Platform terms

1.1 These terms apply when an organisation subscribes to BoxTick. They are a legal agreement between:

• (a) The Programme Group Limited, a company registered in England and Wales under company number 13511776, with its registered office at International House, 10 Churchill Way, Cardiff CF10 2HE, trading as BoxTick and The Programme Group (we, us, our); and
• (b) the organisation named in the Order Form (you, your).

1.2 BoxTick is for businesses and other organisations only. By entering into this agreement, you confirm that you are not a consumer and that the person accepting these terms is authorised to bind your organisation.

1.3 The agreement is formed when you sign or accept an Order Form, or accept these terms in the Platform when you first sign up, whichever happens first.

1.4 The agreement is made up of:

• (a) the Order Form;
• (b) these terms;
• (c) the Data Processing Agreement; and
• (d) the Acceptable Use Policy.

If they conflict, they take priority in that order, except that the Data Processing Agreement takes priority on anything about the processing of personal data.

In these terms:

• Acceptable Use Policy means our policy on how the Platform may be used, available in the Platform and at boxtick.uk.
• Authorised Users means your employees, contractors and advisers whom you allow to use the Platform.
• Client Data means all information, documents and data that you or your Authorised Users upload to, or connect to, the Platform, including information obtained from Connected Systems.
• Connected Systems means third-party systems that you choose to connect to the Platform, such as Microsoft 365, Google Workspace or Xero.
• Data Processing Agreement means our data processing agreement, which forms part of this agreement.
• Fees means the subscription fees, setup fees and any other charges set out in the Order Form.
• Order Form means the order form, online sign-up or written proposal accepted by you that sets out your plan, Fees and Subscription Term.
• Platform means the BoxTick online compliance platform, including its dashboards, registers, tools and connectors.
• Reports means the reports, registers, policies, evidence packs and other outputs we make available to you through the Services.
• Services means access to the Platform, analyst review and any other services described in the Order Form.
• Subscription Term means the period set out in clause 10.1, as renewed.

3.1 During the Subscription Term, we will:

• (a) give you and your Authorised Users access to the Platform for your organisation's internal business purposes;
• (b) provide the Services set out in your Order Form, including analyst review at the frequency stated for your plan; and
• (c) provide the Services with reasonable skill and care.

3.2 Analyst review. Before we release a Report to you as reviewed, it is checked and approved by a member of our analyst team. Registers, dashboards and reminders shown in the Platform between reviews are updated automatically from Client Data and are not individually reviewed unless the Platform says so.

3.3 What the Services are based on. Reports and Platform content are based on the Client Data available to us, publicly available information, and our understanding of the relevant laws, standards and guidance at the time. They are not a guarantee that your organisation complies with any law or standard (see clause 9).

3.4 Certifications. Where the Services help you prepare for a certification, such as Cyber Essentials, the certification itself is carried out and awarded by an independent certification body. We do not award certifications and cannot guarantee that you will achieve one.

3.5 Founding clients and pilots. If your Order Form says you are a founding client or pilot client:

• (a) some features may be in development, may change and may be offered before they are complete;
• (b) you agree to give us reasonable feedback on the Services; and
• (c) any special pricing or terms in your Order Form apply for the period stated there.

3.6 Changes to the Services. We may improve, change or add to the Services from time to time. We will not make a change that materially reduces the core Services in your plan during your current Subscription Term without your agreement, unless the change is needed to comply with law or to keep the Platform secure.

3.7 Support. We provide support by email at hello@boxtick.uk during UK business hours (9am to 5pm, Monday to Friday, excluding bank holidays). We aim to respond within one business day.

3.8 Subcontractors. We may use subcontractors and service providers to help provide the Services. We remain responsible for their work as if it were our own.

4.1 Your decisions. You remain responsible for your organisation's compliance with the laws, regulations and standards that apply to it. You are responsible for deciding whether and how to act on any Report, and for implementing any changes. You should take your own legal advice where needed.

4.2 Accurate information. You must give us complete and accurate information, keep it up to date, and tell us promptly about any change that could affect the Services, such as new systems, new types of data or a significant change to your business. Reports depend on the information you provide, and we are not responsible for errors caused by information that is incomplete, inaccurate or out of date.

4.3 Authorised Users. You must:

• (a) only allow Authorised Users to access the Platform, each with their own login;
• (b) make sure Authorised Users keep their login details confidential and use multi-factor authentication where the Platform offers it;
• (c) make sure Authorised Users comply with this agreement, and remain responsible for their acts and omissions; and
• (d) tell us straight away if you suspect any unauthorised access to your account.

