Acceptable Use Policy

First Essential UK

Version: 1.1

Last updated: 9 September 2026

1.What this policy is

This policy sets out what you may and may not do with anything we provide. It applies to:

• our website at firstessential.uk and any other website we operate;
• our customer portal at dashboard.firstessential.uk;
• any platform, software, subscription or integration we supply;
• any AI Assistant, AI tool, voice service, chat or messaging capability we supply or operate;
• any EPOS system, self-service kiosk, card terminal or other equipment we supply; and
• any support, professional services or content we provide.

We call all of these "the Services".

This policy forms part of our Terms of Service when supplied and accepted through the contract process in clauses 2 and 3 of those Terms. The accepted order identifies the Services and applicable document versions. Words defined in the Terms of Service have the same meaning here. The contractual order of precedence and mandatory legal rights in clause 2.2 apply.

Separate payment providers. Where we introduce you to a Payment Provider, you choose that provider and contract directly with it for merchant payment processing, settlement and its payment/PCI requirements. This policy governs the introductions and other Services we actually provide; it does not replace the provider agreement or make us the payment processor or a PCI assessor. We remain responsible for our own representations and separately agreed equipment, configuration and support.

You must ensure that your staff, contractors and anyone you authorise to use the Services follow this policy. You are responsible for their acts and omissions in that use as if they were your own. You must manage permissions, give appropriate instructions and remove access when no longer needed. Unauthorised use is attributable to you only to the extent caused by your or your users' breach or negligence; use of an account alone does not establish who caused a security incident. Section 12 preserves our own responsibilities.

If you are unsure whether something is permitted, ask us first at info@firstessential.uk. We would far rather answer a question than deal with a breach.

2.The general rule

You must use the Services lawfully, honestly, and in a way that does not harm other people, our other customers, our suppliers, our reputation or our systems.

Your business use and instructions. You control the purposes for which you use the Services and the content, data, contact lists, scripts, prices, permissions and settings you supply, select or approve. You must check that these are accurate, lawful and within the agreed scope, keep them current, and obtain the rights, notices and permissions required for that use. If we prepare material for you, you must verify the business facts and permissions only you can confirm; our agreed work remains our responsibility.

These obligations apply to accidental mistakes as well as deliberate conduct. You must check material changes before activation, stop an affected activity when you discover a breach and tell us promptly. Calling something a mistake does not remove responsibility for a breach you caused; it does not make you responsible for our failures or for every unexpected AI output.

Ongoing supervision. Unless expressly included in your order or required by law, we do not undertake to pre-approve or continuously monitor every message, upload, conversation or action by your users. You must supervise your business use and provide the human review and escalation agreed in your order. Access to a tool or our silence is not approval of a particular use. This does not limit agreed safeguards, security monitoring, our duty to address unlawful instructions we identify, or action required when we become aware of misuse or an incident.

This policy does not prevent honest reviews, lawful complaints or reporting concerns to an authority.

3.Content you must not create, upload, store, transmit or generate

You must not use the Services in connection with material that:

• (a)is unlawful, or promotes or facilitates unlawful activity;
• (b)infringes anyone's copyright, trade mark, database right, design right, confidential information, privacy or other rights;
• (c)is defamatory, deliberately false or maliciously misleading;
• (d)is obscene, sexually explicit, or depicts child sexual abuse;
• (e)harasses, bullies, intimidates, threatens or incites violence against any person;
• (f)is discriminatory, or incites hatred on grounds of race, religion, sex, sexual orientation, gender reassignment, disability, age or any other protected characteristic;
• (g)promotes or facilitates terrorism, extreme violence, self-harm or suicide;
• (h)contains malware, viruses, ransomware, keyloggers, or any other harmful code;
• (i)is designed to deceive a person into disclosing credentials, financial details or personal information; or
• (j)you have no right to hold or transmit.

