Terms of Service

MIE Auth: the authentication service at https://auth.mhglobalgroup.com

Effective from: 1 August 2026

In short. These Terms are the agreement between you and MH Global Group Limited for your use of MIE Auth, a hosted service that signs people in to applications and tells those applications who they are and what they may do.

• You need an account, you must keep your sign-in credentials to yourself, and you are responsible for what happens under your account.
• Two-factor authentication is compulsory for privileged roles and cannot be waived.
• You must not attack the Service or use it to sign people in to unlawful applications. That includes credential stuffing, automated enumeration, and working around our rate limits or bot checks.
• An organisation is run by its owner, who decides who joins, what role they hold, and when they leave. Removing a member ends that member's access immediately. A sole owner must transfer ownership before erasing their own account.
• We make no uptime promise unless we have separately agreed one in writing, and we may change or withdraw features on reasonable notice.
• Our liability is limited, but not for the things the law does not allow us to limit.
• You can export your data or erase your account yourself at any time.

This summary is written for orientation only. The numbered sections below are the operative terms, and where the summary and a numbered section differ, the numbered section prevails.

Contents

1. Who we are, and how these Terms apply

1.1 The MIE Auth service at https://auth.mhglobalgroup.com (the 'Service') is operated by MH Global Group Limited, a company registered in England and Wales under company number 16317481, whose registered office is at 16 St. Clare Street, London, England, EC3N 1LQ ('we', 'us', 'our'). MIE Auth is the name of the Service; MH Global Group Limited is the party contracting with you under these Terms.

1.2 These terms of service (the 'Terms') govern your access to and use of the Service, including its web interface, its application programming interface (the 'API'), and the documentation we publish with it.

1.3 You accept these Terms by creating an account, by signing in, or by otherwise using the Service. If you do not accept them, you must not use the Service.

1.4 If you accept these Terms on behalf of an organisation, company or other body, you confirm that you are authorised to bind it, and 'you' means both you personally and that body.

1.5 Individuals and organisations. An Account belongs to an individual person. An Organisation is created by an Account, which becomes its Owner. Members join an Organisation by invitation and continue to hold their own individual Accounts. These Terms therefore bind each Member individually in respect of their own Account, and bind the Organisation in respect of the Organisation's use of the Service, including the acts and omissions of its Members and Administrators.

1.6 Where we have entered into a separate written agreement with an Organisation covering the same subject matter, that agreement prevails over these Terms to the extent of any conflict, and only in respect of that Organisation's use of the Service.

2. Definitions

In these Terms:

• 'Access Token' means a short-lived signed token issued by the Service so that a Relying Application can verify a signed-in user.
• 'Account' means an individual user record on the Service, identified by a verified email address.
• 'Administrator' means a Member holding a role that permits management of an Organisation, its nodes, its members or their roles.
• 'API Key' means a long-lived bearer credential issued through the Service for machine-to-machine access.
• 'Credentials' means anything that can be used to sign in to or act through an Account, including passwords, one-time codes, two-factor secrets, backup codes, passkeys, magic links, session cookies, Access Tokens and API Keys.
• 'Member' means an Account that belongs to an Organisation.
• 'Organisation' means a tenant on the Service, together with its node hierarchy, roles, assignments and records.
• 'Owner' means a Member holding the owner role for an Organisation.
• 'Privacy Notice' means our privacy notice published on the Service, which forms part of these Terms.
• 'Relying Application' means an application, site or system that uses the Service to authenticate or authorise its users.

3. What the Service does

3.1 The Service is a hosted, multi-tenant authentication service. In plain terms, it allows a Relying Application to hand over the questions 'who is this person?' and 'are they permitted to do this?' to us.

