonable security measures.

2.4. You must not create accounts using false or unauthorised information, impersonate another business, use another person's account without permission, sell personal sign-in credentials, evade a suspension or verification requirement, or use the Services where sanctions or other applicable law prohibit it. Permitted team seats and scoped integration keys, including keys approved for coding tools, are not prohibited account sharing.

2.5. We may request proportionate business, identity, tax or compliance information where reasonably necessary to provide a feature, verify authority or meet legal obligations. We may restrict the affected feature if required information is missing or unreliable and explain the next step where lawful.

2.6. A person buying mainly for personal use may have mandatory consumer rights despite a business label. Nothing in these Terms removes rights that applicable law does not allow us to exclude. The Services are offered for business use; contact us if a proposed purchase is for personal use.

3. General legal terms

3.1. Intellectual property. We or our licensors own the rights in the Services, including software, databases, functionality, design, text, graphics, logos and trade marks, excluding your Content and third-party materials. We grant the Customer a limited, non-exclusive licence to use the purchased Services for the commercial purposes allowed by its Order and the Business Services Module. This includes authorised customer-facing integrations. You must not copy, republish, scrape or reverse engineer our software or otherwise exploit it outside that permission, except where applicable law gives a non-excludable right.

3.2. Feedback. You retain rights in feedback you provide, but grant us a non-exclusive, worldwide, perpetual, royalty-free licence to use and adapt it to improve the Services. Feedback does not include your private customer requests merely because we receive them while supplying a tool. This clause does not authorise model training on your Content or disclosure of your confidential information.

3.3. Acceptable use. Use the Services for their intended lawful purposes and within your agreed licence. You must not use them to commit fraud, infringe rights, unlawfully collect or disclose personal information, distribute malware, obtain unauthorised access, expose credentials, disrupt the service, bypass security or usage restrictions, or manipulate billing or verification records. You may not resell PCIFIC access as a separate service outside your agreed licence.

3.4. Service management. We may investigate suspected breaches and take proportionate steps to protect the Services and affected people. We may restrict, suspend or terminate affected access where reasonably necessary because of a material breach, non-payment, unlawful use or a genuine security or safety risk. Where appropriate, we will give reasons, notice and a reasonable opportunity to remedy or challenge the action. We may act immediately where delay would create material risk or breach the law, and explain afterwards when lawful.

3.5. Changes to these Terms. We may update the Terms for changes in the service, law or providers. We will give reasonable advance notice of material changes affecting an ongoing paid service and explain when they take effect and any right to end the affected service. Changes do not apply retrospectively, save where law requires otherwise. An Order's agreed change process continues to apply. Continued use is not consent to new personal-data purposes.

3.6. Governing law and jurisdiction. These Terms and related non-contractual obligations are governed by the laws of England and Wales. For business disputes, the courts of England and Wales have exclusive jurisdiction, subject to mandatory law. If mandatory consumer protections apply, those protections and any courts they entitle a person to use remain available.

3.7. Entire agreement, severability and waiver. These Terms, the applicable Order and documents expressly incorporated into them form the agreement for the Services. If a provision is unlawful or unenforceable, it is limited or severed to the minimum necessary and the remainder continues. Delay in enforcing a right is not a waiver. This clause does not exclude fraud or rights that cannot lawfully be excluded.

3.8. Assignment. Neither party may transfer the agreement in a way that materially reduces the other's rights or safeguards. You need our written consent to transfer your account or licence, which we will not unreasonably withhold. We may transfer the agreement as part of a genuine business reorganisation or sale with notice and without reducing agreed protections. Subcontracting remains subject to our data processing obligations.

3.9. Electronic communications. We may send account, security, billing and contractual notices electronically to your nominated address. Keep that address current. Agreement to necessary service messages is not consent to optional marketing.

3.10. Relationship of the parties. Nothing creates a partnership, employment, fiduciary relationship, franchise, joint venture or general agency. We contract with you to supply our business tools; we are not the seller or buyer in transactions made through your service.

