Pilot Access Agreement

Parties

(1) The Togethr Project Ltd, a company incorporated in England and Wales (Company No. 13246480) whose registered office is at 64 Cambridge Avenue, New Malden, Surrey, KT3 4LF (Togethr or Provider), trading as Faro;

and

(2) The Agency registering for the Pilot Programme via the Faro platform (Agency or Client).

Each a “Party” and together the “Parties.”

Background

(A) Togethr has developed Faro, an AI-powered operations platform for estate agencies that provides email triage, lead management, sales progression tracking, and related services.

(B) The Agency wishes to evaluate the Platform during a pilot period to assess its suitability for the Agency's operations.

(C) This Agreement sets out the terms on which Togethr will provide pilot access to the Platform, including data protection obligations.

1. Definitions and Interpretation

“Account Data” means the Agency's account information (names, email addresses, roles, login credentials) and billing data (Stripe customer ID, subscription status) held by Togethr for platform administration.

“Agency Data” means all personal data and other data processed by the Platform on behalf of the Agency, including but not limited to email content, lead data, property records, transaction data, and documents uploaded via the Platform. For the avoidance of doubt, Agency Data does not include Account Data.

“AI Features” means the artificial intelligence capabilities of the Platform, including email triage, lead extraction, property matching, email draft generation, and any other features that use large language models to process data.

“Confidential Information” means any information disclosed by one Party to the other in connection with this Agreement that is marked as confidential or that a reasonable person would consider confidential given its nature and the circumstances of disclosure. Agency Data is always Confidential Information.

“DPA” means the Data Processing Agreement set out in Schedule 1.

“Data Protection Legislation” means the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018; the EU General Data Protection Regulation (Regulation (EU) 2016/679) as applicable in France (RGPD); and any successor legislation, together with any binding guidance issued by the ICO or CNIL.

“Permitted Users” means the Agency's employees and authorised representatives who are granted access to the Platform, up to the number of user seats specified in Schedule 3.

“Pilot Period” means 90 days commencing on the Activation Date specified in Schedule 3.

“Platform” means the Faro software-as-a-service platform, accessible at yourfaro.io, including all modules made available to the Agency during the Pilot Period as specified in Schedule 3.

2. Grant of Access

2.1. Togethr grants the Agency a non-exclusive, non-transferable, revocable right to access and use the Platform during the Pilot Period, solely for the purpose of evaluating the Platform for the Agency's estate agency operations.

2.2. Access is provided free of charge during the Pilot Period. No subscription fees are payable until and unless the Agency elects to convert to a paid subscription in accordance with clause 12.

2.3. Togethr may update or modify the Platform during the Pilot Period. Togethr will provide reasonable notice of any material changes that affect the Agency's use of the Platform.

2.4. This Agreement supersedes the standard Terms of Use published at yourfaro.io/terms for the duration of the Pilot Period. Where this Agreement is silent on a matter addressed in the Terms of Use, the Terms of Use apply.

3. Agency Obligations

3.1. The Agency shall:

• (a) provide accurate and complete account information at registration and keep it up to date;
• (b) ensure that all Permitted Users comply with the terms of this Agreement and the acceptable use provisions in the Terms of Use;
• (c) update its privacy notice to disclose the use of Faro as a data processor and the use of AI Features to process personal data, prior to connecting any email account to the Platform. A template paragraph is provided in Schedule 4;
• (d) maintain a lawful basis under Data Protection Legislation for the processing of personal data through the Platform;
• (e) not use the Platform for any unlawful purpose or in any way that could damage, disable, or impair the Platform;
• (f) provide reasonable cooperation for integration setup, including authorisation of Gmail API and/or CRM API connections;
• (g) designate a primary contact for communications under this Agreement.

3.2. The Agency acknowledges that AI Features generate suggestions and draft content only. The Agency retains full responsibility for reviewing, editing, and approving any AI-generated content before it is sent to third parties.

3.3. If the Agency enables auto-send mode for any AI Feature, the Agency accepts full responsibility for all communications sent automatically on its behalf and for compliance with applicable transparency obligations under the EU AI Act and Data Protection Legislation.

4. Togethr Obligations

4.1. Togethr shall:

• (a) provide the Platform substantially as described in the service documentation;
• (b) maintain reasonable technical and organisational security measures in accordance with the DPA;
• (c) process Agency Data only in accordance with the DPA (Schedule 1) and the Agency's documented instructions;
• (d) notify the Agency of any material service changes with not less than 14 days' notice;
• (e) provide reasonable support during the Pilot Period via email (nigel@yourfaro.io) during UK business hours (Monday to Friday, 9am to 5pm GMT/BST);
• (f) not use Agency Data for any purpose other than providing and improving the Platform, and not share Agency Data with any third party except sub-processors listed in Schedule 2.

4.2. The Pilot Period is provided on a best-effort basis. Togethr does not guarantee uptime, response times, or service levels during the pilot. Reasonable efforts will be made to maintain availability, but planned and unplanned downtime may occur.

