Terms of business

1. About these terms

Kalotect Ltd, trading as Kalotect, is a design and technology studio. It is a company registered in England and Wales with company number 17517329, and its registered office is at Lambourne House, London Road, Riverhead, Sevenoaks TN13 2DE. In these terms it is “we”, “us” or “our”. The business named in your engagement schedule is “you”.

These are our standard terms of business. They are written for businesses: we work only with people acting for the purposes of their trade, business or profession, and by signing you confirm that this is how you are dealing with us. They apply to every engagement schedule you sign with us.

Each section has a heading and, where it helps, a short note in plain English. A note explains the clause above it; if a note and a clause ever seem to differ, the clause is what we have agreed.

2. The agreement and which document wins

Each engagement is made up of these documents, which together are the agreement between us:

• the engagement schedule you sign, which lists the services in full, the price, how and when it is paid, the start date, how long the engagement runs, the notice for ending a recurring service, every recurring charge in pounds with the date it starts, and any special conditions;
• these terms of business, in the version frozen with the engagement schedule when you sign it;
• the data processing schedule, in the version frozen in the same way, where we process personal data for you; and
• the proposal and the plan attached to it, as updated through approvals and change requests, which describe how and when the work will be done.

If they conflict, the one higher in this list wins:

1. the special conditions in the engagement schedule;
2. the data processing schedule, on personal data;
3. the rest of the engagement schedule;
4. these terms of business; and
5. the proposal and its plan, on how and when the work is done only.

Nothing in the engagement schedule or in these terms, the special conditions included, reduces the protection the data processing schedule gives to personal data. The proposal and its plan never prevail on liability, ownership, payment or ending the agreement.

Only a special condition departs from these terms. The rest of the engagement schedule fills in what these terms leave to it, such as the services, the price, the payment plan, the dates, the recurring charges and the notice; where it restates something in these terms more briefly, these terms apply as written. A different way of paying, for example in instalments with a cap on the total cost, can be agreed only as a special condition. A special condition in an engagement schedule we have issued binds us; we issue one only once Michelle Wynne, our director, has approved it.

Where your engagement schedule names a package, it lists in full what the package includes and what it excludes, as our pricing page described the package on the day we sent the proposal.

We send a proposal within 2 working days of a completed brief. With it we issue the engagement schedule, already signed for us, as our offer, open until the date the proposal states. The agreement is made when you sign that engagement schedule in the portal within that time. We sign only by Michelle Wynne, our director, or by a person Michelle Wynne has authorised in writing to sign that engagement or engagements of that kind, with the authority recorded in our Ledger. The signed copy shows our signature as it was made, who signed for us, when and under what authority.

3. Words with a set meaning

In these terms the words below have the meanings given. Other words have their ordinary meaning, and “including” introduces examples rather than a complete list.

