Schedule_A_Website_Terms

INNERMEDIA LIMITED

Schedule A Website Project Terms

Website Design, Development & Hosting — Service Terms and Conditions

Version 4.0 | May 2026

Classification: Commercial — Client Facing

Owner: Board of Directors, InnerMedia Limited

Review Cycle: Annual or following material changes to services or legislation

1. Scope of Schedule A

1.1 This Schedule governs the provision of website design, development, hosting, maintenance and related services by the Supplier to the Client as specified in the Project Plan (Schedule B).

1.2 The services provided are detailed in the Quote

2. Definitions

In addition to the definitions in the Master Terms, the following apply in this Schedule:

3. Client Responsibilities for Website Projects

3.1 The Client’s timely participation is essential to maintaining the Project schedule. The Client shall:

• Attend all scheduled meetings and workshops within the timescales set out in the Project Plan;
• Provide all content, images, copy, brand assets and other Materials on or before the dates stated in the Project Plan;
• Provide a single authorised point of contact with decision-making authority for design and content approvals;
• Respond to design sign-off requests, snagging reviews and acceptance notifications within the timescales specified in the Project Plan;
• Ensure that all stakeholders who need to approve the Site are made available during the designated review periods.

3.2 Time is of the essence in relation to the Client’s obligations in clause 3.1. Where the Client fails to meet its obligations, the Supplier may invoke the Project Hold provisions in clause 7.

4. Development Phases

4.1 The Supplier shall design, develop and deliver the Site in Phases as set out in the Project Plan. Standard Phases include:

• Phase 1 — Brand Workshop, Wireframe Development & Page Navigation (requires Client sign-off);
• Phase 2 — Visual Design (UX/UI), including Home Page, Inner Pages, Mobile, Menu and Alerts (requires Client sign-off);
• Phase 3 — Website Build, Internal QA Checks, and 1st View (Home, Inner Pages, Navigation, Sample Page);
• Phase 4 — Snagging Rounds (see clause 6), Content Population, and Go Live Process.

4.2 Once designs are signed off, the Supplier will provide an updated go-live timeline, typically nine (9) weeks from design sign-off. This timeline is conditional on the Client meeting its obligations in clause 3.

5. Acceptance

5.1 Acceptance of the Site shall occur when the Client notifies the Supplier in writing that the Site has passed the Acceptance Tests as described in the Project Plan.

5.2 Acceptance shall be deemed to have taken place (even in the absence of formal Client sign-off) upon the earliest of:

• The Client using any part of the Site for live, revenue-earning or public-facing purposes;
• The Client unreasonably delaying the commencement of Acceptance Tests by more than seven (7) Business Days after the Supplier notifies readiness; or
• Fourteen (14) days elapsing from the Client’s request for the Site to go live.

5.3 If any failure to pass the Acceptance Tests is caused by a Non-Supplier Defect (i.e. caused by the Client, its agents, or third-party content), the Site shall be deemed to have passed. The Supplier may remedy such defects at its standard day rate.

6. Snagging Process

6.1 Snagging Round 1 — Project Lead Review. Following the 1st View of the built Site, the Client’s nominated Project Lead shall review the Site and submit a consolidated list of required corrections. The Supplier will address all valid technical and design issues raised.

6.2 Snagging Round 2 — Stakeholder Sign-Off. Following completion of Round 1 corrections, the Client may circulate the Site to its wider stakeholders (e.g. leadership team, board, marketing team) for final review. A consolidated list of corrections shall be submitted to the Supplier. The Supplier will address all valid issues and prepare the Site for go live.

6.3 Both Snagging Rounds must be conducted within the timescales set out in the Project Plan. Where the Client exceeds these timescales, the Project Hold provisions in clause 7 may apply.

6.4 Snagging corrections must be submitted as a single consolidated document per round. The Supplier is not obliged to action piecemeal or sequential lists between submission dates.

6.5 Any request for a third snagging review, additional design changes after Round 2 sign-off, or scope changes after design sign-off shall be treated as a change to the Project scope and will be charged at the Supplier’s day rate of £750 + VAT per day.

7. Project Hold and Re-initiation

7.1 The Supplier may place the Project on hold (Project Hold) if the Client fails to:

• Provide required Materials, approvals or sign-offs within Thirty (30) Business Days of the date specified in the Project Plan;
• Provide materials and respond to a formal written reminder from the Supplier, requesting action to progress, within a further five (5) Business Days; or
• Meet any other deadline identified in the Project Plan as a Client dependency.

7.2 Before invoking a Project Hold, the Supplier shall send a written notice to the Client’s nominated contact (copied to a Director or equivalent) stating the specific outstanding obligation(s), the deadline for compliance, and the consequences of non-compliance.

7.3 If the Client fails to remedy the default within the notice period, the Supplier may:

• Formally place the Project on hold by written notice;
• Invoice the Client for all remaining project instalments as set out in the Project Plan (which shall become immediately due and payable as a legitimate cost incurred by the Supplier in reserving capacity);
• Commence the monthly hosting and SLA charges as set out in this Schedule, as the Supplier will be holding the part-built Site and associated resources on behalf of the Client; and
• Release the Project slot in the Supplier’s workflow for reallocation to other clients.

7.4 The Site and all work completed to date will be preserved by the Supplier for a period of twelve (12) months from the Project Hold date.

7.5 To restart a Project following a Project Hold, the Client must:

• Pay all outstanding invoices in full (including any invoices issued under clause 7.3);
• Pay the Re-initiation Fee of £1250 + VAT; and
• Confirm in writing its readiness to meet all future Project Plan obligations.

7.6 On receipt of the above, the Supplier will allocate the Project to the nearest available slot in its workflow and provide a revised Project Plan. Due to scheduling constraints, the Supplier cannot guarantee any specific restart date.

7.7 If the Client does not restart the Project within twelve (12) months of the Project Hold date, the Supplier may treat the Agreement as terminated by the Client for convenience. All invoices issued under clause 7.3 shall remain payable. The Supplier shall retain all completed work but is under no obligation to deliver it.

8. Hosting and Ongoing Services

8.1 Following Go Live (or the commencement of hosting under clause 7.3), the Client shall pay the monthly ongoing charges set out in this Schedule, payable by direct debit monthly in advance or annually in advance (September to August).

8.2 Monthly ongoing services may include (as specified in the Quotation): website hosting, service level agreement (SLA) support, SSL certificate, speed accelerator, GDPR policy management, and CMS group management.

8.3 Hosting services are subject to Schedule C (SLA), which sets out the Supplier’s service level commitments and escalation procedures.

9. Charges and Payment

9.1 Project payments shall be made in instalments as set out in the Project Plan, due on the earlier of the specified milestone date or the number of weeks from the Effective Date stated in the Project Plan:

9.2 For Project Extras, separate payment terms are set out in the relevant Change Request.

9.3 The Supplier reserves the right to adjust payment schedules if the Client causes delays that affect the Project Plan timetable.