3.2 As operated today, the Service provides:

• sign-in methods: email and password; and, where the corresponding credentials have been configured for the deployment, Google, Microsoft Entra ID, GitHub, Apple and the other social providers the Service supports. The Service also supports passkeys (WebAuthn), sign-in links sent by email, and one-time codes sent by email. Sign-in links and email one-time codes sign in existing Accounts only; they cannot create an Account;
• two-factor authentication: time-based one-time codes from an authenticator application, with backup codes, and one-time codes by email as a weaker fallback;
• organisations and roles: a hierarchy of organisation nodes, with roles assigned at a node and applying to that node and everything beneath it;
• machine access: Access Tokens valid for 15 minutes, and API Keys for programmatic access;
• security controls: bot mitigation on sign-in and sign-up using Cloudflare Turnstile, per-address and per-network rate limiting, account lockout after repeated failed sign-ins, rejection of passwords found in known breach corpora, an audit trail, and optional per-Organisation policies including compulsory two-factor authentication and network allow-lists; and
• compliance functions: self-service export of your own personal data and self-service erasure of your Account, and an Organisation-scoped export of the audit trail for Members who hold the necessary permission.

3.3 The description in clause 3.2 records how the Service works at the date of these Terms. It is not a specification, and we may change it in accordance with clause 10.

4. Your account

4.1 Eligibility. You must be at least 16 years old to hold an Account. The Service is intended for use by businesses and other organisations and is not directed at children.

4.2 Verification. A new Account must verify its email address before it can be used to sign in. An unverified Account cannot sign in.

4.3 Accuracy. You must give an email address that is genuine, that you control, and that you keep current. If you can no longer receive email at the address on your Account, you may lose access to it, because that address is where password resets, sign-in links, one-time codes and security notifications are sent.

4.4 Changing your email address. A request to change the email address on an Account is confirmed by a link sent to the address currently on the Account. This is deliberate: the current mailbox is the only one that can properly authorise moving an Account away from itself.

4.5 One person per Account. An Account represents one individual. You must not create an Account for a person other than yourself except through the invitation flow, and you must not use an Account that was issued to someone else.

5. Credentials, two-factor authentication and account security

In short. Your Credentials are yours alone. Sharing them makes you responsible for whatever the person you shared them with does, and we treat the resulting activity as yours.

5.1 Passwords. Passwords must be at least 12 and at most 256 characters. We reject passwords that appear in known public breach corpora. That check is performed using k-anonymity: only a short prefix of a cryptographic hash of your password is sent to the breach-data service, never your password and never the full hash, and the service that receives the prefix cannot tell which password it belongs to. See the Privacy Notice for further detail.

5.2 Two-factor authentication. You may enable two-factor authentication on your Account at any time. Two-factor authentication is compulsory for privileged roles: staff, admin and superadmin. A holder of one of those roles who has not enrolled cannot use the administrative or support surface, and we will not waive that requirement for anyone.

5.3 Recovery credentials. Backup codes and authenticator secrets are recovery credentials of the same class as a password. Treat them accordingly, store them somewhere only you can reach, and regenerate them if you suspect they have been seen by anyone else.

5.4 API Keys. An API Key is a bearer credential: whoever holds it can act as the Account it belongs to, without a password and without a second factor. You must store API Keys securely, must not commit them to source control or embed them in client-side code, must rotate them periodically, and must delete keys you no longer need. Creation, update and deletion of API Keys are recorded in the audit trail.

5.5 Sessions. A session lasts 7 days and is extended while it is in use. You can review your active sessions, with the network address and browser recorded for each, and revoke any of them from your account dashboard. Sign out on shared or public devices.

5.6 Consequences of sharing access. You must not share your Credentials, allow anyone else to use your Account, or use another person's Account. If you do:

• everything done through your Account is treated as done by you, and you remain responsible for it, including under clause 16;
• the audit trail will attribute those actions to your Account, and we are under no obligation to distinguish between you and someone you gave access to; and
• we may suspend the Account under clause 13 where sharing creates a security risk to the Service or to an Organisation.

5.7 Compromise. You must notify us at info@mhglobalgroup.com without undue delay if you believe your Account, an API Key, a second factor, or an Organisation's data has been compromised, and you must change the affected Credentials immediately.

5.8 Security notifications. We send notifications by email for security events on your Account, including a sign-in from a device we have not seen before, a password change, a password reset, enabling or disabling two-factor authentication, regenerating backup codes, a requested email-address change, account lockout, and account deletion. You cannot opt out of these messages. They are not marketing; they are frequently the only channel that reaches the owner of an Account that has already been taken over. Changing or resetting your password, and enrolling in two-factor authentication, also end your other sessions.