• “AI agent” means software we run that uses an AI model to carry out a task, such as drafting, building, testing or checking, within the permissions and budget we set for it.
• “Approval” means your yes to a piece of work, a milestone, a change request or a publication, given as “Approvals, questions and defaults” describes.
• “Background IP” means everything we own, or hold a licence to, that is not made specifically for you: our platform, the portal, the admin and its modules, the site kit we install on sites we build, and our reusable components, templates, prompts, agent profiles, workflows, tools, methods and know-how, whether they existed before the agreement or were developed during it, provided they contain none of your Client Materials or Confidential Information. Anything named as a deliverable in the engagement schedule, the plan or an approved change request is a Deliverable, not Background IP.
• “Change request” means a written proposal to add to or change the agreed scope, stating what it covers, its price and its effect on dates and on any recurring charge.
• “Client admin” means a person you have given that role in the portal; “client member” means a person you have given the role of client member.
• “Client Materials” means everything you or your people give us for the work: content, images, logos, brand guidelines, data, facts about your business, and access to your accounts and systems.
• “Confidential Information” means information about the other party’s business, people, customers, finances, plans, systems or code that is marked as confidential or that a reasonable person would understand to be confidential.
• “Data processing schedule” means our data processing terms, published with these terms, which apply where we process personal data for you.
• “Deliverables” means what we make specifically for you under the agreement, including everything named as a deliverable in the engagement schedule, the plan or an approved change request: designs, the code we write for your site or systems, copy, images, video, animation, brand guidelines and documents, but not Background IP or third-party materials.
• “Engagement schedule” means the document you sign for each engagement, which incorporates these terms.
• “Fees” means the prices in the engagement schedule and in any approved change request.
• “Go-live” means the day your site, or the part of the work concerned, is first made available to the public at its live address.
• “Ledger” means the record we keep of the actions taken for you, each with what was done, who did it, why, the objective it serves and the evidence, as “The Ledger” describes.
• “Plan” means the plan attached to our proposal, as updated through approvals and change requests.
• “Portal” means the client portal at portal.kalotect.com, through which you sign, approve, answer, pay and see your work and your Ledger.
• “Project” means work with a defined end, such as a site build, delivered through milestones. “Recurring service” means a service we charge for by the month, such as Care, a retainer, a module or a licence. The domain, hosting and SSL bundle is not one of our recurring services; “Third-party costs” explains how it is bought.
• “Question” means a decision we ask you to make in the portal, with options, the option we recommend, a default and an expiry date.
• “Third-party costs” means what we pay others for you, such as domains, hosting, licences, stock images, fonts, printing and advertising spend.
• “Working day” means Monday to Friday, other than a bank or public holiday in England.

4. What we do, and to what standard

We will provide the services in your engagement schedule, as the plan describes them and as approved change requests add to them.

We will do the work with the reasonable skill and care of a competent studio doing the same kind of work, using people with the skills it needs, in line with good industry practice and the laws that apply to us. Sites we build meet the standard published on our site on the day we sent the proposal, which is fixed for your engagement as it stood that day: fast, accessible, secure and honest, including conformance with level AA of the Web Content Accessibility Guidelines 2.2 and the performance budgets agreed in the plan.

The dates in the plan are the dates we work to. If one is going to move, we tell you as soon as we know, why, and by how much. A date is a firm commitment only where the engagement schedule says so.

We are not your lawyers, accountants or regulatory advisers. Where the plan includes them, we draft the standard pages a site needs, such as a privacy notice and a cookie notice, from what you tell us, and we point out legal questions we notice. Advice you rely on about your own legal duties should come from your own advisers.

5. The portal

We give you access to the portal from the day the agreement is made. It is the hub for everything we do for you: where you sign, approve work, answer questions, and see your documents, invoices, the uptime of your site and your Ledger. Your roadmap, previews of your site and its deployments, meeting summaries, media and brand guidelines appear there as each is set up for you. We use the portal, as well as email, to reach you.

You decide who has access and in which role. A client admin can approve work, buy and cancel services, pay and invite others. A client member can read, comment and answer questions. You are responsible for choosing them, for keeping their sign-in secure, and for removing anyone who should no longer have access. Tell us at once if you think an account has been misused, and we will help you lock it.

When a person from our studio works in your portal to help you, every action they take is recorded under their own name. Nobody from our studio approves work, answers a question, buys or cancels a service, or pays for you. A person from our studio may record in the portal an instruction you gave us in writing outside it, such as a client admin’s email cancelling a service, or a formal notice, with your message as its evidence, and we confirm it to you. An approval is never recorded in this way.

6. Approvals, questions and defaults

Approvals. When work is ready for your decision, we put it in the portal with what you are approving, what your approval releases (a payment in pounds, a publication or a deployment), our note and a preview. You either approve it, or ask for a change and say what. An approval covers the exact version you were shown and is recorded with that version; if we change it afterwards, we ask again. An approval releases a payment only where it names the milestone and the amount in pounds, as you were shown them when you approved.

Approvals are given by a client admin, signed in to the portal. A link in our email takes you to the approval in the portal, and the approval itself is given there. We do not take an approval by email, by message or in a meeting, and nobody from our studio approves anything for you.

