Orchard Labs Limited

Software as a Service Agreement

Standard terms and conditions for the supply of software as a service

Background

  1. (A)
    The Service Provider has developed an application and platform which it makes available to subscribers, including the Customer, who use the application and platform to assist with the patching, deployment and security controls and reporting to their Apple estate (Permitted Purpose).
  2. (B)
    The Customer wishes to use the Service Provider's service in its business operations.
  3. (C)
    The Service Provider has agreed to provide and the Customer has agreed to take and pay for the Service Provider's service subject to the terms and conditions of this Agreement.

Agreed Terms

1 Interpretation

  1. 1.1
    The definitions and rules of interpretation in this clause apply in this Agreement.
    Agreement
    these Terms and Conditions and any and all (if any) schedules to the Terms and Conditions.
    Administrative User
    those employees, officers, agents and independent contractors of the Customer who are authorised by the Customer to login to the web application and use the Services and the Documentation.
    Authorised Users
    those employees, officers, agents and independent contractors of the Customer whose device is managed by the Platform.
    Business Day
    a day other than a Saturday, Sunday or public holiday in England when banks in London are open for business.
    Confidential Information
    information that is proprietary or confidential and is either clearly labelled as such or identified as Confidential Information in clause 11.1.
    Contract Year
    a 12 month period commencing on the Effective Date or any anniversary of it.
    Customer
    the entity who is using the Platform.
    Customer Data
    the data inputted by the Customer, Authorised Users, or the Service Provider on the Customer's behalf for the purpose of using the Services or facilitating the Customer's use of the Services.
    Data Protection Legislation
    the DPA18, UK GDPR, Privacy and Electronic Communication (EC Directive) Regulations 2003 and all other applicable laws that relate to the protection and Processing of Personal Data and privacy, all as amended, replaced or superseded from time to time.
    Devices
    the devices in respect of which the Customer has enrolled into the Services and checked-in or otherwise wishes to purchase the Services for.
    Device Subscriptions
    the device subscriptions purchased by the Customer pursuant to clause 8.1 and/or the process for additional devices in clause 3 which entitle Authorised Users to access and use the Services and the Documentation in accordance with this Agreement.
    Documentation
    the document(s) and other materials made available to the Customer by the Service Provider online via www.the-orchard.io or such other web address notified by the Service Provider to the Customer from time to time which sets out a description of the Services and the user instructions for the Services.
    DPA18
    the Data Protection Act 2018.
    EEA
    the European Economic Area.
    Effective Date
    the date that the customer signs up for an account on the Service Provider's website.
    Initial Subscription Term
    28 (twenty-eight) days from and including the Effective Date.
    Intellectual Property Rights
    patents, utility models, rights to inventions, copyright and neighbouring and related rights, trademarks and service marks, business names and domain names, rights in get-up and trade dress, goodwill and the right to sue for passing off or unfair competition, rights in designs, database rights, rights to use, and protect the confidentiality of, confidential information (including know-how and trade secrets), and all other intellectual property rights, in each case whether registered or unregistered and including all applications and rights to apply for and be granted, renewals or extensions of, and rights to claim priority from, such rights and all similar or equivalent rights or forms of protection which subsist or will subsist now or in the future in any part of the world.
    Mandatory Policies
    the Service Provider's business policies that can be found via the link in Schedule 1 or at the clients Trust Centre (Trust Centre), as amended by notification to the Customer from time to time.
    Normal Business Hours
    09:00 to 17:30 London time, each Business Day.
    Number of Device Subscriptions
    the number of Devices that are enrolled on the Platform (including, but not limited to, all Devices that have been auto-enrolled).
    Platform
    the Service Provider's web platform and associated services delivered by such platform.
    Renewal Period
    the period described in clause 15.1.
    Service Provider or our
    Orchard Labs Limited (a company incorporated in England and Wales with registered company number 16801687) whose registered office address is 1st Floor, 20 Noel Street, London, Greater London, England, W1F 8GW.
    Services
    the provision of macOS IT security, macOS patching & IT security enforcement via the Platform, on device macOS app.
    Software
    the online software applications provided by the Service Provider as part of the Services.
    Subscription Fees

    the Subscription Fees for each and every Renewal Period shall amount to a total of:

    • £75, $100 or €87.50 (excluding VAT or applicable taxes) per month for the first 25 Device Subscriptions; and
    • an additional £3, $4 or €3.50 (excluding VAT or applicable taxes) per Device Subscription per month if more than 25 Devices are enrolled,

    payable in accordance with clause 8 (Charges and payment). Customer acknowledges and agrees that (i) there is a minimum monthly charge of £75, $100 or €87.50 (excluding VAT or applicable taxes) and (ii) in the event that the Customer has fewer than 25 active Device Subscriptions, it will be paying more than £3, $4 or €3.50 (excluding VAT or applicable taxes) per Device Subscription per month.

    In consideration of the Customer complying with its obligations under this Agreement during the Initial Subscription Term, the Services will be provided without charge during the Initial Subscription Term.

    The applicable currency shall be the currency selected by the Customer on the Platform.

    Subscription Term
    has the meaning given in clause 15.1 (being the Initial Subscription Term together with any subsequent Renewal Periods).
    Terms and Conditions
    these standard terms and conditions for the supply of software as a service.
    UK GDPR
    the version of the General Data Protection Regulation 2016 (2016/679) retained into UK law, in accordance with section 3(10) (as supplemented by section 205(4)) of the DPA18.
    Virus
    any thing or device (including any software, code, file or programme) which may: prevent, impair or otherwise adversely affect the operation of any computer software, hardware or network, any telecommunications service, equipment or network or any other service or device; prevent, impair or otherwise adversely affect access to or the operation of any programme or data, including the reliability of any programme or data (whether by re-arranging, altering or erasing the programme or data in whole or part or otherwise); or adversely affect the user experience, including worms, trojan horses, viruses and other similar things or devices.
    Vulnerability
    a weakness in the computational logic (for example, code) found in software and hardware components that when exploited, results in a negative impact to the confidentiality, integrity, or availability the Services, and the term Vulnerabilities shall be interpreted accordingly.
  2. 1.2
    Clause, schedule and paragraph headings shall not affect the interpretation of this Agreement.
  3. 1.3
    A person includes an individual, corporate or unincorporated body (whether or not having separate legal personality).
  4. 1.4
    A reference to a company includes any company, corporation or other body corporate, wherever and however incorporated or established.
  5. 1.5
    Unless the context otherwise requires, words in the singular includes the plural and in the plural includes the singular.
  6. 1.6
    Unless the context otherwise requires, a reference to one gender includes a reference to the other genders.
  7. 1.7
    A reference to a statute or statutory provision includes references to any amendments or re-enactments thereof.
  8. 1.8
    A reference to a statute or statutory provision includes all subordinate legislation under that statute or statutory provision.
  9. 1.9
    A reference to writing or written includes email and excludes fax.
  10. 1.10
    References to clauses and schedules are to the clauses and schedules of this Agreement; references to paragraphs are to paragraphs of the relevant schedule to this Agreement.