3.11. Content standards. Content must not be unlawful, infringing, fraudulent or misleading, contain child sexual abuse material or terrorist content, include unlawfully shared intimate images, promote criminal hate, harassment or violence, or facilitate unlawful goods or activity. You must not fabricate evidence, remove material caveats from a result to mislead someone, falsify a certificate, or present an AI assessment as a guaranteed finding of fraud, authenticity, ownership or safety.

3.12. Our approach to illegal content. We may assess Content brought to our attention, restrict access and preserve necessary evidence where lawful. The Services do not promise advance human review of everything you submit or publish. You remain responsible for the content and reporting arrangements on your own service. PCIFIC remains responsible for legal duties applicable to its own Services.

3.13. Reporting illegal content. Report suspected illegal content, misuse or an incorrect public certificate to support@pcific.co.uk. Identify the relevant feature or record and explain the concern without sending unnecessary sensitive information. We will assess genuine reports and take appropriate action, and communicate an outcome where reasonable and lawful.

3.14. Children. Business accounts are intended for adults. Do not submit children's personal information to general AI tools. If your own service is used by children, assess its additional legal requirements and obtain an expressly agreed service arrangement before sending information requiring protections our ordinary service does not provide.

3.15. Freedom of expression and privacy. We will have regard to freedom of expression, privacy and applicable law when assessing Content and enforcing these Terms. Restrictions should be proportionate to the relevant breach or risk.

3.16. AI-assisted features. AI means artificial intelligence, software that generates or assesses information using trained models. AI features are assistive and informational. Outputs may be inaccurate, incomplete, out of date, biased or unsuitable, including by misreading a photograph, missing a defect, selecting an incorrect product or suggesting inaccurate condition, pricing or wording.

3.17. Human review. Review, correct and approve generated content before publishing, sending or relying on it. The seller or business remains responsible for the accuracy of its listing, product claims and customer communications. Do not use Outputs as the sole basis for a decision with legal or similarly significant effects on a person, or as professional legal, financial, medical or safety advice.

3.18. AI controls. We may restrict an AI feature for safety, legal or service-integrity reasons. Monitoring and storage must remain consistent with the selected privacy setting, the data processing schedule and applicable law. This clause does not override a no-training commitment or permit undisclosed logging.

3.19. Licence to your Content. You retain ownership of your Content. You grant us the limited permission to receive, host, process, format, transmit and return it as needed to supply your requested Services and comply with the agreement. Where a feature deliberately creates a public certificate, that permission includes the disclosure you instruct through that feature. It does not include using private submissions in advertising, selling them or training models on them. Separate permission is needed for promotional use of identifiable customer Content.

3.20. Content warranty and Outputs. You must have the rights, permissions and lawful grounds needed to submit Content and instruct its use. As between you and PCIFIC, you may use returned Outputs for your agreed commercial purposes; we do not claim your underlying Content. AI Outputs may not be unique or qualify for copyright protection, and this permission cannot transfer third-party rights we do not own. You must check rights and accuracy before use.

3.21. Removal and confidentiality. We will stop using deleted Content for ordinary service purposes as soon as reasonably practicable, subject to documented retention needed for law or claims. Each party must protect the other's confidential information, use it only for the agreement and disclose it only to authorised people or providers bound by appropriate duties, or as required by law. Publicly available information, information lawfully obtained independently and information independently developed are excluded. The data processing schedule governs customer personal information.

4. Data protection

4.1. Our Privacy Policy describes our handling of personal information. Acknowledging that notice is not consent to every processing activity. Where consent is needed, it must be obtained separately.

4.2. For business account administration, security, billing and our own legal duties, PCIFIC acts as a controller, meaning the organisation deciding the purpose and means of that processing. Where we process customer personal information on your documented instructions, we act as your processor, meaning the organisation handling information on your behalf. Your role may itself be that of a processor for another organisation; you must have its authority to engage us.

