Mutual non-disclosure agreement

1. Who this agreement is between

This agreement is between Kalotect Ltd, trading as Kalotect, a company registered in England and Wales with company number 17517329, whose registered office is at Lambourne House, London Road, Riverhead, Sevenoaks TN13 2DE (“we”, “us” or “our”), and [the client’s legal name], trading as [the client’s trading name], [whether they are a company or an LLP] registered in [where they are registered] with number [the client’s company number], whose registered office is at [the client’s registered address] (“you” or “your”). “Each of us” means both of us. Where this agreement speaks of the two of us together, as in “the discussions between us” or “if we later work together”, “we”, “us” and “our” mean both of us.

Each of us enters into this agreement for the purposes of its own trade, business, craft or profession, and the person who signs for each of us confirms that they are authorised to do so.

The summary at the start and the short notes under some sections explain this agreement in plain English. If either ever seems to differ from a clause, the clause is what we have agreed.

In this agreement, “including” and similar words do not limit the words before them; a reference to a law is to it as amended or replaced from time to time; and “in writing” includes email.

2. Why we are sharing information

Each of us expects to share information with the other for this purpose: [why the information is shared] (“the Purpose”). In this agreement, the one of us sharing information is “the discloser” and the one receiving it is “the recipient”; each of us may be both. Each of us makes the promises in this agreement in return for the other’s promises and for the other making Confidential Information available for the Purpose.

Neither of us has to share any particular information. Nothing in this agreement obliges either of us to continue the discussions between us or to enter into any further agreement, and either of us may end the discussions at any time by telling the other.

3. What is confidential

“Confidential Information” means information that the discloser, or anyone acting for it, shares for the Purpose with the recipient or anyone acting for the recipient, and that is marked or described as confidential or that a reasonable person would understand to be confidential from its nature or from the way it is shared. It may be shared in any form and by any means: in writing, in conversation, in a meeting or a recording, or through access to systems or files. It also includes information of that kind that the recipient learns for the Purpose from the discloser’s clients in meetings, interviews or research the discloser arranges.

Information of that kind can include information about the discloser’s business, finances, plans, people, prices, products, designs, systems, software, methods and know-how, about its clients and the people who work for them, and about the terms of any proposal. Confidential Information also includes the content of the discussions between us, and the fact that they are taking place, and the parts of any notes, analyses, summaries and other material the recipient makes that contain or reflect Confidential Information.

Confidential Information does not include information that the recipient can show, with reasonable evidence:

• is or becomes public, other than through a breach of this agreement;
• it lawfully had before the discloser shared it, free of any duty to keep it confidential;
• it lawfully receives from someone else who is free to share it, other than from the discloser’s clients in meetings, interviews or research the discloser arranges for the Purpose; or
• it develops independently, without using or referring to the Confidential Information.

A combination of pieces of information is not public, or already held, just because some of the pieces are.

4. Keeping it confidential

The recipient will:

• use Confidential Information only for the Purpose;
• keep it confidential, and not share it with anyone except as this agreement allows;
• protect it with at least the care it uses for its own information of a similar kind, and never less than reasonable care, keeping it secure against unauthorised access, use, loss and copying;
• copy it only as far as the Purpose needs, and treat every copy in the same way;
• where the discloser gives it access to a system, demonstration, prototype or software, use that access only for the Purpose, keep log-in details to the people who need them, not copy or extract any of it beyond what the Purpose needs, and not reverse engineer or decompile it, except as far as the law allows despite this agreement; and
• tell the discloser promptly on becoming aware that any of it has been used or shared in breach of this agreement, and take reasonable steps to stop or limit the breach.

5. Who it may be shared with

The recipient may share Confidential Information with its directors, officers, employees, contractors and professional advisers, and with the other members of its Group and their directors, officers and employees, who need to know it for the Purpose, and with its auditors, insurers and insurance brokers who need it for their work for the recipient (together, its “Representatives”). Before it does, it must tell them that the information is confidential, and they must be bound to keep it confidential by duties no less protective than this agreement or, for professional advisers, auditors, insurers and insurance brokers, by the duties of confidence that apply to them. The recipient is responsible for what its Representatives do or fail to do with it as if it were its own act or failure.

