Master Services Agreement

This document is version-controlled. The version accepted at checkout, incorporated into an Order, or signed with a Statement of Work governs the relevant transaction. Mandatory rights imposed by law remain unaffected.

This Master Services Agreement, MSA, is between Oxford Private Studios Ltd, company 16271033, of 20 Wenlock Road, London, England, N1 7GU, Provider, and the customer identified in the applicable Order or signature block, Customer. It governs business-to-business professional, hosted, managed, implementation, security, automation, AI, support and enterprise services supplied under Statements of Work or Orders.

This MSA is not intended for a Consumer purchase. If a person contracts as a Consumer, the Aevornix consumer terms and mandatory consumer law apply instead.

Affiliate means an entity controlling, controlled by or under common control with a party. Background IP means intellectual property owned or developed independently of the Services. Customer Data means data, content and material supplied or controlled by Customer. Deliverable means a work product expressly identified as a deliverable in a SOW. Order means an order form or purchase record incorporating this MSA. Services means services in an Order or SOW. SOW means Statement of Work.

Each Order or SOW forms a separate contract under this MSA. If documents conflict, the priority is: signed amendment, SOW or Order, DPA for personal-data matters, product or service schedule, this MSA, then proposal or documentation. A purchase order issued by Customer is administrative only and its additional or different legal terms do not apply unless OPS signs them expressly.

OPS will provide the Services described in each SOW. A SOW should identify scope, assumptions, Customer dependencies, Deliverables, milestones, fees, payment schedule, acceptance criteria, data role, support level and any service level. Work outside scope requires a written change or separate Order.

OPS controls the manner and means of performing Services, subject to agreed requirements. OPS may use qualified employees, Affiliates and subcontractors. OPS remains responsible for its contractual obligations subject to this MSA.

Provide timely access, decisions, information, credentials, facilities and personnel identified in the SOW.

Ensure information and instructions are accurate, complete and lawful.

Maintain backups and a recovery plan for Customer systems and data.

Obtain third-party permissions, licences, consents and security authorisations needed for the Services.

Maintain appropriate access controls and promptly remove departed or unauthorised users.

Review and approve material Deliverables, configurations, AI or agent actions and changes within the stated review period.

Operate the Customer environment in line with documented requirements and applicable law.

Appoint an authorised project and security contact.

OPS is not responsible for delay, rework or failure to the extent caused by a Customer dependency, inaccurate instruction, third-party platform, unsupported environment or Customer change. Milestones are adjusted reasonably for such delay and extra work is chargeable where the SOW provides a rate or the parties agree it.

Either party can request a scope change. OPS will assess the impact on fees, timing, security and dependencies. No material change is binding until authorised in writing by both parties. Emergency security actions can be taken without prior change approval where reasonably necessary to contain an active threat, subject to prompt notice and the authority granted in the relevant security SOW.

If a SOW states acceptance criteria, Customer will test each Deliverable within 10 Business Days after delivery or the stated period. Customer must identify specific material non-conformity against the criteria. OPS will correct verified non-conformity and resubmit.

A Deliverable is accepted when Customer confirms acceptance, uses it in production other than for acceptance testing, or the review period expires without a valid rejection. Minor defects that do not materially prevent the agreed use do not block acceptance and will be handled through ordinary support or a punch list.

Customer will pay the fees in each Order or SOW. Unless stated otherwise, fees are in GBP and exclusive of VAT or similar transaction taxes that OPS is legally required to charge. Customer is responsible for its own income, payroll and similar taxes. OPS is responsible for taxes imposed on OPS income.

Invoices are due within 14 days unless the Order states another period. Customer must raise a good-faith invoice dispute before the due date and pay undisputed amounts on time. OPS can charge statutory interest and fixed recovery costs under the Late Payment of Commercial Debts (Interest) Act 1998 where it applies, or another substantial contractual remedy expressly stated in the Order.

OPS can suspend Services for undisputed overdue fees after reasonable written notice. Suspension does not waive payment and Customer remains responsible for fees that continue to accrue for reserved capacity or committed third-party costs.

Customer will reimburse pre-approved reasonable expenses and third-party charges identified in the SOW. AI model, cloud, messaging, telephony, payment, domain, certificate, marketplace and other usage-based charges are Customer costs where the Order states they are pass-through or Customer-controlled costs.

Each party retains its Background IP. OPS owns Aevornix software, source code, frameworks, methods, templates, libraries, models, prompts, tooling, know-how, generic improvements and reusable components. No source-code ownership transfers unless a SOW expressly states a signed assignment.

After full payment, Customer receives the licence to Deliverables stated in the SOW. If the SOW is silent, Customer receives a non-exclusive, perpetual licence to use the delivered work product internally for its business, excluding OPS Background IP except as embedded and needed to use the Deliverable.

Customer retains Customer Data and Customer Background IP. Customer grants OPS a limited licence to use them only as needed to perform the contract, secure the Service, comply with law and exercise rights expressly granted in the agreement.

Feedback about Aevornix products can be used by OPS without restriction or payment, provided OPS does not publish Customer Confidential Information or identify Customer as the source without permission.

