This Master Subscription Agreement ("Agreement") is between Ilixir Technologies Pty Ltd (ABN 11 680 039 392, ACN 680 039 392), trading as Duely ("Duely"), and the Reporting Entity that accepts these terms ("Client", "Firm", or "Subscriber"). Duely provides AML/CTF compliance workflow and verification tools ("Platform" or "Services").

By accessing the Platform and accepting these terms electronically (including by clicking an "I agree" button or by continued use of the Platform after being given notice of these terms), the Client agrees to be bound by this Agreement. Acceptance given electronically is valid (Electronic Transactions Act 1999 (Cth); Electronic Transactions (Queensland) Act 2001 (Qld)). The person who accepts these terms warrants that they have authority to bind the Client.

Effective date of version 2.2. A new Client is bound by this version when it accepts it. For a Client that accepted an earlier version, any change in this version that is adverse to the Client takes effect 30 days after Duely emails the Administrator about it; all other changes take effect on publication. A Client that accepted an earlier version and does not accept a change in this version may terminate its Subscription under clause 8.1(c).

1. Description of Services

Duely offers a set of AML/CTF compliance tools, including identity verification, sanctions and PEP screening, risk assessment workflows, and audit trail record-keeping. Every Subscription includes the full Platform; the capacity available to the Client (customer slots and users) depends on the Subscription and any additional capacity the Client purchases.

1.1 Changes to the Services

(a) Duely may at any time modify, add, remove, or discontinue any feature, integration, or functionality of the Platform. Where a change Duely chooses to make materially reduces the functionality available to the Client during a paid term, Duely will, at Duely's election, either restore equivalent functionality or refund a pro-rata portion of the Fees for the affected period, and the Client may instead cancel under clause 8.1(c). Withdrawal of a third-party or government verification service caused by the provider or agency is governed by clause 2A.6.

(b) Duely may make beta, preview, or experimental features available from time to time. Such features are provided "as is" and "as available", are not subject to any SLA, carry no warranty of any kind, and may be modified or withdrawn at any time without liability.

2. Limitation of Liability and Regulatory Role

Duely is a technology compliance tool. Duely is not a professional advisor, legal counsel, or accounting firm.

The Platform provides structured workflows to assist Reporting Entities in meeting obligations under the AML/CTF Act 2006 (Cth).
Final compliance responsibility, including all decision-making about risk ratings and Suspicious Matter Reports (SMRs), rests with the Client and the Client's appointed AML Compliance Officer (AMLCO).
The Platform's verification workflows are designed to support risk-based customer identification and verification against reliable and independent data and documents, as required by the AML/CTF Act and the AML/CTF Rules. Completing a workflow does not of itself establish that verification is sufficient for a particular customer. The Client's AMLCO must decide, for each customer, whether the verification carried out meets the Client's obligations and its AML/CTF program.
Identity opinions, verification results and screening results produced through the Platform are based on information supplied by third parties, including verification providers, data providers and government agencies, which Duely does not independently verify.
Use of the Platform does not guarantee a "Pass" from an AUSTRAC assessment and does not confer immunity from regulatory action, fines, or penalties under the AML/CTF Act.

2.1 Cap on Liability

(a) Subject to clauses 2.1(c) and 2.1(e), the total aggregate liability of Duely to the Client for all claims arising under or in connection with this Agreement, whether in contract, tort (including negligence), under statute, in equity, or otherwise, is limited to the greater of:

the Fees paid by the Client to Duely under this Agreement in the twelve (12) months immediately preceding the first event giving rise to the claim; or
AU$100.

(b) To the maximum extent permitted by law, and subject to clauses 2.1(d) and 2.1(e), Duely is not liable to the Client for any of the following, each of which is a separate exclusion:

(i) loss of profit, revenue, savings, business, opportunity, goodwill, reputation, production, anticipated savings, or contract;
(ii) loss or corruption of data, except to the extent caused by Duely's breach of section 2 of the Data Processing Agreement or Duely's negligence, in which case Duely's liability for that loss is limited to restoring the data from its most recent available backup, the Client's reasonable costs of re-creating or re-obtaining records that cannot be restored, and the costs in clause 2.1(d);
(iii) loss arising from the accuracy, completeness, availability or timeliness of information provided by a government agency, registry, data provider or verification provider, except to the extent caused by Duely's negligence or breach of this Agreement, and then subject to clause 2.1(a);
(iv) regulatory fine, penalty, or enforcement cost imposed on the Client or any of its officers, employees, or agents, except to the extent caused by Duely's negligence or breach of this Agreement, and then subject to clause 2.1(a); or
(v) indirect or consequential loss, meaning loss that does not arise naturally, according to the usual course of things, from the relevant breach, and any special, incidental, exemplary, or punitive loss or damage,

however arising and whether or not Duely was advised of, or knew of, the possibility of that loss or damage.

(c) Nothing in this Agreement excludes, restricts, or modifies any right or remedy of the Client that cannot lawfully be excluded, restricted, or modified, including any consumer guarantee under the Australian Consumer Law. To the extent permitted by section 64A of the Australian Consumer Law, Duely's liability for failure to comply with a non-excludable consumer guarantee is limited, at Duely's election, to the re-supply of the Services or the cost of re-supplying the Services.