10. Intellectual Property

10.1 Subject to payment of all Charges, the Supplier shall assign to the Client all bespoke IPR in the Site design and content upon the Go Live Date.

10.2 The Supplier retains all IPR in its pre-built CMS, proprietary frameworks, templates and tooling. These are licensed (not assigned) to the Client on the terms of the Master Agreement.

10.3 On termination: due to the competitive sensitivity of the Supplier’s modified CMS, it cannot be transferred to a direct competitor. If the Client migrates to a direct competitor, the Supplier will provide a quotation to produce a portable version of the Site with proprietary components removed.

11. Warranty

11.1 The Supplier warrants that the Site will perform materially in accordance with the Site Specification for twelve (12) months from Acceptance. Defects must be reported in writing within thirty (30) days of discovery. The Supplier shall remedy confirmed defects at no charge within a reasonable period.

11.2 This warranty does not apply to defects caused by: Client-supplied content; unauthorised modifications; third-party plugins; or failure to follow the Supplier’s guidance.

12. Attribution

12.1 The Supplier may include a discreet link to the Supplier’s website (e.g. ‘Website by InnerMedia’) in the footer of the Site during the build and design phase. The Client may request removal of this link at any time.

Schedule_B_Project_Plan (v4.0 — May 2026)

INNERMEDIA LIMITED

Schedule B Project Plan

Website Design, Development & Hosting — Project Milestones and Responsibilities

Version 4.0 | May 2026 (process alignment update)

Classification: Commercial — Client Facing

Owner: Board of Directors, InnerMedia Limited

Review Cycle: Annual or following material changes to services or legislation

1. Project Details

All timings in this Schedule are expressed in weeks or Business Days relative to the Commencement Date. No date calculations or formula updates are required when this Schedule is issued — timings are fixed relative references that apply to every project.

2. How to Read This Plan

3. Client Dependencies and Project Hold

4. Project Milestones

5. Snagging — Included Rounds and Chargeable Extras

6. Payment Plan — Website Project

6.1 Standard Website Project

6.2 Project Extras

7. Schedule Notes

Schedule_C_SLA

INNERMEDIA LIMITED

Schedule C Service Level Agreement

Hosting, Support and Service Level Commitments

Version 4.0 | May 2026

Classification: Commercial — Client Facing

Owner: Board of Directors, InnerMedia Limited

Review Cycle: Annual or following material changes to services or legislation

1. Interpretation

1.1 The following definitions apply in this Schedule in addition to those in the Master Terms & Conditions:

1.2 All initially capitalised terms used in this Schedule but not defined above shall have the meaning given to them in the Master Terms & Conditions.

2. Support Services

2.1 During the Support Period, the Supplier shall perform the Support Services during Support Hours in accordance with the Service Levels.

2.2 As part of the Support Services, the Supplier shall:

• Provide Help Desk Support via telephone: 01707 875 721 and email: support@innermedia.co.uk;
• Use Commercially Reasonable Efforts to correct all Faults notified under clause 4.3(a); and
• Provide technical support for the Site or Software in accordance with the Service Levels.

2.3 The Supplier may reasonably determine that any services requested constitute Out-of-Scope Services. If it does so, it shall promptly notify the Client.

2.4 Where the Client requires Out-of-Scope Services, it shall complete the Emergency Support Form available at: https://www.innermedia.co.uk/emergency/

2.5 The Client acknowledges that the Supplier is not obliged to provide Out-of-Scope Services. If the Supplier does so, the Service Level response times shall apply and Support Fees shall be payable for such services.

3. Fees

3.1 The provision of Support Services on a remote, off-site basis (such as by telephone or email) within the Support Period shall be included within the Support Fees set out in the applicable Schedule.

3.2 The following shall be charged at the Support Fees rate in addition to any included allowance:

• Support Services provided outside Support Hours;
• Support Services provided at the Client’s site;
• Out-of-Scope Services; and
• Any investigational work where the investigation determines the cause to be a Client Cause.

3.3 The Supplier’s standard day rate for chargeable support and out-of-scope work is £750 + VAT per day (or pro-rata for shorter periods), unless otherwise agreed in writing.

4. Submitting Support Requests

4.1 The Client may request Support Services by submitting a Support Request via the channels specified in clause 2.2.

4.2 Each Support Request shall include:

• A clear description of the problem or Fault;
• The date and time the issue was first identified;
• The severity level (if known) based on the Service Level Table; and
• Any error messages, screenshots or other information reasonably useful to the Supplier.

4.3 The Client shall provide the Supplier with:

• Prompt notice of any Faults; and
• Such output, data, Materials, information, assistance and (subject to the Client’s security requirements) remote access to the Client’s systems as are reasonably necessary to assist the Supplier in reproducing the fault conditions and responding to the Support Request.

4.4 All Support Services shall be provided remotely from the Supplier’s offices unless otherwise agreed in writing.

4.5 The Client acknowledges that, to properly assess and resolve certain Support Requests, it may be necessary for the Supplier to access the Client’s systems directly. The Client shall provide such access promptly, provided the Supplier complies with the Client’s reasonable security requirements and relevant policies.

5. Service Levels

5.1 The Supplier shall prioritise all Support Requests based on a reasonable assessment of the severity level of the problem reported and shall respond in accordance with the following Service Level Table:

5.2 The parties may, on a case-by-case basis, agree in writing to a reasonable extension of the Service Level response times where the nature or complexity of the Fault reasonably requires it.

5.3 The Supplier shall provide the Client with regular updates on the nature and status of its efforts to correct any Fault until a Solution is delivered.

5.4 Hosting Uptime Guarantee

5.5 Scheduled maintenance windows will be communicated to the Client with not less than 48 hours’ notice wherever reasonably practicable. Scheduled maintenance shall not count against the uptime guarantee.

5.6 The uptime guarantee does not apply where unavailability is caused by: (a) a Client Cause; (b) a third-party provider failure outside the Supplier’s reasonable control (such as upstream internet connectivity); or (c) force majeure events as defined in the Master Terms.

6. Escalation

6.1 If a Solution is not provided within the applicable Service Level response time, the Client may escalate the Support Request through the following process:

6.2 The Supplier shall acknowledge all escalations within 2 working hours and provide a written update on the resolution plan.

7. Transfer and Termination

7.1 In the event of termination of the Agreement or the Hosting Services, the Supplier will (on request) provide the Client with:

• A copy of all website files and databases;
• A copy of the project file including all design files, images, CSS, technical templates and other files supplied during the course of the project; and
• Reasonable assistance to facilitate a smooth transition to an alternative provider, charged at the Supplier’s standard day rate (£750 + VAT per day).

