These documents are provided by Finodax Ltd, a company registered in England and Wales [16312959], with its registered office at [71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ], trading as KaelSite ("Finodax", "we", "us" or "our"). They supplement our Terms of Use (kaelsite.com/terms/), Privacy Policy (kaelsite.com/privacy/), AI Disclaimer (kaelsite.com/legal/ai-disclaimer/) and Refund Policy (kaelsite.com/legal/refund-policy/). If there is a conflict between these documents and the Terms of Use, the Terms of Use prevail unless a document below says otherwise.

Contents

Table of Contents

1. General Compliance Disclaimer
2. Data Processing Agreement (DPA)
3. Accessibility Statement
4. Service Level Agreement (SLA)

---

Part 1: General Compliance Disclaimer

1.1 What KaelSite is

KaelSite is a software tool that helps users organise and keep records of site inspections, temporary works and related compliance activities, including records connected to BS 5975 and the Construction (Design and Management) Regulations 2015 (CDM 2015). It also offers optional AI features.

1.2 What KaelSite is not

KaelSite is not a certification body, an inspector, a designer, a competent person, or a legal, engineering or health and safety adviser. Using KaelSite does not make you, your project or your records compliant with any law, standard or contract.

1.3 Status indicators reflect your data

Any "pass", "complete", "approved", "compliant", "on track" or similar status shown in KaelSite reflects only the information entered by you or your users, and the settings you chose. It is not a legal, technical or professional determination, and we do not verify it.

1.4 Your responsibilities

You and your organisation are solely responsible for:

• the accuracy, completeness and timeliness of the information you enter;
• making sure that a competent person reviews, checks and signs off all inspections, designs, permits and records, as the law, the relevant standards and your contracts require;
• complying with all laws, standards, contractual requirements and site rules that apply to your work;
• the safety of your site, your people and the public;
• any decision made using KaelSite, including decisions made with the help of AI features.

1.5 References to standards and regulations

KaelSite and its content may refer to standards, regulations or guidance (such as BS 5975 or CDM 2015). These are summaries and prompts only, may not be complete or current, and are not a substitute for the official texts. Always check the current official source.

1.6 AI-generated content

AI-generated content is also covered by our AI Disclaimer at kaelsite.com/legal/ai-disclaimer/.

1.7 Limits of our responsibility

To the fullest extent permitted by law, Finodax is not responsible for any loss, damage, claim, penalty, delay or cost arising from your reliance on KaelSite, or on content or records created with it, in place of your own professional judgement, a competent person's review, or the advice of a qualified professional. Nothing in this document excludes or limits any liability that cannot lawfully be excluded or limited, including liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot be limited under the law of England and Wales. Our liability is otherwise limited as set out in the Terms of Use.

---

Part 2: Data Processing Agreement

2.1 Who this applies to

This Data Processing Agreement ("DPA") applies to customers who use KaelSite for business purposes and who put personal data of other people (for example their employees, contractors, site workers, clients and visitors) into KaelSite ("the Customer"). It forms part of the agreement between the Customer and Finodax Ltd for the use of KaelSite (the "Agreement") and applies from the date the Customer starts using KaelSite. It is not needed for people using KaelSite only as individuals for their own account data, which is covered by our Privacy Policy. We will sign a separate copy of this DPA on request.

In this DPA, "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, and, where it applies, the EU GDPR. "Controller", "processor", "personal data", "personal data breach", "processing" and "data subject" have the meanings given in the UK GDPR.

2.2 Roles

For personal data that the Customer or its users upload or enter into KaelSite ("Customer Personal Data"), the Customer is the controller and Finodax is the processor. For other personal data, such as account, billing and security information about the Customer's users, Finodax is an independent controller, as described in our Privacy Policy.

2.3 Details of the processing

• Subject matter and purpose: providing KaelSite, including storing, organising, displaying, sharing, reporting on and backing up the Customer's project, inspection and compliance records, and providing optional AI features at the Customer's request.
• Duration: the term of the Agreement, plus the retention and deletion period in section 2.9.
• Nature of processing: hosting, storage, transmission, retrieval, display, analysis, generation of reports and AI responses, backup, and deletion.
• Types of personal data: names, contact details, job titles, employer, signatures, photos, video and voice recordings, location data, notes and diary entries, inspection and training records, and any other personal data the Customer chooses to enter.
• Categories of data subjects: the Customer's employees, contractors, subcontractors, site personnel, clients, visitors and other people who appear in the Customer's records.