4.3. Schedule 1 applies to personal information processed on your behalf. Provide appropriate customer notices and a lawful basis, choose suitable privacy settings and avoid unnecessary sensitive information. We remain responsible for our own statutory duties and for following lawful instructions.

4.4. Do not submit special category information, criminal-offence information or children's personal information unless we have expressly agreed the processing and its safeguards. Special category information includes health, biometric identification and other specially protected information. Never put passwords, payment credentials or unrelated identity documents in ordinary tool requests.

5. Liability, indemnity and intermediary status

5.1. Status. PCIFIC supplies the contracted business software and tools. We are not the retailer, buyer, insurer or payment provider for your customer transactions, and are not a party to their sale contracts. This does not remove our responsibility for supplying our own Services in accordance with our agreement.

5.2. Non-excludable liability. Nothing excludes or limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability, statutory duty or right that cannot lawfully be excluded or limited. Nothing restricts the rights of individuals or a regulator under data protection law.

5.3. Draft reservation: the monetary liability limit, its calculation period, any minimum amount and any separate treatment of confidentiality, data protection or intellectual-property claims are deliberately left open for agreement before publication. This draft does not contain an agreed liability ceiling.

5.4. Losses. Subject to clause 5.2 and applicable law, neither party is responsible for losses that are too remote to be recoverable under the governing law. No additional blanket exclusion of business losses is agreed by this draft; the final allocation of covered losses must be read with the completed clause 5.3.

5.5. Business User indemnity. An indemnity is a promise to reimburse another party for specified losses. You will reimburse our reasonably incurred losses and legal costs arising from a third-party claim to the extent caused by your unlawful Content, infringement of third-party rights or deliberate misuse of the Services. This does not cover loss caused by our breach or negligence. We must notify you promptly, take reasonable steps to reduce loss and not settle a claim at your expense without your reasonable consent. Any agreed liability framework must expressly state how it applies to this clause.

5.6. Disclaimers. Subject to our express commitments and duties that cannot lawfully be excluded, the Services are supplied on an as available basis. Content, verification signals, ratings, matching results and AI Outputs are screening and information tools, not guarantees of accuracy, safety, authenticity, ownership or fitness for a particular purpose. We do not guarantee uninterrupted operation or prevent every third-party fraud. We remain responsible for reasonable care and skill and for providers we engage to perform our contracted obligations; a third party's involvement does not automatically excuse our own breach.

6. Paid services and subscriptions framework

6.1. The agreed Order or purchase disclosure must identify the Services, prices, taxes, credit conversion, billable actions and any recurring charges before you are bound. Illustrative or placeholder prices do not constitute agreed charges. A general business account does not itself authorise a recurring subscription or automatic top-up.

6.2. Credits represent prepaid use of PCIFIC Services. They are not a bank account, do not earn interest and cannot be transferred or traded unless expressly agreed. Purchased credits must be distinguished from free, trial and promotional allowances. Restrictions or expiry on promotional allowances must be disclosed when granted.

6.3. Purchased credits do not expire simply because you stop buying or using the Services while your account remains open. Stopping future purchases does not erase your purchased balance. Completed, correctly charged uses remain paid uses even if you later stop using the service, subject to remedies for a faulty or undelivered service and applicable law.

6.4. If you close your account, or we permanently end the affected service without providing a reasonably equivalent way to use your balance, we will refund the unused purchased credit balance attributable to it. The refund is based on the amount actually paid for those unused credits, not the cash value of free or promotional allowances. We will account for charges already properly incurred, explain the calculation and refund without undue delay to the original payment method where practicable. Suspension or a dispute is not by itself automatic forfeiture of your unused purchased balance.

6.5. A request can reserve credits while work is in progress. A failed request must not be treated as a successful paid use merely because credits were reserved. The applicable tool's published charging rules determine the completed action charged. A repeated call may be a new use unless it uses the supported retry mechanism. We will investigate reported duplicate or incorrect charges and restore credits or refund an incorrect payment as appropriate.