For each of us, its “Group” is itself and every company or limited liability partnership that controls it, that it controls, or that is under the same control as it, with “control” as section 1124 of the Corporation Tax Act 2010 defines it.

The recipient may also share Confidential Information as far as the law, a court, or a regulator or stock exchange with authority over it requires. So far as the law allows, it will tell the discloser before it does so or, if that is not practicable, as soon as it can afterwards, so that the discloser can seek to protect it; it will give the discloser reasonable help to do so, at the discloser’s cost; and it will share only what is required.

Whatever this agreement says, anyone may report a possible crime or other wrongdoing to the police, a regulator or another body with power to act on it; seek advice from a qualified lawyer, or support from a regulated professional or a victim support service, about conduct they believe may be a crime; make a protected disclosure within Part 4A of the Employment Rights Act 1996; and do anything else that the law says an agreement cannot prevent.

6. Online services, AI tools and recordings

The recipient may keep and work on Confidential Information in online services that someone else provides to it for its business, such as email, file storage, video calls and hosting, only where the provider is bound by its terms with the recipient to keep it confidential and to use it only to provide, secure and support the service and as the law requires. The recipient remains responsible for Confidential Information in those services, and in any AI tool, as it is for its Representatives.

It may also put Confidential Information into an AI tool that meets those conditions, but only for the Purpose, and only where the provider’s terms with the recipient do not allow the provider to use that information to train or improve AI models.

Neither of us will record a meeting or call between us, or have it transcribed or summarised by a device or tool, unless it has told everyone present at the start and no one has objected.

7. Personal data

Each of us will share personal data under this agreement only where the Purpose needs it, and only as much as it needs. For personal data shared under this agreement, each of us expects to act as a separate controller, and each is responsible for its own compliance with data protection law, including having a lawful basis to share or use the data and telling the people it concerns what that law requires. Each of us will keep personal data the other shares secure, use it only for the Purpose, transfer it outside the United Kingdom only as data protection law allows, and give the other reasonable help with any request or complaint about it from a person it concerns or from the data protection regulator. If either of us receives a request from a person about personal data the other shared, it will tell the other promptly and, where it can and the law allows, before it replies.

Personal data the discloser shares is Confidential Information even if it is not marked or obviously confidential, but the exceptions in “What is confidential” still apply to it. The duties in this section apply to personal data whether or not it is Confidential Information.

Neither of us will share special category data, or personal data about criminal convictions and offences, as Articles 9 and 10 of the UK GDPR describe them, under this agreement unless the two of us have first agreed in writing what will be shared, why, and how it will be protected.

If either of us becomes aware of a personal data breach affecting personal data the other shared, it will tell the other without undue delay, and in any event within 48 hours, and give the other the information it reasonably needs to meet its own obligations.

If either of us is to process personal data on the other’s behalf, as its processor, the two of us will first sign a data processing agreement that meets Article 28 of the UK GDPR. This agreement is not one. Until the two of us have signed one, you will not put personal data into our platform for us to process for you, and we will work with made-up or anonymised examples instead.

In this agreement, “data protection law” means the UK GDPR, the Data Protection Act 2018 and any other law about personal data that applies to either of us, and “personal data”, “controller”, “processor” and “personal data breach” have their meanings in the UK GDPR. Nothing in this agreement stops either of us from meeting its own duties under data protection law.

8. Inside information

Confidential Information may include inside information, as Article 7 of the UK Market Abuse Regulation defines it, about companies whose shares or other securities are traded on a market. Each of us understands that the UK Market Abuse Regulation and Part V of the Criminal Justice Act 1993 restrict dealing in those securities while holding inside information, encouraging others to deal in them, and disclosing that information unlawfully, and each of us will comply with them.