(d) Subject to the cap in clause 2.1(a), where a personal information breach is caused by Duely's breach of the Data Processing Agreement or its negligence, Duely's liability includes the Client's reasonable costs of notifying the affected individuals and the Office of the Australian Information Commissioner.

(e) Nothing in this clause 2.1 or in clause 2.3 limits or excludes Duely's liability for fraud, wilful misconduct, or personal injury or death caused by Duely's negligence.

2.2 Indemnification by the Client

The Client agrees to indemnify Duely, its officers, directors, employees, and agents against any claim, liability, damage, loss, and expense (including reasonable legal costs) arising out of or in connection with:

(a) the Client's use of the Platform in breach of this Agreement or applicable law;
(b) inaccurate, incomplete, or misleading data inputted by the Client or its users, to the extent caused by the Client's failure to take reasonable care;
(c) the Client's failure to comply with its obligations under the AML/CTF Act 2006 (Cth), including tipping-off contraventions caused by the Client's personnel;
(d) any third-party claim against Duely arising from the Client's AML/CTF compliance decisions made using the Platform, to the extent caused by the Client's breach of this Agreement or of law, or by the negligent or wrongful act or omission of the Client or its users;
(e) the Client's failure to maintain appropriate consents and notifications under the Privacy Act 1988 (Cth) for the personal information it submits to the Platform;
(f) Duely's reasonable costs of responding to a notice, subpoena, investigation or proceeding arising from AUSTRAC enforcement action, a civil penalty proceeding, or a remedial order brought against the Client, where the Client is found to have contravened the Act and Duely is not itself alleged to be at fault;
(g) the Client's breach of clause 2A, and any claim, penalty, audit cost or indemnity payment that a Protected Party asserts against Duely to the extent it arises from an identity check requested by the Client and is caused by the Client's breach of this Agreement or of law, or by the negligent or wrongful act or omission of the Client or its users; and
(h) any misuse by the Client or its Authorised Users of identity information, identity opinions, verification results or screening results.

Each indemnity in this clause 2.2 is given to Duely and, as clause 2A.8 provides, to each Protected Party, subject to the reduction in this clause.

The Client's liability under this clause 2.2, and for costs under clauses 2A.12 and 2A.16, is not limited, and the cap in clause 2.1 does not apply to it. The Client's indemnities are not capped. The Client's liability under each indemnity in this clause 2.2 is reduced to the extent that the relevant claim, liability, damage, loss, or expense was caused by Duely's negligence, wilful misconduct, breach of this Agreement, breach of law, or breach of Duely's agreements with its verification providers.

2.3 Warranty Disclaimer

(a) Except as expressly set out in this Agreement, subject to clause 2.1(c) and to the maximum extent permitted by the Australian Consumer Law, Duely provides the Platform on an "AS IS" and "AS AVAILABLE" basis. Duely makes no warranties, express or implied, regarding the Platform's fitness for a particular purpose, merchantability, or non-infringement. The Client acknowledges that no compliance tool can guarantee regulatory outcomes. Without limiting clause 2.1, Duely's liability in respect of an identity check, verification result or screening result, to the extent the result is based on information supplied by a third-party or government verification provider, is limited, at Duely's election, to re-performing the check or refunding any fee charged for it. Errors in Duely's own processing of a result are governed by clause 2.1.

(b) The Platform is not designed, intended, or authorised for use in any application where failure or error could result in death, personal injury, or environmental or property damage. The Client shall not use the Platform for any such application, and Duely disclaims all liability arising from any such use.

2.4 No Advisory or Client Relationship

Duely provides software tools only. Access to or use of the Platform (including any trial, evaluation, promotional, or beta tier) does not create any professional, advisory, fiduciary, agency, or client-adviser relationship between Duely and any user, and does not constitute compliance, legal, financial, or other professional advice. Each Firm and Reporting Entity remains solely responsible for its own compliance obligations, judgements, decisions, and outcomes, including all decisions about customer due diligence, risk ratings, and Suspicious Matter Reports. Nothing on the Platform or the Duely website should be relied upon as a substitute for advice from a qualified professional.

2.5 AI Features

Outputs of AI-assisted document reading and of Dee are generated automatically, may be inaccurate or incomplete, and are not advice. The Client must review and verify an output before relying on it or adding it to a customer record, and, subject to clause 2.1(c), Duely is not liable for loss arising from reliance on an output the Client has not verified. The Client must use the AI features in accordance with the usage policy of Duely's AI provider, as notified by Duely, and must not use them to generate content that policy prohibits.

2A. Identity Verification Services

2A.1 What Duely provides. Where the Client uses the Platform's identity verification features, Duely gives the Client an identity opinion: Duely's assessment of an individual's identity or of an identity document, formed from several checks, which may include document analysis, biometric liveness and face-match, screening, and a check through the Document Verification Service or another third-party or government verification service. Where a Document Verification Service check is made, it is one of the several checks the identity opinion is formed from, and the Platform shows the identity opinion, not the agency's answer. An identity opinion is not a guarantee of identity, is not a government record, and does not disclose the underlying result of any third-party or government check. The Client remains responsible for its customer due diligence decisions.