Deliverables and Products can contain third-party or open-source components. Their licences govern those components. OPS will not knowingly impose a proprietary restriction that contradicts a mandatory open-source licence. Customer is responsible for separate third-party products it selects unless the SOW says OPS is procuring and supporting them.

Each party will protect the other party’s non-public business, technical, security and commercial information using at least reasonable care and will use it only for the contract. Confidential Information excludes information that is public without breach, already lawfully known, independently developed without use of the confidential information, or lawfully received from another source without duty.

Disclosure is permitted to personnel, professional advisers, insurers, auditors, Affiliates and subcontractors who need the information and are bound by appropriate confidentiality duties. A legally compelled disclosure is permitted, with advance notice where law permits.

Security architecture, vulnerability information, source code, credentials, model weights not publicly released, licence keys and non-public product roadmaps are OPS Confidential Information. Customer security data, credentials, business plans and Customer Data are Customer Confidential Information.

Each party complies with Applicable Data Protection Law for its own processing. Where OPS processes Customer Personal Data on Customer’s behalf, the Aevornix DPA is incorporated. Where a Product is local-first and Customer Data never reaches OPS, OPS is not the processor of that local dataset.

OPS maintains security controls appropriate to the contracted Service. Customer is responsible for endpoint security, Customer credentials, user permissions, backups, source-data integrity, Customer-controlled networks and third-party systems unless the SOW allocates a specific control to OPS.

No security service guarantees that every attack, vulnerability, malware event, account takeover, insider act or data loss will be prevented or detected. The purpose of security Services is to reduce, identify and respond to risk within the agreed scope.

Before OPS conducts active scanning, penetration testing, security validation, response actions or log collection against a target, Customer confirms it owns the target or has written authority sufficient for the activity. The SOW must identify scope, permitted techniques, prohibited techniques, time windows, emergency contacts, data access and any third-party approvals.

Customer indemnifies OPS for third-party claims arising from lack of Customer authority or inaccurate scope information, except to the extent caused by OPS acting outside the agreed scope without reasonable emergency justification.

For AI or agentic Services, the SOW will identify material model providers, connector permissions, approval gates and any usage charges. Customer remains responsible for human review of outputs and high-impact actions. OPS does not warrant that generated material is accurate, complete, unique, non-infringing or suitable for a regulated decision.

Customer must not authorise an agent to make an irreversible financial, legal, employment, safety, identity, security or external-publication action without a review and approval control proportionate to risk, unless the SOW expressly defines a tested autonomous workflow and allocation of responsibility.

No uptime, response or resolution commitment applies unless a Service Level Schedule expressly states it. A service credit is the sole contractual remedy for an SLA miss unless the schedule expressly says otherwise. Planned maintenance, Customer-caused incidents, force majeure, internet failure and excluded third-party dependencies do not count as downtime where the SLA says so.

OPS warrants that professional Services will be performed with reasonable care and skill and that paid Deliverables will materially conform to agreed acceptance criteria at delivery. Customer warrants it has authority to enter the agreement and provide Customer Data, systems, instructions and materials used in the Services.

Except for express warranties in the agreement and terms that law does not permit us to exclude, Products and Services are provided without other warranty. OPS does not warrant uninterrupted or error-free operation, complete security, detection of every threat, permanent third-party compatibility, a specific commercial result, or fitness for an unstated purpose.

If a third party claims that unmodified OPS proprietary software supplied under the agreement infringes a UK patent or copyright, OPS may, at its option, obtain continued use rights, modify or replace the affected item with materially equivalent functionality, or terminate the affected item and refund prepaid unused recurring fees for it. This clause does not apply to claims caused by Customer modifications, combinations not supplied by OPS, Customer specifications, continued use after a supplied non-infringing replacement, Customer Data, open-source components or third-party products.

This clause states the contractual remedy for such infringement claims, subject to liabilities that law does not permit the agreement to restrict.

Customer will defend, indemnify and hold harmless OPS, its Affiliates and personnel from third-party claims and reasonable resulting losses, costs and legal fees to the extent arising from Customer Data or materials infringing rights, Customer’s unlawful processing instructions, unauthorised security testing, Customer’s breach of a third-party service agreement, prohibited use of a Product, or Customer’s material breach of law or clauses 9, 11, 14 or 15.

OPS will give prompt notice, reasonable cooperation at Customer cost and control of the defence to Customer, subject to OPS’s right to participate with its own counsel. Customer must not settle in a way that admits fault by OPS, restricts OPS products or imposes non-monetary obligations on OPS without written consent.

Nothing in the agreement excludes or limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any liability that law does not permit to be excluded or limited.

Subject to the preceding sentence, neither party is liable for indirect or consequential loss. OPS is not liable for loss of profit, revenue, anticipated savings, goodwill, reputation, business opportunity, contracts, production, use, data or business interruption, whether direct or indirect, except where a signed SOW expressly identifies a different recoverable loss.

