Brego Acceptable Use Policy

This Acceptable Use Policy (the “AUP”) forms part of every Agreement governed by the Brego Master Services Agreement (the “MSA”) and applies to all access to and use of the Services. Capitalised terms not defined in this AUP have the meanings given in the MSA or the applicable Order.

1. Scope and responsibility

1.1 This AUP applies to all access to and use of the Services, APIs, Documentation, support channels and systems made available by or on behalf of Brego in connection with the Agreement.

1.2 The Customer shall ensure that every Authorised User, Customer System, Affiliate, subcontractor, End Customer and other person to whom it gives or permits access complies with this AUP. The Customer is responsible for their acts and omissions as if they were its own.

1.3 The Customer must use the Services only for the Permitted Purpose, through approved Customer Systems, within the territory, usage entitlements, rate limits and other restrictions stated in the Order, Documentation, Supplier Terms and Supplemental Terms.

1.4 The examples in this AUP are not exhaustive. An activity may breach the Agreement even if it is not expressly listed where it is unlawful, abusive, deceptive, unsafe, unauthorised or materially threatens Brego, an Upstream Licensor, another customer or the Services.

2. Unlawful, fraudulent and unauthorised use

2.1 The Customer must not use, and must not permit any person to use, the Services:

(a) in breach of any applicable law, regulation, court order, sanction, export control, professional rule, licence, regulatory permission or third-party right;

(b) to commit, facilitate, promote or conceal fraud, deception, theft, money laundering, bribery, corruption, sanctions evasion or other unlawful conduct;

(c) to impersonate another person, misrepresent authority, ownership, Reasonable Cause, sector eligibility, vehicle status, data source or the relationship between the Customer, Brego and an Upstream Licensor;

(d) outside the Permitted Purpose or to obtain, infer, disclose or use information that the Customer is not authorised to receive;

(e) to harass, discriminate against, threaten, defame, exploit or unlawfully monitor an individual, or to create a material risk of harm to a person or property; or

(f) to avoid, undermine or interfere with an investigation, audit, suspension, restriction, data-use control or legal requirement applying to the Services.

3. Security and service integrity

3.1 The Customer must not, without Brego’s prior written consent:

(a) probe, scan, test or assess the vulnerability or security of the Services, Brego systems or a third-party system connected to the Services, including by penetration testing, vulnerability scanning or red-team activity;

(b) attempt to bypass authentication, authorisation, tenant separation, access control, encryption, metering, logging, throttling, rate limits or another technical or contractual safeguard;

(c) access, search for, infer, retrieve, alter or delete an account, credential, system, record or data belonging to another person;

(d) interfere with, disrupt, degrade, overload or place excessive demand on the Services, including through denial-of-service activity, abusive concurrency, repeated failed requests or deliberately inefficient requests;

(e) introduce, transmit or store malicious code, ransomware, spyware, a virus, worm, Trojan horse, time bomb, back door or other harmful or unauthorised code;

(f) use a compromised, stolen, shared or publicly exposed credential or API Key, or embed a credential in publicly accessible code, a client-side application or material made available to an End Customer; or

(g) circumvent a suspension or restriction by creating or using another account, credential, Affiliate, Customer System or third party.

3.2 The Customer must promptly notify Brego of any actual or suspected unauthorised access, credential compromise, security incident, malicious code, misuse or vulnerability affecting the Services and must preserve relevant logs and cooperate with Brego’s investigation and remediation instructions.

4. Automated access, scraping and extraction

4.1 Access is permitted only through the APIs, feeds, interfaces, applications and other manual or automated access methods expressly authorised in the applicable Order or Documentation, subject to applicable usage limits and rate limits.

4.2 The Customer must not scrape, crawl, spider, data-mine, screen-scrape, harvest or systematically extract information from the Services by any other means.

4.3 The Customer must not evade usage controls, split requests or accounts to avoid Fees or limits, or replay or reuse requests outside an authorised workflow. Except to the extent expressly permitted by the Agreement, the Customer must not bulk extract data or reconstruct, populate or maintain a substitute, shadow or derivative database from the Services, Output Data or Supplier Data.

5. Intellectual property, competition and artificial intelligence

5.1 Except to the minimum extent that applicable law prevents the restriction, the Customer must not:

(a) reverse engineer, disassemble, decompile, translate, adapt or attempt to derive source code, object code, non-public interfaces, models, algorithms, methodology, weights, training data, database structure or non-public data from the Services or Output Data;

(b) copy, reproduce, modify or create a derivative work from the Services, Documentation or Brego materials except as expressly permitted by the Agreement;

(c) use the Services, Output Data or Supplier Data to develop, train, fine-tune, retrain, test, validate, benchmark or improve any machine-learning model or artificial-intelligence system, whether for internal or external use, or to develop, test, validate, benchmark or improve any product, service, database or valuation method that competes with the Services, except to the extent expressly permitted in the applicable Order. This paragraph does not prevent the Customer from using Output Data as an input to an existing production system solely for the Permitted Purpose, provided that such use does not train, fine-tune, retrain, test, validate, benchmark or improve that system;

(d) monitor or test availability, performance, accuracy or functionality for competitive analysis, or publish a benchmark, comparative test or performance result without Brego’s prior written consent;

(e) remove, obscure or alter a copyright, trade mark, source, attribution, confidentiality or proprietary notice; or

(f) use Brego’s name, logo, trade marks, domain names or branding except as expressly permitted by the Agreement and Brego’s written brand instructions.