2A.2 Client warranties. The Client warrants, and must ensure at all times while it uses the identity verification features, that it: (a) is a legal entity carrying on business in Australia and subject to Australian law, and has given Duely accurate details from which Duely can establish its identity; (b) is subject to the Privacy Act 1988 (Cth) or is a reporting entity under the AML/CTF Act 2006 (Cth), and in any case complies with the Australian Privacy Principles, as if it were an APP entity, for all personal information obtained through the Platform; (c) uses the identity verification features only for its own due diligence under clause 2A.4A and not as agent for any other person; (d) meets, and will continue to meet, any access or eligibility requirements published by the government agency or provider administering a verification service that Duely uses, as they apply to a client of an identity service provider; and (e) is not, and none of its Authorised Users is, subject to sanctions or embargoes imposed by Australia, the United Nations, the European Union, the United Kingdom or the United States, and will not use the identity verification features for any purpose those sanctions prohibit. The Client must tell Duely promptly if any of these warranties stops being true, and must keep the business, contact and authorised-officer details it has given Duely accurate and current.

2A.3 Consent and notice for identity checks. Before requesting any identity check the Client must ensure that the individual has been given the collection notice presented in the Platform and has given express consent in the form the Platform captures, and must keep records of that notice and consent. For a Document Verification Service check, the consent the Platform captures includes the individual's confirmation that they are authorised to provide the details being checked, and the Client must not alter or remove that confirmation. The Client must not request a check for an individual who has withdrawn consent, and acknowledges that consent given for a series of checks lapses after three months. The Client may edit the default consent statement and is responsible for any wording it adds or changes, which must remain accurate and must not reduce what the individual is told. The Client cannot change the descriptions of the checks the Platform provides. The Client must obtain consent from a parent or guardian where the individual is under 15 or otherwise lacks capacity, and must give Duely a copy of any consent record within five business days of a request so that Duely can meet its own obligations to its verification providers and the agencies administering them.

2A.3A Screening. The Client may request sanctions and politically exposed person screening of a person within clause 2A.4A without that person's consent where the screening is part of customer or personnel due diligence the Client is required to carry out under the AML/CTF Act 2006 (Cth). The Client may request adverse-media screening of a person only where the person has consented to it or the screening is part of enhanced customer due diligence the Client carries out under the AML/CTF Rules. Screening the Platform runs automatically is screening requested by the Client. The Platform screens a person automatically: (a) when the person signs a consent form while a customer due diligence review is open for them; (b) when an identity verification the Client requested for the person returns a result; (c) when the Client adds a team member to its account, for personnel due diligence; and (d) where Duely has switched ongoing monitoring on, when the person is registered for monitoring and when the monitoring service reports a change. The Client must take such steps as Australian Privacy Principle 5 requires to notify the person of the matters in that principle, except where giving that notice would or could contravene section 123 of that Act. Screening results identify possible matches only: the Client must review each possible match, and must not use a screening result as the sole basis for a decision about a person.

2A.4 Use of results. The Client must use identity opinions, verification results and screening results only to verify, or contribute to verifying, the identity of the persons described in clause 2A.4A and for its AML/CTF obligations. The Client must not: (a) attempt to derive, infer or record the underlying result of any third-party or government verification check (for a Document Verification Service check, the Platform shows Duely's identity opinion, formed from several checks including the Document Verification Service check, and not the agency's answer, and the Client must not attempt to work that answer out from the identity opinion or otherwise); (b) use information collected for an identity check to build a profile of an individual, to offer or market goods or services, to enable anyone else to do so, or for market research; (c) use identity information, opinions or results to update, validate or enrich any other data or database; (d) disclose identity opinions or results except as the law requires or permits; or (e) rely on an identity opinion as the only evidence of a person's identity in any legal proceeding.

2A.4A Who may be checked. The Client may request an identity check or screening only in respect of: (a) a person who is, or is proposing to become, a customer of the Client (or a beneficial owner, controller, agent or associated party of such a customer), for the purpose of the Client's customer due diligence under the AML/CTF Act 2006 (Cth); or (b) an employee or contractor of the Client, or a person the Client proposes to engage as one, for the personnel due diligence its AML/CTF program requires under Part 1A of that Act. For an identity check under paragraph (b), the person must first be given the collection notice presented in the Platform and give express consent, the Client must offer the person a way to complete the check without biometric information, and the Client must not make the person's engagement or continued engagement conditional on consenting to a biometric check. A Document Verification Service check may be requested only under paragraph (a), because Duely's access to that service is granted for customer due diligence. The Client must not use the identity verification features for tenancy, credit, marketing or any other purpose, or in respect of any person with whom it has no such relationship.

2A.5 Alternative process. The Client must maintain a process for verifying the identity of an individual whose identity cannot be verified through the Platform, and must not take adverse action against an individual solely because a check could not be completed.

2A.6 Availability. Third-party and government verification services are provided to Duely on an "as is, as available" basis, and Duely does not pass on any service levels its providers give it. Duely may suspend or withdraw identity verification features immediately if a government agency, gateway or verification provider suspends, restricts or withdraws access or changes its terms, or if Duely reasonably believes the Client is in breach of this clause 2A. Duely may also withdraw the identity verification features, or any check type, on fourteen (14) days' notice, and clause 1.1(a) applies where that withdrawal is Duely's choice and materially reduces the functionality available to the Client. Otherwise, and subject to clause 2.1(c), no service credits, refunds or damages are payable for the unavailability, suspension or withdrawal of a third-party or government verification service beyond, where a fee was charged, re-performing the check or refunding that fee. Clause 7 does not apply to third-party or government verification services.