6.6. A recurring plan, minimum commitment, automatic top-up or paid renewal applies only if expressly agreed. Its price, frequency, renewal date, cancellation route and any notice period must be provided before purchase. Cancelling a recurring plan stops future renewals according to that agreed schedule; it does not erase your separately purchased credit balance.

6.7. We will give reasonable advance notice of changes to prices or recurring charges. A price change does not retrospectively reprice completed uses or reduce the number of purchased credits already held. We will explain any prospective change to the cost of a tool action and give a reasonable opportunity to stop further use before it applies. An Order's agreed fixed-price period or change procedure takes precedence.

6.8. Pay undisputed invoices by the agreed due date. If a charge is disputed in good faith, tell us promptly and explain why. We will investigate and keep the disputed amount separate from undisputed sums. We may restrict further paid work for overdue undisputed amounts after reasonable notice, without cancelling rights to a valid refund or data return.

6.9. Payment arrangements. Unless your Order says otherwise, we issue invoices by email and you pay by bank transfer to the account shown on the invoice. The Business app does not take card payments. We do not promise a billing-portal cancellation route unless it is actually offered for your plan; you can contact support@pcific.co.uk about cancellation.

6.10. Mandatory rights. These business payment rules do not exclude remedies required by law. If a purchase is in fact a consumer contract, any applicable cancellation, refund and digital-content rights continue to apply. A statement that a purchase is business-only cannot override the actual legal position, and immediate supply does not by itself remove a statutory cancellation right.

7. Complaints and dispute resolution

7.1. Contact support@pcific.co.uk with your business name, the affected service and a short explanation of the issue. Include a request reference where available rather than passwords, keys or unnecessary personal information. We will review genuine complaints in good faith and explain the next step.

7.2. The parties should first try to resolve a dispute through their nominated contacts. Neither party is required by these Terms to use mandatory arbitration or prevented from seeking urgent court protection or exercising a statutory right. Mediation can be used if both parties agree.

7.3. If mandatory consumer complaint rules apply, we will provide the information those rules require about alternative dispute resolution, meaning an independent process for settling a complaint outside court. We will state whether participation is required or agreed.

7.4. Clause 3.6 governs court proceedings. Complaints do not suspend applicable legal time limits unless the parties expressly agree otherwise or law provides otherwise.

7.5. Survival. Ending the agreement does not affect accrued rights or obligations. Clauses concerning intellectual property, Content rights needed for lawful retention, confidentiality, data protection, accrued payment and refund obligations, liability and disputes continue for as long as necessary to give them effect. A licence to confidential Content does not survive for unrelated use.

7.6. On termination, your right to start new paid work ends. We will explain the treatment of paid work already accepted, settle the balance under clause 6 and provide for return or deletion of customer personal information under Schedule 1. Revoking account access does not itself delete every service record or withdraw a public certificate. Any retention for legal duties must remain limited to what is necessary.

8. Business service role and structure

8.1. This Module applies to licensed tools, the dashboard, integrations and embedded Business journeys. The Customer chooses which tools to enable and the business rules, configuration and data supplied to them. PCIFIC supplies the tools; the Customer remains responsible for its own products, customer contracts and commercial decisions.

8.2. Your Order and enabled account features determine access. A demonstration or test key is not permission for unrestricted production use. Test results and demo certificates must not be presented as live verification records.

9. Integration and account responsibilities

9.1. Follow the supported integration instructions, keep server credentials out of public browser code and use scoped or short-lived credentials where an embedded feature requires them. You are responsible for your own website's security, user notices, permissions and accurate presentation of returned results.

9.2. Supply Content and configuration in the documented form and preserve material warnings, sources, dates and limitations when presenting Outputs. Do not misrepresent a check on supplied evidence as a physical inspection or independent guarantee.