4.Things you must not do

You must not:

• (a)impersonate any person, business or public body, or misrepresent your identity, affiliation or authority;
• (b)use the Services to commit, attempt or facilitate fraud, money laundering, terrorist financing, sanctions evasion, or any other financial crime;
• (c)sell, promote or facilitate goods or services that are illegal to sell in the United Kingdom, or that you are not licensed or authorised to sell;
• (d)resell, sublicense, rent out or make the Services available to any third party, except where your order form expressly allows it;
• (e)copy, modify, adapt, translate, reverse engineer, decompile or disassemble any part of the Services, except where the law expressly gives you that right and you have first asked us for the information you need;
• (f)remove, obscure or alter any proprietary notice, branding or identifier;
• (g)attempt to gain unauthorised access to any part of the Services, to any account other than your own, or to any system, network or data connected to them;
• (h)probe, scan, penetration test, load test or otherwise deliberately stress our systems, or those of our suppliers, without our prior written consent;
• (i)circumvent or attempt to circumvent any authentication, rate limit, usage limit, security control or access restriction;
• (j)scrape, harvest or extract data from the Services by automated means beyond what your order form permits;
• (k)introduce any code or process that damages, disables, overburdens or impairs the Services, or that interferes with any other user's use of them;
• (l)use the Services to send unsolicited bulk communications in breach of section 6;
• (m)do anything that causes us, our suppliers or our other customers to breach a law, a regulator's requirement, a card scheme rule or a supplier's terms; or
• (n)use the Services in a way that could reasonably be expected to damage our reputation or that of our suppliers.

5.Data you must not put into the Services

You must not place into the Services, or allow the Services to capture:

• (a)card security codes (CVV/CVC), PINs, full magnetic stripe data or chip data. Sensitive authentication data must never be retained after authorisation, in any form, including encrypted form, and including in recordings, transcripts, notes, tickets, logs and backups. No customer consent and no disclaimer can make retaining this data acceptable;
• (b)full payment card numbers, except where your order form expressly provides for a compliant, tokenised payment integration and the data flows only through it;
• (c)authentication credentials belonging to other people, or credentials shared between individuals;
• (d)government identification numbers, including passport, national insurance, driving licence and equivalent numbers;
• (e)precise geolocation data;
• (f)special category personal data (including health information), and criminal offence data; the standard Services and standard Data Processing Agreement exclude these categories;
• (g)personal data relating to children; the standard Services exclude this category;
• (h)personal data you have no lawful basis to process, or that you obtained in breach of data protection law;
• (i)data subject to a legal or regulatory restriction that we have not been told about, including data subject to a court order, a legal hold or a security classification;
• (j)anything you are contractually prohibited from disclosing to a third party.

Payment-provider exception. Paragraphs (a) and (b) do not prevent normal entry of payment credentials directly into a Payment Provider-operated secure terminal or hosted payment flow under that provider's separate agreement. They do not permit copying payment credentials into our AI conversations, general enquiry forms, messages, uploads or support records.

These are First Essential's service restrictions. They do not establish that every underlying platform automatically prevents accidental capture. You must not write a script, prompt or form that asks for any of it. If it is captured despite that, stop the capture, remove the prompt, and tell us at once.

Restricted personal data. Our standard Services and standard Data Processing Agreement do not permit health or other special category data, criminal offence data or children's personal data. A general order form, customer consent or account designation does not override that restriction. Any proposed exception requires a separately reviewed agreement, verified supplier permission and implemented safeguards before processing begins. A routine healthcare booking may itself reveal health information and is not automatically within standard scope.

If restricted data reaches the Services by accident, tell us immediately at office@firstessential.uk so that we can help you remove it.

6.Marketing rules

For marketing you initiate or instruct through the Services, you are responsible for your campaign, audience selection, lawful permissions and opt-outs. Uploading a list or using a sending feature does not establish that the contacts may be marketed to. We do not certify permissions merely by supplying the tool. This does not remove any responsibility we have for marketing we prepare, send or instigate, or for a check expressly included in our agreed work.