Please approve or ask for a change within the time the request states, or within ten working days if it states none. We never treat silence as an approval. While an approval is waiting, the work that depends on it waits too, and the dates that follow move by the same amount.

A change you ask for at an approval is part of the price where it brings the work into line with what was agreed. A change that goes beyond what was agreed, or reverses something you approved earlier, is handled as a change request.

Questions. Where we need a decision from you, we ask it as a question in the portal. Every question states its options, the option we recommend, the default and the date it expires. A client admin or a client member may answer it. If nobody has answered by the expiry date, we proceed with the default, record in your Ledger that the default applied, and tell you.

A default can never do any of the following, which always need your express yes:

• increase what you pay, or commit you to a third-party cost;
• approve a milestone or release a payment;
• publish anything in your name;
• deploy a change to your live site;
• end a service or delete your data; or
• use personal data we process for you in a new way, handle a new kind of it, or send it somewhere new, as the data processing schedule provides.

Approvals and answers given in the portal, and defaults applied under this section, are instructions we are entitled to act on. You can change your mind later; if work has already relied on the earlier decision, undoing it may be a change request.

7. The Ledger

We record in your Ledger the work we do for you: what was done, by whom (a person or a named AI agent), why, the objective it serves and the evidence. Approvals, answers, defaults, change requests, invoices and payments, deployments, changes of access and the signing of the agreement are all recorded there.

Entries are never altered. Each is linked to the one before it so that any later alteration would show, and a mistake is corrected by a new entry that says so. We keep the Ledger for as long as “What happens when it ends” says, and then delete it.

The Ledger is our shared record of the agreement. Either of us may rely on it as evidence of what was asked, approved, answered and done, and either of us may show that an entry is wrong.

You can read your Ledger in the portal at any time, open the evidence attached to its entries, and export it. Some entries concern only our own running and are not shown to you: our internal costs, and the step-by-step working of our AI agents, such as each tool an agent used, which we keep in our own records. Every entry about work delivered to you, a decision you made or a charge to you is shown to you, and if you ask how a piece of work was done, we tell you from our records.

8. Meetings, notes and your roadmap

We may record and transcribe our meetings with you, using a Plaud recording device and its app, so that nothing said is lost. We record a meeting with you only once you have agreed that we may. You can agree in the portal, by answering the one-click question we put to you there; when you sign the engagement schedule, by ticking its separate, optional box; or by telling us at the start of a meeting, which the person from our studio who asked records on your record. Until you have agreed, any notes of your meetings are kept for us only, and are never planned into work or shared with you. You can withdraw your agreement in the portal at any time. Even once you have agreed, we tell everyone present at the start of each meeting that we are recording, and anyone may ask us not to, in which case we take written notes instead.

Once you have agreed, we file the notes to your record and use them to plan the work. Before they are used to plan anything, a person from our studio reads the notes and the transcript for sensitive details, such as anyone’s health, and takes out any they find. Nothing from a meeting reaches the portal until a person from our studio has checked that it belongs to you and released it. With the release you see a summary of the meeting and its actions in the portal, with the work it plans that we show you and the questions it puts to you, and you may ask us for the transcript. If a note gets something wrong, tell us and we will add a correction.

We are the controller of the recordings, transcripts and notes of our meetings with you, and handle them as our privacy notice describes, except that where a meeting names or discusses people whose personal data we process for you, such as your customers, patients or staff, that part is your personal data, which we process for you under the data processing schedule.

What is said in a meeting becomes an instruction when it is confirmed in the portal as an approval, an answer or a change request. Until then the notes are a record of the conversation, not a change to the agreement.

Your roadmap in the portal shows the work planned for you, in order, with its status. It is a plan we keep up to date, not a commitment to further work: what we have agreed to do, and its price, is in your engagement schedule and in approved change requests.