The discloser will share inside information only where the Purpose needs it, and only after it has told the recipient that it intends to and which company it concerns, and the recipient has agreed in writing to receive it. The recipient may decline. When the discloser shares it, it will say which information is inside information.

If the recipient agrees to receive inside information, it will give the discloser the names and details the discloser reasonably needs for any insider list that the law requires the discloser, or its client, to keep, and will make sure that each person to whom it passes the information knows the duties that come with it and, if the discloser asks, confirms that in writing.

9. Keeping the discussions private

Neither of us will announce or publicise the discussions between us, or say that the two of us are working together, without the other’s agreement in writing, except as the law requires. If the two of us later sign an agreement for services that deals with publicity, that agreement applies instead of this section.

10. How long it lasts

This agreement starts when the second of us signs it (the “Effective Date”) and ends [how long the agreement covers what is shared] after the Effective Date, unless either of us ends it sooner by telling the other in writing. It covers Confidential Information shared from the Effective Date until it ends, and Confidential Information shared from [the day from which earlier information is covered] until the Effective Date, which each of us agrees was shared in confidence. The recipient’s duties apply to that earlier information from the Effective Date, and nothing either of us did with it before then is a breach of this agreement. It does not cover information shared after it ends.

The duties this agreement gives each of us continue for [how long the duty of confidence lasts after it ends] after it ends. A duty about a trade secret continues for as long as the information remains a trade secret, and a duty about personal data continues for as long as the one who received it holds it. Copies kept under “Returning or deleting it” stay confidential for as long as they are kept. The parts of this agreement those duties need in order to work, including “Who it may be shared with”, “Returning or deleting it”, “If this agreement is broken”, “Notices” and “Law and courts”, continue with them. Ending this agreement does not affect any right either of us already has.

In this agreement, a “trade secret” is information that meets the definition in regulation 2 of the Trade Secrets (Enforcement, etc.) Regulations 2018.

11. Returning or deleting it

When the discloser asks in writing, the recipient will, within 14 days, return or securely delete the discloser’s Confidential Information, including every copy and the parts of anything it made that contain or reflect it, and confirm by email that it has done so. It need not delete:

• copies that the law, a regulator or its professional rules require it to keep;
• one copy kept securely in its records only to show what was shared and agreed under this agreement, including the signed copy of this agreement;
• Confidential Information in records it keeps for audit or compliance that cannot be changed without breaking them; and
• copies in routine electronic backups and archives that are not readily accessible, until they are overwritten or deleted in the ordinary course.

Anything it keeps stays confidential under this agreement for as long as it is kept, and it will not use it for any other purpose.

12. No licence, and no promises about the information

The discloser, and anyone whose information it shares, keeps whatever rights they have in it. Material the recipient makes is the recipient’s, but the parts of it that contain or reflect the discloser’s Confidential Information stay confidential under this agreement. Nothing in this agreement gives the recipient any licence or other right in the discloser’s Confidential Information or intellectual property, except to use the Confidential Information for the Purpose as this agreement allows. Sharing information that is legally privileged does not waive privilege in it.

Nothing in this agreement stops either of us from working with anyone else, from developing anything similar to what the other shares, or from using the general skills and experience it gains, provided it does not use or share the other’s Confidential Information to do so.

The discloser confirms that it is entitled to share the Confidential Information it shares for the Purpose. Otherwise, it shares it as it is, makes no promise that it is accurate or complete, and accepts no liability for the recipient’s use of it, except as this agreement says or as a later agreement between us says otherwise.

13. If this agreement is broken

Each of us accepts that damages alone may not be an adequate remedy for a breach of this agreement, and that the other may seek an injunction, specific performance or other equitable relief for an actual or threatened breach, as well as any other remedy available to it.

14. If we work together, or already do

If an agreement for services between us is in force when this agreement is signed, or the two of us sign one later, its confidentiality terms apply to information shared under it. This agreement applies to Confidential Information shared for the Purpose that is not shared under an agreement for services, including everything shared before one was signed.