Subject to non-excludable liability, OPS total aggregate liability arising from an affected SOW or Order is limited to 100 percent of fees paid or payable to OPS under that SOW or Order during the 12 months immediately before the first event giving rise to the claim. If the SOW has run for less than 12 months, the cap is the fees paid or payable for that shorter period. For a one-time perpetual software licence without recurring fees, the cap is the licence fee paid for the affected Product.

The same event and related events count as one claim for the cap. Liability is reduced to the extent loss was caused or increased by Customer, a Customer supplier, failure to back up, unsupported configuration, failure to install a supplied fix, unauthorised use or failure to follow an agreed control.

The parties agree that the fees, allocation of responsibilities, available insurance and exclusions form part of the commercial basis of this liability allocation. A SOW for a materially different risk can state a different negotiated cap.

OPS will maintain insurance that it considers commercially reasonable for its operations and contractual risk. A SOW can require stated cyber, technology errors and omissions, professional indemnity, public liability or other limits. Evidence of required cover will be provided on reasonable request subject to insurer confidentiality and policy terms.

Customer will maintain insurance appropriate to its own systems, data, operations and use of the Services. Insurance does not expand either party’s contractual liability.

OPS can suspend an affected Service where reasonably necessary for non-payment, legal compliance, active security risk, abuse, material licence breach or Customer conduct that threatens the Service or others. OPS will limit suspension to what is reasonably necessary and give notice where doing so does not increase risk or breach law.

This MSA begins on the Effective Date and continues until terminated. Either party can terminate the framework on 30 days notice if no active Order or SOW remains. Terminating the framework does not terminate an active committed SOW unless the SOW permits it.

Either party can terminate an affected SOW for material breach if the breach is not cured within 30 days after written notice, or immediately if the breach cannot be cured, the other party becomes insolvent in a manner permitting termination by law, or continued performance would be unlawful.

On termination, Customer pays fees accrued and committed non-cancellable third-party costs. Each party returns or destroys Confidential Information on request subject to legal retention and secure backups. Licences and provisions intended to survive continue according to their terms.

If an Order includes hosted Customer Data, OPS will provide standard export functions stated in the Service. Additional migration, conversion or professional exit assistance is chargeable. OPS is not required to build a bespoke export format unless the SOW says so or Applicable Data Protection Law requires reasonable assistance.

Neither party is liable for delay or failure caused by events beyond reasonable control, except payment obligations already due. The affected party will use reasonable efforts to mitigate. If a material force majeure event prevents a recurring Service for more than 60 consecutive days, either party can terminate the affected recurring Service on written notice without liability for future unprovided periods.

Each party complies with law applicable to its role. Customer is responsible for sector rules governing its use and data unless the SOW expressly assigns a task to OPS. Neither party will require the other to violate sanctions, export controls or trade restrictions. OPS can require end-use or end-user information for controlled software or security technology.

Neither party may use the other party’s name, logo or marks in public marketing as a customer endorsement without written permission. Factual disclosure required by law, regulator, investor due diligence or confidential financing is permitted subject to confidentiality obligations.

During an active SOW and for 6 months afterwards, neither party will knowingly solicit for employment a named employee of the other party who was materially involved in the SOW, except through general recruitment not targeted at that person. This clause applies only to the extent enforceable by law and does not prevent a person applying independently.

Before court proceedings, a party will give written notice of the dispute and the parties will refer it to a senior representative for good-faith discussion for at least 15 Business Days, unless urgent injunctive relief, debt recovery, security action or a limitation deadline requires earlier action.

This MSA, each SOW and non-contractual obligations arising from them are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction, unless a signed SOW expressly selects arbitration or another forum.

Notices. Formal notices must be in writing and sent to the addresses in the SOW and to legal@oxfordprivatestudios.com for OPS. Email notice is effective when acknowledged or when no delivery failure is received and a copy is sent by another agreed method for termination or litigation notices.

Assignment. Customer cannot assign without OPS consent, not to be unreasonably withheld for a genuine sale of the relevant business. OPS can assign to an Affiliate or successor to the relevant Aevornix business, subject to continued performance obligations.

Independent contractors. The parties are independent contractors. No partnership, agency or fiduciary relationship is created.

No third-party rights. A person who is not a party has no right to enforce the agreement unless expressly stated.

Severability. Invalid provisions are adjusted or severed to the minimum extent needed.

Waiver. A waiver must be specific. Delay is not a waiver.

Entire agreement. The agreement is the entire agreement about its subject matter and replaces prior representations not expressly incorporated. Fraudulent misrepresentation is not excluded.

Counterparts and electronic signature. The MSA and SOWs can be signed electronically and in counterparts.

• Customer legal entity and authorised contacts.
• Service or Product scope and exclusions.
• Deliverables, milestones and acceptance criteria.
• Customer dependencies, systems and third parties.
• Fees, payment schedule, tax and third-party charges.
• Data roles, DPA applicability, data location and retention.
• Security scope, authorisations and incident contacts.
• AI model providers, connector scopes and human approval gates where relevant.
• Support hours, SLA and maintenance if any.
• Insurance limits if different from the standard position.
• Project term, renewal, termination and exit.
• Any negotiated liability cap or special indemnity.