Contractor and Vendor Standards Policy

1. Purpose

Evatar works with a small number of contractors and vendors. We expect each of them to meet the same human rights and labor standards we hold ourselves to in our Human Rights and Fair Treatment Policy. This policy sets out what we expect, the checks we do before and during a relationship, and what we do when a standard is not met. The checks are proportionate to the risk and to our size.

This policy applies from its effective date. The checks in section 4 apply to every new contractor and vendor from that date. Contractors and vendors we already work with are brought under it within 90 days of that date.

2. Who it covers

We sort the parties we work with into two groups, because the right level of checking is different.

Group A, people and firms who do work for us. Independent contractors, subcontractors, freelancers and agencies who work on Evatar's behalf, especially on client projects or with access to client systems or data.

Group B, vendors of products and services we use. Software, cloud, AI model, hosting, payment and similar providers whose services we buy or subscribe to.

3. What we expect from every contractor and vendor

• Comply with all applicable laws, including labor, employment, anti-discrimination, health and safety, immigration, privacy, anti-bribery, sanctions and export control laws.
• Do not use, accept or tolerate forced labor, prison labor, bonded labor, slavery or human trafficking.
• Do not employ anyone under the minimum legal working age where the work is done.
• Pay workers at least the legal minimum wage, on time, for hours that comply with the law.
• Do not charge workers recruitment fees or hold their identity documents.
• Do not discriminate against or harass workers, and respect their freedom of association.
• Provide a safe and healthy working environment.
• Protect confidential information and personal data that we share.
• Do not offer or accept bribes or kickbacks.
• Work only with their own suppliers and subcontractors who meet these same standards, in a way proportionate to their size.
• Tell us promptly if they become aware of a breach of these standards connected to work they do for us.

4. Checks before we engage someone

Group A: contractors and subcontractors

Before any work starts, the owner:

1. Confirms who they are. For an individual, their legal name and the country they work from. For a company, its legal name, registration and country.
2. Screens them against sanctions and denied party lists. We search the U.S. Consolidated Screening List (trade.gov) and the OFAC Sanctions List Search, and record the date and result. A match that cannot be cleared means we do not engage them.
3. Signs a written agreement with them that covers scope, rate and payment terms, their agreement to follow this policy and our Human Rights and Fair Treatment Policy, confidentiality and data protection, and any requirements our client has asked us to pass on, such as a client's supplier code of conduct.
4. Confirms they may lawfully do the work, for example that they are working as an independent business where they are based.
5. Gets the client's approval first where our client agreement requires approval before a subcontractor works on that client's project or sees that client's data.

Group B: vendors of products and services

Before we start using a new paid vendor for business purposes, the owner:

1. Screens the vendor against the same sanctions and denied party lists.
2. Checks what the vendor publishes, such as a code of conduct, a modern slavery or human rights statement, or a privacy and security page, where one exists. For large providers this check is usually enough. For a small or unfamiliar vendor, we look for any public evidence of serious human rights or labor problems.
3. Records the vendor in our vendor register (section 6).

If a client project needs a vendor to process the client's data, we also check that the vendor meets the client's data protection requirements before using it on that project.

5. During the relationship

• We re-screen each contractor and vendor against sanctions lists at least once a year and when an agreement is renewed.
• We pass on to contractors any updated requirements from our clients that apply to their work.
• We pay contractors in full and on time, as agreed.

6. Records

The owner keeps a vendor register listing every Group A contractor and every Group B vendor, with the date and result of each check, a link to the signed agreement where there is one, and the date of the next review. We keep these records for at least three years after a relationship ends, and we can share them with a client who asks for evidence of our checks, subject to confidentiality.

7. When a standard is not met

If we learn that a contractor or vendor may have breached these standards, through a concern raised with us, news, or our own checks, the owner:

1. Looks into it promptly, including asking the contractor or vendor for their account.
2. Stops any immediate harm, for example by pausing their work on a client project or their access to client data while we look into it.
3. Decides on a response proportionate to what happened:
   • for a minor or administrative issue, a written corrective plan with a deadline
   • for a serious breach, including any forced labor, child labor, human trafficking, sanctions violation or bribery, ending the relationship
   • if the contractor or vendor will not cooperate or does not fix the problem by the deadline, ending the relationship
4. Tells affected clients where our agreement with them or the law requires it, and reports to the authorities where the law requires it.
5. Records what happened, what we decided and why.

Ending a relationship may mean finding a different vendor or contractor, even at extra cost or delay. We accept that.

8. Raising a concern

Anyone, including workers at our contractors and vendors, can raise a concern about a contractor or vendor by emailing info@evatar.ai. The confidentiality and no-retaliation commitments in section 4 of our Human Rights and Fair Treatment Policy apply.

9. Review

The owner reviews this policy at least once a year and whenever a client's requirements change.

Version history

• 1.0, October 9, 2026: first version, adopted by the owner.