6. Acceptable use

In short. Do not attack the Service, do not use it to attack anyone else, and do not use it to sign people in to something unlawful.

6.1 You must not, and must not permit or encourage any other person to:

• test credentials in bulk: carry out credential stuffing, password spraying, brute-force or dictionary attacks, or submit credentials obtained from a breach, a phishing campaign or any other source without the account holder's authority;
• enumerate: use automated means to discover or confirm the existence of Accounts, email addresses, Organisations, Organisation slugs, Members, API endpoints, identifiers or invitations, whether by scripted requests, by observing responses or timings, or by any other means;
• circumvent our protections: evade, disable, degrade or exhaust the rate limits, account lockout, bot mitigation, send throttles, quotas or policy controls described in clause 7, including by distributing requests across networks or addresses to stay under a limit, by relaying or farming out Turnstile challenges, or by forging or replaying a challenge token;
• test our security without permission: conduct penetration testing, vulnerability scanning, fuzzing, load testing or any similar assessment of the Service without our prior written permission. Request permission at info@mhglobalgroup.com before you begin, and expect us to agree scope, timing and reporting first. If you discover a vulnerability without looking for one, report it to info@mhglobalgroup.com promptly, do not exploit it beyond what is necessary to demonstrate it, and do not disclose it publicly until we have had a reasonable opportunity to remedy it;
• authenticate unlawful applications: use the Service to sign users in to, or to authorise access to, any application, site or system that is unlawful, that distributes malware, that facilitates fraud, phishing or impersonation, that infringes another person's rights, or that holds or processes content you have no right to hold or process;
• abuse our sending domain: use the invitation, verification, sign-in-link, one-time-code or password-reset flows to send unsolicited messages, to send repeated messages to an address in order to flood or harass its holder, or to reach people who have not asked to hear from you;
• access what is not yours: attempt to access an Account, Organisation, node, record or token that you have not been granted access to, or retain access after it has been withdrawn;
• interfere: introduce malicious code, interfere with the operation or integrity of the Service, or attempt to derive source code from it by reverse engineering, decompilation or disassembly except to the extent that this cannot lawfully be restricted;
• misrepresent: misstate your identity, your affiliation, or your authority to act for an Organisation; or
• make the Service available to others: resell, sub-license, rent, lease or otherwise make the Service available to any third party, except as clause 12.2 expressly permits or as a separate written agreement with us allows.

6.2 You must comply with all laws applicable to your use of the Service, and you must ensure that your Members and your Relying Applications do the same.

6.3 A breach of this clause 6 is a material breach of these Terms and may result in immediate suspension under clause 13.

7. Automated protections and enforcement

7.1 The Service applies automated protections to authentication traffic. As configured by default at the date of these Terms:

• requests that change state at an authentication endpoint are limited to 30 per network address in a rolling 60-second window, and a separate budget of the same size applies to the rest of the API, so that ordinary traffic cannot exhaust the sign-in budget;
• an Account is locked for 15 minutes after 5 failed sign-in attempts, and the failure counter decays after an hour;
• sign-in and sign-up require a Cloudflare Turnstile challenge, which we verify on the server and pin to our own hostnames and to the form being submitted; and
• messages sent to a given recipient address by the reset, verification, sign-in-link, one-time-code and invitation flows are throttled per recipient.

7.2 These values are configuration, not commitments. We may change them at any time, including tightening them sharply and without notice while an attack is in progress. A lockout is temporary and clears by itself; if you are locked out and cannot wait, contact support.

7.3 Denied requests are recorded in the audit trail, including the reason, the network address, the browser user-agent string and the email address that was targeted. The Privacy Notice explains what those records contain and how long we keep them.

7.4 We may refuse, throttle or block traffic that we reasonably consider to be abusive, automated or a threat to the Service or to its users, without prior notice.

