Supplier and Vendor Code of Conduct

This Supplier and Vendor Code of Conduct (“Code”) sets out the standards we expect from a supplier or vendor we engage. Aperim Pty Ltd (ABN 46150699737; ACN 150699737) is incorporated in New South Wales, Australia and operates the aicial brand. In this Code, “aicial” refers to that brand; “we”, “us” and “our” refer to Aperim Pty Ltd; and “you” refers to a supplier, or a person reading this Code on a supplier’s behalf.

This Code does not, by itself, create a contractual relationship between us and a supplier. It describes the standard we expect. That standard takes effect through our actual agreement with the supplier — for example, a services agreement, purchase order or engagement terms — and, to the extent that agreement addresses the same subject differently, the agreement governs.

This Code applies to anyone who supplies goods or services to us, including our infrastructure and technology vendors, and to anyone we engage as a business partner, including a reseller or affiliate partner. We call each of them a “supplier” in this Code, whether they supply goods, services or partnership activities, and whatever we call our relationship with them — vendor, contractor, consultant, reseller, affiliate partner or another name.

This Code applies to a supplier relationship at every stage, from the point we first assess a prospective supplier through to the end of our engagement with them.

We expect a supplier to:

• comply with the law that applies to them in every jurisdiction they operate in;
• not use forced, bonded or child labour anywhere in their own operations or supply chain, consistent with our Modern Slavery and Ethical Sourcing Statement;
• treat their own workforce fairly, including on pay, working hours, health and safety, and freedom from discrimination and harassment;
• not engage in bribery or corruption, consistent with our Anti-Bribery and Corruption Policy;
• apply reasonable data security and privacy practices wherever they process personal information on our behalf. Where that includes personal information we handle as a processor for our customers, that supplier is a sub-processor: we impose data-protection obligations on them that are no less protective than those in our Data Processing Agreement, and identify them on our Sub-processor List;
• where they collect data, supply a model, or perform any part of an AI system on our behalf, meet the principles in our Responsible AI Usage Policy as we meet them ourselves — including warranting that they do not circumvent a platform’s technical access controls, and propagating a deletion or consent withdrawal we pass on to them; and
• respect human rights in how they conduct their own operations, consistent with our Human Rights Policy.

The assessment we carry out before and during a supplier relationship is proportionate to the size of that relationship and the risk involved. We are an early-stage company with a small, largely cloud-infrastructure-focused supplier base, so today that means a reasonable, proportionate assessment when we onboard a supplier and periodically after that — for example, considering what a supplier does, where they operate, and whether anything about the relationship raises a concern against this Code — rather than a standing audit programme. Where our agreement with a supplier gives us an audit or information right — for example, where they collect data on our behalf — we use it when we have reason to.

As aicial grows and our supplier base becomes larger or more complex, we will formalise this assessment and update this Code to describe it.

Where we identify, or are told about, a supplier falling short of this Code, we assess the concern and, where it is practicable to do so without compromising the confidentiality of anyone who raised it in good faith, raise it with the supplier directly and work with them to seek remediation within a reasonable time.

Where a supplier cannot or will not remediate a serious concern, we end the relationship, unless doing so is not reasonably practicable, in which case we take other proportionate action to address the risk.

Anyone who believes a supplier to aicial is not meeting the standards in this Code — whether they work for that supplier, for us, or are an unrelated third party — can contact compliance@aicial.com with enough detail for us to understand and investigate the concern. If you are an aicial employee, contractor or other member of our personnel, you can also raise it under our Whistleblower and Ethics Policy, which explains how we handle a report made in good faith, including the option to report anonymously and our commitment not to retaliate against anyone who makes one.

We acknowledge a concern raised under this Code and assess it within a reasonable period. Where it is practicable to do so without compromising an investigation, a legal obligation we owe the supplier, or another person’s rights, we tell you the outcome or the reason we cannot share it.

Aperim Pty Ltd is an early-stage company. Accountability for the commitments in this Code currently sits with Aperim Pty Ltd’s leadership rather than a separate or formally constituted body.

As aicial grows, we will formalise this governance — including clearer internal roles and a defined review process — proportionate to the size and complexity of our supplier base at the time, and we will update this Code when we do.

We review this Code at least annually, and sooner if our supplier base changes materially. We may also update this Code to reflect changes to our services or our practices as aicial grows. The version, effective date and last-reviewed date shown at the top identify the current Code. We publish the updated Code on our website and, where a change is material, provide additional notice to an affected supplier before the change takes effect.

For questions about this Code, or to raise a concern about a supplier, contact:

Aperim Pty Ltd, which operates the aicial brand
ABN 46150699737
ACN 150699737
New South Wales, Australia
Email: compliance@aicial.com