7.2 All files and materials referred to in clause 7.1 will only be released once all outstanding invoices have been paid in full and any reasonably disputed charges have been settled between the parties.

7.3 The Hosting Services are subject to a minimum three (3) months’ notice period as set out in the Master Terms. To ensure continuity of service following notification of termination, the Supplier will continue to host the Site for as long as the Client requires, subject to payment of the agreed Hosting Fees.

7.4 If the Client wishes to transfer the Site to an alternative provider before the expiry of the three-month notice period, it may do so on payment of the equivalent of three months’ Hosting Fees, which shall cover:

• Hosting services for the three-month notice period;
• A server backup; and
• The collation and supply of all website files and databases.

7.5 If the project is terminated before the website goes live, for any reason, all sums due for time consumed on the project plus any uninvoiced expenses shall become immediately due and payable.

8. Limitation of Liability

8.1 The Supplier’s liability for failure to meet the Service Levels is limited to the service credits set out in clause 5.4. These credits represent the Client’s sole and exclusive remedy for any breach of the hosting uptime guarantee.

8.2 In all other respects, the liability provisions in the Master Terms & Conditions clause 8 shall apply to this Schedule.

Schedule_D_AI_Terms

INNERMEDIA LIMITED

Schedule D AI Product Terms

AI Products & Services — Service Terms and Conditions

Version 4.0 | May 2026

Classification: Commercial — Client Facing

Owner: Board of Directors, InnerMedia Limited

Review Cycle: Annual or following material changes to services or legislation

1. Scope

1.1 This Schedule governs the provision of InnerMedia’s suite of AI-powered products and services, including in imHUB, and any future AI-based tools developed by the Supplier.

1.2 The services provided are detailed in the Quote

2. Definitions

3. AI Product Delivery

3.1 The Supplier shall configure, integrate and deliver the AI Products as set out in the Quotation

3.2 Acceptance of the AI Product shall occur when it passes the KDQ Acceptance Tests or is deemed accepted under clause 3.3.

3.3 Acceptance is deemed to have occurred upon the earliest of: (a) the Client using the AI Product for live, customer-facing or operational purposes; (b) the Client delaying Acceptance Tests by more than seven (7) Business Days after notification of readiness; or (c) fourteen (14) days after the Client’s request for the AI Product to go live.

3.4 If the AI Product fails Acceptance Tests due to incorrect or incomplete Client Data, unsuitable inputs, or Client/agent actions (Non-Supplier Defects), the AI Product shall be deemed to have passed. The Supplier may assist in remedying Non-Supplier Defects at its standard day rate.

4. Warranties and AI Limitations

4.1 The Supplier warrants that the AI Product will operate materially in accordance with the specification during the Supplier’s management. If it does not, the Supplier will remedy confirmed defects at no additional charge.

4.2 This warranty does not apply where failures arise from Client Data, Client misuse, unauthorised modifications, or operation contrary to the Supplier’s instructions.

4.3 The Client acknowledges that AI technology is evolving and that the Supplier may update or improve the underlying AI Product from time to time. Where such updates materially alter the Client’s AI Configuration, the Supplier will provide thirty (30) days’ notice.

5. Data Protection and AI Processing

5.1 Roles

The Client is the Data Controller. The Supplier is the Data Processor. All processing of Personal Data by the Supplier is governed by the DPA.

5.2 Prohibition on AI Training with Client Data

5.2.1 The Supplier confirms that:

• All AI model inference runs on the Client’s AI Configuration are performed within the Client’s environment;
• Conversation logs and Client Data are logically isolated per client and are not accessible to other clients;
• No Client Data is used to improve the Supplier’s general AI capabilities or shared with any third party for model improvement purposes.

5.3 Sub-Processors

5.3.1 The Supplier uses the following approved Sub-Processors in connection with the AI Products. All Sub-Processors are contractually bound to process Personal Data only on the Supplier’s instructions and to maintain appropriate security standards:

5.3.2 The Supplier shall provide the Client with at least thirty (30) days’ written notice before engaging any new Sub-Processor or replacing an existing one. The Client may object to a new Sub-Processor on reasonable grounds within fourteen (14) days of notice. If the parties cannot agree, the Client may terminate the AI Product service on thirty (30) days’ notice without penalty.

5.4 Data Residency

5.4.1 All Client Data and Interaction Data is stored and processed exclusively within AWS UK or EU regions. No Personal Data is transferred outside the United Kingdom or the European Economic Area unless the Client provides prior written consent.

5.4.2 The use of Anthropic Claude via AWS Bedrock ensures that LLM inference occurs within the AWS environment without data being transmitted to Anthropic’s external systems.

5.5 Children’s Data

5.5.1 The Client warrants that it has obtained all necessary consents and has appropriate lawful bases for sharing any data relating to individuals under the age of 18 with the Supplier.

5.5.2 The Supplier shall not process data identifiable as relating to a child under 18 for any purpose other than the delivery of the specific AI Product configuration for that Client.

5.5.3 Interaction Data involving children shall be subject to a maximum retention period of three hundred and sixty (360) days, after which it will be automatically deleted from the Supplier’s systems, unless the Client instructs a shorter period.

5.5.4 The Client is responsible for ensuring that any AI Product used in contexts involving children complies with applicable safeguarding requirements, DfE guidance and the ICO’s Age Appropriate Design Code.

5.6 Interaction Data Retention

5.6.1 Interaction Data (conversation logs, End-User inputs and AI outputs) will be retained for a maximum of three hundred and sixty (360) days following the end of the applicable session, unless the Client requests a shorter period or extended retention for a specific operational purpose.

5.6.2 On termination, all Interaction Data will be deleted within Sixty (60) days of the termination date, unless the Client requests an export before deletion.

5.7 Security

5.7.1 The Supplier implements the following security measures in connection with AI Products:

• AES-256 encryption of data at rest within AWS;
• TLS 1.2 or higher encryption of data in transit;
• Logical isolation of each Client’s data and AI Configuration;
• Role-based access controls limiting Supplier personnel access to Client Data;
• Multi-factor authentication (MFA) for all internal systems accessing Client Data;
• Annual security review of AI infrastructure.

6. Client Data and Acceptable Use

6.1 The Client warrants that all Client Data: (a) does not infringe any applicable law or third-party rights; (b) does not contain inappropriate content; (c) is provided with a valid lawful basis under Data Protection Laws.

6.2 The Supplier does not monitor Client Data or AI outputs in real time, but shall notify the Client promptly if it becomes aware of any apparent legal issue or inappropriate content.

6.3 The Client shall indemnify the Supplier against all claims arising from: (a) Client Data constituting inappropriate content; or (b) alleged third-party IPR infringement arising from the Supplier’s use of Client Data.

6.4 The Client is responsible for publishing appropriate privacy notices to its End-Users explaining that AI is used to process their enquiries and that their interactions may be stored. The Supplier can provide template wording on request.