8. Organisations, owners and members

In short. The Owner runs the Organisation. Owners and Administrators invite Members and set their roles; removing a Member ends that Member's access straight away. A sole Owner must hand ownership to someone else before erasing their own Account, because otherwise the Organisation would be left with nobody able to administer it.

8.1 The Owner's authority. The Account that creates an Organisation becomes its Owner and is provisioned with the Organisation's root node and an owner assignment on it. The Owner, and any Administrator the Owner appoints, may invite and remove Members, create and delete nodes, assign and withdraw roles, and configure the Organisation's security policy. You acknowledge that where you are a Member of an Organisation, the Owner and its Administrators exercise that authority over your access to that Organisation and its data.

8.2 Adding Members. Members are added by invitation to an email address. An invitation names the Organisation and the person who sent it. Accepting an invitation creates a role assignment on the Organisation's root node derived from the role in the invitation. Invitations expire, and an Organisation must not use them to send unsolicited messages (see clause 6.1).

8.3 Roles. Roles are assigned at a node and apply to that node and to every node beneath it. It is the Organisation's responsibility, not ours, to grant appropriate roles, to review them, and to withdraw them when they are no longer needed.

8.4 Removing Members. When a Member is removed from an Organisation, that Member's role assignments for that Organisation are withdrawn and any session scoped to that Organisation is deleted, so their access to it ends at once rather than at the end of their session. Sessions the Member holds for other Organisations are unaffected. Access Tokens already issued are rejected by the Service once the underlying session has been revoked; a Relying Application that has cached its own session must end it independently. Removal does not delete the Member's Account, which continues to exist independently of the Organisation.

8.5 Organisation security policy. An Organisation may require its Members to use two-factor authentication and may restrict access to specified network addresses. If your Organisation enables either, you must satisfy it in order to use the Service in that Organisation's context. We are not responsible for an Organisation locking out its own Members through its own policy configuration, although our support desk can assist under clause 9.

8.6 The last Owner. An Organisation must at all times have at least one Owner. A request to remove the only Owner from an Organisation is refused. Promote another Owner first.

8.7 Transfer of ownership before erasure. If you are the sole Owner of an Organisation that still has other Members, your request to erase your own Account is refused, and nothing is erased. You must transfer ownership to another Member first. This exists because the alternative (an Organisation that nobody can administer, invite to, or delete) cannot be repaired without direct intervention in the production database.

8.8 Erasure by the last Member. If you are the only Member of an Organisation and you erase your Account, that Organisation is deleted with you, together with its node hierarchy, its invitations, its role assignments and the records it holds. This is irreversible.

8.9 Responsibility for Members and end users. An Organisation is responsible for its Members' compliance with these Terms, for the lawfulness of the Relying Applications it authenticates, and for the accounts it causes to be created.

9. Operator and support access

9.1 Our operators can perform support actions on the Service, including unlocking a locked Account, resetting a lost second factor, exporting a user's data on their behalf, erasing an Account on request, relaxing an Organisation's network allow-list where the Organisation has locked out its own Members, and signing in as a user in order to reproduce a fault.

9.2 Every one of those actions requires both an administrative role and a verified second factor, and every one writes a record to the audit trail identifying the operator who performed it and the subject it was performed on. Signing in as a user is recorded against the operator, not against the user, so that the trail shows who actually acted.

9.3 We perform support actions to operate, secure and support the Service, to respond to a request from you or from your Organisation, or where we are required to do so by law.

10. Availability, maintenance and changes to the Service

10.1 No uptime commitment. We make no commitment as to the availability, uptime or response time of the Service unless we have agreed one with you separately and in writing. Nothing published about our operational practices (including any status page, monitoring probe or operations documentation) constitutes such a commitment.

10.2 Maintenance. We may suspend access to the Service for maintenance. Where maintenance is planned and we expect it to be disruptive, we shall give reasonable notice. Emergency maintenance, including action to contain a security incident, may be carried out without notice.

10.3 Changes to the Service. We may add to, modify, or discontinue any part of the Service. Where a change is material and adversely affects your use of the Service (for example the withdrawal of a sign-in method or of an API endpoint on which you rely), we shall give you reasonable notice, by email to the address on your Account or by notice within the Service, unless the change is required for security, legal or operational reasons that make notice impracticable.