2.4 Our obligations as processor

Finodax will:

• (a) process Customer Personal Data only on the Customer's documented instructions, which are this DPA, the Agreement and the Customer's use of KaelSite's features and settings, unless the law requires otherwise (in which case we will tell the Customer beforehand unless the law prohibits this);
• (b) make sure that everyone we authorise to process Customer Personal Data is bound by confidentiality;
• (c) keep Customer Personal Data secure with appropriate technical and organisational measures (see section 2.6);
• (d) comply with the sub-processor conditions in section 2.5;
• (e) taking into account the nature of the processing, provide reasonable help, through KaelSite's features or on request, so the Customer can respond to data subjects exercising their rights;
• (f) provide reasonable help with the Customer's security, breach-notification, impact-assessment and prior-consultation obligations under Articles 32 to 36 of the UK GDPR;
• (g) notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, with the information we have, and keep the Customer updated;
• (h) delete or return Customer Personal Data at the end of the Agreement, as set out in section 2.9;
• (i) make available the information needed to show compliance with Article 28 of the UK GDPR, and allow audits as set out in section 2.8.

If we think an instruction from the Customer breaches Data Protection Law, we will tell the Customer. We may suspend carrying out that instruction until it is changed or confirmed.

2.5 Sub-processors

The Customer gives general authorisation for Finodax to use sub-processors for server hosting, file storage, email and SMS delivery, payment processing, web security and delivery, and AI processing. Our current list of sub-processors, with the purpose and location of each, is available on request at [email protected].

We will give the Customer at least [14] days' notice of any intended addition or replacement of a sub-processor, by email or in the app, so the Customer can object on reasonable data protection grounds. If the Customer objects and we cannot reasonably accommodate the objection, either party may end the affected service, and we will refund any prepaid fees for the period after the end date for the affected service.

We impose on each sub-processor data protection obligations that are no less protective than those in this DPA, and we remain responsible to the Customer for each sub-processor's performance of those obligations, subject to the limits on liability in section 2.10.

2.6 Security

We protect Customer Personal Data with measures that are appropriate to the risk, including encrypted connections (HTTPS/TLS), access controls that limit access to authorised staff, authentication controls, logging of key actions, and separation between customer accounts. The Customer acknowledges that these measures are appropriate for the processing it carries out, and that it is responsible for the security of its own accounts, including using strong passwords, protecting login details, and controlling which people it invites to its projects and what permissions they have.

2.7 International transfers

The Customer authorises us and our sub-processors to process Customer Personal Data in the UK and in other countries, including the United States, provided that appropriate safeguards are in place, such as an adequacy decision or regulation, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or another transfer mechanism allowed by Data Protection Law. Where required, the Customer instructs us to enter into those transfer terms with sub-processors on the Customer's behalf.

2.8 Audit and information

We will make available to the Customer the information reasonably needed to show that we comply with this DPA. If the Customer reasonably needs more than this to meet its legal obligations, it may carry out an audit, no more than once in any 12 months (unless a regulator requires otherwise or following a personal data breach), on at least 30 days' written notice, during business hours, in a way that does not disrupt our business or put the security or confidentiality of other customers' data at risk. The Customer pays the reasonable costs of the audit, and the auditor must sign a confidentiality agreement acceptable to us. We may meet an audit request by giving the Customer a recent independent audit report or certification, where one exists, or a written response to a security questionnaire.

2.9 Return and deletion

The Customer can export or delete its data at any time using KaelSite's features. When the Agreement ends or a request to delete the account is carried out, we will delete Customer Personal Data as described in our Privacy Policy (Section 6), including after any grace period that applies. Copies that remain in routine backups are overwritten in the normal backup cycle and are not used for any other purpose. We may keep Customer Personal Data after that to the extent the law requires, and we will keep it protected and not use it for any other purpose.

2.10 Responsibilities of the Customer

The Customer confirms that:

• (a) it has a lawful basis for putting Customer Personal Data into KaelSite and for the instructions it gives us, and has given any notices to, and obtained any consents from, data subjects that the law requires (including, where relevant, telling site personnel that their photos, signatures or location may be recorded);
• (b) it will not enter data that it is not allowed to enter, or special category or criminal offence data, unless it has a lawful basis and an appropriate condition under Data Protection Law for doing so; and
• (c) it is responsible for the accuracy and quality of the data it enters, and for deciding whether and how to use optional AI features, including what personal data it enters into them.

2.11 Liability

Each party's liability arising out of or in connection with this DPA is subject to the exclusions and limits on liability in the Terms of Use, which apply to this DPA as if set out in full. Nothing in this DPA limits any liability that cannot lawfully be limited, or a data subject's rights against either party.

2.12 General

This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, subject to any mandatory rights the Customer has. If there is a conflict between this DPA and the Agreement about the processing of Customer Personal Data, this DPA prevails. We may update this DPA to reflect changes in the law or in our services, giving notice of material changes in the same way as in section 2.5.

---

Part 3: Accessibility Statement

3.1 Our commitment

We want KaelSite to be usable by as many people as possible, including people who use assistive technology. This statement covers the KaelSite website, web application and mobile app.

3.2 Standard we are working to

We are working towards conformance with the Web Content Accessibility Guidelines (WCAG) 2.2, Level AA.