9. What we need from you

The work depends on you as well as on us. You will:

• give us the content, materials, information and decisions the plan asks for, by the dates it gives;
• give us access to the accounts and systems the work needs, such as your domain, hosting, code repositories, analytics, search and social accounts, and keep that access working;
• name a person who can make decisions for you and answer our questions;
• make sure the facts you give us about your business, such as your prices, opening hours, address, qualifications, results and claims, are accurate and can be supported, and check them when you approve work that contains them;
• make sure you have the right to give us the Client Materials and for us to use them for the work, and tell us of any limit on that right;
• tell us about any law, regulator or professional rule that governs what your business may say or do, such as the rules on advertising medical, financial or legal services; and
• keep your own copies of the materials you give us.

If something we need is late or wrong, the dates that depend on it move, and we tell you by how much. If we must redo work that relied on what you gave us, that work is a change request.

10. Your accounts stay yours

We never create an advertising, analytics, search or social account in our own name for your business. Those accounts are yours and you grant us the access the work needs. We register your domain in your name, with you as its registrant, and the code we write for you is kept in a repository you own or one we transfer to you when you ask.

You can see in your Ledger every access we have been given and every access we have removed.

11. Changes to the work

Anything outside the agreed scope is a change. Either of us may suggest one. We write it up as a change request stating what it covers, its price, and its effect on the dates and on any recurring charge, and put it in the portal for your approval.

We do not start a change, and you do not pay for one, until a client admin has approved the change request. Once approved, it adds to the work under the agreement.

A change is priced either as a fixed amount, or at our day rate of £760 or our hour rate of £120 with an estimate of the time it will take and a limit we will not go beyond without asking you again.

Work outside a project, such as consulting, build days or small changes outside a Care plan, is charged in the same way, at the day or hour rate agreed in writing before it starts.

12. Prices and payment

The Fees are fixed in the engagement schedule and in approved change requests. Every recurring charge is stated in pounds before you agree to it, and again on each invoice.

A site project is paid in four parts, unless the engagement schedule records a different payment plan as a special condition:

1. 50 per cent of the project price when you sign;
2. 20 per cent when you approve the design;
3. 20 per cent when the build is complete and you approve the preview; and
4. 10 per cent at go-live.

We issue each invoice when the step it belongs to is reached. We issue the deposit invoice once the agreement has been made, and we schedule the start of a project once it has been paid. We issue the go-live invoice only once the deposit, design and build invoices have been paid.

Care, retainers, modules and licences are charged monthly in advance. A business in the United Kingdom pays them by Direct Debit unless we agree otherwise; others pay by card.

Invoices are due fourteen days from the date of issue, and you can pay them through the portal. If you dispute an invoice in good faith, tell us before it is due and pay the part you do not dispute. We do not charge interest on the disputed part, or pause work over it, while we resolve it with you.

Prices exclude VAT. We are not yet VAT registered; VAT will be added to new invoices once we are, and we will tell you before it applies.

If we register for VAT while your engagement is running, VAT is added to every invoice we issue from the date of registration, including the later payments for a project agreed before it, and we tell you at least thirty days before that date. The price before VAT does not change.

We do not increase the price of a recurring service during a minimum term. Otherwise we may change it by telling you in writing, in pounds, at least thirty days before the change, which applies only from the start of a billing period. You may cancel before it applies, without paying for any remaining minimum term. We do not change the price of a project once it is agreed, except through a change request you approve.

A discount, including our founding-client offer, applies only as the engagement schedule states, and the schedule also states in pounds what the price will be when the discount ends.

We never hold money for you. What you pay us is payment for our services, or reimbursement of third-party costs you approved.

13. Third-party costs

We agree third-party costs with you before we commit to them. We pass them on at what they cost us, without a mark-up, listed separately on the invoice, and we may ask you to pay for them before we buy.

Where we can, we buy in your name, or you buy directly, so that the account, the licence and the relationship are yours. Hosting may be billed to you directly by the host.