2 Device subscriptions

  1. 2.1
    Subject to the Customer purchasing the Device Subscriptions in accordance with clause 3.3 and clause 8.1 and paying for the same in accordance with clause 8, the restrictions set out in this clause 2 and the other terms and conditions of this Agreement, the Service Provider hereby grants to the Customer a non-exclusive, non-transferable, revocable right and licence, without the right to grant sublicences, to permit the Authorised Users to use the Services in object code form and the Documentation during the Subscription Term solely for the Customer's internal business operations in accordance with the terms of this Agreement.
  2. 2.2
    In relation to the Administrative and Authorised Users, the Customer undertakes that:
    1. 2.2.1
      the maximum number of Authorised Users that it authorises to use the Services and the Documentation shall not exceed the users it elects to receive the Device Subscriptions it has purchased from time to time;
    2. 2.2.2
      it will not allow or suffer any Device Subscription to be used by more than one individual Authorised User unless it has been reassigned in its entirety to another individual Authorised User, in which case the prior Authorised User shall no longer have any right to access or use the Services and/or Documentation;
    3. 2.2.3
      each Administrative User shall have their own secure login credentials for the Platform and their use of the Services and Documentation.
  3. 2.3
    The Customer shall not (and shall procure that Authorised Users shall not) access, store, distribute or transmit any Viruses, or any material during the course of its use of the Services that:
    1. 2.3.1
      is unlawful, harmful, threatening, defamatory, obscene, infringing, harassing or racially or ethnically offensive;
    2. 2.3.2
      facilitates illegal activity;
    3. 2.3.3
      depicts sexually explicit images;
    4. 2.3.4
      promotes unlawful violence;
    5. 2.3.5
      is discriminatory based on race, gender, colour, religious belief, sexual orientation, disability; or
    6. 2.3.6
      is otherwise illegal or causes damage or injury to any person or property;
    and the Service Provider reserves the right, without liability or prejudice to its other rights to the Customer, to disable the Customer's access to any material that breaches the provisions of this clause.
  4. 2.4
    The Customer shall not (and shall procure that Authorised Users shall not):
    1. 2.4.1
      except as may be allowed by any applicable law which is incapable of exclusion by agreement between the parties and except to the extent expressly permitted under this Agreement:
      1. (a)
        copy, modify, duplicate, create derivative works from, frame, mirror, republish, download, display, transmit, or distribute all or any portion of the Software, the Services and/or Documentation (as applicable) in any form or media or by any means; or
      2. (b)
        attempt to de-compile, reverse compile, disassemble, reverse engineer or otherwise reduce to human-perceivable form all or any part of the Software or the Services; or
    2. 2.4.2
      access all or any part of the Services and Documentation in order to build a product or service which competes with the Services and/or the Documentation; or
    3. 2.4.3
      use the Services and/or Documentation to provide services to third parties; or
    4. 2.4.4
      subject to clause 24.1, license, sell, rent, lease, transfer, assign, distribute, display, disclose, or otherwise commercially exploit, or otherwise make the Services and/or Documentation available to any third party except the Authorised Users; or
    5. 2.4.5
      attempt to obtain, or assist third parties in obtaining, access to the Services and/or Documentation, other than as provided under this clause 2; or
    6. 2.4.6
      introduce or permit the introduction of, any Virus or Vulnerability into the Services or the Service Provider's network and information systems; or
    7. 2.4.7
      use the Services other than for the Permitted Purpose as part of its internal business operations.
  5. 2.5
    The Customer shall use all reasonable endeavours to prevent any unauthorised access to, or use of, the Services and/or the Documentation and, in the event of any such unauthorised access or use, promptly notify the Service Provider.
  6. 2.6
    The rights provided under this clause 2 are granted to the Customer only, and shall not be considered granted to any subsidiary or holding company of the Customer.

3 Additional device subscriptions

  1. 3.1
    Subject to clause 3.2 and clause 3.3, the Customer may, from time to time during any Subscription Term, purchase additional Device Subscriptions in excess of the Number of Device Subscriptions that the Customer currently subscribes for and the Service Provider shall grant access to the Services and the Documentation to such additional Authorised Users in accordance with the provisions of this Agreement.
  2. 3.2
    If the Customer wishes to purchase additional Device Subscriptions, one of the Customer's Administrative Users shall enrol additional Devices to the Platform and, in consideration of the Customer paying the Subscription Fees for such additional Device Subscriptions, the additional Device Subscriptions will start from the date of such enrolment.
  3. 3.3
    If such additional Device Subscriptions are purchased by the Customer part way through the relevant Renewal Period, the Service Provider (i) may not charge the Customer for the additional Device Subscriptions for the remainder of the relevant Renewal Period and (ii) shall charge the Customer the Subscription Fees for such additional Device Subscriptions from and including the start of the next Renewal Period.

4 Services

  1. 4.1
    The Service Provider shall, during the Subscription Term and subject always to clause 7, provide the Services and make available the Documentation to the Customer on and subject to the terms of this Agreement.
  2. 4.2
    The Service Provider shall use commercially reasonable endeavours to make the Services available 24 hours a day, seven days a week, except for:
    1. 4.2.1
      planned maintenance; and
    2. 4.2.2
      unscheduled maintenance,
    and subject always to the service levels set out in Schedule 3.
  3. 4.3
    The Service Provider will, as part of the Services and at no additional cost to the Customer provide the Customer with the Service Provider's standard customer support services which will consist of an online help centre with the ability to escalate to a service desk team in Normal Business Hours.