4.4 Connected Systems. When you connect a Connected System to the Platform, you:

• (a) confirm that you have the authority and any permissions needed to connect it and to let us access the data we need from it;
• (b) authorise us to access and use data from it to provide the Services; and
• (c) accept that the Connected System is provided by a third party under its own terms. We are not responsible for its availability, accuracy or any change to it that affects the Services.

You can disconnect a Connected System at any time, which may limit the Services we can provide.

4.5 Your data and the law. You are responsible for making sure that you have a lawful basis and have given any notices needed to share Client Data with us, including personal data about your staff, customers and suppliers.

4.6 Acceptable use. You and your Authorised Users must comply with the Acceptable Use Policy. In particular, you must not:

• (a) upload anything unlawful, harmful or infringing, or any malicious code;
• (b) try to access parts of the Platform or other clients' data that you are not entitled to;
• (c) copy, resell, sublicense or make the Platform available to anyone else, except where your Order Form allows it;
• (d) reverse engineer the Platform, or use it to build a competing product; or
• (e) carry out security or load testing of the Platform without our written permission.

4.7 Staff policy sign-off. If you use the Platform to issue policies to your staff, you remain responsible for the content of those policies, for how you communicate them to staff, and for any employment law consequences.

5.1 You must pay the Fees set out in your Order Form. All Fees are in pounds sterling and exclude VAT, which you must pay in addition at the applicable rate.

5.2 Subscription fees are payable in advance, monthly or annually as set out in your Order Form, by card or Direct Debit through our payment provider. By giving us your payment details, you authorise us to collect the Fees when they fall due.

5.3 Setup fees are payable when the agreement is formed and are not refundable once onboarding has started.

5.4 Partner arrangements. If you subscribe through one of our partners and your Order Form says the partner will bill you, you pay the partner instead of us, on the partner's payment terms. This agreement otherwise still applies between you and us.

5.5 Price changes. We may change our Fees by giving you at least 60 days' written notice. A change will not take effect before the end of any fixed period or special price stated in your Order Form, including founding client pricing. If you do not agree to a price change, you may end the agreement under clause 10 before the change takes effect.

5.6 Late payment. If a payment fails or is late, we will let you know. If any amount is not paid within 14 days of its due date, we may:

• (a) charge interest and compensation under the Late Payment of Commercial Debts (Interest) Act 1998; and
• (b) after giving you a further 7 days' written notice, suspend access to the Platform until the amount is paid.

5.7 Disputed invoices. If you reasonably dispute an amount in good faith, tell us in writing within 14 days of the invoice or payment. You must pay any amount not in dispute, and we will not suspend the Services for the disputed amount while we work together to resolve it.

5.8 Refunds. Except where this agreement says otherwise, Fees already paid are not refundable. If you end the agreement because of our material breach, or because you do not accept a change to these terms or our Fees, we will refund any subscription Fees you have paid in advance for the period after the agreement ends.

6.1 Roles. For personal data within Client Data, you are the controller and we are your processor. The Data Processing Agreement sets out how we process that personal data, and it must be in place before you upload Client Data or connect any Connected System. For personal data we use to manage our relationship with you, such as account contacts and billing details, we are the controller, as described in our privacy notice.

6.2 Using Client Data. We will only use Client Data to provide, maintain, secure and support the Services for you, and as the Data Processing Agreement and the law allow. We will not sell Client Data.

6.3 Security. We will use appropriate technical and organisational measures to protect Client Data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These include encryption in transit and at rest, access controls limited to authorised staff, and audit logging of access to Client Data. We will tell you without undue delay if we become aware of a personal data breach affecting Client Data, as set out in the Data Processing Agreement.

6.4 Automated and AI-assisted tools. To provide the Services efficiently, we use software, including automated and AI-assisted tools, to read documents, gather evidence from Connected Systems, and prepare draft findings. When we use these tools:

• (a) every Report released as reviewed is checked and approved by a member of our analyst team under clause 3.2;
• (b) we only use providers that are bound by data processing terms and that do not use Client Data to train their models; and
• (c) the providers we use are listed on our sub-processors page.

6.5 Sub-processors. You give general authorisation for us to use the sub-processors listed on our sub-processors page. We will give you notice before adding or replacing a sub-processor, and you may object as set out in the Data Processing Agreement.

6.6 Aggregated information. We may create anonymised and aggregated information from use of the Services, for example the most common compliance gaps across our clients, to improve the Services and to publish general insights. This information will not identify you, any individual or any Client Data.