2A.7 Audit and cooperation. The Client acknowledges that Duely's use of third-party and government verification services is subject to audit by the agencies and providers administering them, which may be conducted at any time, with or without notice. The Client authorises the Framework Administrator for the Document Verification Service and its personnel to access the Client's records relating to identity checks requested through the Platform, will give them, and any other agency or provider administering a verification service Duely uses, prompt access to those records and to relevant systems and, where an agency requires it, premises, will cooperate fully with any such audit, and will keep its contact details current with Duely.

2A.8 Third-party benefit. All disclaimers, exclusions, limitations of liability and indemnities in this Agreement are also for the benefit of each Protected Party. Duely holds the benefit of those provisions on trust for each Protected Party, and each Protected Party may enforce them directly or through Duely on its behalf. Duely and the Client may vary or end this Agreement, including this clause, without the consent of any Protected Party, but a variation does not take away a right a Protected Party has already acquired. Duely need not enforce a provision on behalf of a Protected Party unless that Protected Party asks it to and meets Duely's reasonable costs of doing so.

2A.9 Fees. A check that carries a per-check charge, such as a Document Verification Service check, is charged for each check the issuing agency or provider answers, whether or not it returns a match, at the rate shown in the Platform before the check runs, in addition to subscription Fees. A check is answered when the agency returns a match, a no-match or a document-error result. A check that is not answered (for example, because of a system error at the agency, or because the request is refused, fails or times out) is not charged. Clause 5.1(d) applies to changes in the underlying provider or government charge. Fees for a check are payable whether or not the Client's user requested it in error.

2A.10 Location of users. The Client must ensure that identity checks are requested only by Authorised Users located in Australia or New Zealand, unless Duely has agreed otherwise in writing. Duely may need to notify a government agency before any person outside Australia or New Zealand may request checks, and may refuse or delay such a request.

2A.11 Access, training and credentials. The Client must limit access to identity information, identity opinions and screening results to Authorised Users who need it for the Client's due diligence under clause 2A.4A and have been trained in handling personal information; keep credentials confidential; and is responsible for every identity check requested using its users' credentials, whether or not authorised, unless the use resulted from Duely's breach of this Agreement or Duely's negligence.

2A.12 Security incidents. The Client must notify Duely at support@duely.com.au immediately, and in any event within 24 hours, if it knows or suspects that a credential has been compromised, that the identity verification features have been accessed or used without authority, or that identity information obtained through the Platform has been lost, accessed, modified or disclosed without authority, and must give Duely the information and cooperation it reasonably requests. Where such an incident is caused by the Client's breach of this Agreement or of law, or by the negligent or wrongful act or omission of the Client or its users, the Client bears the reasonable costs of investigation, notification and remediation that Duely incurs, including any amount Duely must pay to a Protected Party, reduced as clause 2.2 provides.

2A.13 Statements about the service. The Client must not: (a) state or imply that Duely, the Platform or any identity check is approved, endorsed, accredited or certified by any government agency; (b) make any public statement about Duely's access to or use of any government verification service; (c) use the logo or trade marks of Duely or of its verification providers or the agencies administering them in marketing material without Duely's prior written consent. This does not prevent the Client naming Duely or those providers in a privacy policy, collection notice or other statement the law requires; or (d) describe an identity opinion to its customers or anyone else as a government or provider result.

2A.14 Single point of contact. Duely is the sole point of contact for any request about the operation of a verification service or a check result for an identity check requested through the Platform. The Client must not contact Duely's verification providers or the agencies administering government verification services about such checks, and must refer to Duely any query, complaint or request from an individual about the operation of a verification service or a check result, and cooperate in resolving it. For any other privacy inquiry from its customers, the Client remains the primary point of contact.

2A.15 Records. The Client must keep records of the identity checks it requests, the individuals concerned, the notices given and consents obtained, and the decisions it made, for at least seven (7) years, and must provide them to Duely within five business days of a request made for the purpose of an audit, complaint or regulatory inquiry. Once in each year, on Duely's written request, the Client must confirm in writing within ten (10) business days that it has complied with this clause 2A.

2A.16 Regulator and agency inquiries. If a regulator, Protected Party or individual raises an inquiry, audit finding, complaint or claim with Duely that relates to an identity check requested by the Client, the Client must give Duely all information and assistance reasonably required, and must reimburse Duely's reasonable costs of responding to the extent the matter is caused by the Client's breach of this Agreement or of law, or by the negligent or wrongful act or omission of the Client or its users, reduced as clause 2.2 provides.

2A.17 Duely's right to decline or withdraw. Duely may decline to enable, or may withdraw, the identity verification features for a Client without liability if the Client does not meet or ceases to meet clause 2A.2, if a government agency or verification provider objects to or restricts the Client's use, or if Duely reasonably suspects misuse. Duely may verify the Client's identity and standing, including against public registers, before enabling the features and from time to time afterwards.