The domain, hosting and SSL bundle on our pricing page is a product with its own published price. It is not a third-party cost passed on at cost, and it is not one of our recurring services. You buy it through our hosting partner’s storefront, and the partner bills you for it on its own billing period and terms. Before you buy, we show you its price in pounds, how often it is billed, when it renews, how to cancel it and the partner’s terms. The domain is registered with you as its registrant. We list the bundle in your engagement schedule so that you see every recurring cost in one place, and we help you cancel it or move it whenever you ask.

Advertising spend is paid from your own advertising accounts. Where we agree to buy media for you, we invoice the spend in advance, stated separately from our fee.

We do not charge expenses, such as travel, unless you have agreed them in writing first.

14. Late payment and pausing work

If an invoice is overdue, we send you up to three reminders, and then a person from our studio gets in touch.

We may claim interest and compensation under the Late Payment of Commercial Debts (Interest) Act 1998 on an overdue amount that is not disputed in good faith. We will not claim them without first telling you in writing that we intend to, and if you pay within seven days of that notice, we will not claim them at all.

If an undisputed invoice is more than fourteen days overdue, we may pause work on the services it relates to, after giving you at least seven days’ notice in the portal and by email. We restart as soon as it is paid, and the dates move by the length of the pause.

Pausing work never takes your live site offline, and we never withhold your data, the Deliverables you have paid for, or your access to your own accounts in order to obtain payment.

15. Recurring services, trials and cancelling

Recurring services run month by month from their start date, charged in advance, until they are cancelled. They have no minimum term unless the engagement schedule states one, with its length and its cost in pounds.

Care starts at go-live. Every site we build includes Care without charge from go-live until the paid plan starts, on the date and at the price in your engagement schedule, and we remind you 3 days before the first charge.

A paid module tier starts with 30 days free, and nothing is charged during them. We email you 3 days before the trial ends, with the price in pounds and how to stop. If you do not cancel, the paid tier starts when the trial ends, at the price you were shown.

Where a package includes a service for a set period, such as a module for the first year, the period ends on the date your engagement schedule states. The service continues after it, as a paid recurring service, only if the engagement schedule states in pounds the price that will then apply and we have reminded you 3 days before the period ends, with that price and how to stop; otherwise it ends with the period. When a hosted module ends, we give you its data as “What happens when it ends” describes and, if you ask, help you keep what it did for your site, at our day or hour rate agreed before we start.

You can cancel a recurring service in one click in the portal, or by telling us in writing, which we then record for you as “The portal” describes. Cancelling takes effect at the end of the period you are in: the service continues until then, nothing further is charged, and we record the cancellation in your Ledger. Because the service runs to the end of the period, we do not refund part of a period already started, except as the next paragraph says.

Changing your mind. The law gives a business no general right to cancel, but we give you 14 days to change your mind about anything new you agree to with us:

• a new recurring service, including a paid module tier: you may cancel it within 14 days of agreeing to it, or of its first charge after a free period, and we refund every charge for it taken in that time; and
• a new project or an approved change request: you may end it within 14 days of agreeing to it, and you then pay only for the work you asked us to do in that time, at our day or hour rate, and for third-party costs you approved that cannot be cancelled, and we refund the rest of what you have paid within fourteen days.

Where the law gives you any further right to cancel, you have that as well, and nothing in these terms takes it away.

After a recurring service ends, the data it holds for you stays available to export for 90 days.

16. Who owns what

Your materials. You keep ownership of the Client Materials. You give us a non-exclusive licence to use them to do the work while the agreement lasts and, if you approve a case study, for that case study. We do not use them for anything else, and we do not let anyone use them to train AI models.

What we make for you. Once you have paid for them, we assign to you, with full title guarantee, all the rights we hold in the Deliverables, and the agreement, signed for us, is the assignment. For a project, that happens when the project price has been paid; if a project ends early, it happens for the Deliverables made by then when you have paid what “What happens when it ends” says is due. For a recurring service, it happens when the invoice for the month in which the Deliverable was made has been paid. Until then you may use the Deliverables we share with you to review the work.

When a project has been paid for, we confirm the assignment in a short document signed for us as “Signing electronically” describes and recorded in your Ledger, and we will sign any further document you reasonably need to prove or register your ownership.

