network360 client agreement

Version 1.0 (8 November 2026)

6 November 2026 · Draft 0.1 for counsel

This agreement is between LBVC (Pty) Ltd ("LBVC") and the organisation named in the order form ("the Client"). It follows LBVC's Terms of Service and adds what network360 needs under POPIA, the GDPR and the EU AI Act. Text in [square brackets] is completed per client.

1. Documents and order of precedence

1.1 The agreement is made up of the order form, these terms, the data processing schedule (section 9) and the LBVC Terms of Service.

1.2 If they conflict, the order form wins, then the data processing schedule, then these terms, then the Terms of Service.

1.3 The Client accepts the agreement on the plan page before set-up. Acceptance is recorded with the user's name, the date and time, and the version accepted.

2. The service

2.1 network360 is an online 360 review. An AI interviewer holds conversations with each candidate and their raters, the conversations are scored against LBVC's behavioural rubrics, and the results are reported as an individual 360 report for each candidate and an organisation dashboard, including a network analysis drawn from the same conversations.

2.2 Developmental use. network360 is a developmental service. Its reports and recommendations describe how colleagues experience a person's work and suggest development actions. They are not an assessment of fitness for employment and are not designed for selection, promotion, pay, discipline or dismissal decisions. The Client decides how it uses results, and remains solely responsible for any decision it makes and for complying with employment and data protection law in doing so, including section 71 of POPIA and section 8 of the Employment Equity Act.

2.3 network360 measures colleagues' opinions and perspectives against behavioural rubrics. It is not a psychological or psychometric test.

2.4 Results are reported only as set out in the product: individual reports for candidates, and organisation results in aggregate with LBVC's minimum group sizes. Raters are never reported individually. network360 does not report results by race, gender or any other protected characteristic.

2.5 LBVC's role is advisory. LBVC does not guarantee any particular outcome.

3. Plans, fees and payment

3.1 Fees are per candidate per cycle, as shown on the plan page and confirmed in the order form. Raters, and people on the people list who do not take part, are free. There is no set-up fee.

3.2 Each band's price applies to the candidates in that band. The minimum is 10 candidates per cycle.

3.3 The annual plan covers two cycles within 12 months, includes a report on change between them, and holds the price for the following year.

3.4 Fees are in US dollars and exclude VAT and similar taxes. LBVC adds VAT at the South African standard rate where the Client's billing address is in South Africa. For a Client with a billing address outside South Africa, LBVC zero-rates the supply as an exported service, and by accepting this agreement the Client confirms that it is not a South African resident or VAT vendor and is not in South Africa when the service is used. The Client accounts for any tax due in its own country. Tax invoices to clients with a South African billing address show the amounts in rand as well. *(Changed 10 November 2026: the confirmation is given by accepting this agreement rather than by a separate tick at checkout; for counsel review.)*

3.5 The Client pays when it orders, either by card or by bank transfer against an LBVC invoice. Card payments are charged in South African rand at the day's exchange rate, and the Client's bank may convert the amount to its own currency. A cycle launches only for candidates that have been paid for.

3.6 A cycle that has launched is not refundable. A cycle cancelled before launch is refunded.

4. The Client's responsibilities

4.1 Data integrity. The Client is responsible for the accuracy, completeness and lawfulness of all data it supplies, including the people list, units, reporting lines and formal links. The Client confirms each set-up screen. LBVC does not review client data and is responsible only for the integrity of the data it collects and analyses.

4.2 Lawful basis. The Client relies on its legitimate interest in developing its people to share its people list with LBVC and run the cycle, and is responsible for that basis. Candidates and raters also consent to take part.

4.3 Notice. Before launch, the Client sends all employees on the people list the staff notice LBVC supplies, adapted as needed.

4.4 Free choice. Taking part is voluntary. The Client will not treat anyone less favourably for declining or withdrawing.

4.5 Safeguarding details. The Client names a safeguarding contact with an out-of-hours phone number, its reporting channel and its employee wellbeing service, and keeps them up to date.

4.6 Access. The Client decides who sees the dashboard, by role, keeps log-in details secure and reports any suspected misuse at once.

4.7 Use of results. The Client decides how it uses results and carries the responsibility for that use, as in clause 2.2. It does not try to identify raters or anyone described in a conversation.

5. Participants

5.1 Each candidate and rater sees the consent screen before their first conversation and may decline or withdraw at any time.

5.2 What raters say about a candidate is never attributed to them. The candidate's line manager is told that their input cannot be fully anonymous, but their words are not shared.

5.3 Interviews may be typed or spoken. Audio is used only to produce text and is not kept.

6. Serious incidents

6.1 If a participant describes an immediate risk to life or safety, physical harm, or a crime, the passage goes to LBVC's psychologist under the network360 serious incident protocol, and LBVC may alert the Client's safeguarding contact. Where there is a serious risk to someone's safety, LBVC may contact emergency services.

6.2 Other concerns, such as harassment, bullying or discrimination, are not escalated. The interviewer points the participant to the Client's reporting channel and wellbeing service.

6.3 LBVC does not investigate any incident. Investigation and action remain the Client's responsibility as employer.

6.4 An allegation never appears in any report or on the dashboard, and a disclosure never affects the discloser's results.

7. AI in the service

7.1 The interviewer, Elle, tells every participant that she is an AI in her first message.

7.2 Conversations are scored by one AI model and checked by a second, independent AI model, with a reason recorded for every score and change.