7.1 Each party will keep the other party's confidential information secret, only use it to perform or receive the Services, and only share it with its employees, contractors, advisers and service providers who need to know it and who are bound by similar confidentiality duties.

7.2 Confidential information includes Client Data, Reports, our pricing, the Platform, and any information marked as confidential or that a reasonable person would treat as confidential.

7.3 This clause does not apply to information that is already public through no fault of the receiving party, that the receiving party already lawfully had or developed independently, or that must be disclosed by law, a court or a regulator. If disclosure is required, the receiving party will tell the other party first where the law allows.

7.4 These duties continue for five years after the agreement ends, and indefinitely for Client Data.

8.1 Our property. We, or our licensors, own all intellectual property rights in the Platform, the Services, our templates, methods, rule libraries and content, and the BoxTick and The Programme Group names and logos. Apart from the rights expressly given in this agreement, you do not acquire any rights in them.

8.2 Your property. You own all rights in Client Data. You give us a non-exclusive licence to use Client Data for the length of the agreement, and for any period afterwards set out in clause 10, only to provide the Services and as clause 6 allows.

8.3 Reports. Once you have paid the Fees that relate to them, you may use, copy and share Reports for your organisation's own business purposes, including with your customers, insurers, auditors, certification bodies, funders and advisers. Reports may contain our templates and content, which remain ours. You must not sell Reports or use them to provide compliance services to others.

8.4 Feedback. If you give us suggestions or feedback about the Services, we may use them freely to improve the Services without any obligation to you.

8.5 Publicity. We will not name you as a client, or publish a case study or testimonial about you, without your prior written consent. If you are a founding client, your Order Form may include that consent, and you can withdraw it for future use at any time.

9.1 Not legal advice. BoxTick provides compliance tools, support and evidence. We are not a law firm and are not regulated to provide legal services. Reports are not legal advice and are not a substitute for advice from a qualified professional on your organisation's particular circumstances.

9.2 No guarantee of compliance. Using the Services does not guarantee that your organisation complies with any law, regulation or standard, that you will pass any audit, assessment or certification, or that you will avoid any fine, claim, complaint or enforcement action.

9.3 Changes in law. Laws, guidance and standards change. We will make reasonable efforts to update the Platform and Reports to reflect significant changes affecting your plan, but Reports reflect the position at the date they were produced.

9.4 Availability. We aim to make the Platform available at all times, but it may sometimes be unavailable because of maintenance, updates, faults or events outside our control. Where we can, we will carry out planned maintenance outside UK business hours and give you advance notice of anything likely to cause significant disruption. We do not promise that the Platform will be uninterrupted or error-free.

9.5 Third-party services. We are not responsible for Connected Systems or other third-party services, including any change, fault or interruption to them.

9.6 Exclusion of implied terms. Except as expressly set out in this agreement, and to the extent the law allows, all warranties, conditions and other terms implied by statute or common law are excluded.

10.1 Subscription Term. The agreement starts when it is formed under clause 1.3 and continues for the initial period in your Order Form. After that:

• (a) monthly plans continue month by month until either party ends them by giving at least 30 days' written notice; and
• (b) annual plans renew automatically for further 12-month periods unless either party gives written notice at least 30 days before the end of the current period. We will remind you at least 45 days before an annual plan renews.

10.2 Ending the agreement for breach or insolvency. Either party may end the agreement immediately by written notice if the other party:

• (a) commits a material breach that cannot be put right, or that is not put right within 30 days of being asked in writing to do so; or
• (b) becomes insolvent, enters administration or liquidation (other than a solvent reorganisation), has a receiver appointed, or stops trading.

10.3 Non-payment. We may end the agreement by written notice if any undisputed Fees remain unpaid 30 days after we have suspended access under clause 5.6.

10.4 Changes you do not accept. You may end the agreement by written notice under clause 5.5 (price changes) or clause 12.1 (changes to these terms) before the change takes effect.

10.5 What happens when the agreement ends.

• (a) Your access to the Platform will end, and you must pay any Fees due up to the end date.
• (b) For 30 days after the end date, you can export your Client Data and Reports from the Platform, or ask us to provide them to you in a commonly used format.
• (c) After that period, we will delete Client Data within 90 days, including from backups as they are routinely overwritten, unless the law requires us to keep it. We will confirm deletion in writing if you ask. For the future Platform, database backups will use a rolling seven-day restore window. This does not extend the 30-day export period or the following 90-day deletion deadline.
• (d) We may keep records of our dealings with you, such as the Order Form, invoices, correspondence and records of Report approvals, for as long as the law requires or as we reasonably need to defend legal claims.