2A.18 Disclosure to providers and agencies. The Client consents to Duely disclosing the Client's identity, contact details and records of its use of the identity verification features to Duely's gateway and verification providers and to the Framework Administrator for the Document Verification Service, as Duely's agreements with them require.

3. Data Ownership and Licensing

Client Data: "Client Data" means all data the Client or its users submit to the Platform, including Customer and Matter data. The Firm retains ownership of Client Data. Duely may use Client Data (a) to provide, secure, support and maintain the Services, (b) to comply with law and with its agreements with verification providers and government agencies, and (c) in de-identified and aggregated form that does not identify the Client or any individual, to operate, analyse and improve the Services. Duely owns usage and technical data about the operation of the Platform, and may use any feedback the Client gives without restriction.
Intellectual Property: The Client owns its inputs and selections, including the information it enters and the choices it makes in completing its AML/CTF program. Duely retains all rights in the Platform, including its features, codebase, UI/UX, methodologies, templates, wording, algorithms, configurations, and workflows, and in the template text and methodology embedded in a completed program. Duely grants the Client a perpetual, royalty-free licence to use, copy and adapt its completed program for its own AML/CTF compliance, and to provide it for that purpose to its professional advisers, its independent evaluator, AUSTRAC and any successor to the Client's business. The licence survives the end of this Agreement.

4. Tipping-Off and Confidentiality (s123 AML/CTF Act)

Tipping off is an offence under s123 of the AML/CTF Act. The Platform provides Role-Based Access Controls (RBAC) to support internal data compartmentalisation. The Client acknowledges that ultimate responsibility for ensuring users do not breach tipping-off laws rests with the Firm and the Firm's designated AMLCO. The Client warrants that it has implemented internal policies, controls, and training so that personnel understand and comply with s123. The Client is responsible for the content and timing of any communication sent to its customers through the Platform on its instruction. Duely accepts no liability for tipping-off contraventions caused by any user of the Firm.

4A. Confidentiality

Each party agrees to treat as confidential all non-public information received from the other party during this Agreement, including business information, pricing, technical data, and Platform internals ("Confidential Information"). Confidential Information does not include information that is or becomes public other than through a breach of this clause, or that the receiving party develops independently. Neither party shall disclose the other's Confidential Information to any third party without prior written consent, except:

as required by law, regulation, or court order;
to professional advisors bound by confidentiality obligations;
to employees or contractors who need access to perform obligations under this Agreement and are bound by equivalent confidentiality terms; or
in the case of Duely, as clause 2A.18 permits; to a regulator or law enforcement body where Duely reasonably believes disclosure is necessary to report suspected unlawful activity, as the Privacy Act permits; and to sub-processors listed in the Data Processing Agreement.

This obligation survives termination of this Agreement for a period of three (3) years, except that it continues for as long as the information remains a trade secret of the disclosing party.

5. Subscriptions, Fees, and Suspension

Subscription Fees are billed monthly in advance. Flex customer slots and extra users are billed monthly with the Subscription, with any addition during a billing period charged in full on addition (no proration) and then renewing on the normal billing date. Per-use charges (such as Document Verification Service checks and document intelligence runs) are billed in arrears on the next monthly invoice. A document intelligence run is charged per extraction attempt that completes, or that fails after processing starts; an attempt that fails before processing starts (for example, because consent was withdrawn or the file is too large) is not charged.
The Subscription includes thirty (30) customer slots per subscription year, counted from the Subscription start date. A customer occupies an included slot from activation until the next subscription anniversary. Flex slots are released for reuse when the last engagement of the occupying customer is concluded, and may be removed by the Client with effect from the next billing cycle. On each subscription anniversary Duely re-counts the Client's customers with an open engagement, allocates them to the included slots first, and cancels any flex slots no longer required.
Duely may suspend Platform access (i) for non-payment, including a reversed payment, after Duely tells the Administrator that a charge has failed, (ii) immediately for a Serious Breach (but where the Serious Breach is a breach of clause 2A that was not deliberate, the suspension is limited to the identity verification features), (iii) immediately where Duely reasonably believes continued access poses a security risk to the Platform or to other Subscribers, (iv) where required by law or regulator direction, or (v) immediately in respect of the identity verification features where clause 2A.6 applies. During a suspension, the Firm's data is preserved, the Client keeps read-only access to its records, and its AML/CTF Compliance Officer can continue to prepare and record suspicious matter reports, unless the suspension is under (iii) or (iv) and the security risk or the law requires Duely to block that access.
Duely may also suspend access for any other material breach of this Agreement, including a breach of the Acceptable Use Policy that is not a Serious Breach, that the Client fails to cure within seven (7) days of written notice.

5.1 Fee Changes

(a) Duely may change the Fees (including the Subscription Fee, the rates for additional capacity and the per-use charges) with effect from the next monthly billing cycle by giving the Client at least thirty (30) days' written notice (which may be delivered by email or by in-Platform notice).

(b) A change to the rate for additional capacity applies to capacity the Client already holds from the effective date of the change.

(c) If the Client does not accept a Fee change, the Client may terminate the Subscription with effect from the date the Fee change would take effect by giving written notice to Duely before that date, and Duely will refund any Fees prepaid for the period after that date. Continued use of the Platform after the effective date of the Fee change constitutes acceptance of the new Fees.