7. Charges and Payment

7.1 Charges shall be paid in accordance with the quotation

7.2 Ongoing subscription, hosting and AI runtime charges shall be collected by monthly direct debit in advance or annually in advance.

7.3 VAT invoices shall be issued accordingly. The Client shall pay each invoice within thirty (30) days of issue.

7.4 If Client-caused delays affect the Project timeline, the Supplier may revise the payment schedule accordingly.

8. Intellectual Property

8.1 All IPR in Client Data remains the property of the Client.

8.2 The Supplier retains all IPR in: (a) the AI Products; (b) all AI templates, pre-built models, system prompts and workflows; (c) the AI Configuration architecture and methodology.

8.3 Any custom AI Configuration created for the Client is licensed to the Client for their use only during the term of this Agreement. It shall not be assigned without the Supplier’s express written consent.

9. Consequences of Termination

9.1 On termination, all unpaid invoices become immediately due and payable.

9.2 Within thirty (30) days of payment of all outstanding sums, the Supplier shall: (a) return all Client Data in a structured, machine-readable format; (b) provide an export of any custom configuration or content created for the Client, excluding proprietary AI functionality; and (c) delete all Client Data from Supplier systems and confirm deletion in writing.

9.3 The prohibition on AI training in clause 5.2 survives termination indefinitely.

10. Attribution

10.1 Where AI Products are deployed in client-facing interfaces, the Supplier may include a discreet ‘Powered by InnerMedia’ attribution. The Client may request removal of this attribution at any time.

Data_Processing_Agreement

INNERMEDIA LIMITED

Data Processing Agreement

UK GDPR Article 28 — Processor Agreement

Version 4.0 | May 2026

Classification: Commercial — Client Facing

Owner: Board of Directors, InnerMedia Limited

Review Cycle: Annual or following material changes to services or legislation

This DPA is entered into between:

1. Definitions

1.1 In this DPA, the following terms have the meanings given in the UK GDPR and the Data Protection Act 2018: ‘Controller’, ‘Data Subject’, ‘Personal Data’, ‘Personal Data Breach’, ‘Processing’, ‘Processor’, ‘Special Category Data’, ‘Supervisory Authority’.

1.2 ‘Services’ means the services described in the applicable Schedule to the Master Terms.

1.3 ‘Sub-Processor’ means any third party engaged by the Processor to carry out Processing activities on behalf of the Controller.

2. Scope and Purpose of Processing

3. Controller Obligations

3.1 The Controller warrants and undertakes that:

• It has a valid lawful basis under UK GDPR for each Processing activity;
• It has provided Data Subjects with all required privacy notices;
• It is entitled to transfer Personal Data to the Processor for Processing under this DPA;
• Where required, it has obtained valid consent from Data Subjects (including parents/guardians of children under 13);
• It will ensure that any instructions given to the Processor comply with UK GDPR.

4. Processor Obligations

The Processor shall, in relation to any Personal Data processed on behalf of the Controller:

4.1 Process Only on Instructions

Process Personal Data only on documented instructions from the Controller, unless required to do so by applicable law (in which case the Processor shall notify the Controller unless prohibited by law).

4.2 Confidentiality

Ensure that all personnel authorised to process Personal Data are subject to binding confidentiality obligations and have received appropriate data protection training.

4.3 Security

Implement and maintain appropriate technical and organisational measures to protect Personal Data against unauthorised or unlawful Processing and against accidental loss, destruction, damage, alteration or disclosure, including:

• AES-256 encryption of Personal Data at rest;
• TLS 1.2 or higher encryption of Personal Data in transit;
• Role-based access controls and least-privilege principles;
• Multi-factor authentication (MFA) for all systems accessing Personal Data;
• Regular security testing and review of AI infrastructure;
• Physical security controls at all data centre locations (managed by AWS).

4.4 Sub-Processors

4.4.1 The Controller provides general written authorisation to use the Sub-Processors listed in Schedule D Appendix 1 (the Approved Sub-Processor List).

4.4.2 The Processor shall: (a) give at least thirty (30) days’ written notice before engaging any new Sub-Processor or replacing an existing one; (b) impose data protection obligations on each Sub-Processor equivalent to those in this DPA; and (c) remain fully liable to the Controller for the acts and omissions of each Sub-Processor.

4.4.3 The Controller may object to a new Sub-Processor within fourteen (14) days of notice. If the parties cannot resolve the objection, the Controller may terminate the affected Service on thirty (30) days’ notice without penalty.

4.5 Data Subject Rights

Without undue delay, and in any case within seventy-two (72) hours, assist the Controller in responding to Data Subject requests (access, rectification, erasure, restriction, portability, objection) by providing all information the Controller reasonably requires. Such assistance shall be at the Processor’s cost where it relates to a security or processing failure by the Processor, and at the Controller’s cost otherwise.

4.6 Data Protection Impact Assessments (DPIAs)

Assist the Controller with any Data Protection Impact Assessment required by Article 35 UK GDPR and with any consultation with the ICO.

4.7 Personal Data Breach Notification

Notify the Controller without undue delay (and in any event within 72 hours) of becoming aware of a Personal Data Breach affecting Controller Personal Data. Such notification shall include:

• A description of the nature of the breach;
• The categories and approximate number of Data Subjects and Personal Data records affected;
• The name and contact details of the Data Protection contact;
• The likely consequences of the breach;
• Measures taken or proposed to address the breach.

Where it is not possible to provide all information within 72 hours, the Processor shall provide information in phases without undue further delay.

4.8 Audit

Make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits and inspections by the Controller or a mandated auditor, at the Controller’s cost, on not less than thirty (30) days’ written notice. The Processor may refuse unreasonable audit requests or impose reasonable conditions to protect third-party confidentiality.

4.9 No Training on Client Data

4.10 International Transfers

The Processor shall not transfer Personal Data outside the United Kingdom or the European Economic Area without the prior written consent of the Controller, except where a valid transfer mechanism under UK GDPR exists (such as adequacy regulations or Standard Contractual Clauses).

The use of AWS UK/EU regions and Anthropic Claude accessed exclusively via AWS Bedrock ensures that AI processing does not constitute an international transfer of Personal Data.

4.11 Deletion and Return

On termination of the Agreement or on written request by the Controller: (a) return all Personal Data in a structured, machine-readable format; and (b) securely delete all Personal Data from Supplier systems within thirty (30) days, unless retention is required by applicable law. The Processor shall confirm deletion in writing.

5. Data Retention

6. Governing Law

This DPA is governed by the laws of England and Wales. Any dispute arising under this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales.