5. AI Processing

5.1. The Platform uses large language models provided by Anthropic (Claude API) and, where applicable, OpenAI (GPT API) to process Agency Data for the purposes described in the service documentation.

5.2. When an AI Feature is used, the minimum data necessary for the specific task is sent to the AI provider for processing. AI providers process data transiently and do not retain input or output data beyond the API request lifecycle.

5.3. AI providers do not use Agency Data for model training without the Agency's separate, explicit opt-in. No such opt-in is requested or enabled by default.

5.4. AI-generated content is provided as suggestions only. Togethr does not warrant that AI-generated content will be accurate, complete, legally compliant, or suitable for any particular purpose. The Agency is responsible for reviewing all AI-generated content before use.

5.5. Details of AI sub-processors, data transfers, and safeguards are set out in the DPA (Schedule 1) and the sub-processor list (Schedule 2).

6. Intellectual Property

6.1. Togethr retains all intellectual property rights in the Platform, including its software, design, algorithms, and documentation.

6.2. The Agency retains all intellectual property rights in Agency Data, including property listings, client records, and documents uploaded to the Platform.

6.3. Intellectual property in AI-generated content (including email drafts and property descriptions) vests in the Agency upon generation.

6.4. Neither Party acquires any rights in the other Party's pre-existing intellectual property by virtue of this Agreement.

6.5. The Agency grants Togethr a non-exclusive, royalty-free licence to use feedback, suggestions, and enhancement requests provided by the Agency for the purpose of improving the Platform. This licence survives termination of this Agreement.

7. Confidentiality

7.1. Each Party shall keep the other Party's Confidential Information confidential and shall not disclose it to any third party without the prior written consent of the disclosing Party.

7.2. The obligations in clause 7.1 do not apply to information that: (a) is or becomes publicly available through no fault of the receiving Party; (b) was already known to the receiving Party prior to disclosure; (c) is independently developed by the receiving Party; or (d) is required to be disclosed by law, regulation, or order of a court or regulatory authority.

7.3. The obligations in this clause survive termination of this Agreement for a period of three (3) years.

8. Data Protection

8.1. The Parties acknowledge that: (a) the Agency is the data controller for Agency Data; and (b) Togethr is the data processor, processing Agency Data on behalf of the Agency in accordance with the DPA.

8.2. The processing of Agency Data shall be governed by the DPA set out in Schedule 1.

8.3. The Agency warrants that it has a lawful basis under Data Protection Legislation for the processing of personal data through the Platform, and that it has updated its privacy notice in accordance with clause 3.1(c).

8.4. In the event of a personal data breach affecting Agency Data, Togethr shall notify the Agency without undue delay and in any event within 48 hours of becoming aware of the breach.

8.5. The Agency may request a copy of all Agency Data in a machine-readable format at any time during the Pilot Period. Togethr shall provide the export within 10 business days of receiving the request.

9. Limitation of Liability

9.1. Togethr's total aggregate liability to the Agency under or in connection with this Agreement, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, shall not exceed £5,000 (five thousand pounds sterling).

9.2. Neither Party shall be liable to the other for any indirect, consequential, special, or incidental loss or damage, including but not limited to loss of profit, loss of revenue, loss of data (beyond the obligations to maintain backups), or loss of business opportunity.

9.3. Nothing in this Agreement shall limit or exclude either Party's liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; (c) any liability which cannot be limited or excluded by applicable law; or (d) a breach of the DPA resulting in a personal data breach.

10. Warranties and Disclaimers

10.1. Togethr warrants that: (a) it has the right to enter into this Agreement and to grant the rights granted herein; (b) it will comply with all applicable laws, including Data Protection Legislation, in its provision of the Platform; (c) the security measures described in the DPA are accurate and are implemented in practice.

10.2. The Agency warrants that: (a) it has the right to enter into this Agreement and to provide Agency Data for processing; (b) it has a lawful basis for the processing of personal data through the Platform; (c) all information provided at registration is accurate and complete.

10.3. The Platform is provided during the Pilot Period on an “as is” and “as available” basis for evaluation purposes. Except as expressly stated in this Agreement, Togethr makes no representations or warranties of any kind, whether express, implied, statutory, or otherwise.

10.4. Togethr does not warrant that AI-generated content will be accurate, complete, legally compliant, or suitable for any purpose. The Agency is solely responsible for reviewing and approving all AI output.

11. Term and Termination

11.1. This Agreement commences on the date of electronic acceptance and the Pilot Period begins on the Activation Date. The Agreement continues for the duration of the Pilot Period unless terminated earlier in accordance with this clause.

11.2. Either Party may terminate this Agreement by giving not less than 14 days' written notice to the other Party.

11.3. Either Party may terminate this Agreement immediately by written notice if the other Party: (a) commits a material breach of this Agreement which is not remediable or, if remediable, is not remedied within 14 days of written notice; or (b) becomes insolvent, enters administration, or ceases trading.

