49G Staff Terms of Use (IT and Acceptable Use)

Version 0.2. Last updated: 6 November 2026. Reviewed every year.

These terms set the rules for using Group systems, data and tools. They are a Group instrument and bind a company's people only once that company has adopted them by its own act.

1. Purpose and scope

• These terms apply to everyone who works for or with a Group company, whatever their contract says: employees, workers, contractors, consultants, agency and seconded staff, and directors or officers doing operational work. They also apply to AI agents run for a Group company, through the person accountable for each agent.
• Your employer or contracting company is the one named in your signed agreement. BitLease Technology Ltd is the Group's designated employing company. There is no Group employment: shared ownership, brands, systems, tools or a 49g.com email address do not make another company your employer or give you authority in it.
• "Systems" means any device, account, network, application, repository, cloud service or AI tool a Group company provides or connects to, including a personal device used for work.
• A breach is handled by your employing or contracting company, under its own law and procedures, with a proportionate outcome.
• Your wider duties, covering honesty, conflicts, gifts and hospitality, personal dealing and speaking up, are in Governance, Conduct and People. These terms repeat them only where they touch systems.

2. Accounts and access

• Your identity is yours alone. Sign in through the group single sign-on wherever a system supports it, and keep multi-factor authentication switched on.
• Never share passwords, MFA codes, API keys or session tokens, even with colleagues or IT. IT will never ask for your password.
• Access is issued only after the onboarding gate: a signed agreement with the correct company, a defined role, accepted confidentiality, intellectual-property and acceptable-use obligations, and assigned training.
• Ask for more access through the IT access request process; never use someone else's.
• A job title, an email address or system access gives you no authority to sign, pay, move wallet funds, deploy to production, hire or speak publicly. That authority comes only from an adopted authority schedule and a specific assignment.
• Keep secrets only in the approved secrets manager. Never put them in a repository, ticket, chat message or document.
• Tell your manager and IT before you change role, employing company or the country you work from. Each is a control event that needs your engagement, access and privacy basis reviewed first.

3. Acceptable use

Use Group systems mainly for work. Limited personal use is fine if it does not get in the way of your work, cost the company money or break these terms. You must not:

• access, store or share unlawful, discriminatory, harassing, sexually explicit or extremist content;
• install unapproved software, browser extensions or plug-ins, or connect unapproved apps to company accounts, including through OAuth grants;
• bypass or switch off security controls such as endpoint protection, MFA, logging or VPN;
• forward company email or files to personal accounts or unapproved storage;
• impersonate anyone, or send messages that appear to come from a Group company without authority;
• make a commitment or guarantee, or use the BitLease or 49G name, without authority;
• make or publish any claim about a Group company's status, solvency, authorisation or guarantee. These claims are reserved matters and need a recorded authorisation naming who gave it;
• present 49G Holding Ltd as standing behind any obligation of another Group company;
• misstate the name of a Group company: always use its exact legal name, for example BitLease Technology Ltd; or
• deal, for yourself or anyone connected to you, on information you hold because of your role, or use company systems for personal trading or crypto mining.

4. Data handling and confidentiality

• Classify and handle information under the Group's data classification standard.
• Client, identity-verification, wallet, transaction and Lessor data stay in their approved systems and hosting regions. Do not copy them to local drives, personal devices or spreadsheets.
• Client-facing and Lessor-facing roles are kept apart. Do not look at the other side's data, even if a system would let you.
• Each company's data stays within that company. Share with another Group company only the minimum needed, for a documented purpose, under an intercompany arrangement. Own Token Foundation is not a Group company and gets no access to client, identity, wallet, transaction or repository data.
• Use synthetic or anonymised data for development and testing. Production data must never reach a local, sandbox or demo environment.
• Share information outside the Group only through approved channels, and only what the recipient needs.
• Keep a clear desk and a clear screen wherever restricted material is handled: in the office, at home, in public and in shared drives and chats.
• Your confidentiality duties continue after you leave.