Incoming calls and service communications. The requirement below for prior consent to automated marketing does not apply merely because an AI Assistant answers an incoming call or makes a genuinely non-promotional administrative callback, confirmation, reminder or service call. These communications must remain relevant to the person’s request or service relationship and comply with the applicable privacy, recording and data-protection requirements.

Callbacks and mixed-purpose calls. A callback may be administrative or promotional, depending on its purpose and content. A form submission or general callback request does not, by itself, establish consent to automated marketing calls. A service communication containing promotional content must meet the applicable marketing requirements.

You must:

• (a)have an appropriate lawful basis for processing personal data and meet the rules applicable to each marketing message or call. Where consent is required, keep evidence of the wording used, the date, the source, the channel and any subsequent withdrawal;
• (b)for email, text and similar electronic-message marketing to individual subscribers, including sole traders and many partnerships, obtain consent or a valid soft opt-in. The soft opt-in requires that you obtained the details directly in the course of a sale or negotiations for a sale, that you market only your own similar products and services, and that you gave an opt-out both at collection and in every message;
• (c)recognise that different rules apply to corporate subscribers for the message itself, but that the personal information involved is still protected by data protection law;
• (d)identify yourself clearly as the sender, and not conceal or falsify your identity or your sending address;
• (e)provide a working, free and simple opt-out in every electronic message, and act on opt-outs promptly;
• (f)maintain and honour a suppression list, and never re-import a suppressed contact;
• (g)carry out screening against the Telephone Preference Service and the Corporate Telephone Preference Service where required for live marketing calls, and screen against your own applicable suppression records;
• (h)display a valid caller line identity that can be called back, and not withhold your number;
• (i)keep to reasonable calling hours and not make repeated unwanted calls; and
• (j)not make silent or abandoned calls.

You must not:

• (k)use purchased, scraped, harvested or "publicly available" contact lists as though they were permission. They are not. Publicly available details do not by themselves give you the right to market to someone;
• (l)make automated marketing calls, including calls made by an AI voice system or that play a recorded message, without specific prior consent to that kind of call. Consent to marketing generally, or to human sales calls, is not sufficient, and this applies to business-to-business campaigns as well;
• (m)send marketing on behalf of a third party through your account without our written agreement;
• (n)make claims about price, availability, savings, performance, endorsement or regulatory status that you cannot substantiate;
• (o)use urgency, scarcity or pressure tactics that are misleading; or
• (p)contact anyone who has objected.

● Specific product requirement for AI calling. Where you use any autonomous or automated AI voice calling capability for marketing, we require you to hold specific prior consent from every person called, including in business-to-business campaigns. This is a condition of use, and we apply it whether or not a particular regulator has yet ruled on real-time generated conversational speech. Uncertainty in the law is not a cold-calling exemption. If you cannot evidence that consent, do not run the campaign.

7.Rules for AI Assistants and AI tools

In addition to everything above, you must not use, configure or permit an AI Assistant or AI tool to:

• (a)assess, triage, diagnose, interpret, prioritise or advise on any symptom, condition, medication, test result or clinical matter, or otherwise influence a clinical decision. Our AI products are not medical devices, are not UKCA marked and are not registered with the MHRA. A service menu must still comply with section 5: a healthcare booking may reveal restricted health data. Inferring clinical needs is prohibited;
• (b)give regulated financial, credit, insurance, investment, legal, immigration or tax advice;
• (c)make, or materially determine, a decision about a person's employment, credit, housing, insurance, education, benefits or access to an essential service, without meaningful review by a person who has the authority and the information to change the outcome;
• (d)claim to be a human being when asked, or be presented to the public in a way designed to conceal that it is automated;
• (e)impersonate a real, identifiable person, or clone a person's voice or likeness without that person's documented permission;
• (f)take, request, repeat, read back or store card details, PINs or card security codes;
• (g)agree prices, discounts, refunds, credits or contractual terms beyond the authority limits recorded on your order form;
• (h)generate content that breaches section 3, or present AI-generated information as fact without the review required by clause 13.4 of our Terms of Service;
• (i)hold or record conversations without giving the notice required by law, including telling people that they are dealing with an automated assistant where that is needed for the processing to be fair, and telling them if the conversation is recorded;
• (j)process special category or criminal offence data outside what section 5(f) permits; or
• (k)be deployed in a regulated activity before you have obtained any approval your own regulator requires.