So far as the law allows, we waive, and will have anyone who works on the Deliverables for us waive, any moral rights in them.

Material made with AI. Some Deliverables are made with the help of AI tools. We assign to you whatever rights exist in them on the same terms as other Deliverables. The law on whether such material is protected by copyright is unsettled, so we cannot promise that it is; we do promise, as “Our promises, and what we do not promise” sets out, that we have the rights we need to give it to you.

What we keep. We keep ownership of the Background IP. Where Background IP is part of a Deliverable, we grant you a non-exclusive, worldwide, royalty-free and perpetual licence to use, copy and adapt it as part of that Deliverable, for your site and your business, and to let others, such as your staff, contractors, hosts and any future supplier, do so for you. The licence starts when you own the Deliverable, cannot be withdrawn once it has started, and continues after the agreement ends. You may transfer it, without our consent, to anyone who takes over the site or the business it serves. It does not allow you to sell the Background IP, or grant licences of it, separately from your site. When we hand over a Deliverable, we list the Background IP inside it.

Hosted services are not Deliverables. The portal, the admin and its modules are services we run. They work while you subscribe to them; when one ends, you take your data with you as “What happens when it ends” describes, and we help you keep what it did for your site as “Recurring services, trials and cancelling” describes.

Open source and third-party materials. Deliverables may include open-source software and third-party materials such as fonts, stock images, music and plug-ins, each under its own licence. We record each licensed asset with its licence and any expiry date and give you that list, choose licences that permit the use the Deliverable needs, and tell you before including anything whose licence would require you to publish your own code, pay a further fee, or stop using it at a set date. Where a licence belongs to whoever buys it, we buy it in your name where we can.

General know-how. Nothing stops either of us using the general skills and experience we gain while working together, provided neither uses the other’s Confidential Information.

17. How we use AI

We do the work with people and AI agents together. We plan and carry out work with AI models, including Anthropic’s Claude, and with Claude Code sessions run on Claude accounts that Kalotect Ltd or our people hold, as described below, which may open pull requests on your code repositories and deploy previews to Vercel. We may ask models from other providers for a second opinion. The providers we use are listed in the data processing schedule and on our AI disclosure page.

We stay in control of that work:

• every unit of work done with AI agents has a budget set before it starts, and an agent run that would go beyond it stops until a person decides whether it continues; a Claude Code session, which reports no cost of its own, counts against that budget at an allowance per run set before it starts;
• an AI agent can never approve anything for you or for us, or move money;
• an AI agent working for you is given access only to your repositories, accounts and data, and we do not start one whose access reaches another client’s;
• anything an AI model produces is checked against a defined format before it touches your data, files or systems;
• a person from our studio approves anything that carries your name before you see it or it is published;
• a change goes live on your site only when our head of delivery, Joe Kaul, or a person they have named in writing, with the naming recorded in our Ledger, has approved it, and, where the plan says so, after you have approved the preview; and
• every action an AI agent takes is recorded in our records before and after it acts, and what it produces for you, such as a pull request, a preview, a deployment or a draft put to you for approval, is recorded in your Ledger.

We use Claude, including Claude Code, only through accounts held by Kalotect Ltd or by our people, of two kinds. The first is on Anthropic’s commercial terms and its data processing addendum, through its API or a Team or Enterprise plan; under those terms Anthropic does not train its models on what we send. The second is a Pro or Max plan, on Anthropic’s consumer terms, which has a setting that lets Anthropic use what we send to improve its models: before any client work is sent to such an account, we check that the setting is off and record the check, and our platform refuses to send client work to a consumer account without that record. We send your Confidential Information, your Client Materials and personal data we process for you to other AI providers only where their business terms do not allow them to train their models on it. We check those terms, and record the check, before a provider or an account is used for client work.

The cost of the AI we use is ours and is covered by the Fees. We do not pass it on to you unless your engagement schedule says otherwise.