5 Data protection

  1. 5.1
    Both the Service Provider and the Customer warrant and undertake that they shall comply with all applicable requirements under the Data Protection Legislation in relation to their activities in connection with this Agreement. This clause 5.1 is in addition to, and does not relieve, remove or replace, a party's obligation or rights under the Data Protection Legislation.
  2. 5.2
    Both the Service Provider and the Customer have described the Processing of Personal Data being undertaken by the Service Provider in Schedule 2.
  3. 5.3
    The Service Provider acknowledges and agrees that to the extent that the performance of its obligations, and any supporting and/or ancillary activities, under the Agreement involves processing Personal Data on behalf the Customer, it will be a Processor (or sub Processor) and it shall:
    1. 5.3.1
      process the Personal Data only to the extent necessary for the purposes of performing the Service Provider's obligations under the Agreement and otherwise in accordance with the Customer's reasonable and lawful documented instructions and applicable laws; the Processing shall continue, subject to clause 5.3.7 and clause 15.4.3, for the duration of the Agreement and any post termination period set out in Schedule 2;
    2. 5.3.2
      not process the Personal Data in any country outside the combined area of the United Kingdom and the EEA unless:
      1. (a)
        the Service Provider has obtained the Customer's consent to do so (such consent not to be unreasonably withheld or delayed);
      2. (b)
        the Service Provider has ensured that there are appropriate safeguards in relation to the transfer and Processing in accordance with the applicable Data Protection Legislation;
      3. (c)
        the Data Subject has enforceable rights and effective legal remedies;
      4. (d)
        the Service Provider complies with its obligations under the Data Protection Legislation by providing an adequate level of protection to any Personal Data that is transferred.
      If the Service Provider is required by applicable laws to transfer the Personal Data outside of the combined area of the United Kingdom and the EEA, the Service Provider shall inform the Customer of such requirement before making the transfer (unless the Service Provider is barred from making such notification under the relevant applicable law);
    3. 5.3.3
      take reasonable steps to ensure that, in addition to any confidentiality provisions in the Agreement, all persons authorised by the Service Provider to process the Personal Data are subject to appropriate duties of confidentiality;
    4. 5.3.4
      have at all times during the term of the Agreement, taking into account the nature of the Processing, appropriate technical and organisational measures in place to provide a necessary level of security to protect any Personal Data against unauthorised or unlawful Processing and against accidental loss, alteration, destruction or damage. This will include (i) maintaining Cyber Essentials Plus accreditation and (ii) complying with the requirements of ISO 27001;
    5. 5.3.5
      assist the Customer, where reasonably requested by the Customer and to the extent reasonably practicable, with the Customer's compliance obligations in respect of security of Personal Data, notifications of breaches of Data Protection Legislation to supervisory authorities, communications of breaches of Data Protection Legislation to Data Subjects, the carrying out of data protection impact assessments and any consultations with supervisory authorities;
    6. 5.3.6
      assist the Customer, where reasonably requested by the Customer and to the extent reasonably practicable, with fulfilling the Customer's obligations to respond to requests from a Data Subject for access to, rectification, erasure or portability of, or for restriction of, or objections to, the Processing of, that Data Subject's Personal Data;
    7. 5.3.7
      cease Processing (other than storage, retrieval, disclosure by transmission, erasure or destruction in accordance with this clause) the Personal Data in connection with this Agreement on the termination or expiry of the Agreement, or if earlier, at the Customer's request, delete or return all Personal Data to the Customer, and delete all existing copies unless applicable laws require their retention;
    8. 5.3.8
      (subject always to the confidentiality provisions at clause 11 and the Customer not seeing confidential information and/or Personal Data of the Service Provider's other customers) make available to the Customer information reasonably necessary to demonstrate compliance with the obligations set out in this clause 5.3 and where requested by the Customer allow for and contribute to audits, including inspections, conducted by the Customer or its representative;
    9. 5.3.9
      on reasonable written notice provide the Customer with all reasonable assistance and information required by the Customer to satisfy the Customer's record keeping obligations under the Data Protection Legislation and, at the Customer's reasonable request, adhere to any applicable code of conduct or certification method approved under the applicable Data Protection Legislation; and
    10. 5.3.10
      without undue delay after having become aware, notify the Customer of any unauthorised or unlawful Processing of any of the Personal Data to which this clause 5.3 applies and of any loss or destruction or other damage and shall take such steps consistent with good industry practice to mitigate the detrimental effects of any such incident on the Data Subjects and co-operate with the Customer in dealing with such incident and its consequences.
  4. 5.4
    The Customer acknowledges and agrees that the Service Provider may engage third party sub Processors in connection with the Processing of such Personal Data and in order to meet its obligations under the Agreement from time to time. In such circumstances the Customer hereby authorises the Service Provider to engage with such third party sub Processors and in respect of the Service Provider's use of sub Processors:
    1. 5.4.1
      a list of the sub Processors used by the Service Provider as at the Effective Date is set out in Schedule 2 and the Service Provider will notify the Customer where it appoints, replaces or removes any sub Processor;
    2. 5.4.2
      within 20 (twenty) Business Days of the Service Provider's notification the Customer can object to the intended changes; and such objection by the Customer shall be in writing and include the Customer's specific reasons for its objection;
    3. 5.4.3
      where the Customer objects to an intended change of sub Processor within the period in clause 5.4.2 and the Service Provider cannot reasonably accommodate the Customer's objection, the Service Provider will notify the Customer and the Customer may terminate the Agreement by providing the Service Provider with written notice within one (1) month of the Customer's receipt of the Service Provider's notice;
    4. 5.4.4
      the Service Provider shall remain fully liable to the Customer for the acts and omissions of a sub Processor; and
    5. 5.4.5
      the Service Provider shall procure that such sub Processor is subject to a written agreement containing data processing obligations no less onerous than those set out in the Agreement and that such agreement will meet the requirements of the applicable Data Protection Legislation.
  5. 5.5
    If the Service Provider appoints sub Processors who process Personal Data outside the combined area of the United Kingdom and the EEA, the Service Provider shall notify the Customer of such sub Processors and the jurisdiction in which Personal Data shall be processed and clause 5.4 shall apply in respect of any objection by the Customer.
  6. 5.6
    The Customer warrants and undertakes to the Service Provider that:
    1. 5.6.1
      the Customer's appointment of the Service Provider to provide the products and/or services hereunder is in accordance with the applicable Data Protection Legislation; and
    2. 5.6.2
      the Service Provider's Processing of the Customer's Personal Data in compliance with the Customer's processing instructions shall not cause the Service Provider (and/or any of the Service Provider's sub-Processors) to be in breach of the applicable Data Protection Legislation.

6 Service Provider's obligations

  1. 6.1
    The Service Provider shall perform the Services:
    1. 6.1.1
      substantially in accordance with the Documentation; and
    2. 6.1.2
      with reasonable skill and care and in accordance with good industry practice.
  2. 6.2
    The Service Provider's obligations at clause 6.1 shall not apply to the extent of any non-conformance which is caused by use of the Services contrary to the Service Provider's instructions, or modification or alteration of the Services by any party other than the Service Provider or the Service Provider's duly authorised contractors or agents. If the Services do not conform with the terms of clause 6.1, Service Provider will, at its expense, use reasonable commercial endeavours to correct any such non-conformance promptly. Such correction constitutes the Customer's sole and exclusive remedy for any breach of the undertaking set out in clause 6.1.
  3. 6.3
    The Service Provider:
    1. 6.3.1
      does not warrant that:
      1. (a)
        the Customer's use of the Services will be uninterrupted or error-free;
      2. (b)
        that the Services, Documentation and/or the information obtained by the Customer through the Services will meet the Customer's requirements;
      3. (c)
        the Software or the Services will be free from Vulnerabilities or Viruses. Nothing in this clause 6.3.1(c) affects the Service Provider's general obligation to comply with its security obligations at clause 5.3.4.
    2. 6.3.2
      is not responsible for any delays, delivery failures, or any other loss or damage resulting from the transfer of data over communications networks and facilities, including the internet, and the Customer acknowledges that the Services and Documentation may be subject to limitations, delays and other problems inherent in the use of such communications facilities.
  4. 6.4
    This Agreement shall not prevent the Service Provider from entering into similar agreements with third parties, or from independently developing, using, selling or licensing documentation, products and/or services which are similar to those provided under this Agreement.
  5. 6.5
    The Service Provider warrants that it has and will maintain all necessary licences, consents, and permissions necessary for the performance of its obligations under this Agreement.

