Verification Services Agreement
The master commercial agreement for buying Verifications.
Version 1.0 · In effect from 15 October 2026 · Permanent link to this version
1. Parties and structure
1.1 The parties
This Agreement is between SkillSwap Ltd, trading as Lemma, a Cyprus private company limited by shares, registration number HE 475899, registered office Dodekanisou 18, Office 201, 7060 Larnaca, Cyprus, not registered for VAT (the "Company", "we", "us"), and the organisation named in the Order Form (the "API Client", "you").
1.2 It is a business agreement
This Agreement is offered only to organisations acting in the course of a trade, business, craft or profession. It is not offered to Consumers.
1.3 How the documents fit together
This Agreement is the master contract. It works with:
1.3.1 the Order Form — services purchased, Verification volumes, prices, initial term; 1.3.2 the Developer API Terms — the technical rules for using the API; 1.3.3 Schedule 1 — Data Sharing Agreement — Verification disclosures, where each party is an independent controller; 1.3.4 Schedule 2 — Data Processing Agreement — processing we carry out on your instructions, principally Assessment Invites; 1.3.5 the Sub-processor List, referenced by Schedule 2.
Schedules 1 and 2 form part of this Agreement. On conflict, the Order Form prevails on commercial terms, Schedules 1 and 2 on data protection, and this Agreement on everything else.
1.4 Definitions
Capitalised terms carry the meanings in the Terms of Service and the SCI Methodology & Rights Notice: a "Verification" is a query of a User's verified skill profile through the Verification API; a "Candidate" is a User whose profile is its subject; the "SCI" is the per-skill Skill Credibility Index; an "Assessment Invite" is an assessment you commission and send to a person whose contact details you supply to us.
2. The services
2.1 We provide access to the Verification API, return Verification results for Candidates who have consented, and — where the Order Form says so — deliver Assessment Invites and return the results to you. The service description, endpoints, response fields and any service levels are set out in the Order Form and our published documentation.
2.2 We may improve or change the service, but will not remove a materially relied-upon feature without the notice period in Developer API Terms clause 8.
3. What a Verification is — and what it is not
This is the most important clause in the Agreement. Read it, understand it, and communicate it accurately inside your organisation.
3.1 What it is
An SCI is a probabilistic indicator, a number from 0 to 100 per skill, computed automatically from Evidence Events about a User in that skill — completed Sessions, AI-Tutor practice drills, assessment results (questions generated and some answers scored by AI), confirmations from other Users and connected work from GitHub, Figma or Vercel, less deductions for no-shows, late cancellations, failed assessments and integrity concerns. Part of it (Freshness) falls with inactivity. Its inputs, points and Freshness rules are described in the SCI Methodology & Rights Notice, which you must read before go-live and which serves as the instructions for use of the SCI.
3.2 What it is not
An SCI, and any Verification containing one, is not:
3.2.1 a background check, criminal record check, credit check or reference check; 3.2.2 an identity verification, and it does not confirm that the person in front of you is the person the profile describes; 3.2.3 a guarantee, warranty or certification of competence, qualification, licensure or fitness for any role; 3.2.4 a recommendation, endorsement or advice to hire, promote, engage or reject anyone; 3.2.5 a prediction of job performance, honesty, reliability or character; 3.2.6 a measure of anything outside the specific skill scored, on the specific Platform activity measured.
3.3 Not the sole basis for any decision
You must not use a Verification as the sole or determinative basis for any decision about a Candidate. It is one input among several, to be weighed alongside your own interview, assessment and reference process.
3.4 Known limits
Scores reflect activity on Lemma only. A low or absent score may mean nothing more than that the Candidate has not used Lemma much. Part of the score falls with inactivity, and a skill without recent evidence is marked stale, so an older score is not a current one. Confirmations come from other Users and carry their subjectivity.
4. Our obligations
4.1 We will provide the services with reasonable skill and care and in accordance with applicable law, and maintain the technical and organisational measures in Schedule 2, Annex II.
4.2 We will disclose a Candidate's data to you only where that Candidate has given the consent described in clause 6, and will stop where consent is withdrawn. We will never disclose the SCI of a person under 18.
4.3 We will keep the SCI Methodology & Rights Notice accurate and operate a documented SCI Review & Appeal process through which a Candidate may obtain human intervention, express a point of view and contest a score (GDPR Art. 22(3)).
4.4 We will tell you without undue delay if we correct or withdraw an SCI you have received, or if a Candidate withdraws consent, so that you can act under clause 5.6.
5. Your obligations
5.1 Lawful basis. You are an independent controller for the personal data you receive. You must have your own lawful basis for obtaining and using it, and your own record of processing (GDPR Arts. 6, 30). Our obtaining the Candidate's consent to disclose does not give you a basis to use.
5.2 Transparency. Tell Candidates, before or at the point you use Lemma in a process, that you use it and what a Verification contributes to your decision, and give them your own privacy notice within one month of receiving their data (GDPR Art. 14). Schedule 1 sets out the detail.