10.4 Third-party dependencies. Parts of the Service depend on third parties (see clause 18). A change or withdrawal by one of those third parties may require us to change the Service at short notice.

10.5 Limits. We may impose or vary technical limits on the Service, including those described in clause 7 and limits on the number of Organisations, nodes, Members, invitations, API Keys or requests.

11. Fees

11.1 The Service may be provided to you free of charge or on paid terms agreed separately in writing. Where fees apply, they are payable as set out in that separate agreement.

11.2 Where the Service is provided free of charge, we may begin to charge for it, or withdraw it, on reasonable notice given in accordance with clause 10.3.

11.3 Non-payment of fees that have fallen due is a material breach of these Terms.

12. Intellectual property and licence

12.1 Ownership. The Service, its software, its interfaces, its documentation, its designs and the MIE Auth and MIE Group names and logos are owned by us or by our licensors. Nothing in these Terms transfers any of those rights to you. All rights not expressly granted are reserved.

12.2 Licence to you. We grant you a non-exclusive, non-transferable, non-sub-licensable, revocable licence, for the term of these Terms, to access and use the Service in accordance with these Terms and any documentation we publish, for your own internal business purposes. That licence expressly includes using the Service to authenticate the users of your own Relying Applications, and permitting your Members to use the Service for that purpose. It does not permit you to make the Service available to third parties as a service of your own.

12.3 Your material. You retain all rights in the data and content you or your Members submit to the Service. You grant us a licence to host, store, transmit, display and process that material to the extent necessary to provide, secure and support the Service, and to comply with our legal obligations. That licence ends when the material is deleted, save to the extent it persists in backups or in the audit archive for the periods described in clause 13.6 and in the Privacy Notice.

12.4 Feedback. If you send us suggestions or feedback about the Service, we may use them without restriction and without any obligation to you.

12.5 No trade mark licence. These Terms do not grant either party the right to use the other's name, logo or trade marks without prior written consent.

13. Suspension and termination

In short. You can leave at any time and erase your Account yourself. We can suspend or end your access if you breach these Terms or put the Service at risk. Afterwards, your Account data is deleted, but the security audit record of what happened is kept.

13.1 Termination by you. You may stop using the Service at any time. You may erase your Account yourself from the account dashboard, or through the API at DELETE /api/compliance/me. Erasure requires you to confirm by typing your email address and, where your Account has a password, to enter it. Erasure is immediate and irreversible. If you are the sole Owner of an Organisation with other Members, clause 8.7 applies and you must transfer ownership first.

13.2 Exporting first. You may export a machine-readable copy of your personal data at any time from the account dashboard or through the API at GET /api/compliance/me/export. We recommend you do so before erasing your Account, because afterwards there is nothing left to export.

13.3 Suspension by us. We may suspend your Account, an Organisation, an API Key, or your access to any part of the Service, in whole or in part and with immediate effect, where we reasonably consider that:

• you are in breach of these Terms, and in particular of clause 6;
• your Account or an Organisation has been compromised, or its continued operation presents a security risk to the Service or to other users;
• suspension is required by law, by a regulator, or by an order of a court; or
• fees that have fallen due remain unpaid.

13.4 Notice and reinstatement. We shall notify you of a suspension and of its reason, before it takes effect where practicable and otherwise as soon as reasonably practicable afterwards. Where the cause is capable of remedy and you remedy it, we shall lift the suspension without undue delay.

13.5 Termination by us. We may terminate these Terms and close your Account:

• immediately on notice, where you are in material breach of these Terms and the breach is not capable of remedy, or is capable of remedy and you have not remedied it within 14 days of our notice requiring you to do so;
• immediately on notice, where you become insolvent, enter into any formal insolvency process, or cease to carry on business; or
• otherwise, on reasonable notice, where we discontinue the Service in accordance with clause 10.3.