11.4. On termination: (a) the Agency's access to the Platform will be suspended immediately; (b) Togethr shall retain Agency Data for 90 days following termination to allow export; (c) after the 90-day retention period, Togethr shall permanently delete all Agency Data and provide confirmation; (d) clauses that by their nature should survive termination (including confidentiality, data protection, and limitation of liability) shall survive.

12. Post-Pilot Conversion

12.1. At or before the end of the Pilot Period, the Agency may elect to convert to a paid subscription. Conversion is entirely optional and there is no automatic renewal from pilot to subscription.

12.2. If the Agency elects to convert, subscription terms (including pricing) will be set out in a separate subscription agreement or amendment to this Agreement.

12.3. If the Agency converts to a paid subscription, Agency Data shall carry over seamlessly. There is no data migration charge.

12.4. If the Agency does not convert, the standard termination and data deletion provisions in clause 11.4 apply.

13. Governing Law and Jurisdiction

For UK Agencies:

13.1. This Agreement and any dispute or claim arising out of or in connection with it shall be governed by and construed in accordance with the laws of England and Wales.

13.2. The Parties submit to the exclusive jurisdiction of the courts of England and Wales for the resolution of any dispute.

For French Agencies:

13.3. This Agreement and any dispute or claim arising out of or in connection with it shall be governed by and construed in accordance with French law.

13.4. The Parties submit to the exclusive jurisdiction of the Tribunal de Commerce de Paris for the resolution of any dispute.

14. General Provisions

14.1. This Agreement, together with its Schedules, constitutes the entire agreement between the Parties in relation to its subject matter and supersedes all prior agreements, understandings, and arrangements.

14.2. No variation of this Agreement shall be effective unless made in writing and agreed by both Parties.

14.3. Neither Party may assign or transfer its rights under this Agreement without the prior written consent of the other Party, except that Togethr may assign this Agreement to a successor entity in the event of a merger, acquisition, or sale of substantially all of its assets.

Schedule 1: Data Processing Agreement (DPA)

1. Scope and Purpose

This DPA forms part of the Pilot Access Agreement and governs the processing of Agency Data by Togethr on behalf of the Agency.

2. Processing Details

Nature and purpose of processing: Provision of AI-powered email triage, lead management, sales progression, seller onboarding, and property listing services.

Categories of data subjects: The Agency's clients, prospective buyers, sellers, tenants, landlords, solicitors, and other parties whose data is processed through the Platform.

Types of personal data: Names, email addresses, telephone numbers, postal addresses, property details, financial information (budgets, sale prices), search criteria, transaction status, and documents (ID, proof of funds, property forms).

Duration of processing: For the duration of the Pilot Period plus 90 days for data retention/deletion.

3. Processor Obligations

Togethr shall: process Agency Data only on documented instructions from the Agency; ensure persons authorised to process data are bound by confidentiality; implement appropriate technical and organisational security measures; assist the Agency in responding to data subject requests; and assist with breach notification, impact assessments, and prior consultation.

On termination, Togethr shall delete or return all Agency Data (at the Agency's choice) and confirm deletion within 10 business days.

4. Sub-Processors

Togethr shall not engage another sub-processor without the Agency's prior general written authorisation. Current sub-processors are listed in Schedule 2. Changes will be notified with 30 days' notice.

5. International Transfers

Agency Data is stored in the EU (Supabase, AWS Frankfurt region). Transient processing via AI API calls to Anthropic (US) and OpenAI (US) is governed by Standard Contractual Clauses (EU) and the UK IDTA. A Transfer Impact Assessment is available on request.

6. Security Measures

• Encryption in transit: TLS 1.2+ on all connections
• Encryption at rest: AES-256 (Supabase/AWS)
• Access control: Row Level Security (RLS) enforced on every database table
• Authentication: bcrypt password hashing, JWT sessions (1-hour expiry), rate-limited login
• Tenant isolation: RLS enforced at database level; cross-tenant access technically impossible
• OAuth token security: encrypted at rest; deleted on disconnection
• API security: rate limiting, input validation, authenticated cron endpoints
• Infrastructure: Vercel Pro (EU region), Supabase Pro (EU region)

Schedule 2: Sub-Processor List

Schedule 3: Service Description and Pilot Details

Activation Date: The date on which the Agency accepts this Agreement via the Faro platform.

Pilot Period: 90 days from the Activation Date.

Support Contact: nigel@yourfaro.io

Modules available during pilot:

• Module 1: Lead & Email Assistant (email triage, lead extraction, property matching, draft replies, automated follow-ups)
• Module 2: Sales Progression Tracker (deal cards, timelines, document checklists, deadline alerts)
• Module 3: Seller Onboarding (branded upload portal, smart checklists, auto-reminders, progress tracking)
• Module 4: Listing Assistant (voice-to-listing, transcription, data extraction, EN/FR translation)

Schedule 4: Privacy Notice Template Paragraph

The Agency shall add the following paragraph (or substantially similar wording) to its privacy notice prior to connecting an email account to the Platform.

English Version

French Version