Privacy_Policy

INNERMEDIA LIMITED

Privacy Policy

How InnerMedia Collects, Uses and Protects Personal Data

Version 4.0 | May 2026

Classification: Public — Website & Client Facing

Owner: Board of Directors, InnerMedia Limited

Review Cycle: Annual or following material changes to services or legislation

1. About This Policy

1.1 Inner Media Limited (‘InnerMedia’, ‘we’, ‘us’, ‘our’) is committed to protecting the privacy and security of personal information. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights you have in relation to it.

1.2 InnerMedia is registered with the Information Commissioner’s Office (ICO) under registration number ICO:00010252104 as both a Data Controller (for data we collect directly) and a Data Processor (for data we process on behalf of our clients).

1.3 This policy applies to: visitors to our website (innermedia.co.uk); prospective and existing clients; personnel of our clients; and End-Users of AI-powered products we deploy on behalf of our clients.

1.4 We handle four categories of data, each described in detail below:

• Website Information — data collected through website visits and cookies;
• Contact and Relationship Information — data provided when you contact us or become a client;
• Client Configuration Information — data provided by clients to configure our services;
• AI Interaction Information — data generated when End-Users interact with our AI products.

2. Who We Are

3. What Data We Collect and Why

3.1 Website Information

When you visit innermedia.co.uk, we may automatically collect:

• Your IP address and approximate geographic location;
• Browser type, version and operating system;
• Pages visited, time on page, referral source and navigation paths;
• Date and time of visits.

We use this data to analyse website performance and improve user experience. The legal basis is our legitimate interests (Article 6(1)(f) UK GDPR). This data is collected via Google Analytics (GA4) and Google Tag Manager. Please see our Cookie Policy (Section 13) for details.

3.2 Contact and Relationship Information

When you contact us, complete a form, request a quote, or enter into a contract with us, we collect:

• Name, job title and organisation;
• Email address and telephone number;
• The content of your communications with us;
• Billing and payment information (processed by Access Paysuite and Xero).

We use this data to manage our client relationships, deliver our services, send relevant communications, and comply with legal obligations. The legal basis is: (a) performance of a contract (Article 6(1)(b)); (b) legitimate interests in managing our business (Article 6(1)(f)); or (c) legal obligation (Article 6(1)(c)).

3.3 Client Configuration Information

Clients provide us with information to configure our services, including:

• School or business information, branding assets, copy and content;
• Documents, FAQs, policies and procedures used to train AI models;
• Staff names and contact details for account management purposes.

We act as a Data Processor for this information. The Client remains the Data Controller. Our processing is governed by the Data Processing Agreement (DPA) executed with each client.

3.4 AI Interaction Information

When End-Users interact with AI products we have deployed on a client’s behalf (e.g. an admissions chatbot or reception assistant), we store:

• The content of conversations between the End-User and the AI;
• Timestamp and session metadata;
• Any information the End-User volunteers during the conversation.

This data is stored securely and made available to the client (the Data Controller) to review. We process this data on behalf of the client under the DPA. Interaction data is automatically deleted after ninety (90) days (or thirty days for interactions identified as involving individuals under 18).

End-Users should be informed by the deploying client that AI is processing their enquiry. If you have questions about how your data has been handled by a specific AI product, please contact the organisation that deployed it.

4. How We Share Your Data

4.1 We do not sell personal data to third parties.

4.2 We may share personal data with the following categories of recipients:

• Sub-Processors: third-party service providers who process data on our behalf, as listed in Section 5;
• Professional advisers: lawyers, accountants and insurers, where necessary;
• Regulatory bodies: the ICO or other authorities, where required by law;
• Acquirers: in connection with a sale of InnerMedia’s business (clients will be notified in advance).

5. Our Sub-Processors

We use the following third-party sub-processors in connection with our services. All are contractually bound to process data only on our instructions and to maintain appropriate security standards:

We will notify you of any material changes to our sub-processor list with at least thirty (30) days’ notice.

6. International Data Transfers

6.1 All Client Data and AI Interaction Data is stored and processed within AWS UK or EU regions. We do not transfer this data outside the UK or EEA.

6.2 Some sub-processors (such as Google and Meta) may process limited analytics or advertising data outside the UK/EEA under Standard Contractual Clauses or UK adequacy decisions. Where we rely on SCCs, copies are available on request.

6.3 We do not transfer Personal Data to countries without an adequate level of data protection without a valid legal mechanism in place.

7. Data Retention

8. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

To exercise any of these rights, contact us at hello@innermedia.co.uk. We will respond within one calendar month. We may request proof of identity before processing your request.

If you are dissatisfied with our response, you have the right to lodge a complaint with the ICO: ico.org.uk / 0303 123 1113.

9. AI-Specific Rights

9.1 You have the right to be informed that you are interacting with an AI system. Our AI products do not take automated decisions with legal or similarly significant effects without human oversight.

9.2 If you believe an AI product has processed your data incorrectly or made an error that has affected you, please contact the organisation that deployed the AI product in the first instance. If your concern relates to InnerMedia’s processing, contact us directly.

9.3 You have the right to request that your AI conversation history be deleted. Requests will be processed within 72 hours.

10. Children’s Data

10.1 InnerMedia works with schools and other education providers. Where our services involve the processing of data relating to children under 18, we apply enhanced protections:

• Children’s interaction data is retained for a maximum of 90 days;
• Children’s data is never used for AI model training or improvement;
• Children’s data is not used for advertising or profiling;
• We require clients to ensure appropriate consents and safeguarding measures are in place.

10.2 InnerMedia does not knowingly collect personal data directly from children under 13 through its own website. If you believe we have inadvertently collected such data, please contact us immediately.

11. Security

11.1 We take the security of personal data seriously and implement appropriate technical and organisational measures including:

• AES-256 encryption at rest for all stored data;
• TLS 1.2+ encryption for all data in transit;
• Multi-factor authentication on all internal systems;
• Role-based access controls;
• Annual security review and testing;
• Staff data protection training.

11.2 In the event of a Personal Data Breach, we will notify affected Controllers within 72 hours and, where required, the ICO within 72 hours of becoming aware.

12. Third Party Websites

Our website may contain links to third-party websites. This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party sites you visit.

13. Cookies

13.1 Cookies We Use

13.2 We will ask for your consent before placing non-essential cookies on your device. You can withdraw consent or manage your cookie preferences at any time via our cookie banner or browser settings.

13.3 For more information on cookies, visit ico.org.uk/cookies.

14. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology or legal obligations. We will notify active clients of any material changes by email with at least thirty (30) days’ notice. The current version is always available at innermedia.co.uk/privacy.

Last updated: May 2026 (Version 4.0).

AI_Data_Transparency_Statement

INNERMEDIA LIMITED

AI & Data Transparency Statement

How InnerMedia Builds, Deploys and Safeguards AI Products

Version 4.0 | May 2026

Classification: Public — Client Facing

Owner: Board of Directors, InnerMedia Limited

Review Cycle: Annual or following material changes to services or legislation

1. Our Approach to AI

InnerMedia builds AI-powered tools specifically for the education and professional services sectors. Our products — including aiAdmissions, aiReception, aiMarketeer, aiParents, aiStaff and aiSEO — are designed to reduce administrative burden and improve responsiveness for our clients and their communities.

