# Agency and Client Workspace Addendum **Version AUT-AGENCY-2026-09-15.1. Applies when validly accepted.** Applies only to an expressly accepted agency arrangement. It does not revive any historical agency price, minimum-license commitment, or promotion. ## 1. Parties and client relationships Agency means the Customer identified as agency in its Order. A Client means a separately identified business for which Agency administers a workspace or resells approved Services. Agency is an independent business and must not represent itself as an employee, partner, legal agent, or branch of Autonomized except for a specific authority actually granted in writing. Agency may offer only the resale, branding, support, and administration scope expressly permitted in its Order. It must identify its own legal business to Clients, explain who provides the platform and who performs its own services, and avoid unsubstantiated performance, security, certification, compliance, or autonomy claims. White-label presentation does not erase required provider, privacy, AI, or legal disclosures. ## 2. Each Client must be authorized and covered Before access to a Client workspace, Agency must identify the Client's legal entity and establish written authority for Agency's particular administration, data access, communications, and spending activities. Each Client must accept the applicable platform documents directly, or Agency must supply evidence of actual authority to execute the specified documents on that Client's behalf. A platform administrator role, reseller invoice, or possession of a client's login is not that authority. Client receipt records must distinguish the Client, Agency, payer, authorized signer, operational administrator, and data controller. Agency's acceptance does not bind every future client automatically. Each individual user must also accept the User Access Terms before operational access. Autonomized may verify authority without accessing unnecessary customer content. Agency must maintain enforceable client agreements that accurately allocate its own services and responsibilities, pass through applicable use and communications obligations, disclose Autonomized's role where required, and do not diminish Autonomized's agreed rights. Agency must not claim that those agreements waive nonparties' rights or give Autonomized immunity from legal claims. ## 3. Data and permissions The Client ordinarily controls its business data and communications purposes. Where Agency determines additional purposes or means, it must assess its own controller or joint-controller duties rather than assume it is always a processor. Where Agency is a processor, it must have authority to appoint Autonomized as subprocessor and provide required flow-down terms. Complete the DPA and transfer schedules for the actual chain. Agency may access only the Client workspaces and data it is authorized to administer. It must not reuse one Client's data, contacts, suppression records, prices, or confidential knowledge for another Client without a specific lawful basis and authority. Separate Client spending limits and approval policies must be maintained. Agency must not disable required consent, role, or tenant checks for convenience. ## 4. Communications, AI, and downstream representations Agency is responsible for the lawfulness of its own campaigns, instructions, content, offers, consent collection, and client representations. It must identify which Client is the actual sender and maintain evidence of relevant recipient permissions. Shared agency permission does not authorize marketing by unnamed Clients. Agency must not promise that Anna never makes mistakes, always obeys instructions, is a human employee, replaces a licensed professional, or makes a Client legally compliant. It must preserve required AI disclosures and recording choices in white-label deployments. A change of brand, intended purpose, or substantial functionality may change obligations under applicable AI law and requires review before launch. Agency must train its administrators on limits and escalation, maintain a reachable human contact, and stop unsafe activity promptly. Autonomized's own express controls and legal duties remain intact. ## 5. Billing and service responsibility The Order identifies whether Agency or each Client pays Autonomized, what Agency may charge independently, which usage rates and caps apply, and who may change them. Agency may not create an unauthorized direct subscription for a Client or increase a Client's cap without the required authority. Agency bears the agreed fees for accounts it purchases even if it cannot collect from its Client, except as its Order provides. Agency's taxes, invoicing, refunds, service commitments, and disputes with Clients remain its responsibility to the extent arising from Agency's own business. This does not shift losses caused by Autonomized's breach. Autonomized may reasonably suspend affected Client activity under the Business Terms, using a scope proportionate to the issue and preserving lawful cancellation and data-rights routes. ## 6. Client departure and ownership disputes The parties must identify ownership of the workspace, content, numbers, domains, and direct provider accounts before onboarding. On a Client's departure, Agency must cooperate with authorized export or transfer, revoke its own unnecessary access, and respect valid suppression and retention requirements. Transition fees or porting conditions must be agreed and lawful; a data export required by law cannot be held hostage to a disputed agency invoice. Autonomized may require credible proof of authority before changing account ownership or disclosing data. It will not treat payment-card ownership alone as proof that the payer owns every Client record. Where authority is genuinely disputed, access may be restricted while evidence is reviewed or a lawful order is obtained. The parties' agreements cannot make Autonomized's unilateral decision immune from review. ## 7. Indemnity and contract alignment Agency's indemnity under the Business Terms includes covered third-party claims caused by its unauthorized promises, infringement in agency-supplied material, unlawful contact practices, missing Client authority, and breach of this Addendum. It excludes the share attributable to Autonomized's own fault under the Business Terms. Liability and dispute provisions are those of the accepted regional agreement; this Addendum does not create a duplicate recovery or an unlimited automatic debit authorization. Agency must keep its client terms, marketing materials, support procedures, and actual configuration consistent with these commitments. It must supply focused evidence of compliance when reasonably requested to investigate a material issue, minimizing unrelated personal information. ## Client authorization record Record Agency and Client legal identities; Client country and address; Client signer and authority evidence; covered workspace; administrator permissions; data roles and DPA; approved features/channels; payer and spending authorization; ownership and exit rights; support and incident contacts; document versions and signatures. A separate record is required for each Client. **Agency signature and applicable Client signature or specific agency authority:** complete in the immutable agreement record before Client operational access.