(d) Despite (a), Duely may pass through an increase in the charge a third-party or government provider makes to Duely for a per-use check (including identity verification, Document Verification Service, sanctions and PEP screening, AI document processing and registry data) on at least seven (7) days' written notice, capped at the actual increase. Duely will give reasonable evidence of the increase on request, and clause 5.1(c) applies.

5.2 Term and Renewal

(a) Each Subscription is monthly and automatically renews for successive monthly periods at the Fees then applying under clause 5.1, unless cancelled via the billing portal before the end of the current billing period or terminated under clause 5.3.

(b) The Client acknowledges that the Subscription will be charged automatically to the payment method on file on each renewal date.

5.3 Termination

(a) By Duely for convenience: Duely may terminate this Agreement or any Subscription for convenience by giving the Client at least sixty (60) days' written notice. On such termination, Duely will refund any prepaid Fees pro-rata for the unused remainder of the then-current term.

(b) By the Client for convenience: The Client may cancel the Subscription at any time via the billing portal in the Platform. Cancellation takes effect at the end of the then-current billing period in accordance with the Refund and Cancellation Policy. No pro-rata refund is payable on cancellation by the Client outside the 14-day cooling-off period set out in that policy, except under clauses 5.1(c), 5.3(a), 5.3(c), 5.3(e), 8.1(c) and 8.4 and on termination following an objection to a sub-processor under section 4 of the Data Processing Agreement.

(c) By either party for cause: Either party may terminate this Agreement immediately by written notice if the other party (i) commits a material breach that is not remediable, (ii) commits a material breach that is remediable and fails to remedy it within fourteen (14) days of written notice, or (iii) becomes insolvent, bankrupt, or subject to external administration. Where the Client terminates under this clause because of Duely's breach or insolvency, Duely will refund any Fees prepaid for the period after termination.

(d) By Duely for Serious Breach: Duely may terminate immediately for a Serious Breach that was deliberate or reckless, or that has caused or is likely to cause a government agency or verification provider to restrict Duely's access. For any other Serious Breach, Duely may first suspend under clause 5(ii) and may terminate if the breach is not remedied within five (5) business days of notice. Subject to clause 2.1(c), no refund is payable on termination under this clause. Any other breach of the Acceptable Use Policy is dealt with under clause 5.3(c).

(e) By Duely on a provider or agency requirement: Where a verification provider or government agency requires Duely to stop providing the Services, or the identity verification features, to the Client, Duely may terminate this Agreement or withdraw those features by notice. Unless the requirement was caused by the Client's breach of this Agreement or of law, or by the negligent or wrongful act or omission of the Client or its users, Duely will refund any prepaid Fees pro-rata for the unused remainder of the then-current term.

5.4 Payment Terms

(a) Subscription Fees are payable in advance, and per-use charges on the next monthly invoice. Both are charged automatically to the payment method on file when the invoice is issued.
(b) Overdue amounts accrue interest at the Reserve Bank of Australia cash rate plus four percent (4%) per annum, calculated daily and compounded monthly, until paid.
(c) Duely may recover the reasonable costs of collection it actually incurs, including reasonable legal fees and debt-collection agency fees.
(d) All Fees are stated exclusive of GST, which the Client is liable to pay where applicable.

5A. Trial Terms

If Duely offers a trial, evaluation or promotional period, the following apply during that period:

All terms of this Agreement apply, including limitation of liability and acceptable use obligations.
Duely may limit features, storage, or support during the trial period.
Duely may modify, restrict, or terminate a trial at any time with reasonable notice and without liability.
No refunds apply to trial periods. On trial expiry, access to paid features will be suspended unless a paid Subscription is activated.

6. Audit Vault and Data Retention

During the Subscription, Duely keeps tamper-evident evidence packs and matter records (content-hashed at creation and recorded in an append-only audit log) in the Platform.
Read-only access after the Subscription ends: When a Subscription ends (by cancellation, expiry or termination), the Client keeps read-only access to its records in the Platform. Its Authorised Users can sign in to view and download the records the Platform offers for download, such as evidence packs, reports, AML/CTF program versions, documents and training records. The Client may resume its Subscription and get full access back, with all its data. While the Subscription is ended nothing new can be done in the Platform, including creating a new evidence pack or report, so the Client should create any it needs before its Subscription ends. Duely does not prepare exports or supply copies of records on request; the Client downloads what it needs while it has access.
The Client's own record-keeping: The Client's obligations to keep records under the AML/CTF Act (including Part 10 and Part 1A, and sections 107, 111 and 116, which generally require records to be kept for 7 years) are the Client's own. Duely does not keep records for the Client, so the Client must download the records it needs before its data is deleted.
Deletion: Duely will give the Client's Administrator at least thirty (30) days' notice by email before Client Data is deleted or de-identified. When that happens, Duely deletes or de-identifies Client Data in its primary systems: files are deleted and personal information is removed from records. Encrypted backups are overwritten through the normal backup rotation, as set out in section 6A of the Data Processing Agreement. Duely keeps Client Data after the Subscription ends only so that the Client can view, download and resume, and keeps backups only so that the Platform can be recovered after a failure.
What Duely keeps: After deletion Duely keeps, for its own legal obligations: its billing and financial records about the Client, for 7 years (section 286 of the Corporations Act 2001 (Cth)); records of the Client's acceptance of these terms (the version, the date, and the accepting user's name and email address), for 7 years; its records of Document Verification Service consents and checks, which do not hold the individual's name, date of birth or address, for 7 years, as its agreement with the agency administering that service requires; records of any data breach involving the Client's data, for 7 years; and a record of the removal of the Client's data, for 7 years. It may also keep de-identified, aggregated data under clause 3. Backups roll off on their normal cycle. These are Duely's own records and are not available to the Client.
A live image captured for a face match is destroyed within 7 days of capture, except that a copy included in a reliance pack the Firm releases to another firm is kept with that pack as part of the Firm's records, until it is deleted under this clause 6. The face-match and liveness result, provider reference and image hash are retained with the verification record.