5.3 Human review. Any adverse decision — rejection, non-progression, non-engagement or any similarly significant outcome — must be reviewed by a competent human authorised and able to reach a different result, and you must record that it happened.
5.4 No discrimination. Do not use a Verification to discriminate on any protected ground, or combine it with protected characteristics to score, rank or filter Candidates. Monitor your own use for disparate impact.
5.5 Purpose limitation. Use each Verification only for the role, engagement or programme for which you obtained it, never in an unrelated context. The prohibited uses in Developer API Terms clause 6.2 are incorporated here in full.
5.6 Acting on our notices. On receiving a notice under clause 4.4 you must, without undue delay, stop relying on the affected data, correct or delete your copy, and re-open any decision that turned on it where the outcome may have been affected.
5.7A AI Act deployer duties. We plan on the basis that our assessments and the SCI are a high-risk AI system under Annex III point 4(a) of the AI Act (Reg. (EU) 2024/1689), with obligations applying from 2 December 2027 (Reg. (EU) 2026/1744). From that date, and as good practice before it, you will: use Verifications and assessment results in accordance with the SCI Methodology & Rights Notice; assign human oversight to competent, trained people (clause 5.3); inform Candidates that the system is used in decisions about them; keep the logs you control for at least six months; and tell us without undue delay of any serious incident or risk you identify (AI Act Art. 26).
5.7 Accurate description and security. Do not describe an SCI to a Candidate, a regulator or the public as anything clause 3.2 says it is not. You are responsible for the security of your own systems and for anyone you allow to access the data.
6. Candidate consent architecture
6.1 The rule
We will return a Verification only where the Candidate has given separate, explicit, opt-in consent to disclosure of their SCI to organisations of your type, given specifically for that purpose (GDPR Arts. 6(1)(a) and 22(2)(c)).
6.2 Never bundled
That consent is never bundled into acceptance of our Terms of Service, never pre-ticked, and never a condition of using Lemma. It is granular: a Candidate may consent to some audiences and not others.
6.3 Why it is built this way
We treat the SCI as an automated decision within GDPR Art. 22, following the reasoning of the Court of Justice in C-634/21 SCHUFA (7 December 2023): where a score is produced wholly automatically and a third party draws strongly on it, the score is itself the decision. Explicit consent under Art. 22(2)(c) is therefore the basis on which disclosure is lawful, and it carries the Art. 22(3) safeguards with it.
6.4 Revocable at any time
Consent is freely revocable. Revocation takes effect immediately and stops all future Verifications about that Candidate. It does not make earlier disclosures unlawful, but it does trigger your obligations under clause 5.6.
6.5 Under-18s
No person under 18 may be the subject of a Verification, and no consent — theirs or a parent's — changes that.
6.6 No circumvention
Do not ask a Candidate for their Lemma credentials, or for a screenshot of a Skill Passport in place of a consented Verification, and do not seek consent under pressure or as a condition of an application without telling them what they are consenting to.
7. Fees and payment
7.1 Fees, currency and payment terms are in the Order Form.
7.2 The Company is not registered for VAT and does not currently charge it. If it registers, VAT will be added as the law requires: for a business established in another EU Member State the reverse charge applies (Council Directive 2006/112/EC, Arts. 44 and 196).
7.3 Late payment bears interest at the Cyprus statutory rate for commercial transactions, plus reasonable recovery costs (Directive 2011/7/EU). We may suspend the services for non-payment after written reminder, as set out in Developer API Terms clause 10.
8. Term, renewal and termination
8.1 This Agreement starts on the date in the Order Form and runs for the initial term stated there. It then renews automatically for successive periods of equal length unless either party gives written notice of non-renewal at least 30 days before the end of the current term.
8.2 Either party may terminate immediately if the other commits a material breach not cured within 30 days of written notice, or becomes insolvent or subject to a winding-up or analogous procedure.
8.3 We may terminate immediately, without a cure period, for a breach of clause 5.4, 5.5, 6.5 or 6.6, or of the incurable prohibited uses in Developer API Terms clause 14.2. You may terminate immediately if we make a change that materially and adversely affects the services and do not remedy it within 30 days of notice.
8.4 On termination access ends, accrued fees fall due, prepaid unused fees are refunded pro rata unless we terminated for your material breach, you must delete or return personal data under Schedules 1 and 2, and clauses 3, 5.6, 9, 10, 11, 12, 16 and 17 survive.
9. Confidentiality
9.1 Each party will keep the other's confidential information confidential, use it only for this Agreement, disclose it only to people who need it and are bound to equivalent obligations, and protect it with at least reasonable care.
9.2 This does not cover information that is public through no breach, independently developed or lawfully received from a third party, nor prevent a disclosure required by law — where lawful, the disclosing party tells the other first. It survives termination for five years, and indefinitely for trade secrets. Personal data is governed by Schedules 1 and 2, not by this clause.