7 Customer's obligations

  1. 7.1
    The Customer shall (and shall procure that Authorised Users shall):
    1. 7.1.1
      provide the Service Provider with:
      1. (a)
        all necessary co-operation in relation to this Agreement; and
      2. (b)
        all necessary access to such relevant information as may be required by the Service Provider;
      in order to provide the Services, including but not limited to Customer Data, security access information and configuration services;
    2. 7.1.2
      without affecting its other obligations under this Agreement, comply with all applicable laws and regulations with respect to its activities under this Agreement (including, without limitation, in relation to its use of the Services and the Documentation), as they may change from time to time;
    3. 7.1.3
      carry out all other Customer responsibilities set out in this Agreement in a timely and efficient manner. In the event of any delays in the Customer's provision of such assistance as agreed by the parties, the Service Provider shall not be liable for any failure to deliver any or all of the Services to the extent caused by Customer’s delay;
    4. 7.1.4
      use all reasonable endeavours to ensure that the Authorised Users use the Services and the Documentation in accordance with the terms and conditions of this Agreement and acknowledges and agrees that it shall be responsible for any Authorised User's breach of this Agreement as if they were its own breach. As part of this obligation, the Customer shall supervise and control the use of the Services in accordance with the terms of this Agreement;
    5. 7.1.5
      obtain and shall maintain all necessary licences, consents, and permissions necessary for the Service Provider, its contractors and agents to perform their obligations under this Agreement, including without limitation the Services;
    6. 7.1.6
      ensure that its network and systems comply with the relevant specifications provided by the Service Provider or relevant licensor or manufacturer from time to time; and
    7. 7.1.7
      be, to the extent permitted by law and except as otherwise expressly provided in this Agreement, solely responsible for procuring, maintaining and securing its network connections and telecommunications links from its systems to the Platform, and all problems, conditions, delays, delivery failures and all other loss or damage arising from or relating to the Customer or Authorised Users' (as the case may be) network connections or telecommunications links or caused by the internet.
  2. 7.2
    The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of all such Customer Data.

8 Charges and payment

  1. 8.1
    The Customer shall pay the Subscription Fees to the Service Provider for the Device Subscriptions in accordance with this clause 8.
  2. 8.2
    Unless the Customer has purchased the Services via a reseller or managed service provider, the Customer acknowledges and agrees that:
    1. 8.2.1
      it is a condition of this Agreement that it shall - no later than the expiry of the Initial Subscription Period - provide to the Service Provider valid, up-to-date and complete credit card details and any and all (if any) other relevant valid, up-to-date and complete contact and billing details;
    2. 8.2.2
      if the Customer provides its credit card details to the Service Provider, the Customer hereby irrevocably authorises the Service Provider to bill such credit card, subject to clause 15.1, shortly before or around the start of each Renewal Period for the Subscription Fees payable in respect of the relevant Renewal Period. The Subscription Fee charged for the relevant Renewal Period shall be calculated based on the Number of Device Subscriptions on the last Business Day before payment is sought by the Service Provider. If the Customer (acting in good faith) disputes part or all of any amounts debited on reasonable grounds, it shall notify the Service Provider in writing as soon as is reasonably possible (and in any event within 10 Business Days of having paid the relevant Subscription Fees) identifying clearly the disputed part of Subscription Fees paid and the reasons why it is challenged. Time shall be of the essence in relation to all sums payable by the Customer under the terms of this Agreement.
      In the event that the Customer purchases the Services via a reseller or managed service provider, the Customer acknowledges and agrees that it must provide a fully completed purchase order or its credit card details to the relevant reseller or managed service provider before the end of the Initial Subscription Period.
  3. 8.3
    If the Service Provider has not received payment in full in cleared funds when it tries to take payment in accordance with the payment process in clause 8.2, and without prejudice to any other rights and remedies of the Service Provider, the Service Provider may:
    1. 8.3.1
      downgrade the services the Customer receives to the free services that the Service Provider offers certain of its customers;
    2. 8.3.2
      on no less than 5 Business Days' notice to the Customer and without liability to the Customer, disable the Customer's password, account and access to all or part of the Services and the Service Provider shall be under no obligation to provide any or all of the Services while the relevant Subscription Fees remain unpaid; and
    3. 8.3.3
      charge interest shall accrue on a daily basis on such due amounts at an annual rate equal to 4% over the Bank of England's then current base lending rate, commencing on the first day of the relevant Renewal Period and continuing until fully paid, whether before or after judgment.
  4. 8.4
    All amounts and fees stated or referred to in this Agreement:
    1. 8.4.1
      shall be payable in the currency selected by the Customer on the Platform
    2. 8.4.2
      are, subject to clause 15.5, non-cancellable and non-refundable;
    3. 8.4.3
      are exclusive of value added tax or any other applicable tax, which shall be added to the Service Provider's charges at the appropriate rate.
  5. 8.5
    The Service Provider shall be entitled to increase the Subscription Fees and the fees payable in respect of the additional Device Subscriptions purchased pursuant to clause 3.3 by giving not less than 30 days' prior notice to the Customer and the prices shall be deemed to have been amended accordingly, subject to:
    1. 8.5.1
      such increase shall not exceed the greater of: (a) 7.5% (seven-and-a-half percent); and (b) the percentage increase in CPI during the period since the last such increase or, if there has been no such increase, during the period since the Effective Date;
    2. 8.5.2
      the Service Provider shall not be entitled to increase each type of subscription fee more than once in any 12 month period.

9 Warranties

  1. 9.1
    Each party warrants and undertakes that:
    1. 9.1.1
      it has full capacity and authority to enter into and to perform this Agreement;
    2. 9.1.2
      this Agreement is executed by a duly authorised representative of and is binding on that party;
    3. 9.1.3
      it shall at its own expense comply with all laws and regulations relating to its activities under this Agreement, as they may change from time to time.

10 Proprietary rights

  1. 10.1
    Except as expressly set out in this Agreement, neither party shall acquire any right, title or interest in or to the Intellectual Property Rights of the other party.
  2. 10.2
    Each party shall retain ownership of its Intellectual Property Rights that it owned before the Effective Date or created independently of its obligations under this Agreement.
  3. 10.3
    The Customer acknowledges and agrees that the Service Provider and/or its licensors own all intellectual property rights in the Services and the Documentation. Except as expressly stated herein, this Agreement does not grant the Customer any rights to, under or in, any patents, copyright, database right, trade secrets, trade names, trade marks (whether registered or unregistered), or any other rights or licences in respect of the Services or the Documentation.
  4. 10.4
    The Service Provider confirms that it has all the rights in relation to the Services and the Documentation that are necessary to grant all the rights it purports to grant under, and in accordance with, the terms of this Agreement.
  5. 10.5
    Where either party acquires by operation of law, title to Intellectual Property Rights that is inconsistent with the allocation of title in this clause 10, it hereby assigns such Intellectual Property Rights to the other party by way of assignment of present and future rights, with full title guarantee and waives its moral rights in such Intellectual Property Rights.