5.2 The Customer shall ensure that any third-party provider permitted to process Output Data or Supplier Data for a Customer System has no right to use that data for its own model training, product improvement or other independent purposes, except as expressly permitted by the Agreement. This does not authorise any disclosure or use otherwise prohibited by the Agreement.

6. Customer Data, privacy and content

6.1 The Customer must not submit, transmit or otherwise make available through the Services any Customer Data unless it has all rights, lawful bases, notices, consents and permissions required for Brego, its Affiliates and subprocessors to process that Customer Data under the Agreement.

6.2 The Customer must not submit special category personal data or personal data relating to criminal convictions and offences unless Brego has expressly agreed in writing and the Customer has satisfied all additional legal, security and contractual requirements.

6.3 The Customer must not submit content or instructions that are unlawful, infringing, defamatory, deceptive, threatening, abusive, obscene, exploitative, discriminatory, confidential to a third party without authority, or materially harmful to Brego or another person.

6.4 Where a Service enables messages, alerts or communications, the Customer must not send spam or unsolicited communications, falsify routing or sender information, or send communications without all legally required consent, identification and opt-out mechanisms.

6.5 The Customer shall apply data minimisation, accuracy, access control, retention and deletion measures appropriate to Customer Data and its use of the Services. The Customer must not retain data merely because the Services make retention technically possible.

7. Supplier Data and vehicle information

7.1 Supplier Data may be received, used, stored, cached, combined, retained and disclosed only to the extent expressly permitted by the applicable Order and Supplier Terms. A right to use Output Data does not imply a right to receive or disclose Supplier Data.

7.2 The Customer must not sell Supplier Data as a dataset or create an alternative database from it, except to the extent expressly permitted by the applicable Order and Supplier Terms. The Customer must not use Supplier Data outside the applicable Reasonable Cause, disclose it to an unauthorised person or territory, or permit access from a location prohibited by Supplier Terms.

7.3 Where DVLA data is made available, the Customer must comply with the DVLA Supplier Terms, including all restrictions on Reasonable Cause, caching, disclosure, security, audit, record-keeping, location and VIN use. No disclosure to an Intermediary, Third Party Customer, Requestor or consumer is permitted unless expressly approved under the Agreement and the DVLA Supplier Terms.

7.4 The Customer must not disclose a full or partial vehicle identification number, personal data or another restricted field except to the precise audience, for the precise purpose and in the precise form permitted by the applicable Order and Supplier Terms.

7.5 The Customer must maintain sufficient records to trace each access to and disclosure of Supplier Data to the relevant Authorised User, Customer System, End Customer, purpose, vehicle enquiry and time, and must make those records available to Brego where permitted by the Agreement.

8. High-risk, regulated and automated uses

8.1 The Services are not designed or authorised to control or operate a vehicle, autonomous-driving system, safety-critical component, medical device, emergency service, nuclear facility, aviation system, weapons system or other environment in which an error or failure could reasonably be expected to cause death, personal injury or material physical damage.

8.2 The Customer must not present Brego or Output Data as providing legal, tax, financial, investment, lending, credit, insurance or other regulated advice, an independent appraisal, a guaranteed valuation or a promise of a transaction price or outcome.

8.3 If the Customer uses Output Data in a significant decision based solely on automated processing, it shall independently comply with all applicable requirements, including any required information, representations, human intervention and challenge rights.

8.4 The Customer remains solely responsible for all credit, underwriting, lending, purchasing, pricing, insurance, investment, compliance and other decisions made using the Services.

9. Cooperation, monitoring and enforcement

9.1 Brego may use technical and organisational measures to monitor usage, protect security and integrity, verify compliance, calculate Fees and investigate suspected misuse. Brego is not obliged to monitor all use or Customer Data.

9.2 Brego may require the Customer to provide information, logs, records, explanations, assurances and remediation evidence reasonably relevant to suspected misuse, security, Supplier Terms or an Upstream Licensor request. The Customer shall respond promptly and accurately.

9.3 Brego may throttle, restrict, quarantine, block, remove or suspend access where permitted by the MSA, including while Brego reasonably investigates suspected misuse or a risk to security, service integrity, law, an Upstream Licensor or another person. Brego may terminate access only in accordance with the termination provisions of the MSA.

9.4 Where permitted by law, Brego may preserve and disclose relevant information to an Upstream Licensor, regulator, court, law-enforcement body, affected provider or other competent person where reasonably necessary to investigate, prevent or respond to unlawful conduct, fraud, abuse, security risk or a breach of Supplier Terms.

9.5 The Customer shall reimburse Brego’s investigation, remediation, audit and enforcement costs to the extent provided in the MSA, including clauses 4.7, 11.4 and 12.4.

10. Reporting and changes

10.1 A suspected vulnerability, misuse or breach of this AUP should be reported promptly to security@brego.io or another contact notified by Brego. The Customer must not publicly disclose a vulnerability before Brego has had a reasonable opportunity to investigate and remediate it.

10.2 The version of this AUP applicable to an Order and any changes to it are governed by the MSA. Publication of a revised AUP does not, of itself, amend an existing Agreement. Continued use after the effective date of an update notified in accordance with the MSA constitutes acceptance, subject to its change provisions and any express termination right.

10.3 If this AUP conflicts with the Order, applicable Supplemental Terms, the MSA or mandatory Supplier Terms, the precedence provisions in the MSA apply.