10. Intellectual property
10.1 We own the Platform, the API, the SCI, the SCI methodology, our models and our documentation, and all intellectual property in them. Nothing transfers to you; you receive only the licence in Developer API Terms clause 6.1.
10.2 You own your data and systems, and grant us the limited right to process what you send us in order to provide the services. We may use feedback you give us without restriction or payment.
11. Warranties, disclaimers and liability
11.1 Warranties
Each party warrants that it has authority to enter into this Agreement, will comply with applicable law — including data protection, employment, equality and anti-discrimination law — and holds the consents its own obligations require.
We warrant that the services will be provided with reasonable skill and care and will perform materially in accordance with the documentation. Subject to that, and so far as the law permits, we give no other warranty. In particular, and consistently with clause 3, we do not warrant that an SCI accurately measures a Candidate's competence or is fit for your decision.
11.2 Liability that is never limited
Neither party limits liability for death or personal injury caused by negligence, for fraud, for wilful misconduct or gross negligence, or for anything that cannot be limited under Cyprus law.
11.3 Excluded loss and cap
Subject to clause 11.2, neither party is liable for indirect or consequential loss, loss of profit or revenue, anticipated savings, business opportunity or goodwill; and each party's aggregate liability under this Agreement and its Schedules in any twelve-month period is capped at the greater of the fees paid or payable by you in that period and the minimum liability amount stated in the Order Form, so that the cap is not zero during a free pilot.
11.4 Carve-outs from the cap
The cap does not apply to: your breach of clause 5.4, 5.5, 6.5 or 6.6; either party's breach of clause 9; the indemnities in clause 12; or your payment obligations.
12. Indemnities
12.1 You will indemnify us against claims, losses, fines and reasonable costs arising from your use of Verification data outside the permitted purpose, your breach of clause 5, 6 or Schedule 1, or a claim by a Candidate that your decision was unlawful, discriminatory or made without human review.
12.2 We will indemnify you against claims that the services, used as permitted, infringe a third party's intellectual property rights, and against losses from our own breach of Schedule 2.
12.3 An indemnified party must notify the other promptly, let the indemnifying party conduct the defence, give reasonable assistance at that party's cost, and not settle without consent (not to be unreasonably withheld).
13. Insurance
13.1 Each party will maintain insurance appropriate to its obligations under this Agreement and provide evidence of it on reasonable request.
14. Force majeure
14.1 Neither party is liable for a failure caused by an event genuinely beyond its reasonable control, for as long as it lasts, provided it tells the other promptly and works to mitigate. If the event lasts more than 30 days either party may terminate on written notice, and prepaid unused fees are refunded pro rata. Accrued payment obligations are not excused.
15. Publicity
15.1 Neither party may use the other's name, logo or marks publicly, or describe the relationship publicly, without prior written consent. Consent is opt-in, may be limited to a specific use, and may be withdrawn on reasonable notice. Either party may state the fact of the relationship where the law or a regulator requires it.
16. Governing law and disputes
16.1 This Agreement and its Schedules are governed by the laws of the Republic of Cyprus.
16.2 The courts of the Republic of Cyprus have exclusive jurisdiction and, where a district must be named, the Larnaca District Court.
16.3 Before starting proceedings each party will escalate the dispute to a senior representative and try in good faith to resolve it within 30 days. This does not delay urgent relief.
17. General
17.1 Assignment. You may not assign without our written consent. We may assign to a group company or a buyer of our business, provided your rights are not reduced.
17.2 Notices and variation. Contractual notices are in writing to legal@getlemma.io and the addresses in the Order Form, effective when sent or the next working day if sent outside working hours. Changes must be agreed in writing by both parties, except changes we may make under Developer API Terms clause 8.3.
17.3 Severability, waiver, entire agreement. An unenforceable provision is modified to the minimum extent needed, or removed; the rest continues. Delay in enforcing a right does not waive it. This Agreement, the Order Form, the Developer API Terms and Schedules 1 and 2 are the whole agreement between us, without limiting any remedy for fraud.
17.4 Relationship, third parties, language. Nothing here creates a partnership, joint venture, agency or employment relationship. No one other than the parties may enforce this Agreement. It is in English and English governs; any Russian translation is for convenience only.
Annexes and Schedules
| Reference | Document | Status |
|---|---|---|
| Order Form | Commercial terms, volumes, prices, initial term | Signed separately; incorporated |
| Schedule 1 | Data Sharing Agreement — controller-to-controller, Verification disclosures | Incorporated in full |
| Schedule 2 | Data Processing Agreement — Art. 28, Assessment Invites and Client-configured content; Annex I Details of Processing, Annex II Technical and Organisational Measures, Annex III Sub-processors | Incorporated in full |
| — | Developer API Terms | Incorporated by reference |
| — | SCI Methodology & Rights Notice | Must be read before go-live |
| — | Sub-processor List | Published; referenced by Schedule 2 |
Signed for SkillSwap Ltd, trading as Lemma: Roman Kochetov, Director. Signed for the API Client: as set out in the Order Form.