11 Confidentiality

  1. 11.1
    Confidential Information means all confidential information (however recorded or preserved) disclosed by a party or its Representatives (as defined below) to the other party and that party's Representatives whether before or after the Effective Date in connection with the Services, including but not limited to:
    1. 11.1.1
      the terms of this Agreement;
    2. 11.1.2
      any information that would be regarded as confidential by a reasonable business person, including information relating to:
      1. (a)
        the business, assets, affairs, customers, clients, suppliers or plans of the disclosing party; and
      2. (b)
        the operations, processes, product information, know-how, designs, trade secrets or software of the disclosing party;
    3. 11.1.3
      any information developed by the parties in the course of carrying out this Agreement;
    4. 11.1.4
      any other information that is identified as being of a confidential or proprietary nature.
    Representatives means, in relation to a party, its employees, officers, contractors, subcontractors, representatives and advisers.
  2. 11.2
    The provisions of this clause shall not apply to any Confidential Information that:
    1. 11.2.1
      is or becomes generally available to the public (other than as a result of its disclosure by the receiving party or its Representatives in breach of this clause);
    2. 11.2.2
      was available to the receiving party on a non-confidential basis before disclosure by the disclosing party;
    3. 11.2.3
      was, is or becomes available to the receiving party on a non-confidential basis from a person who, to the receiving party's knowledge, is not bound by a confidentiality agreement with the disclosing party or otherwise prohibited from disclosing the information to the receiving party;
    4. 11.2.4
      the parties agree in writing is not confidential or may be disclosed; or
    5. 11.2.5
      is independently developed by or for the receiving party, which independent development can be shown by written evidence.
  3. 11.3
    Each party shall keep the other party's Confidential Information secret and confidential and shall not:
    1. 11.3.1
      use such Confidential Information except for the purpose of exercising or performing its rights and obligations under or in connection with this Agreement; or
    2. 11.3.2
      disclose such Confidential Information in whole or in part to any third party, except as expressly permitted by this clause 11.
  4. 11.4
    A party may disclose the other party's Confidential Information to those of its Representatives who need to know such Confidential Information for the purpose set out in clause 11.3.1, provided that:
    1. 11.4.1
      it informs such Representatives of the confidential nature of the Confidential Information before disclosure; and
    2. 11.4.2
      at all times, it is responsible for such Representatives' compliance with the confidentiality obligations set out in this clause.
  5. 11.5
    A party may disclose Confidential Information to the extent such Confidential Information is required to be disclosed by law, by any governmental or other regulatory authority (including, without limitation, by a court or other authority of competent jurisdiction) provided that, to the extent it is legally permitted to do so, it gives the other party as much notice of the disclosure as possible and, where notice of disclosure is not prohibited and is given in accordance with this clause 11.5, it takes into account the reasonable requests of the other party in relation to the content of the disclosure.
  6. 11.6
    A party may, provided that it has reasonable grounds to believe that the other party is involved in activity that may constitute a criminal offence under the Bribery Act 2010, disclose Confidential Information to the Serious Fraud Office without first informing the other party of such disclosure.
  7. 11.7
    Each party reserves all rights in its Confidential Information. No rights or obligations in respect of a party's Confidential Information other than those expressly stated in this Agreement are granted to the other party, or to be implied from this Agreement.
  8. 11.8
    On termination of this Agreement, each party shall:
    1. 11.8.1
      destroy or return to the other party all documents and materials (and any copies) containing, reflecting, incorporating or based on the other party's Confidential Information;
    2. 11.8.2
      erase all the other party's Confidential Information from computer and communications systems and devices used by it, including such systems and data storage services provided by third parties (to the extent technically and legally practicable); and
    3. 11.8.3
      certify in writing to the other party that it has complied with the requirements of this clause, provided that a recipient party may retain documents and materials containing, reflecting, incorporating or based on the other party's Confidential Information to the extent required by law or any applicable governmental or regulatory authority. The provisions of this clause shall continue to apply to any such documents and materials retained by a recipient party, subject to clause 15 (Term and termination).
  9. 11.9
    No party shall make, or permit any person to make, any public announcement concerning this Agreement without the prior written consent of the other parties (such consent not to be unreasonably withheld or delayed), except as required by law, any governmental or regulatory authority (including, without limitation, any relevant securities exchange), any court or other authority of competent jurisdiction.
  10. 11.10
    Except as expressly stated in this Agreement, no party makes any express or implied warranty or representation concerning its Confidential Information.
  11. 11.11
    The above provisions of this clause 11 shall survive for a period of five years from termination of this Agreement.

12 Indemnity

  1. 12.1
    The Customer shall indemnify, defend and hold harmless the Service Provider, its officers, directors and employees against any and all claims, actions, proceedings, losses, damages, expenses and costs (including without limitation court costs and reasonable legal fees) arising out of or in connection with (i) any breach by the Customer or its Authorised Users of clause 2 or any other Intellectual Property Rights related obligations in this Agreement and (ii) (subject to the general liability cap at clause 14.4.3) the Customer and Authorised Users' use of the Services and/or Documentation, provided that:
    1. 12.1.1
      the Customer is given prompt notice of any such claim;
    2. 12.1.2
      the Service Provider provides information and reasonable co-operation to the Customer in the defence and settlement of such claim, at the Customer's expense; and
    3. 12.1.3
      the Customer is given sole authority to defend or settle the claim.
  2. 12.2
    The Service Provider shall, subject to clauses 12.3, 12.4, 13.1 and 14.4.2, indemnify, defend and hold harmless the Customer, its officers, directors and employees against any and all claims, actions, proceedings, losses, damages, expenses and costs (including without limitation court costs and reasonable legal fees) arising out of or in connection with a claim by a third party that the Customer's use of the Services or Documentation in accordance with this Agreement infringes the Intellectual Property Rights of a third party, provided that:
    1. 12.2.1
      the Service Provider is given prompt notice of any such claim;
    2. 12.2.2
      the Customer and Authorised Users do not make any admission, or otherwise attempt to compromise or settle the claim and provides information and reasonable co-operation to the Service Provider in the defence and settlement of such claim, at the Service Provider's expense; and
    3. 12.2.3
      the Service Provider is given sole authority to defend or settle the claim.
  3. 12.3
    In the defence or settlement of any claim, the Service Provider may:
    1. 12.3.1
      procure the right for the Customer and its Authorised Users to continue using the Services;
    2. 12.3.2
      replace or modify the Services so that they become non-infringing; or
    3. 12.3.3
      if such remedies in clauses 12.3.1 and 12.3.2 are not reasonably available, terminate this Agreement on not less than 2 Business Days' notice to the Customer without any additional liability or obligation to pay liquidated damages or other additional costs to the Customer.
  4. 12.4
    The foregoing states the Customer's sole and exclusive rights and remedies, and the Service Provider's (including the Service Provider's employees', agents' and sub-contractors') entire obligations and liability, for infringement or alleged infringement of any third party Intellectual Property Right by the Service Provider.