13.6 What happens to data afterwards. On erasure of an Account, or on termination followed by erasure:

• the Account record is deleted, and with it the sessions, linked social sign-in records, two-factor enrolment and backup codes, passkeys, API Keys, organisation memberships, role assignments and outstanding password-reset and delete-account tokens associated with it; any other short-lived sign-in token issued to that address expires on its own and is removed by an automated sweep; pending invitations addressed to that email address are deleted; the address is removed from our email suppression list; and records the Account authored within an Organisation have their authorship attribution removed while the Organisation's own record is retained;
• where the Account was the only Member of an Organisation, that Organisation and its contents are deleted, as described in clause 8.8;
• the audit trail is retained. It is an append-only security record and is not erased with the Account. Audit records remain available online for 90 days and are then moved to archival storage, where they are retained as our long-term security and accountability record;
• backups. A nightly export of the production database is configured, and every export is deleted automatically 35 days after it is taken. Data erased from the live Service may therefore persist in a backup until that backup expires; we do not restore individual records from backups, and a restored backup is re-subjected to erasure requests;
• operational logs are retained for approximately 7 days; and
• Access Tokens already issued cease to be accepted by the Service once the session or Account they were issued against no longer exists. An Access Token has a lifetime of 15 minutes, which bounds the window in which a Relying Application relying solely on its own token validation might still accept one.

13.7 The Privacy Notice describes these retention periods, and the lawful bases for them, in full.

13.8 Survival. Clauses 5.6, 6, 12, 13.6, 14, 15, 16, 17, 22 and 23, and any other provision which by its nature is intended to survive, shall survive termination or expiry of these Terms.

14. Warranties and disclaimers

14.1 We warrant that we shall provide the Service with reasonable care and skill.

14.2 Except as expressly stated in these Terms, and subject to clause 15.1, the Service is provided 'as is' and 'as available', and we exclude all other warranties, conditions, terms and representations, whether express or implied by statute, common law or otherwise, to the fullest extent permitted by law. In particular, we do not warrant that:

• the Service will be uninterrupted, timely, secure or free from error;
• the Service will meet your requirements or be fit for any particular purpose you have in mind;
• defects will be corrected within any given time; or
• the Service will prevent every unauthorised access to an Account, since the effectiveness of authentication depends in part on the Credentials, devices, mailboxes and configuration choices under your control and under the control of your Members.

14.3 You remain responsible for your own applications. The Service tells a Relying Application who a user is and what roles they hold. Deciding what a user may then do in your application, and enforcing that decision, remains yours. You must validate tokens and sessions as our documentation describes, and you must not rely on the Service as your only security control.

14.4 Backups of your own systems. You are responsible for maintaining your own records of the configuration and data you rely on within your Relying Applications.

15. Limitation of liability

In short. We do not limit liability for the things the law says we cannot: death or personal injury caused by our negligence, and fraud. For everything else, our total liability is capped by reference to what you have paid us in the year before the claim, and we are not liable for indirect or consequential loss.

15.1 What we never exclude. Nothing in these Terms excludes or limits our liability for:

• death or personal injury caused by our negligence;
• fraud or fraudulent misrepresentation;
• any other liability which cannot lawfully be excluded or limited.

Nothing in these Terms affects the statutory rights of a consumer.

15.2 What we are not liable for. Subject to clause 15.1, we shall not be liable to you, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for:

• loss of profits, revenue, business, contracts, anticipated savings or goodwill;
• loss or corruption of data, except to the extent it results from our breach of clause 14.1;
• business interruption or loss of opportunity; or
• any indirect or consequential loss,

in each case whether or not that loss was foreseeable and whether or not we had been advised of the possibility of it.

15.3 Cap. Subject to clause 15.1, our total aggregate liability to you arising out of or in connection with these Terms and the Service, whether in contract, tort (including negligence), breach of statutory duty or otherwise, shall not exceed the total fees paid by you to us for the Service in the twelve months immediately preceding the event giving rise to the claim. Where no fees have been paid by you in that period, our total aggregate liability shall be limited to re-performing the affected part of the Service.