9.3. Your administrators may manage shared resources and colleague access within their permissions. Removing a colleague's workspace membership is different from deleting that person's account. Changes to ownership, shared resources and deletion must be made by an authorised person.

10. Permitted commercial use

10.1. Within your agreed licence, you may integrate enabled tools into your business systems, show appropriate Outputs to your customers, use supported embeds, and let coding tools request test keys through key link with the approval of a manager in your business. You may use generated drafts commercially after checking their accuracy and third-party rights.

10.2. You may not give another business unrestricted access under your credentials, sell raw PCIFIC access outside your licence or present PCIFIC's software as your property. Branding and any agreed attribution requirements are set by your Order and feature configuration; this clause does not impose an undisclosed attribution requirement.

11. Customer data and privacy choices

11.1. Choose an available privacy setting appropriate to the information you send. The Privacy Policy explains Operational only, Full monitoring, Customer-held logs and contractual True ZDR, meaning the agreed setting with no request-content logging. Basic usage and security records and separate feature records can still remain as disclosed.

11.2. Privacy changes apply to subsequent requests and do not automatically delete prior records. Full monitoring permits the disclosed quality assessment, not model training. PCIFIC does not use your customer requests to train models.

11.3. Customer-held logs require a master code held by your team. If you lose it, those logs are permanently unrecoverable through PCIFIC. A support code grants only the scoped, time-limited access it covers; revocation stops further use of that grant but does not undo a view already made or a lawful investigation record.

12. Your own AI provider and authorised applications

12.1. Where agreed, Bring Your Own lets PCIFIC connect your own OpenAI or Anthropic account at your request, under your own account and agreement with that provider. You are responsible for that account, its charges, lawful instructions and suitability. Your provider's retention and training terms may differ from PCIFIC's managed route, and our privacy labels do not override them.

12.2. A fallback to PCIFIC's managed model applies only where you explicitly enable it. Research and device-check services remain separate from your chosen model provider.

12.3. Approving a key for a coding tool or giving a key to another application allows it to use the tools and receive the information that key permits. Review its requested scope and revoke it when no longer needed. Its own processing is governed by the arrangements applicable to that application.

13. Embeds, capture and public records

13.1. An embedded journey operates using the business's selected branding and configuration. You must supply an appropriate customer notice and explain what is sent to PCIFIC and what is returned to your website. The website addresses allowed to use your embeds must be configured accurately.

13.2. A PixelTrace camera certificate deliberately creates a stored photographic record. Do not promise that camera images stay only on a phone.

13.3. Publishing a certificate permits access to its public record by anyone holding its code. Review photographs, backgrounds, labels and supplied links before publication. Only publish information you have the right and lawful grounds to disclose. Retraction and account deletion are different actions.

14. Releases, availability and support

14.1. Tool releases are identified versions of the tool's behaviour. Your selected release and account update policy determine which release your integration uses. A new release does not by itself authorise migration from a pinned release. Support periods, any required migration and notice are governed by your Order and the documented release process.

14.2. We may maintain or improve the Services and must address genuine legal or security risks. We will give reasonable notice of a material withdrawal affecting a paid integration where practicable, explain the available migration or ending arrangements and deal with unused purchased credits under clause 6. We do not promise indefinite availability of every provider, website or optional feature.

14.3. Guaranteed uptime, response times, service credits or dedicated support apply only if expressly agreed. Contact support@pcific.co.uk for ordinary support. The absence of a separate service-level agreement does not remove our contractual duties or obligation to use reasonable care and skill.

15. Closing or suspending the business service

15.1. You may stop making new requests and cancel an agreed recurring service under its disclosed cancellation process. Request account or business closure through support@pcific.co.uk; PCIFIC staff carry out the deletion and confirm when it is done. An expressly agreed fixed commitment remains subject to its lawful terms, but we may not invent a minimum term after purchase.