13 Disclaimer

  1. 13.1
    Subject to clause 14.3, in no event shall the Service Provider, its employees, officers, agents and sub-contractors be liable to the Customer under its obligation at clause 10.4 or under the indemnity at clause 12.2 to the extent that the alleged infringement is based on
    1. 13.1.1
      a modification or alteration of the Services or Documentation by anyone other than the Service Provider; or
    2. 13.1.2
      the Customer or Authorised Users' use of the Services or Documentation in a manner contrary to the terms of this Agreement and/or instructions given to the Customer and/or Authorised Users by the Service Provider; or
    3. 13.1.3
      the Customer or Authorised Users' use of the Services or Documentation after notice of the alleged or actual infringement from the Service Provider or any appropriate authority; or
    4. 13.1.4
      the Customer Data; or
    5. 13.1.5
      the Customer or Authorised Users' breach of this Agreement.
  2. 13.2
    The Services and Documentation are provided to the Customer on an "as is" basis during the Initial Subscription Term and the existence of errors in the Services shall not constitute a breach of this Agreement. The Customer acknowledge this clause is fair and reasonable in the context of the Services and Documentation being provided during the Initial Subscription Term (i) without charge to the Customer and (ii) at a cost to the Service Provider.
  3. 13.3
    The Customer acknowledges and agrees that certain third party equipment, services and/or software not manufactured or licensed by the Service Provider may be provided by Service Provider in relation to this Agreement (Third Party Products and Services). The Customer acknowledges and agrees that save for the Service Provider's obligation in clause 6.1.2 above, the Service Provider makes no representation or warranty in respect of Third Party Products and Services and any Third Party Products and Services provided by and/or made available to the Customer by the Service Provider are done so on an "as is" basis as part of the Service Provider's commercial service offering subject to the relevant third party's standard terms. Any and all other warranties, representations, conditions and terms of any kind whatsoever relating to the Third Party Products and Services whether express or implied by statute or common law including, without limitation, the implied conditions, warranties or other terms as to satisfactory quality or fitness for purpose are, to the fullest extent permitted by applicable law, excluded from this Agreement.

14 Limitation of liability

  1. 14.1
    This clause 14 sets out the entire financial liability of each party (including any liability for the acts or omissions of its employees, agents and sub-contractors) to the other party in respect of:
    1. 14.1.1
      any breach of this Agreement;
    2. 14.1.2
      any use made by the Customer or Authorised Users of the Services and the Documentation or any part of them; and
    3. 14.1.3
      any representation, statement or tortious act or omission (including negligence) arising under or in connection with this Agreement.
  2. 14.2
    Except as expressly and specifically provided in this Agreement:
    1. 14.2.1
      the Customer assumes sole responsibility for results obtained from the use of the Services and the Documentation by the Customer, and for conclusions drawn from such use. The Service Provider shall have no liability for any damage caused by errors or omissions in any Customer Data, information or instructions provided to the Service Provider by the Customer in connection with the Services, or any actions taken by the Service Provider at the Customer's direction;
    2. 14.2.2
      all warranties, representations, conditions and all other terms of any kind whatsoever implied by statute or common law including, without limitation, the implied conditions, warranties or other terms as to satisfactory quality, fitness for purpose or the use of reasonable skill and care are, to the fullest extent permitted by applicable law, excluded from this Agreement; and
    3. 14.2.3
      the Services and the Documentation are provided to the Customer on an "as is" basis;
    4. 14.2.4
      nothing limits the (i) Customer's liability under the indemnity at clause 12.1 if it or Authorised Users breach clause 2 or any other Intellectual Property Rights related obligations in this Agreement or (ii) Service Provider's liability under the third party IPR indemnity at clause 12.2.
  3. 14.3
    Nothing in this Agreement excludes the liability of either party for:
    1. 14.3.1
      death or personal injury caused by its negligence;
    2. 14.3.2
      fraud or fraudulent misrepresentation; or
    3. 14.3.3
      any other matter in respect of which it would be unlawful to exclude or restrict liability under English law.
  4. 14.4
    Subject to clause 14.2 and clause 14.3:
    1. 14.4.1
      neither party shall have any liability in contract, tort (including negligence) or for breach of statutory duty or in any other way under this Agreement for any:
      1. (a)
        loss of profits,
      2. (b)
        loss of business,
      3. (c)
        wasted expenditure,
      4. (d)
        depletion of goodwill and/or similar losses,
      5. (e)
        loss or corruption of data or information, or
      6. (f)
        any special, indirect or consequential loss, costs, damages, charges or expenses;
    2. 14.4.2
      and to the maximum extent permitted by law, the Service Provider's total liability to the Customer in respect of any and all defaults and any claims under this Agreement during the Initial Subscription Term is limited to £0 (zero pounds). The Customer acknowledges and agrees that this clause 14.4.2 is (i) fair and reasonable in the context of the Services and Documentation being provided by the Service Provider without charge to the Customer (and at a loss to the Service Provider) during the Initial Subscription Term and (ii) intended to ensure all of the Service Provider's customers are able to benefit from the Service Provider's services for the level of fees rendered during the Subscription Term. Given the nature of the security services provided, if the Customer is unhappy with the balance of the parties’ rights and obligations under this Agreement (in particular during the Initial Subscription Term), the Customer should use an alternative provider for its services the same as the Services;
    3. 14.4.3
      each party's total aggregate liability to the other (without prejudice to the Customer's obligation to pay the Subscription Fees as and when they fall due for payment) arising under or in connection with this Agreement following the expiry of the Initial Subscription Term, whether arising in contract, tort (including negligence) or restitution, or for breach of statutory duty or misrepresentation, or otherwise, shall be limited to 100% (one hundred percent) of the Subscription Fees paid or payable in the Contract Year that the claim or series of connected claims arise.
  5. 14.5
    The Customer acknowledges and agrees that, without prejudice to the Service Provider's obligations under clause 6 and subject to clause 13.3:
    1. 14.5.1
      the Services are designed to mitigate the risk of a cyber and other IT related security incidents occurring in respect of the Customer's business and systems, but the Service Provider cannot guarantee that the Customer will not suffer a successful cyber or other IT related security incident during the term of this Agreement;
    2. 14.5.2
      the Service Provider shall have no liability to the Customer for any losses or damages incurred by the Customer as a result of zero day exploits; and
    3. 14.5.3
      it shall make its own arrangements to prevent any permanent loss or corruption of the Customer's data save that this shall not apply to exclude or limit the Service Provider’s liability for breach of its obligations under this Agreement or its negligence in providing the Services.
  6. 14.6
    Nothing in this Agreement excludes the liability of the Customer for any breach, infringement or misappropriation of the Service Provider’s Intellectual Property Rights.