Approvals and changes. Before an agreed launch, your authorised contact must approve the customer-supplied business facts, scripts or knowledge content, intended audiences, permitted actions and human escalation arrangements in a record that can be saved. Material changes require the same review and any written FE approval required by the Terms or Data Processing Agreement. An approval does not authorise a prohibited use, waive defects in our work or replace the agreed tests. Silence is not approval.

You must review AI-generated content as required by clause 13.4 of our Terms of Service. Expressly agreed real-time conversations may operate automatically within approved information, instructions and authority limits without prior approval of every response. This does not remove the approval requirements above or permit prohibited uses, significant decisions without meaningful human review, or actions outside the agreed scope.

8.Security obligations

You must:

• (a)keep credentials confidential, use strong unique passwords, and enable multi-factor authentication where we make it available;
• (b)grant each user only the access that user needs, and remove access promptly when someone leaves or changes role;
• (c)not share named user accounts between individuals;
• (d)keep your own devices, networks and software patched and protected;
• (e)inspect card terminals and kiosks regularly for tampering, substitution or attached devices, keep a record of the serial numbers deployed at each location, and restrict physical access to authorised staff;
• (f)tell us immediately at office@firstessential.uk if you suspect a compromise of credentials, a security incident, tampering with equipment, or a personal data breach affecting data held in the Services; and
• (g)cooperate with any investigation, and preserve relevant evidence and logs.

Evidence and cooperation. Keep proportionate records of relevant approvals, permissions, user access and material changes. On a reasonably justified request concerning suspected misuse, provide the relevant evidence and cooperate in stopping it. Requests must be limited to what is necessary, respect confidentiality and data protection, and use a secure route. Do not send passwords or unnecessary personal data. This does not authorise unrestricted monitoring or retention beyond the agreed data schedule.

Responsible disclosure. If you find a security vulnerability in our Services, please report it to office@firstessential.uk and give us a reasonable opportunity to fix it before disclosing it to anyone else. Do not access, alter or exfiltrate any data that is not yours, and do not run destructive or disruptive tests. We will not pursue a person who reports a vulnerability in good faith and within these limits.

9.Fair use and resource limits

The Services are provided subject to the usage limits in your order form, including numbers of users, locations, devices, minutes, messages, storage and API calls.

Where a Service is described as unlimited or unmetered, that means normal business use of the kind the Service is designed for. It does not permit use that materially exceeds the pattern of comparable customers, that degrades the Service for others, or that imposes disproportionate cost on us or our suppliers.

If your use exceeds fair use, we will contact you first, explain what we are seeing, and give you a reasonable opportunity to bring usage back into line or to move to a suitable plan. We will only apply a restriction without prior contact where the usage poses an immediate risk to the Service, to security, or to our compliance obligations.

10.Reporting a breach

If you believe someone is using the Services in breach of this policy, tell us at office@firstessential.uk. Please include what you saw, where, when, and any references or evidence. We investigate every report we receive. We will not tell you the outcome where doing so would breach confidentiality or data protection law.

11.What we do if this policy is breached

11.1We assess suspected breaches reasonably and explain the basis for action where lawful. You may challenge our assessment under the complaints procedure; our decision does not prevent independent review or legal remedies.

11.2Depending on the seriousness of the breach, its effect and whether it is repeated, we may:

• ask you to stop, and give you a reasonable period to put it right;
• issue a formal written warning;
• remove or disable the offending content, configuration, campaign or capability;
• apply a usage restriction;
• suspend all or part of the Services under clause 19 of the Terms of Service;
• terminate the contract under clause 18.6 of the Terms of Service;
• disclose information to a regulator, a law enforcement body, a Payment Provider or a card scheme, where we are required to or where it is necessary to prevent or investigate crime; and
• take any other step available to us in law, including recovering losses and costs we incur.