15.4 Third parties and misuse. Subject to clause 15.1, we are not liable for loss arising from:

• the acts or omissions of a third-party identity provider, network, hosting or email service on which the Service depends (see clause 18);
• use of Credentials by any person to whom you disclosed them, or who obtained them because you failed to keep them secure;
• an Organisation's own configuration decisions, including role assignments, security policy and the removal of Members; or
• your failure to act on a security notification sent under clause 5.8.

15.5 Apportionment. Each provision of this clause 15 operates separately. If any part is held to be unenforceable, the remainder continues to apply.

16. Indemnity

16.1 If you are acting in the course of a business, or where you accept these Terms on behalf of an organisation, company or other body under clause 1.4, you shall indemnify us against all liabilities, costs, expenses, damages and losses (including reasonable legal costs) suffered or incurred by us arising out of or in connection with:

• your breach of clause 6 (acceptable use);
• any claim that a Relying Application you authenticate using the Service, or content you or your Members hold or process through it, is unlawful or infringes the rights of any person;
• any claim brought by a Member, an end user or a third party in respect of your acts or omissions as an Organisation, including your grant, withdrawal or misuse of roles and access; and
• your use of the Service in breach of any applicable law.

16.2 We shall notify you promptly of any claim to which this indemnity applies, shall not settle it without your consent (not to be unreasonably withheld), and shall give you reasonable assistance, at your cost, in defending it.

16.3 This clause 16 does not apply to an individual acting wholly or mainly outside that individual's trade, business, craft or profession.

17. Confidentiality

17.1 Each party may receive information from the other which is confidential. Our confidential information includes non-public details of the Service's security configuration, including rate-limit and lockout parameters beyond those published in clause 7, and any vulnerability disclosed to or by us until it has been remedied.

17.2 Each party shall keep the other's confidential information confidential, use it only for the purposes of these Terms, and disclose it only to those of its personnel and advisers who need it and who are bound by equivalent obligations.

17.3 These obligations do not apply to information which is or becomes public other than through a breach of this clause, which was already lawfully held free of any obligation of confidence, or which is independently developed. A party may disclose confidential information to the extent required by law, by a court or by a regulator, giving the other party notice where it is lawfully able to do so.

18. Third-party services

18.1 The Service relies on third parties, including:

• identity providers: whichever of Google, Microsoft Entra ID, GitHub, Apple and the other supported providers has been configured for the deployment. If you choose to sign in using one of these, that provider's own terms and privacy notice govern your relationship with it, and it will tell us that you signed in successfully together with the limited profile information described in the Privacy Notice;
• Cloudflare, which provides the compute, database, storage and bot mitigation on which the Service runs;
• an email delivery service, which delivers verification, reset, invitation and security messages. The Service sends through Cloudflare's email service where that is configured for the deployment, and otherwise through a third-party delivery provider; the Privacy Notice names the provider in use; and
• a breach-data service, queried using the k-anonymity method described in clause 5.1 when a password is set or changed.

18.2 We do not control those third parties. We are not responsible for their availability, their acts or omissions, or changes they make to their own services, and their withdrawal or change may require us to change the Service under clause 10.4.

18.3 If a third-party identity provider suspends or removes your account with it, you may lose the ability to sign in by that method. Where your Account has a password or another enrolled method, you can continue to use that instead.

19. Data protection

19.1 Our handling of personal data is described in the Privacy Notice, which forms part of these Terms and which explains what we hold, why, for how long, where it is stored, and the rights available to you under the UK GDPR and the Data Protection Act 2018.

19.2 If you use the Service to authenticate individuals (your staff, your customers or the users of a Relying Application), you are responsible for having a lawful basis for doing so, for giving those individuals the information the applicable data protection law requires, and for responding to their requests in respect of your own processing.