7. Service Level Agreements (SLA)

Uptime: Duely targets a 99.5% monthly uptime, excluding planned maintenance, force majeure, and third-party-service failures.
Maintenance: Duely aims to give at least 48 hours' notice of planned maintenance.
Support response targets:
- All Subscriptions: next business day.
- Custom agreements: as specified in the agreement.
The SLA is a service target and not a warranty.

8. General Provisions

8.1 Changes to Terms

(a) Duely may amend this Agreement where reasonably necessary to comply with law or with a requirement of a verification provider or government agency, to protect the security of the Platform, or to reflect a change to the Services, and otherwise by agreement with the Client.

(b) Duely will notify the Administrator at the email on file at least thirty (30) days before a change that is adverse to the Client takes effect, unless a shorter period is required by law or by a provider or agency, in which case Duely will give as much notice as it can. Other changes take effect on publication. Duely may ask the Client to accept the updated Agreement when it next signs in.

(c) The Client may terminate the Subscription by notice before an adverse change takes effect or, where a change took effect with less than thirty (30) days' notice (including on publication) or is a change to the Services under clause 1.1(a), within thirty (30) days after Duely notifies the Client of it. Duely will refund any Fees prepaid for the period after the termination takes effect. Continued use of the Platform after the later of the effective date of a change and the end of that thirty-day period constitutes acceptance.

8.2 Force Majeure

Neither party is liable for any failure or delay in performing obligations under this Agreement to the extent caused by circumstances beyond its reasonable control, including natural disasters, pandemic, government actions, war, terrorism, power failures, internet outages, or failures of third-party service providers. The affected party shall promptly notify the other and use reasonable efforts to mitigate the impact. This clause does not excuse payment of Fees.

8.2A Third-Party Services

The Platform integrates with third-party and government services, including identity verification, screening, payment, and registry providers. Duely is not liable for any failure, delay, error, downtime, change in functionality or pricing, or discontinuation of any third-party service, except to the extent caused by Duely's failure to exercise due care and skill in selecting or managing the provider, and may modify or replace any third-party integration on reasonable notice to the Client.

8.3 Dispute Resolution

Any dispute arising out of or in connection with this Agreement, other than a claim for a liquidated sum, shall be resolved as follows:

Negotiation: The parties shall first attempt to resolve the dispute through good-faith negotiation between senior representatives within thirty (30) days of written notice.
Mediation: If negotiation fails, the parties agree to submit the dispute to mediation administered by the Australian Disputes Centre (ADC) in Brisbane, Queensland, before commencing litigation.
Litigation: If mediation fails to resolve the dispute within sixty (60) days, either party may commence proceedings in the courts of Queensland, Australia.

Nothing in this clause prevents either party from seeking urgent injunctive or equitable relief from a court of competent jurisdiction.

8.4 Assignment

Neither party may assign or transfer this Agreement or any rights or obligations under it without the prior written consent of the other party, except that Duely may assign this Agreement to a successor entity in connection with a merger, acquisition, restructure, or sale of all or substantially all of its assets, provided that the successor agrees to be bound by the terms of this Agreement. Duely will notify the Client of any such assignment, and the Client may terminate the Subscription by notice within thirty (30) days of that notice and receive a pro-rata refund of prepaid Fees.

8.5 Severability

Each paragraph and numbered limb of clauses 2.1, 2.2 and 2.3, and each other provision of this Agreement, is a separate term. If a term or limb is void, unenforceable or unfair, it is to be read down to the extent necessary to make it valid and enforceable, and if it cannot be read down it is severed, without affecting the remaining terms.

8.6 Entire Agreement and Order of Precedence

This Agreement, together with the Data Processing Agreement (DPA), Acceptable Use Policy (AUP), Fair Usage Policy (FUP) and Refund and Cancellation Policy, constitutes the entire agreement between the parties and supersedes any prior representations or agreements relating to its subject matter. The Privacy Policy and the Regulatory Disclaimer are information documents and do not form part of this Agreement. In the event of conflict between these documents, clauses 2 and 2A of this Agreement prevail over every other document, including the DPA. Subject to that, the DPA prevails in relation to the processing of personal data; otherwise the following order of precedence applies:

Master Subscription Agreement (MSA)
Data Processing Agreement (DPA)
Refund and Cancellation Policy
Acceptable Use Policy (AUP)
Fair Usage Policy (FUP)

8.7 Governing Law

This Agreement is governed by the laws of Queensland, Australia. The parties submit to the non-exclusive jurisdiction of the courts of Queensland.