11.3We will give you notice before suspending or terminating, and a reasonable opportunity to put matters right, unless the breach is such that immediate action is needed to prevent harm, to protect security, to comply with the law or a regulator's requirement, or to stop us being in breach of a supplier's terms. Where we act without notice, we will tell you as soon as we reasonably can and explain why.

11.4We will keep any action proportionate to the breach, limit it to the affected Service where practicable, and restore the affected Service promptly once the cause has been resolved to our reasonable satisfaction. Suspension and termination remain subject to clauses 18 and 19 of the Terms, including their payment-dispute and insolvency qualifications.

11.5Charges during suspension. Under clause 19.2 of the Terms, agreed recurring charges may continue during a suspension caused by your payment default or material breach while we keep the Service available to restore. No additional suspension penalty applies. Suspension does not turn a one-off project into a subscription or create new recurring fees; one-off charges follow the agreed order and work performed. Mandatory refund and data exit obligations remain.

11.6Business customers: third-party claims. Subject to any expressly agreed limit for these customer obligations, you must reimburse reasonable, evidenced sums we are legally required to pay to a third party, or agree in a settlement approved under this clause, and reasonable defence costs, to the extent caused by your or your authorised users' material breach of this policy or negligent use of the Services. This includes unlawful customer instructions or marketing, customer material infringing another person's rights, and failures to obtain required rights or permissions or to follow agreed access and data restrictions. An accidental breach is covered only to the extent you or your users are responsible for it.

We must notify you promptly, provide reasonable evidence, take reasonable steps to reduce loss, allow reasonable participation in the defence and obtain your consent to a settlement you fund, not unreasonably withheld or delayed. If late notice prejudices your defence, your obligation is reduced to that extent. We retain control of responses that we are legally required to make. Recovery excludes the part caused by our own breach, negligence or wilful misconduct, including failures of suppliers for which we are legally responsible, and any fine or other amount that cannot lawfully be transferred. An allegation alone does not establish your liability. No loss is recoverable twice. This clause does not apply to consumers or transfer our mandatory regulatory duties.

11.7Business customers: additional remediation costs. Where your or your authorised users' material breach or negligent use causes additional work outside our agreed scope, we may recover reasonable, evidenced and foreseeable direct costs of containing and correcting that customer-caused problem. Recovery is limited to the part you caused, excludes loss caused by our own or our responsible suppliers' failures, and includes no penalty, speculative future revenue or amount already recovered under another clause. We will explain the work and cost basis, give an estimate and seek agreement before non-urgent work. Urgent protective action is limited to what is reasonably necessary, with prompt notice and an itemised account. Genuine billing disputes follow clause 15.5 of the Terms. The Data Processing Agreement takes priority for processing-related assistance and charges; a fee dispute must not delay a legal duty, and work already included in our obligations is not an extra service.

12.Our own conduct

This policy governs your use of the Services. We remain responsible for performing our agreed work with reasonable skill and care, implementing agreed safeguards, complying with our own data protection duties and taking required action on known unlawful instructions or incidents. Our responsibility for subprocessors under the Data Processing Agreement is not transferred to you. Any exclusion or limitation of our business liability remains subject to clause 21 of the Terms and applicable law; consumer rights remain protected by clause 24. Where both parties contribute to a loss, this policy allocates costs only to the extent each is responsible, without limiting a third party's statutory rights. We will act proportionately and in good faith.

13.Changes to this policy

We may update this policy. For contracted customers, changes follow clause 6 of the Terms of Service: at least 30 days' written notice of a material change, with the right to end the affected Service and receive the applicable refund if the change materially and adversely affects you. Changes required by law may take effect on shorter notice. A supplier or card-scheme request alone does not remove these contractual rights. Immediate protective action under section 11 remains separate from changing the contract.

14.Contact

First Essential UK is a trading name of First Essential Holdings Ltd, registered in England and Wales under company number 15619967. Registered office: 10 Montague Place, Worthing, West Sussex, BN11 3BG, United Kingdom.