This agreement does not change any agreement for services between us. An agreement for services ends or changes this agreement only if it names this agreement and says so; a general clause saying that it replaces earlier agreements is not enough.

15. Signing electronically

We sign first. Michelle Wynne, our director, or a person Michelle Wynne has authorised in writing, with the authority recorded in our Ledger (the record we keep of what we do, who did it and why), confirms on our platform that it is them and makes a signature for us when we send this agreement to you.

The person signing for you does so in the portal at portal.kalotect.com, signed in to their own account with a passkey or a single-use email link. Just before they sign, the portal asks them to confirm again that it is them. They then give their full name and role, confirm that they have authority to sign for [the client’s legal name], make their signature by typing their name, drawing it or uploading a picture of it, initial beside the heading of each section marked for initials, and press the button to sign.

Each of us agrees that signatures and initials made electronically in this way are as valid and binding as handwritten ones on paper, and that this agreement is in writing and signed by each of us wherever the law asks for that. Neither of us will dispute it only because it was made, signed or initialled electronically. An electronic signature is admissible in evidence under section 7 of the Electronic Communications Act 2000, and the law of England and Wales accepts it as a way of signing a contract.

With each signature we record:

• the name and role of the person signing, and the email address of the account they signed in with;
• their signature and, for the person signing for you, their initials, exactly as made;
• how they signed in, and when they last confirmed that it was them;
• the IP address their request reached us from, and the description their browser gave of itself;
• the date and time, by our server’s clock; and
• the SHA-256 fingerprint of the exact text signed.

Our privacy notice explains why we keep this record and for how long.

When the person signing for you signs, we make a certified copy: a PDF of this agreement exactly as signed, with both signatures as they were made, the initials beside each section marked for initials, and a certificate of what we recorded with each signature. We keep the certified copy unchanged and record its SHA-256 fingerprint in the Ledger. You can download it from the portal at once, and we email it to the person who signed. Each of us agrees that the certified copy is the record of what was signed.

This agreement may be signed in any number of counterparts, and signatures given on the same text together make one agreement.

16. Notices

A notice under this agreement must be in writing. A notice to us is sent by email to hello@kalotect.com or by post to our registered office. A notice to you is sent by email to the person who signed this agreement for you, at the address of their portal account, and to any other address you have given us for notices, or by post to your registered office. Either of us may give the other a different address for notices.

A notice sent by email is received when it is sent, if that is between 9am and 5pm on a working day, and otherwise at 9am on the next working day, unless the sender is told that it was not delivered. A notice sent by first-class post is received on the second working day after posting. This section does not apply to the service of legal proceedings, which must be served as the court rules require.

17. Whole agreement and other terms

This agreement is the whole agreement between us about keeping information shared for the Purpose confidential, and replaces anything said or written about that before. It does not end or reduce any duty of confidence either of us already owes the other, under the general law or an earlier agreement, for information this agreement does not cover, and it does not change any agreement for services between us. Nothing in this section limits or excludes liability for fraud or for misrepresentation.

Nothing in this agreement limits or excludes the liability of either of us for death or personal injury caused by its negligence, for fraud or fraudulent misrepresentation, or for anything else the law does not allow to be limited or excluded.

A change to this agreement binds us only if it is set out in a document that says it changes this agreement and is signed by each of us, which may be done electronically.

Neither of us may transfer this agreement without the other’s agreement in writing, except to a successor to all or substantially all of its business that agrees in writing to be bound by it.

If a court finds any part of this agreement unenforceable, the rest continues. If that part would be enforceable with some words deleted, it applies with those words deleted.

A delay in enforcing a right, or not enforcing it, does not give it up.

Nothing in this agreement makes either of us the other’s partner or agent.

Only the two of us have rights under this agreement; the Contracts (Rights of Third Parties) Act 1999 does not apply to it.

18. Law and courts

This agreement, and any dispute or claim arising from or in connection with it, its subject matter or its formation, including a non-contractual dispute or claim, is governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction, except that either of us may seek an injunction or other urgent relief in any court.