8.8 Survival

Clauses 2 (Limitation of Liability and Regulatory Role), 2.1 to 2.5, 2A (Identity Verification Services), 3 (Data Ownership and Licensing), 4 (Tipping-Off and Confidentiality), 4A (Confidentiality), 5 (for amounts then owing), 5.4 (Payment Terms), 6 (Audit Vault and Data Retention), 7, 8.2A, 8.3 (Dispute Resolution), 8.5, 8.6, 8.7 (Governing Law), 8.8 (Survival), 8.9 (Notices), 8.11 (Restrictions), sections 5, 6A, 7 and 7A of the Data Processing Agreement, and any other provision that by its nature survives, survive termination or expiration of this Agreement.

8.9 Notices

Any notice under this Agreement must be in writing and is given when:

(a) sent by email to legal@duely.com.au (to Duely) or to the Administrator's email address on file (to the Client), and is taken to be received when it becomes capable of being retrieved at that address, unless the sender receives an automated message that it was not delivered;
(b) in the case of a notice from Duely, posted as an in-Platform notice to the Client's Administrator, and is taken to be received when the Administrator next signs in; or
(c) delivered by registered post to the registered office of Ilixir Technologies Pty Ltd as recorded on the ASIC register.

A notice received after 5:00pm Brisbane time, or on a day that is not a business day, is deemed received the next business day.

8.10 Publicity

Duely may name the Client as a customer, or use its logo, only with the Client's written consent. The Client may withdraw that consent at any time by written notice to legal@duely.com.au, and Duely will stop new uses and remove existing ones from material it controls within a reasonable time.

8.11 Restrictions

The Client must not, and must not permit any third party to:

(a) resell, sublicense, or make the Platform available to any person other than Authorised Users of the Client;
(b) use the Platform to build, train, or benchmark a competing product or service;
(c) reverse-engineer, decompile, disassemble, or attempt to derive the source code, structure, or algorithms of the Platform or of any verification flow made available through the Platform, except to the minimum extent permitted by law;
(d) remove, obscure, or alter any proprietary notice on the Platform;
(e) use the Platform or any verification flow made available through the Platform in any manner that could damage, disable, overburden, or impair it or interfere with any other party's use;
(f) use identity opinions, verification results, images or other data obtained through the identity verification features to train, develop or improve any machine-learning or artificial-intelligence model, or to build an identity verification service; or
(g) reproduce, publish, sell or otherwise distribute third-party content included in a screening result (such as news articles or other media content and their metadata), except within the Client's own customer due diligence records, to AUSTRAC, its auditors or independent evaluator, or as the law requires. Duely grants no intellectual property rights in that content.

8.12 Definitions

In this Agreement, capitalised terms have the meanings given to them where first used. The following defined terms apply throughout:

"Administrator" means the Authorised User the Client designates in the Platform as its account administrator or, if none is designated, the person who accepted this Agreement for the Client.
"Authorised User" means an individual employee or contractor of the Client whom the Client has authorised to access the Platform under the Client's Subscription.
"Fees" means the subscription and usage fees payable by the Client for the Services.
"Platform" or "Services" means the Duely software-as-a-service platform and any associated tools, integrations, and documentation made available by Duely.
"identity check" means an identity document check, a biometric liveness or face-match check, or a Document Verification Service check, requested through the Platform in respect of an individual. Screening is not an identity check and is governed by clause 2A.3A.
"identity opinion" has the meaning given in clause 2A.1.
"collection notice" means the notice presented in the Platform to an individual before an identity check that uses their personal information.
"verification provider" means a third party, gateway or government service through which Duely obtains identity, document, biometric or screening results.
"Framework Administrator" means the Commonwealth of Australia acting through the Attorney-General's Department in its role administering the Document Verification Service.
"Protected Party" means the Framework Administrator, each Official Record Holder (the agency or body against whose records a document is checked), Austroads Ltd, each State and Territory Registry of Births, Deaths and Marriages, and each gateway or verification provider whose services Duely uses to deliver the identity verification features.
"Serious Breach" means a breach of clause 2A.4, 2A.4A, 2A.10, 2A.11, 2A.12 or 2A.13; any other breach of clause 2A that is not remedied within five (5) business days of notice; or a breach of section 1, 2, 4 or 5 of the Acceptable Use Policy.
"Subscription" means the Client's monthly Duely subscription, together with any flex customer slots and extra users the Client holds.

9. Version History

2.2 (19 October 2026; for a Client that accepted an earlier version, changes adverse to it take effect 30 days after Duely emails its Administrator, and other changes on publication): clauses 1, 2, 2A, 3, 4A, 5, 6 and 8 and the definitions updated.
Changes between 2.1 and 2.2: 23 September to 14 October 2026, clauses 4 and 5 updated. For a Client that accepted an earlier version, these changes take effect 30 days after Duely emails its Administrator about version 2.2.
2.1 (19 August 2026): named the operating entity; added clause 2A on identity verification services, including the obligations Duely's verification providers and government agencies require.
2.0 (19 May 2026): revised agreement.
1.0 (12 March 2026): first published version.

Master Subscription Agreement (MSA) / Terms of Service