5. AI tools and agents

• Use only AI tools on IT's approved list, through your company account. Never use a personal or consumer AI account for work.
• Do not put Confidential or Restricted information, client personal data or credentials into an AI tool that is not approved for that class of data.
• You are accountable for any AI output you use. Check it for accuracy, bias, intellectual property and confidentiality before you rely on it, share it or merge it.
• AI agents run under their own bot identities with scoped credentials, never under your personal account. Agents have no production access, and a release to production needs a recorded human approval.
• Never use AI to take a company decision; approve a corporate act, a public claim or a release; sign, file, submit, pay or grant access; call a draft signed or in force; quietly resolve a policy conflict; or remove evidence or rewrite history.
• Say when content is AI-generated where the reader would reasonably expect to know, and in any record that requires it.

6. Source code and intellectual property

• All Group code lives in Group-controlled repositories: the Group's approved code-hosting platforms. Do not keep it in personal repositories or personal forks.
• Follow the Group's code style guide, Conventional Commits and the merge request review and approval rules.
• Use open-source components only under licences approved under the engineering open-source policy, and never paste in code under an incompatible licence.
• Intellectual property you create in your role belongs to 49G Holding Ltd, which owns all Group-created intellectual property, through the IP clause in your engagement and the Group's assignment instruments. Your employing company's right to use it comes from its intercompany grants.

7. Devices, locations and equipment

• Your engagement records where you may work from and which equipment you are issued. Work with restricted data or privileged access only from an approved location, on an approved device.
• Keep company devices encrypted, up to date, with endpoint protection on and the screen locking after 5 minutes.
• A personal device used for work must be enrolled in the company's device management tool and meet the same standards. Company data on it may be wiped remotely.
• Issued equipment is tracked from issue to return or disposal. Report a lost or stolen device straight away.
• Get approval before you start working from a different country, because it can change the employment law, payroll and tax that apply.
• Use the VPN on any network you do not trust.

8. Communications and social media

• Use approved channels, such as company email and the Group's approved chat and task tools, for work. Do not conduct company business through personal messaging apps.
• Do not speak for a Group company in public, including on social media, unless authorised. A publication, public statement or market release needs a recorded authorisation naming who gave it.
• Never disclose non-public information about the Group, its clients, products or deals.
• Treat people with respect. Anti-harassment rules apply online too.

9. Monitoring

Before your engagement starts, your employing company tells you in writing, in a form you keep, what is monitored, why, who may see it and how long it is kept. Any change is notified to you before it takes effect.

• Covert monitoring is not used.
• Monitoring aimed at one person needs a stated purpose, collects the minimum data and is seen only by those who need it.
• Monitoring output is not turned into a performance measure, a disciplinary case or a commercial analysis without a separate recorded basis.
• The content of your messages or files is looked at only for a specific, recorded purpose, such as a security incident, a legal obligation or an investigation with documented scope and authority.
• Whether a form of monitoring is lawful where you work is checked before it is used.

10. Reporting incidents and concerns

• Report suspected security incidents, data breaches, phishing, lost devices or breaches of these terms immediately, and within 1 hour of noticing, to security@49g.com or the security channel of the Group's approved chat tool.
• Speed matters: a regulator, such as the UK Information Commissioner's Office, may have to be told within 72 hours of the company becoming aware of a breach.
• Do not investigate on your own, delete evidence or contact affected people unless asked to.
• Raise concerns about wrongdoing through the speak-up route your employing company publishes. You can report anonymously, and an anonymous report is investigated on the same terms. A concern about senior management or your own reporting line goes to a route outside that line. No one may suffer any detriment for an honest report.

11. Changing role or leaving

• A change of role is a control event: your access, authority and segregation are reviewed again before new access is issued.
• When you leave, return devices, access cards and company information, and keep no copies.
• Hand over what you own or set up: accounts, repositories, AI agents, credentials, scheduled jobs and automations, approvals still routed to you, and any third-party accounts registered in your name.
• Your access ends on your last day. Anyone outside the Group who relied on you as authorised is told you no longer are.
• Your confidentiality and intellectual-property obligations continue after you leave.

12. Acknowledgement

I have read and agree to follow the 49G Staff Terms of Use, as adopted by my employing or contracting company.

This acknowledgement is captured at onboarding and renewed every year.