We believe AI should be transparent, controlled and trustworthy. This statement explains how we build and operate our AI products to deliver that promise.

2. What AI Powers Our Products

2.1 The Model

Our AI products are powered by Anthropic’s Claude large language model (LLM). Anthropic is a leading AI safety company whose models are designed with safety and reliability as a core priority.

2.2 How We Access It

We access Claude exclusively through Amazon Web Services (AWS) Bedrock — AWS’s managed AI platform. This means:

• All AI inference (the process of generating a response) happens entirely within the AWS environment;
• Client data is never transmitted to Anthropic’s external systems;
• Anthropic does not have access to your data and cannot use it to train or improve their models;
• All data remains within AWS UK or EU regions at all times.

3. What Data Our AI Uses

3.1 Configuration Data

To configure an AI product for your organisation, we use information you provide us — such as your FAQs, admissions procedures, school policies, staff directories and brand guidelines. This forms the ‘knowledge base’ that the AI draws on when answering queries.

3.2 Interaction Data

When End-Users (e.g. prospective parents, enquirers, staff) interact with your AI product, the conversation is stored securely so you can review it. This helps you monitor quality, identify common questions, and improve your configuration.

3.3 What We Do NOT Do With Your Data

• We will NEVER use your data to train any AI model — ours or anyone else’s;
• We will NEVER share your data with other InnerMedia clients;
• We will NEVER use your data for advertising or profiling;
• We will NEVER transfer your data outside the UK or EU without your explicit written consent;
• We will NEVER retain your data beyond the agreed retention periods (90 days for interaction data, unless you request otherwise).

4. Data Security

All data processed by our AI products is protected by:

• AES-256 encryption at rest (industry standard — the same encryption used by banks);
• TLS 1.2 or higher encryption in transit (all data moving between systems is encrypted);
• Logical data isolation — your data is kept entirely separate from other clients’ data;
• Role-based access controls — only authorised InnerMedia staff with a legitimate need can access your data;
• Multi-factor authentication (MFA) on all InnerMedia systems;
• AWS-managed physical security at all data centres.

5. Children’s Data — Additional Protections

• Conversation data involving children under 18 is automatically deleted after 3600 days;
• Children’s data is never used for AI model training or improvement;
• Children’s data is never used for advertising, profiling or commercial purposes;
• Our AI products are configured to avoid requesting sensitive personal information from End-Users;
• Clients are responsible for ensuring their AI deployment complies with DfE safeguarding requirements and the ICO’s Age Appropriate Design Code.

If your AI product is deployed in a context where children under 13 may interact with it, please discuss this with your InnerMedia account manager so we can ensure the appropriate configuration and consent mechanisms are in place.

6. Human Oversight

6.1 InnerMedia’s AI products are decision-support tools, not autonomous decision-makers. No AI product we deploy makes final decisions in the following areas without human review:

• Admissions decisions or offers of places;
• Safeguarding or pastoral matters;
• Staff performance or HR matters;
• Financial commitments.

6.2 All AI Products include a handoff mechanism to route enquiries to a human member of staff when the query falls outside the AI’s knowledge base or involves a sensitive topic.

6.3 We recommend that all clients designate a named AI Product Manager within their organisation who is responsible for monitoring AI outputs, reviewing interaction logs, and escalating concerns.

7. AI Limitations and Accuracy

7.1 AI language models generate responses based on patterns — they do not ‘know’ facts in the way a human expert does. Responses may occasionally be incorrect, outdated or incomplete.

7.2 All InnerMedia AI products are configured with your organisation’s specific information to maximise accuracy. However, we recommend:

• Reviewing your AI knowledge base regularly (at least every school term or quarterly);
• Monitoring interaction logs to identify and correct any patterns of inaccuracy;
• Including a standard disclaimer in AI responses informing End-Users that information should be verified for critical decisions.

7.3 InnerMedia is not liable for decisions made by End-Users based solely on AI-generated content. Clients are responsible for ensuring that their AI deployment is appropriately supervised.

8. Sub-Processors

The following third-party sub-processors may process data in connection with our AI products. All are contractually bound to maintain appropriate data protection standards:

We will provide at least thirty (30) days’ notice of any changes to our sub-processor list.

9. Your Rights

You (and your End-Users) have the right to:

• Know that you are interacting with an AI product;
• Request deletion of conversation history within 72 hours;
• Opt out of interaction data storage (this may limit some features);
• Request a copy of data held about you;
• Lodge a complaint with the ICO if you believe your data has been mishandled.

To exercise any of these rights, contact: hello@innermedia.co.uk

10. Questions and Contact

If you have questions about how our AI products work or handle data, please contact:

Data_Protection_Policy

INNERMEDIA LIMITED

Data Protection Policy

Internal Policy — UK GDPR Compliance Framework

Version 4.0 | May 2026

Classification: Internal — All Staff

Owner: Board of Directors, InnerMedia Limited

Review Cycle: Annual or following material changes to services or legislation

1. Introduction and Purpose

1.1 Inner Media Limited (‘InnerMedia’) collects and processes personal data about clients, prospective clients, staff, website visitors, and end-users of our AI products. We are committed to handling all personal data lawfully, transparently and securely.

1.2 This policy sets out the framework for how InnerMedia complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to all personal data processed by InnerMedia, whether in digital or physical form.

1.3 Compliance with this policy is mandatory for all staff, contractors and any third party granted access to InnerMedia systems or client data.

2. Roles and Responsibilities

2.1 Data Controller

InnerMedia acts as a Data Controller for personal data it collects about its own contacts, prospects and staff. InnerMedia acts as a Data Processor for personal data provided by clients. In both cases, the obligations in this policy apply.

2.2 Board of Directors

• Hold ultimate accountability for data protection compliance;
• Ensure adequate resources are allocated for data protection;
• Approve this policy and any material amendments;
• Receive and act on reports of data breaches or significant compliance issues.

2.3 Data Protection Lead

InnerMedia has designated a Data Protection Lead (currently the Managing Director) who is responsible for:

• Day-to-day oversight of data protection compliance;
• Maintaining the Record of Processing Activities (ROPA);
• Managing data subject requests and breach notifications;
• Liaising with the ICO when required;
• Keeping staff training up to date;
• Reviewing and updating this policy annually.

2.4 All Staff

• Complete data protection induction training before handling personal data;
• Complete annual refresher training;
• Handle personal data only as required for their role and in accordance with this policy;
• Report any suspected data breach or security incident immediately to the Data Protection Lead;
• Not access, share or use personal data for any purpose outside their role;
• Follow the clean desk and screen lock policies in the Information Security Policy.