15.2. Suspension should be limited to what reasonably addresses its cause. Where it can safely be remedied, we will explain what is required for restoration. Unused paid credit, disputed charges, data access and return obligations are dealt with separately rather than automatically forfeited by suspension.

15.3. On closure, review any public certificates, exports, connected applications and your own stored copies. We will assist with return or deletion of customer personal information under Schedule 1. Keep any customer-held master code needed to open an export; PCIFIC cannot recover it for you.

16. Safeguard Module

16.1. Safeguard assesses the supplied listing evidence and returns informational signals, ratings, explanations or suggested questions. This Module covers the licensed Business tool, not the separate browser-extension subscription.

16.2. Outputs are informational only. They are not a guarantee, warranty or certification that a seller, listing or transaction is safe, genuine or free of risk. A listing that Safeguard does not flag may still carry risk, and a flagged listing may be legitimate. You remain responsible for the decisions you make and the way you explain a result to your customers.

16.3. The assessment is limited by the evidence supplied or lawfully obtained for the requested feature. Missing, false or outdated evidence can affect a result. A score does not establish criminal conduct, product authenticity, ownership or legal compliance. Third-party fraud is not insured by using this tool.

17. Orbit Module

17.1. Orbit assists with listing drafts using supplied product information, photographs, seller answers, configured fields and permitted research. It does not physically inspect goods or independently verify every seller statement.

17.2. Check descriptions, condition, specifications, compatibility, prices, safety statements and the rights to photographs before publication. Do not present generated wording as evidence that an item works or is genuine. You remain responsible for the listing even where a draft follows your configured format.

17.3. Research can be incomplete or outdated. You must have rights to submitted product information and documents. Full monitoring may compare the first draft with the final listing your integration reports for quality review, as disclosed in the Privacy Policy; it does not authorise model training.

18. Ask PCIFIC Module

18.1. Ask PCIFIC answers questions using the listing context, documents and other information made available for that request. You are responsible for supplying accurate, current and authorised source material, including your own returns, delivery and support policies.

18.2. Answers can be mistaken or incomplete. A missing answer is not confirmation that a right, restriction or product feature does not exist. Provide a suitable human support route for questions requiring judgement or correction. An AI answer cannot remove a customer's statutory rights or change an agreed sale contract.

18.3. Unanswered questions and request copies follow the selected privacy setting and the periods in the Privacy Policy. Choosing Customer-held logs does not by itself suppress the separately disclosed unanswered-question list; contractual True ZDR excludes that list. Chats are kept on every privacy setting while chat history is on, so turn chat history off if your business does not want them kept.

19. PixelTrace Module

19.1. Ordinary PixelTrace matching compares image fingerprints, meaning values used to recognise identical or similar photographs, within your workspace's registered photos. It does not establish who owns copyright, who took a photo, whether goods are genuine or whether a seller is dishonest. A missing match is not proof of originality.

19.2. The current matching service does not offer your registered fingerprints to other businesses or search their fingerprints for you. Camera certificates are separate public records: once published, anyone holding the certificate code can view its published photographs and details.

19.3. A camera certificate records the supported capture process and the evidence stated on the certificate. It does not prove ownership, physical condition beyond what is visible, authenticity, delivery or the absence of manipulation outside the checks actually performed. Present its date, status and limitations accurately.

19.4. You must have the right to submit and publish photographs and related listing references. Retract an inappropriate certificate promptly using the supported process or contact support. Retraction stops the public access controlled by PCIFIC; it cannot recall copies already lawfully or unlawfully made by others.

20. Checkup Module

20.1. Checkup is not yet available. When it is enabled, Checkup queries device information using the serial number or IMEI you supply. An IMEI is a number identifying a mobile device. External sources may return model, lock, blacklist, activation, warranty or related information.

20.2. Results reflect the source information available at the time of the check. They are not a physical inspection, proof of ownership, guarantee of authenticity, guarantee that a device is debt-free or promise that a later blacklist or status change cannot occur. Check that the identifier belongs to the actual device and present the result's date and limitations.