15 Term and termination

  1. 15.1
    This Agreement shall, unless otherwise terminated as provided in this clause 15, commence on the Effective Date and shall continue for the Initial Subscription Term and, thereafter, this Agreement shall be automatically renewed for successive periods of one (1) month (each a Renewal Period), unless:
    1. 15.1.1
      the Customer notifies the Service Provider via the Platform of its wish to terminate this Agreement (i) upon the expiry of the Initial Subscription Term or then current Renewal Period (as the case may be), in which case this Agreement shall terminate upon the expiry of the applicable Initial Subscription Term or Renewal Period or (ii) within seven (7) days of receipt of a revised Mandatory Policy whereby the new Mandatory Policy has or will have a material adverse effect on the Customer;
    2. 15.1.2
      the Service Provider gives the Customer not less than 60 (sixty) days' written notice to terminate this Agreement, in which case this Agreement shall terminate upon the expiry of the applicable notice period; or
    3. 15.1.3
      otherwise terminated in accordance with the provisions of this Agreement;
    and the Initial Subscription Term together with any subsequent Renewal Periods shall constitute the Subscription Term.
  2. 15.2
    Without affecting any other right or remedy available to it, either party may terminate this Agreement with immediate effect by giving written notice to the other party if:
    1. 15.2.1
      the other party commits a material breach of any other term of this Agreement and (if such breach is remediable) fails to remedy that breach within a period of 30 days after being notified in writing to do so;
    2. 15.2.2
      the other party suspends, or threatens to suspend, payment of its debts or is unable to pay its debts as they fall due or admits inability to pay its debts or is deemed unable to pay its debts within the meaning of section 123 of the Insolvency Act 1986 as if the words "it is proved to the satisfaction of the court" did not appear in sections 123(1)(e) or 123(2) of the Insolvency Act 1986;
    3. 15.2.3
      the other party applies to court for, or obtains, a moratorium under Part A1 of the Insolvency Act 1986;
    4. 15.2.4
      a resolution is passed, or an order is made, for or in connection with the winding up of that other party other than for the sole purpose of a scheme for a solvent amalgamation of that other party with one or more other companies or the solvent reconstruction of that other party;
    5. 15.2.5
      an order is made for the appointment of an administrator, or an administrator or administrative receiver is appointed over the other party (being a company, partnership or limited liability partnership);
    6. 15.2.6
      a receiver is appointed over the assets of the other party;
    7. 15.2.7
      any event occurs, or proceeding is taken, with respect to the other party in any jurisdiction to which it is subject that has an effect equivalent or similar to any of the events mentioned in clause 15.2.2 to clause 15.2.6 (inclusive);
    8. 15.2.8
      the other party suspends or ceases, or threatens to suspend or cease, carrying on all or a substantial part of its business;
    9. 15.2.9
      entitle to do so for Force Majeure in accordance with clause 16.
  3. 15.3
    Without affecting any other right or remedy available to it, the Service Provider may terminate this Agreement without liability to the Customer by giving written notice to the Customer if the Customer:
    1. 15.3.1
      fails to pay an amount due to the Service Provider under this Agreement (other than an amount that is subject to a bona fide dispute raised in accordance with clause 8.2.2) and such amount remains outstanding 10 Business Days after the Service Provider seeks to take the relevant payment from the Customer pursuant to clause 8.2.2;
    2. 15.3.2
      challenges or disputes the validity of any of the Service Provider or its licensors' Intellectual Property Rights;
    3. 15.3.3
      purports to assign any of its rights or obligations under this Agreement except as permitted in accordance with this Agreement.
  4. 15.4
    On termination of this Agreement for any reason:
    1. 15.4.1
      all licences granted under this Agreement shall immediately terminate and the Customer shall immediately cease all use of the Services and/or the Documentation;
    2. 15.4.2
      each party shall return and make no further use of any equipment, property, Documentation and other items (and all copies of them) belonging to the other party;
    3. 15.4.3
      the Service Provider may destroy or otherwise dispose of any of the Customer Data in its possession unless the Service Provider receives, no later than sixty days after the effective date of the termination of this Agreement, a written request for the delivery to the Customer of the then most recent back-up of the Customer Data. The Service Provider shall use reasonable commercial endeavours to deliver the back-up to the Customer within 30 days of its receipt of such a written request, provided that the Customer has, at that time, paid all fees and charges outstanding at and resulting from termination (whether or not due at the date of termination). The Customer shall pay all reasonable expenses incurred by the Service Provider in returning or disposing of Customer Data. Any electronic data shall be considered deleted for the purpose of this clause where it has been put beyond used by the deleting party; and
    4. 15.4.4
      any rights, remedies, obligations or liabilities of the parties that have accrued up to the date of termination, including the right to claim damages in respect of any breach of the agreement which existed at or before the date of termination shall not be affected or prejudiced.
  5. 15.5
    In the event that this Agreement is terminated by the Service Provider on notice pursuant to clause 15.1.2 or correctly terminated by the Customer for the Service Provider's material breach pursuant to clause 15.2.1, the Service Provider shall make a pro-rata refund to the Customer of the Subscription Fees that the Customer paid in advance in respect of Services not provided by the Service Provider as at the date of termination of this Agreement. If this Agreement is terminated (in part or in whole) for any other reason, clause 8.4.2 shall apply and no refunds shall be required to be made as a result of such termination (whether by way of compensation or otherwise).

16 Force majeure

Neither party shall be in breach of this Agreement or otherwise liable for any delay or failure in the performance of its obligations for so long as and to the extent that such delay or failure results from events, circumstances or causes beyond its reasonable control. If the period of delay or non-performance continues for 60 days, the party not affected may terminate this Agreement by giving not less than 5 Business Days' written notice to the affected party.

17 Bribery and Modern Slavery

  1. 17.1
    Each party shall, and shall procure that any person associated with it in connection with the performance of its obligations under this Agreement shall:
    1. 17.1.1
      comply with all applicable laws, regulations, codes and sanctions relating to anti-bribery and anti-corruption including but not limited to the Bribery Act 2010;
    2. 17.1.2
      comply with all applicable anti-slavery and human trafficking laws, statutes, regulations and codes from time to time in force including but not limited to the Modern Slavery Act 2015;
    3. 17.1.3
      not engage in any activity, practice or conduct that would constitute an offence under sections 1, 2 or 4 of the Modern Slavery Act 2015 if such activity, practice or conduct were carried out in the UK.

18 Conflict

  1. 18.1
    In the event, and only to the extent, of any conflict or inconsistency between the various documents forming part of this Agreement the following order of precedence shall apply:
    1. 18.1.1
      these Terms and Conditions; and
    2. 18.1.2
      the Schedules to these Terms and Conditions.

19 Variation

No variation of this Agreement shall be effective unless it is in writing and signed by both parties duly authorised representative.

20 Waiver

  1. 20.1
    A waiver of any right or remedy is only effective if given in writing and shall not be deemed a waiver of any subsequent right or remedy.
  2. 20.2
    A delay or failure to exercise, or the single or partial exercise of, any right or remedy does not waive that or any other right or remedy, nor does it prevent or restrict the further exercise of that or any other right or remedy.

21 Rights and remedies

Except as expressly provided in this Agreement, the rights and remedies provided under this Agreement are in addition to, and not exclusive of, any rights or remedies provided by law.

22 Severance

  1. 22.1
    If any provision or part-provision of this Agreement is or becomes invalid, illegal or unenforceable, it shall be deemed deleted, but that shall not affect the validity and enforceability of the rest of this Agreement.
  2. 22.2
    If any provision or part-provision of this Agreement is deemed deleted under clause 22.1 the parties shall negotiate in good faith to agree a replacement provision that, to the greatest extent possible, achieves the intended commercial result of the original provision.