19.3 Each party shall comply with the data protection legislation applicable to it. Where we process personal data on behalf of an Organisation, these Terms constitute the contract required by Article 28(3) UK GDPR. The subject matter and duration of the processing, its nature and purpose, the types of personal data and the categories of data subject are those described in the Privacy Notice. We shall: process that personal data only on the Organisation's documented instructions (these Terms and the Organisation's use of the Service being such instructions) unless required otherwise by law; ensure that personnel authorised to process it are bound by confidentiality; apply the technical and organisational measures described in the Privacy Notice; engage only the sub-processors listed in the Privacy Notice, giving the Organisation notice before adding or replacing one and an opportunity to object; assist the Organisation with data subject requests and with its obligations under Articles 32 to 36; delete or return the personal data at the end of the arrangement, save for the audit trail described in clause 13.6; and make available the information necessary to demonstrate compliance and allow for audits. Where we have entered into a separate data processing agreement with an Organisation, that agreement prevails to the extent of any conflict.

19.4 Data protection enquiries may be sent to info@mhglobalgroup.com.

20. Changes to these Terms

20.1 We may change these Terms. The current version is always published on the Service, with the date it took effect.

20.2 Where a change is material, we shall give you reasonable notice before it takes effect, by email to the address on your Account or by notice within the Service. Where a change is required by law, by a regulator, or to address a security risk, it may take effect immediately.

20.3 If you continue to use the Service after a change takes effect, you accept the changed Terms. If you do not accept them, you must stop using the Service and may erase your Account under clause 13.1.

21. Notices

21.1 Notices to you are given by email to the address on your Account, or by notice within the Service, and are deemed received at the time of sending unless we receive a delivery failure. You must keep that address current (clause 4.3).

21.2 Notices to us are given by email to info@mhglobalgroup.com. A notice that these Terms or the law require to be in writing must also be sent by post to MH Global Group Limited, 16 St. Clare Street, London, England, EC3N 1LQ, and is deemed received on the second working day after posting.

22. General

22.1 Assignment. You may not assign, transfer, charge or sub-contract any of your rights or obligations under these Terms without our prior written consent. We may assign or transfer these Terms to a company acquiring our business or assets to which they relate, and shall notify you if we do.

22.2 Entire agreement. These Terms, together with the Privacy Notice and any separate written agreement referred to in clause 1.6, constitute the entire agreement between us in relation to the Service, and supersede all previous agreements, statements and understandings between us in relation to it. Neither party has relied on any statement or representation not set out in these Terms, save that nothing in this clause limits liability for fraudulent misrepresentation.

22.3 Severability. If any provision of these Terms is held to be invalid, illegal or unenforceable, it shall be modified to the minimum extent necessary to make it enforceable, or if that is not possible, deleted. The remaining provisions continue in full force.

22.4 No waiver. A failure or delay in exercising any right under these Terms is not a waiver of that right, and no single or partial exercise of a right prevents its further exercise.

22.5 No partnership or agency. Nothing in these Terms creates a partnership, joint venture, agency or employment relationship between the parties.

22.6 Force majeure. Neither party is liable for a failure or delay in performing its obligations (other than an obligation to pay) caused by an event beyond its reasonable control, provided it notifies the other and takes reasonable steps to mitigate. Our obligation is limited to using reasonable endeavours to restore the Service.

22.7 Third-party rights. A person who is not a party to these Terms has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce any of their provisions. This does not affect any right or remedy of a third party which exists, or is available, apart from that Act.

22.8 Interpretation. Headings are for convenience only and do not affect interpretation. 'Including' and 'for example' are not words of limitation. References to a statute include any amendment or re-enactment of it.

23. Governing law and jurisdiction

23.1 These Terms, and any dispute or claim (including any non-contractual dispute or claim) arising out of or in connection with them, their subject matter or their formation, are governed by and construed in accordance with the law of England and Wales.

23.2 Each party irrevocably agrees that the courts of England and Wales shall have exclusive jurisdiction to settle any such dispute or claim. Nothing in this clause prevents either party from applying to any court of competent jurisdiction for interim or injunctive relief, or affects the rights of a consumer to bring proceedings in the courts of their place of residence where the law gives them that right.

24. How to contact us

• Legal notices, security reports, requests for testing permission and data protection enquiries: info@mhglobalgroup.com
• Telephone: +44 207 377 9630
• Registered office: MH Global Group Limited, 16 St. Clare Street, London, England, EC3N 1LQ, a company registered in England and Wales under company number 16317481