3.3 Current status

KaelSite has not yet had an independent accessibility audit, so we do not claim full conformance with WCAG 2.2 AA. We test our pages and screens during development, and we are improving them. We will update this statement when an audit has taken place. We are not currently aware of any specific issues that stop people using the main features, but some parts may not yet work as well as they should with screen readers, keyboard navigation or system text-size settings.

Some content is provided by users, such as photos, videos, documents and notes. We do not control whether this content is accessible, and users are responsible for the content they add.

3.4 Feedback and contact

If you have difficulty using KaelSite, or you need information in a different format, please contact us at [email protected] or on 0330 520 4998. Please tell us the page or screen, the problem, and the device and assistive technology you use. We aim to respond within 5 working days and will tell you what we can do.

3.5 Enforcement

KaelSite is a private-sector service and is not subject to the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018. We publish this statement voluntarily, and we have regard to the Equality Act 2010. If you are not happy with our response, you can contact the Equality Advisory and Support Service (EASS).

3.6 Preparation of this statement

This statement was prepared on 14 October 2026 from our own review and will be reviewed at least once a year.

---

Part 4: Service Level Agreement

4.1 Who this applies to

This Service Level Agreement ("SLA") applies only to customers on an Enterprise plan whose written order or agreement with us says that this SLA applies. It does not apply to free or trial use, or to other plans. It forms part of the Agreement with those customers.

4.2 Availability target

We aim to make the KaelSite web application and API available at least 99.0% of the time in each calendar month ("Target Availability"), excluding the events in section 4.4.

Measurement. Availability is calculated as: ((total minutes in the month − minutes of unavailability) ÷ total minutes in the month) × 100. "Unavailability" means minutes in which the Customer's users cannot log in to the web application or reach the API because of a fault in our systems, as recorded by our own monitoring. Our records are the basis for measurement unless the Customer shows an obvious error.

4.3 Scheduled maintenance

We may carry out scheduled maintenance, and will aim to do this outside UK working hours. We will give at least 48 hours' notice by email or in the app for maintenance expected to make the service unavailable. Scheduled maintenance does not count as unavailability, up to a total of 8 hours in a calendar month.

4.4 Exclusions

The following do not count as unavailability, and this SLA does not apply to them:

• (a) scheduled maintenance as in section 4.3, and urgent maintenance needed to protect the security or stability of the service, for which we will give as much notice as reasonably possible;
• (b) problems caused by the Customer or its users, including misuse, breach of the Agreement, incorrect configuration, or the Customer's own equipment, networks, software or internet connection;
• (c) problems with third-party services we do not control, including internet and mobile networks, app stores, cloud and email providers, SMS delivery, payment services, calendar integrations and AI providers;
• (d) optional AI features (including Kael), beta or preview features, and integrations, which are provided without an availability commitment;
• (e) attacks or events beyond our reasonable control, including denial-of-service attacks, power or network failures, government action, industrial action, or severe weather ("force majeure");
• (f) suspension or limiting of the service in line with the Agreement; and
• (g) the offline functions of the mobile app, which work on the device and are not covered by this SLA.

4.5 Service credits

If we do not meet the Target Availability in a calendar month, the Customer may claim a service credit against its next invoice, as a percentage of the monthly fee (or one-twelfth of the annual fee) for the affected month:

The total service credits for any month cannot exceed 15% of the monthly fee. Credits are not paid in cash, do not apply to fees for other services, and are lost if the Agreement ends before they are used (except that we will pay any unused credit if the Agreement ends because of our uncured material breach).

Claims. The Customer must claim a service credit in writing to [email protected] within 30 days after the end of the month in which the unavailability occurred, with the dates and times and details of the problem. We will confirm whether the claim is accepted within 30 days. A claim not made within this period is lost.

4.6 Sole remedy

Service credits are the Customer's sole and exclusive remedy, and our entire liability, for any failure to meet the Target Availability. This does not limit the Customer's right to end the Agreement under its terms if we repeatedly and materially fail to meet the Target Availability in three or more months in any rolling six-month period. Nothing in this SLA limits any liability that cannot lawfully be limited, including for death or personal injury caused by our negligence or for fraud.

4.7 Support

Support is available by email at [email protected] from 9:00 to 17:00 UK time, Monday to Friday, excluding public holidays in England. We aim to respond within the times below. These are response targets, not times to resolve a problem, and are measured from when we receive a complete report.

4.8 Customer responsibilities

To receive support and claim credits, the Customer must give us reasonable details and access to information, use a named contact for support requests, and keep its contact details up to date in KaelSite.

4.9 Changes

We may update this SLA from time to time. For a customer with a signed Enterprise agreement, any change that reduces the service levels takes effect only at the next renewal, with at least 30 days' notice.

---

These documents are governed by the law of England and Wales. If you have any questions about them, please contact us at [email protected] or on 0330 520 4998.