23 Entire agreement

  1. 23.1
    This Agreement constitutes the entire agreement between the parties and supersedes and extinguishes all previous and contemporaneous agreements, promises, assurances and understandings between them, whether written or oral, relating to its subject matter.
  2. 23.2
    Each party acknowledges that in entering into this Agreement it does not rely on, and shall have no remedies in respect of, any statement, representation, assurance or warranty (whether made innocently or negligently) that is not set out in this Agreement.
  3. 23.3
    Each party agrees that it shall have no claim for innocent or negligent misrepresentation or negligent misstatement based on any statement in this Agreement.
  4. 23.4
    Nothing in this clause shall limit or exclude any liability for fraud.

24 Assignment and subcontracting

  1. 24.1
    Neither party may assign or transfer any of its rights, benefits or obligations under this Agreement without the prior written consent of the other party (such consent not to be unreasonably withheld or delayed).
  2. 24.2
    The Service Provider may at any time sub-contract all or any of its rights or obligations under this Agreement. The Service Provider shall be responsible for the acts and omissions of its subcontractors as if they were its own.

25 No partnership or agency

Nothing in this Agreement is intended to or shall operate to create a partnership or joint venture between the parties, or authorise either party to act as agent for the other, and neither party shall have the authority to act in the name or on behalf of or otherwise to bind the other in any way (including, but not limited to, the making of any representation or warranty, the assumption of any obligation or liability and the exercise of any right or power).

26 Third party rights

  1. 26.1
    This Agreement does not give rise to any rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of this Agreement.
  2. 26.2
    The rights of the parties to rescind or vary this Agreement are not subject to the consent of any other person.

27 Counterparts

  1. 27.1
    This Agreement may be executed in any number of counterparts, each of which shall constitute a duplicate original, but all the counterparts shall together constitute the one agreement.

28 Notices

  1. 28.1
    Any notice given to a party under or in connection with this Agreement shall be in writing and shall be:
    1. 28.1.1
      delivered by hand or courier service;
    2. 28.1.2
      sent by pre-paid first class, first class recorded delivery or special delivery post; or
    3. 28.1.3
      sent by email,
    to a Director of the relevant party at their registered office address (or such other position or address as either party may indicate by at least five Business Days prior written notice to the other party).
  2. 28.2
    Any notice shall be deemed to have been received:
    1. 28.2.1
      if delivered by hand, special delivery or courier at the time the notice is left at the proper address;
    2. 28.2.2
      if sent by pre-paid first class or first class recorded delivery post, at 9.00 am on the second Business Day after posting; or
    3. 28.2.3
      if sent by email to the correct e-mail address without any error message, at the time of transmission, or, if this time falls outside Normal Business Hours, when Normal Business Hours resume.
  3. 28.3
    This clause does not apply to the service of any proceedings or other documents in any legal action or, where applicable, any arbitration or other method of dispute resolution.

29 Costs

  1. 29.1
    Save as otherwise provided in this Agreement, each party shall pay its own costs in connection with the negotiation, preparation, execution and performance of this Agreement, and all documents ancillary to it.

30 Governing law

This Agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and interpreted in accordance with the law of England and Wales.

31 Jurisdiction

Each party irrevocably agrees that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this Agreement or its subject matter or formation (including non-contractual disputes or claims).

Schedule 1: Mandatory Policies

The Mandatory Policies can be found at https://trust.the-orchard.io

  • Modern Slavery and Human Trafficking Policy
  • Corporate and Social Responsibility Policy
  • Data and Privacy Policy
  • Ethics and Anti-Bribery Policy
  • Cybersecurity Policy
  • Business Continuity and Disaster Recovery

Schedule 2: Data Protection

1 Particulars of processing

The parties acknowledges and agrees that:

Scope

The subject matter of the Processing of Personal Data for and on behalf of the Customer:

The provision of the Platform and Services, including the processing of personal data submitted, stored, transmitted, or otherwise made available by the Customer and/or its authorised end users within the Platform.

This includes user account data, device metadata, configuration data, support communications, and any customer data uploaded or generated through use of the Services.

Nature and purpose of Processing

The purpose for the Processing of the Personal Data is the performance of the following tasks for and on behalf of the Customer:

  • Provision, operation, and maintenance of the Platform and Services;
  • Authentication of Authorised Users;
  • Management of device compliance, application patching, and security state monitoring;
  • Provision of Customer support services;
  • Security monitoring, logging, and incident response;
  • Compliance with legal and regulatory obligations.

Processing activities may include collection, recording, organisation, structuring, storage, retrieval, consultation, use, transmission, alignment, restriction, deletion, and destruction of personal data.

Types of personal data

The types of Personal Data processed may include:

Account Information

  • Name
  • Email address
  • Company name
  • Job title
  • Phone number
  • Login credentials (hashed/authenticated)

Device and Usage Information

  • IP address
  • Operating system version
  • Device identifiers (serial number, hardware ID)
  • Security configuration state
  • Installed applications metadata
  • Platform usage logs and timestamps
  • Device Username

Customer Support Data

  • Support ticket content
  • Communications and chat logs
  • Diagnostic information voluntarily provided by the Customer

The Service Provider does not intentionally process special categories of personal data (as defined under UK GDPR Article 9) and does not process data relating to criminal convictions or offences under Article 10, unless such data is inadvertently submitted by the Customer.

Categories of Data Subjects

The Processing concerns the following categories of Data Subjects:

  • Customer employees and contractors
  • Customer end users of managed macOS devices
  • Customer administrators
  • Individuals contacting the Service Provider for support services
  • The Customer's representatives interacting with the platform
Duration

Processing shall continue for the duration of the Agreement.

Upon termination or expiry of the Agreement:

  • Customer data will be retained for up to 90 days following account closure, after which it will be securely deleted, in accordance with the Service Provider’s Data Retention Policy.
  • Internal records, audit logs, and security documentation may be retained for a minimum of 7 years where required for legal, regulatory, contractual, or audit purposes.

2 Sub-processors

NameProcessingLocation
Hyve LimitedData Centre, HostingUnited Kingdom
HubSpot UK Holdings LimitedCRM, ticketing servicesGermany

Schedule 3: Service Levels

  1. 1.
    The Service Provider shall make the Platform available to a minimum of 99.9% uptime in each calendar month 24 hours per day 7 days per week, excluding planned and emergency maintenance i.e. a maximum of 0.1% downtime excluding planned and emergency maintenance.
  2. 2.
    On request the Service Provider shall compensate the Customer in relation to failure to comply with the service levels set out in paragraph 1 of this Schedule 3 in each month through a 1 day rebate in the Subscription Fees in the relevant calendar month for each hour in the relevant calendar month the Platform availability is beneath the 99.9% availability service level set out in paragraph 1 SUBJECT ALWAYS to a maximum rebate of the actual Subscription Fees paid for the relevant calendar month. Such compensation shall be the Customer's sole and exclusive financial remedy for the Service Provider's breach of paragraph 1 of this Schedule 3.
  3. 3.
    Any (if any) compensation to be paid by the Service Provider pursuant to paragraph 2 of this Schedule 3 reflects the reduced value of the Services actually received, is stated exclusive of VAT and shall be deducted from the Subscription Fees that are payable by the Customer for the next Renewal Period following the Service Provider calculating availability pursuant to paragraph 1 of this Schedule 3.