20.3. A live certificate's stated validity period does not mean that device status is continuously rechecked or that its record is deleted when it expires. Anyone holding its code can access the disclosed public verification record, including the masked identifier and relevant check details. Certificates from test checks must not be represented as live certificates.

1. Scope, roles and instructions

This schedule applies where PCIFIC processes personal information on the Customer's behalf. Applicable data protection law includes the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other data protection law applicable to that processing. Controller, processor, personal data and personal data breach have the meanings given by that law.

The Customer determines the lawful purposes and instructions, or acts with authority from its own controller. PCIFIC processes only on documented instructions, including the agreed Order, enabled tool requests and privacy configuration, unless law requires otherwise. We will tell you about a legal requirement before processing unless law prohibits that notice, and immediately inform you if an instruction appears to infringe applicable data protection law.

2. Processing details

The subject matter is the supply of the Customer's selected PCIFIC tools and related support. Processing lasts for the service period and the limited return, deletion and lawful retention period afterwards. Operations can include receiving, organising, storing, encrypting, retrieving, analysing, generating, transmitting, publishing as expressly instructed, exporting and deleting information.

The purposes are providing requested tool results and integrations, operating the selected retention and support controls and fulfilling the Customer's lawful instructions. People concerned may include the Customer's authorised users, staff, sellers, buyers, support contacts and other people whose information the Customer lawfully supplies.

Information can include identifiers and contact details, listing and product data, photographs, device identifiers, questions, documents, generated results and related references. Ordinary processing excludes special category information, criminal-offence information and children's personal information unless expressly agreed with appropriate safeguards. No clause in this schedule permits unrelated marketing or model training on customer requests.

3. Customer obligations

The Customer must provide lawful and sufficiently clear instructions, appropriate privacy information, a valid legal basis and any required permissions. It must minimise submitted information, select suitable access and retention settings and notify PCIFIC of a correction, restriction or deletion instruction affecting the processing. This does not transfer PCIFIC's own statutory responsibilities to the Customer.

4. Confidentiality and security

PCIFIC will ensure that people authorised to process customer personal information are bound by confidentiality. We will maintain appropriate technical and organisational security measures proportionate to the processing and its risks, including access restrictions, secure connections, protected credentials, account verification and relevant audit records. We will assess and review security measures and the ability to restore availability after an incident. No security measure is a guarantee against every attack or loss.

Customer-held logs are encrypted using the disclosed customer-controlled arrangement. A support code gives access only to the requests, scope and period it covers. We cannot reset a lost master code or recover information never retained. Ordinary encrypted content logs, public certificates and operational records are distinct stores with distinct access and retention rules.

5. Providers processing on our behalf

A sub-processor is a provider PCIFIC appoints to process your personal information on our behalf. Subject to this schedule, the Customer gives general written authorisation for the providers needed for its selected Services. The initial provider list below must be read with the applicable service, data categories and transfer arrangements; optional providers do not all receive every request.

Before adding or replacing a sub-processor affecting your customer personal information, we will give reasonable advance written notice, normally at least 30 days, identifying the provider and processing. You may object on reasonable data protection grounds. We will try to resolve the objection, offer a suitable alternative or allow the affected service to end with return or deletion and any applicable unused-credit refund. We will not treat silence as authorisation for unrelated purposes.

We will impose written data protection obligations offering equivalent protection for the relevant processing, assess sufficient guarantees and remain responsible to you for the sub-processor's performance of those obligations. An independent controller must instead have its actual role and lawful disclosure explained; a provider's own terms do not automatically displace our obligations.

6. Initial provider list and information involved

DigitalOcean: hosting and databases, including stored account, configuration and tool records needed for the service. OpenRouter and the hosts it selects for models made by Anthropic, OpenAI, Z.ai and DeepSeek, including Microsoft Azure for OpenAI models: task content needed for managed AI inference. Cerebras: task content, including photos, for Ultra Fast requests. Cloudflare R2: storage of tool and PixelTrace photos. Provider availability and the route actually selected determine the recipient.