7.3 network360 never infers emotions from a person's voice, face or other biometric data.

7.4 LBVC takes no decision with legal or similarly significant effects for any person by automated means.

7.5 AI providers. The AI models are provided by outside companies: Qwen models, developed by Alibaba Cloud and reached through OpenRouter, Inc. (United States), for the interviewer and scoring, and the Kimi model from Moonshot AI (China) for the independent check. Conversation text is sent to these providers so that they can generate the interviewer's replies, the scores and the checks. LBVC intends to move these models onto hosting it controls, and will tell the Client when it does.

8. Intellectual property and confidentiality

8.1 LBVC owns the platform, the rubrics, the question cards, the interventions and all other LBVC materials. The Client owns the data it supplies.

8.2 After payment, the Client has a non-exclusive licence to use the reports and dashboard internally for development. It may not publish or resell them without LBVC's written consent.

8.3 Each party keeps the other's confidential information confidential, as in the Terms of Service.

9. Data processing schedule

9.1 Roles. For the cycle, the Client is the responsible party (controller) and LBVC the operator (processor) under POPIA sections 20 and 21 and GDPR article 28. For research on anonymised data, LBVC acts on its own account.

9.2 Subject and purpose. Running 360 reviews and a network analysis for the Client's people development.

9.3 Data. Names, work emails, roles, units, reporting lines, optional pronouns, and conversation transcripts of candidates and raters. No special personal information is collected, other than what a participant volunteers in a conversation, which is handled under the serious incident protocol.

9.4 Instructions. LBVC processes personal information only on the Client's documented instructions, which are this agreement and the Client's set-up choices.

9.5 Confidentiality. Everyone at LBVC with access is bound by confidentiality.

9.6 Security. LBVC applies appropriate technical and organisational measures (POPIA section 19, GDPR article 32), including encryption in transit and at rest, role-based access controls for staff, pseudonymisation of transcripts before scoring, and logging of access to identifiable data.

9.7 Sub-operator. The Client authorises Lovable as LBVC's sub-operator for hosting and server code, with data held in Lovable Cloud's Europe region, and OpenRouter, Inc. and Moonshot AI as sub-operators for AI processing, as described in clause 7.5. LBVC may add a voice provider for spoken conversations as a further sub-operator, with data processed in the EU. Urgent safety alerts are sent by email to LBVC's psychologist, who contacts the Client's safeguarding contact where needed. These alerts carry only a short notice, never anything a participant said. LBVC gives the Client 30 days' notice of any new sub-operator, and the Client may object on reasonable grounds.

9.8 Transfers. Data from South Africa is stored in the EU, whose law gives comparable protection (POPIA section 72(1)(a)). Conversation text is also processed by the AI providers in clause 7.5, which may be in the United States, China or elsewhere. The Client accepts this, tells its staff in the staff notice, and every participant consents to it before taking part (POPIA section 72(1)(b)).

9.9 Breaches. LBVC tells the Client without undue delay, and within 48 hours of becoming aware, of any compromise of the Client's personal information, with what is known and what LBVC is doing about it.

9.10 Rights requests. LBVC helps the Client respond to requests from data subjects and passes on any request it receives.

9.11 Retention. Identifiable data for each cycle is kept for at least 18 months after that cycle's final report. Six months before a cycle's deletion date, LBVC asks both custodians whether to keep the data for 12 more months or keep the deletion date; the Client may extend by 12 months at a time, without limit, to follow change over the years, up to the day before deletion. When the Client stops extending, the data is deleted or anonymised on the deletion date and LBVC confirms this to both custodians. Uploaded files are deleted once the Client confirms them. Anonymised transcripts are kept for up to three years from anonymisation for research, then deleted. Anonymised scores and totals may be kept indefinitely. Invoices are kept as tax law requires. *(Changed 10 November 2026 from 12 months; for counsel review.)*

9.12 Audit. LBVC makes available the information needed to show compliance, and answers the Client's reasonable written questions once a year.

9.13 End of the agreement. On termination, LBVC deletes or anonymises the Client's personal information on each cycle's deletion date under clause 9.11, unless the Client asks for an export within 30 days. *(Changed 10 November 2026; for counsel review.)*

10. Liability and indemnity

10.1 LBVC is not liable for indirect or consequential loss. LBVC's total liability under this agreement is limited to the fees the Client paid in the 12 months before the claim, as in the Terms of Service.

10.2 The Client indemnifies LBVC against any claim arising from data the Client supplied, from use of results for any purpose other than development, from the Client's employment decisions, or from the Client's breach of this agreement.

11. Term and ending

11.1 The agreement runs from acceptance until the last cycle's results have been delivered, or for 12 months on the annual plan.

11.2 Either party may end it on 30 days' written notice. Fees for launched cycles remain due.

11.3 Either party may end it at once if the other materially breaches it and does not put the breach right within 14 days of notice.

12. Law and disputes

12.1 South African law governs this agreement. Disputes go to good-faith negotiation, then mediation, then arbitration in Cape Town, as in the Terms of Service. Either party may seek urgent relief from a court.

12.2 For a Client in the EU, the data processing schedule also meets GDPR article 28, and nothing in this agreement limits the rights of data subjects under the GDPR.

*Draft for counsel. Not legal advice.*