3. Data Protection Principles

InnerMedia shall ensure that all personal data is:

4. Lawful Bases for Processing

4.1 Before processing any personal data, the relevant team member must confirm that a valid lawful basis exists. InnerMedia’s primary lawful bases are:

• Contract (Article 6(1)(b)): processing necessary to deliver services to clients;
• Legitimate Interests (Article 6(1)(f)): managing client relationships, marketing to business contacts, improving our services — subject to a Legitimate Interests Assessment (LIA) where required;
• Legal Obligation (Article 6(1)(c)): compliance with accounting, employment and regulatory requirements;
• Consent (Article 6(1)(a)): newsletter sign-ups, non-essential cookies, certain marketing activities.

4.2 For Special Category Data (health, race, religion, biometric data, etc.), an additional condition under Article 9 UK GDPR must be identified. InnerMedia does not ordinarily process Special Category Data. If a client scenario requires this, the Data Protection Lead must be consulted before any processing begins.

4.3 For children’s data, the Data Protection Lead must review the relevant processing activity before it begins to ensure compliance with the ICO’s Age Appropriate Design Code and any applicable sector guidance.

5. Record of Processing Activities (ROPA)

5.1 InnerMedia maintains a Record of Processing Activities (ROPA) as required by Article 30 UK GDPR. The ROPA is maintained by the Data Protection Lead and reviewed annually.

5.2 The ROPA covers: all categories of personal data processed; the purposes of processing; lawful bases; data subjects; retention periods; recipients and sub-processors; and international transfers.

5.3 Any new processing activity (including new AI product features, new sub-processors or new client sectors) must be notified to the Data Protection Lead before launch so the ROPA can be updated.

6. Data Subject Rights

6.1 InnerMedia is committed to honouring all Data Subject rights requests within the statutory timescales:

6.2 All data subject requests must be directed to hello@innermedia.co.uk and immediately forwarded to the Data Protection Lead.

6.3 We may request proof of identity before processing a request. We will not charge a fee for routine requests.

7. Data Breaches

7.1 What Constitutes a Breach

A personal data breach is any security incident that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This includes:

• Sending personal data to the wrong recipient (email, post, or file share);
• Loss or theft of a device containing personal data;
• Unauthorised access to systems containing personal data;
• AI product errors resulting in inappropriate disclosure of personal data;
• A sub-processor reporting a breach affecting InnerMedia client data.

7.2 Breach Response Process

On discovery of a suspected breach, the following steps shall be taken:

• Step 1 — Report: Notify the Data Protection Lead immediately (within 2 hours);
• Step 2 — Contain: Take immediate steps to stop ongoing harm (e.g. revoke access, suspend AI service);
• Step 3 — Assess: Data Protection Lead assesses severity, scope and likely consequences;
• Step 4 — Notify Controller: If the breach affects a Client’s data, notify the Client within 72 hours;
• Step 5 — ICO Notification: If the breach is likely to result in a risk to individuals’ rights and freedoms, notify the ICO within 72 hours of InnerMedia becoming aware;
• Step 6 — Document: Record all details of the breach, the response, and any remedial actions taken.

7.3 Not all breaches require ICO notification, but all breaches must be documented in the Breach Register maintained by the Data Protection Lead.

8. Data Minimisation and Retention

8.1 Staff must only collect the personal data that is genuinely necessary for the relevant purpose. When in doubt, less is more.

8.2 All personal data must be deleted or anonymised when it is no longer needed, in accordance with the retention periods in the Privacy Policy. Staff must not retain personal data in personal email accounts, local drives or unofficial storage.

8.3 AI interaction data is automatically deleted from InnerMedia systems after three hundred and sixty (360) days. Staff must not extract or copy this data beyond the agreed purposes.

9. Third Parties and Sub-Processors

9.1 Before sharing personal data with any third party, the Data Protection Lead must confirm that an appropriate contract or agreement is in place (e.g. a DPA or sub-processor agreement).

9.2 New sub-processors must be approved by the Data Protection Lead before use. Clients must be notified of new sub-processors with at least thirty (30) days’ notice.

9.3 Sub-processors must be vetted to confirm they implement appropriate technical and organisational security measures.

10. International Transfers

10.1 No personal data may be transferred outside the UK or EEA without the prior written approval of the Data Protection Lead and a valid transfer mechanism (adequacy decision, SCCs, or Binding Corporate Rules).

10.2 The use of AWS UK/EU regions and Anthropic Claude via AWS Bedrock means that AI processing does not constitute an international transfer.

11. Training

11.1 All staff must complete data protection induction training before accessing any personal data.

11.2 All staff must complete annual refresher training, updated to reflect any changes in law or InnerMedia’s processing activities.

11.3 Staff working directly with AI products or client data must complete additional AI-specific data handling training.

11.4 Training completion records shall be maintained by the Data Protection Lead.

12. Policy Breaches

Any breach of this policy by a member of staff will be investigated and may result in disciplinary action up to and including dismissal. Serious breaches may also be referred to the ICO or other regulatory authorities.

13. Policy Review

This policy shall be reviewed annually by the Data Protection Lead and approved by the Board. It shall also be reviewed following any material change in UK GDPR, relevant guidance from the ICO, or a significant change to InnerMedia’s data processing activities.

Information_Security_Policy

INNERMEDIA LIMITED

Information Security Policy

Internal Policy — Controls, Responsibilities and Incident Response

Version 4.0 | May 2026

Classification: Internal — All Staff

Owner: Board of Directors, InnerMedia Limited

Review Cycle: Annual or following material changes to services or legislation

1. Introduction

1.1 Information security is fundamental to InnerMedia’s ability to deliver trusted services to our clients. We hold sensitive data on behalf of schools, businesses and their communities. Protecting that data is a legal obligation and a commercial and ethical responsibility.

1.2 This policy establishes InnerMedia’s information security framework, based on the CIA triad:

• Confidentiality — data is accessible only to those with authorised need;
• Integrity — data is accurate, complete and protected from unauthorised alteration;
• Availability — data and systems are available to authorised users when needed.

1.3 Compliance with this policy is mandatory for all staff. Contractors and sub-processors must comply with equivalent standards as a condition of their engagement.

2. Scope

This policy applies to all information assets owned, managed or processed by InnerMedia, including:

• Client data and Personal Data;
• AI product infrastructure and configurations;
• InnerMedia’s internal systems, networks and devices;
• Third-party systems accessed in connection with InnerMedia services (AWS, WordPress, SendGrid, etc.);
• Physical documents containing sensitive information.

3. Responsibilities

3.1 Board of Directors

The Board holds ultimate accountability for information security. The Board shall ensure that appropriate resources are allocated, that this policy is reviewed annually, and that significant incidents are escalated appropriately.