Cloudflare using Exa, and websites read for research: the search terms written for the task and the page requests needed for enabled research. IMEI.org: device identifiers and information needed for an enabled device check. Resend: recipient details and transactional email content. Only disclose customer personal information to a research service where necessary and covered by lawful instructions.

The Customer's own connected AI provider and externally authorised applications are subject to the Customer's arrangements and their actual processing roles. Consent-based Google Analytics concerns website measurement; it is not a recipient of ordinary tool Content. Provider-specific data and international transfer details must be available for the applicable service before personal information is sent.

7. International transfers

PCIFIC must not make a restricted international transfer without the Customer's documented instructions or authority and a lawful transfer mechanism. Where required, this includes an applicable adequacy decision, the UK International Data Transfer Agreement or UK addendum to appropriate European clauses, and any necessary transfer assessment and supplementary measures. European requirements apply where relevant.

London database hosting does not mean all processing takes place in the UK; managed AI endpoints and other providers may process abroad. We will provide the applicable recipient, destination and safeguard information on request, subject to necessary confidentiality and security redactions. A general data processing agreement alone is not a transfer mechanism.

8. Personal information rights and assistance

Taking account of the processing, PCIFIC will assist the Customer through appropriate technical and organisational measures with lawful requests for access, correction, deletion, restriction, objection and portability. We will promptly forward a request concerning information processed on your behalf and not respond on your behalf unless authorised or legally required. We may respond separately to a request concerning information for which we are the controller.

Taking account of the processing and available information, we will assist with security obligations, breach notifications, data protection impact assessments and prior consultation with a regulator. A data protection impact assessment is a review of risks to people and safeguards for higher-risk processing.

9. Personal data breaches

PCIFIC will notify the Customer without undue delay after becoming aware of a personal data breach affecting information processed on its behalf. We will provide available information about its nature, affected people and records, likely consequences, containment, remedial steps and a contact for follow-up. Information may be supplied in stages as it becomes available. We will cooperate with the Customer's investigation and legal notifications; this does not postpone a notification required without undue delay.

10. Return, deletion and retention

At the Customer's choice, PCIFIC will return or delete personal information processed on its behalf when the relevant service ends, and delete existing copies unless law requires retention. We will provide a practicable export route or reasonable assistance, then confirm the return or deletion process and its timing. You must retain your own master code where it is needed to unlock a customer-held export.

Ordinary request records, content logs and temporary work follow the disclosed retention schedule during service. Public certificates, device-check records, Ask PCIFIC documents and photo fingerprints require their own applicable deletion or retraction instructions. They are not exempt from this schedule merely because a different technical store holds them.

Any residual backup copy must be protected, excluded from ordinary use and deleted under a defined backup cycle. If restored, outstanding deletion instructions must be reapplied. Where law requires retention, PCIFIC will explain the applicable requirement where lawful, restrict further processing and retain only what is necessary. A privacy notice does not authorise indefinite retention.

11. Information, audits and inspections

PCIFIC will make available the information needed to demonstrate compliance with this schedule and allow and contribute to audits and inspections by the Customer or its authorised independent auditor. Reasonable arrangements for notice, confidentiality, scope and security may protect other customers but must not prevent an effective audit or urgent action required by law or a material incident.

12. End of instructions and priority

If lawful processing cannot continue, the parties will work promptly to correct the instructions, suspend the affected processing or end the affected service. PCIFIC must not continue unlawful processing merely because an Order says otherwise. This schedule prevails over a conflicting general term on processing customer personal information; it does not restrict a regulator's powers or an individual's statutory rights.

For service, billing, privacy or contractual questions, email support@pcific.co.uk. Write to PCIFIC Marketplaces Limited, 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.