10.6 Clauses that by their nature should continue after the agreement ends will do so, including clauses 4.1, 5, 7, 8, 9, 10.5, 11 and 13.

11.1 What is not limited. Nothing in this agreement limits or excludes either party's liability for:

• (a) death or personal injury caused by its negligence;
• (b) fraud or fraudulent misrepresentation; or
• (c) any other liability that cannot be limited or excluded by law.

Nothing in this agreement limits your obligation to pay the Fees.

11.2 Losses we are not responsible for. Subject to clause 11.1, we will not be liable to you, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for any:

• (a) loss of profits, revenue, sales or business;
• (b) loss of anticipated savings;
• (c) loss of contracts, business opportunity, goodwill or reputation;
• (d) business interruption;
• (e) loss or corruption of data, except that if Client Data is lost or corrupted because of our breach, we will restore it from our most recent backup at no charge;
• (f) fines, penalties or sanctions imposed on you by a regulator or other authority, to the extent the law allows them to be excluded; or
• (g) indirect or consequential loss.

11.3 Losses caused by you. We will not be liable for any loss to the extent it is caused by Client Data or information you gave us being incomplete, inaccurate or out of date, by your failure to act on a Report, or by your breach of this agreement.

11.4 Our total liability. Subject to clauses 11.1 and 11.5, our total liability to you for all claims arising out of or in connection with this agreement in any 12-month period, starting on the date the agreement is formed, is limited to the greater of:

• (a) the Fees paid and payable by you in that 12-month period; and
• (b) £10,000.

11.5 Data protection and confidentiality. Subject to clause 11.1, our total liability for claims arising from our breach of clause 6, clause 7 or the Data Processing Agreement in any 12-month period is limited to the greater of three times the Fees paid and payable in that period and £50,000. This amount is separate from, and in addition to, the limit in clause 11.4.

11.6 Your liability. Subject to clause 11.1, your total liability to us in any 12-month period, other than for unpaid Fees and for breach of clause 4.6 or clause 8.1, is limited to the Fees paid and payable by you in that period.

11.7 Making a claim. A party must notify the other in writing of any claim within 12 months of becoming aware of the circumstances giving rise to it, giving reasonable details.

12.1 Changes to these terms. We may change these terms by giving you at least 30 days' written notice, unless the change is needed sooner to comply with law or to keep the Platform secure. If a change is materially to your disadvantage, you may end the agreement under clause 10.4 before it takes effect. The terms in force at any time are published at boxtick.uk with the date they were last updated.

12.2 Transfer. We may transfer this agreement to a company in our group, or to anyone who takes over all or part of our business, by giving you written notice. The Data Processing Agreement will continue to protect Client Data. You may not transfer this agreement without our written consent, which we will not unreasonably withhold.

12.3 Events outside our control. Neither party will be liable for delay or failure to perform caused by events outside its reasonable control, such as a failure of the internet or a hosting provider, cyber attack (despite reasonable security measures), power failure, fire, flood, pandemic, war or government action. This does not affect your obligation to pay Fees for Services we provide. If such an event prevents the Services for more than 30 days, either party may end the agreement by written notice.

12.4 Notices. Notices under this agreement must be in writing and sent by email: to us at hello@boxtick.uk, and to you at the contact email in your Order Form or Platform account. A notice is treated as received at the time it is sent if it is sent during UK business hours, or otherwise at 9am on the next business day.

12.5 Entire agreement. This agreement is the whole agreement between the parties about its subject matter and replaces any earlier discussions or arrangements. Neither party has relied on any statement not set out in this agreement. This does not limit liability for fraud.

12.6 Relationship. Nothing in this agreement creates a partnership, joint venture or employment relationship between the parties.

12.7 Third parties. No one other than the parties has any right to enforce this agreement under the Contracts (Rights of Third Parties) Act 1999.

12.8 Severance and waiver. If any part of this agreement is found to be unenforceable, the rest remains in force. A delay in enforcing any right is not a waiver of it.

13.1 If a dispute arises, each party will first try to resolve it in good faith by referring it to a senior person in each organisation. If it is not resolved within 30 days, either party may take it further under clause 13.2. This does not stop either party seeking urgent relief from a court.

13.2 This agreement, and any dispute or claim arising out of or in connection with it (including non-contractual disputes or claims), is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.