3.2 Information Security Lead

The Information Security Lead (currently the Managing Director) is responsible for:

• Day-to-day oversight of security controls and compliance;
• Maintaining the risk register and reviewing it quarterly;
• Approving new information systems before deployment;
• Managing security incidents and coordinating response;
• Overseeing staff security training.

3.3 All Staff

• Follow all security controls and procedures in this policy;
• Report suspected security incidents or breaches immediately to the Information Security Lead;
• Complete security training at induction and annually;
• Not share passwords, access credentials or security tokens;
• Lock screens when away from their workstation;
• Not install unapproved software on company or client systems.

4. Access Controls

4.1 Principles

Access to InnerMedia systems and client data shall be granted on the principle of least privilege — each user shall have access only to the information and systems necessary for their role, and no more.

4.2 User Access Management

• All user accounts must be individually assigned — shared accounts are prohibited;
• Access rights must be reviewed quarterly and when roles change;
• Access must be revoked within 24 hours of a staff member leaving or changing role;
• Privileged access (admin rights, database access, AI configuration access) requires explicit approval from the Information Security Lead and must be logged.

4.3 Passwords

• All passwords must be a minimum of 12 characters, combining upper and lower case letters, numbers and symbols;
• Passwords must not be reused across systems;
• Staff are required to use Last Pass a company-approved password manager;
• Passwords must be changed immediately if compromise is suspected.

4.4 Multi-Factor Authentication (MFA)

• MFA must be enabled on: all cloud systems (AWS, Microsoft 365, Google Workspace); CMS and hosting management portals; email accounts; AI configuration platforms; any system containing client or personal data.

5. Device and Equipment Security

5.1 Company and Personal Devices

• All company-issued devices must have full-disk encryption enabled;
• Personal devices (BYOD) used for work must have screen lock, encryption, and remote wipe capability enabled;
• Screens must be locked when unattended (maximum idle lock: 5 minutes);
• Devices must not be left unattended in public places without being locked or stored securely.

5.2 Remote Working

• Public Wi-Fi networks must not be used to access client data or InnerMedia systems without VPN;
• Staff must ensure their home networks are secured with WPA2 or WPA3 encryption;
• Video calls involving client data must not be conducted in public spaces.

5.3 Device Disposal

All storage media (hard drives, USB drives, mobile devices) must be securely wiped or physically destroyed before disposal. The Information Security Lead must confirm disposal and maintain a record.

6. Network and Cloud Security

6.1 AWS Infrastructure

• All InnerMedia production systems run on Amazon Web Services (AWS) UK or EU regions;
• Data at rest is encrypted using AES-256;
• Data in transit is encrypted using TLS 1.2 or higher;
• AWS security groups and IAM policies restrict access to authorised services and users only;
• AWS CloudTrail and logging are enabled to record all API activity;
• Regular review of AWS IAM permissions to remove stale or overprivileged roles.

6.2 AI Infrastructure Security

• Anthropic Claude is accessed exclusively via our company account, not personal accounts
• Each client’s AI configuration is logically isolated and not accessible to other clients;
• Prompt injection attack mitigation is implemented in all AI product configurations;
• AI conversation logs are stored in encrypted form and automatically deleted after360 days.

6.3 Third-Party Systems

7. Software and Patch Management

• All software must be kept up to date with security patches applied within 14 days of release for critical patches and 30 days for standard patches;
• Software must be sourced from official, verified sources only;
• No software may be installed on company devices or InnerMedia systems without approval from the Information Security Lead;
• WordPress plugins and themes must be reviewed and updated monthly; unused plugins must be deactivated and removed;
• End-of-life software must be replaced before vendor security support ends.

8. Malware and Threat Protection

• Anti-malware software must be installed and kept up to date on all company devices;
• Email filtering and anti-phishing controls must be active on all email accounts;
• Staff must not click links or open attachments from unknown or suspicious sources;
• Removable media (USB drives) from external sources must not be used on InnerMedia systems without explicit approval and virus scanning;
• Staff must report phishing attempts to the Information Security Lead immediately.

9. Physical Security

• Physical access to any workspace containing sensitive data must be controlled;
• Sensitive documents must not be left unattended;
• Printed documents containing personal data must be shredded (cross-cut) before disposal;
• Clean desk policy applies — sensitive information must be secured at end of working day.

10. Security Incident Management

10.1 What to Report

• Suspected or confirmed unauthorised access to any system or account;
• Loss or theft of any device containing business data;
• Receipt of suspicious emails (phishing, malware);
• Unexpected system behaviour that may indicate a breach;
• Accidental disclosure of personal data;
• AI product anomalies (unexpected outputs, data exposure).

10.2 Incident Response Process

• Contain: Immediately isolate affected systems or accounts to prevent further harm;
• Report: Notify the Information Security Lead within 1 hour;
• Assess: Information Security Lead assesses scope, severity and whether personal data is affected;
• Escalate: If personal data is affected, activate the Data Breach Response in the Data Protection Policy;
• Recover: Restore systems from clean backups where necessary;
• Review: Conduct a post-incident review within 5 Business Days and update controls as required;
• Document: Record all incidents in the Security Incident Register.

11. Business Continuity and Disaster Recovery

11.1 InnerMedia’s primary infrastructure is hosted on AWS, which provides built-in redundancy, automated backups and geographic resilience within UK/EU regions.

11.2 The following recovery objectives apply:

11.3 Business continuity plans shall be tested at least annually by the Information Security Lead and reviewed following any significant incident.

12. Risk Management

12.1 The Information Security Lead maintains a Security Risk Register, reviewed quarterly. Risks are assessed by likelihood and impact and assigned to an owner for remediation.

12.2 Any new information system, AI feature or sub-processor must undergo a security risk assessment before deployment, including a Data Protection Impact Assessment (DPIA) where required under UK GDPR.

13. Supplier and Sub-Processor Security

13.1 All suppliers and sub-processors with access to InnerMedia systems or client data must:

• Sign a Data Processing Agreement (DPA) or equivalent sub-processor agreement;
• Demonstrate compliance with appropriate security standards (ISO 27001, SOC 2, or equivalent);
• Report any security incident affecting InnerMedia data within 24 hours;
• Allow InnerMedia to audit their security controls on reasonable notice.

13.2 Supplier security shall be reviewed annually. Suppliers who cannot demonstrate adequate security shall be replaced.

14. Staff Training and Awareness

• Security awareness training is mandatory at induction and annually;
• Staff working with AI products or client data must complete additional training;
• Phishing simulation exercises shall be conducted at least twice per year;
• Training completion records are maintained by the Information Security Lead.

15. Policy Review

This policy shall be reviewed annually by the Information Security Lead and approved by the Board. It shall also be reviewed following any significant security incident or material change to InnerMedia’s systems or services.