Disclosure. Where Article 50 of the EU AI Act, which applies from 2 August 2026, the advertising codes of the ASA and CAP, or a platform’s rules require AI involvement in copy, images or video to be disclosed, we disclose it on the thing itself. We do not deliver an image or video we have made, or changed with AI, until it carries signed Content Credentials: a C2PA manifest, signed by us and kept with the file, inside it or alongside it, saying which tool made or edited it and which parts were made or changed with AI. We record the person responsible for it in your Ledger. No copy we write is published until it has passed our thirteen-check copy audit and has a certificate.

Nothing invented is presented as real. We do not fabricate testimonials, reviews, statistics, people or places, and we do not present an AI-generated image as a photograph of your premises, your people or your work.

Your part. Please do not remove a disclosure, or strip Content Credentials from material we made, where the law or a platform requires them. If you publish or change material yourself, you are responsible for any disclosure it needs.

18. Showing our work

We show work we did for you, or name you as a client, only with your approval of the case study or mention, given in the portal and recorded in your Ledger. You can ask us to take it down at any time, and we will do so within five working days.

We do not put a credit or badge on your site unless you agree. If you take our founding-client offer, you agree to the founding-client badge and to a case study once the work is live, and you still approve the text before it is published.

19. Confidentiality

Each of us will keep the other’s Confidential Information confidential, use it only for the agreement, and protect it with at least the care it uses for its own.

Each of us may share it only with its own people, subcontractors, professional advisers and insurers, and with the service providers and AI providers it uses for the work, who need it for the agreement and are bound to keep it confidential; and as the law, a court or a regulator requires, telling the other first where the law allows.

These duties do not apply to information that is or becomes public other than through a breach of the agreement, that the recipient already had or develops independently, or that it receives from someone free to share it.

These duties last while the agreement lasts and for five years after it ends, and for as long after that as the information remains a trade secret or is personal data.

20. Data protection

Each of us will comply with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended by the Data (Use and Access) Act 2025, and with the EU GDPR where it applies.

Where we process personal data for you, as your processor, the data processing schedule applies and forms part of the agreement. It sets out what we process and for how long, the security we keep, the sub-processors we use, and how we help you with requests from individuals and with breaches.

Where we decide for ourselves why and how personal data is used, such as the contact details of your people, sign-in records, invoices, the Ledger and the recordings and notes of our meetings with you, we are a controller and our privacy notice applies.

As controller of the personal data you ask us to process, you are responsible for having a lawful basis for it and for telling the people it concerns, including through the privacy and cookie notices on your site, which we build into it as the plan describes.

21. Our promises, and what we do not promise

We promise that:

• we will do the work with reasonable skill and care, as “What we do, and to what standard” describes;
• at go-live, the Deliverables will match in all material respects what you approved, and if you tell us within thirty days of go-live that they do not, we will put it right at no charge, which does not limit your other rights if we break a promise in this section;
• we have the rights we need to give you the Deliverables and, so far as we know after reasonable checks, using them as the agreement intends will not infringe anyone else’s rights;
• we will not knowingly put malicious code in anything we deliver; and
• we will hold professional indemnity insurance suited to the work, which covers claims that what we deliver infringes another person’s intellectual property, and cyber insurance, while the agreement lasts and for six years after it ends, so long as such cover remains available on reasonable commercial terms, and we will tell you the insurers and limits if you ask.

You promise that:

• you have the authority to enter into the agreement, and the person who signs for you has authority to sign;
• the Client Materials and the facts you give us are accurate, and you have the right to give them to us for the work; and
• you will use the Deliverables and the portal lawfully.

We do not promise any position in a search engine or an AI answer, any amount of traffic, enquiries, reach or sales, that an advertising or social platform will accept or keep running what we make, or that services run by others, such as hosts, platforms and payment providers, will always be available. We report what happens from the data, not from memory.

Unless your engagement schedule states a service level, we do not promise a level of availability for your site. We monitor it, show its uptime in the portal, and act on what our checks find under your Care plan.

Other terms that the law would otherwise imply are excluded so far as the law allows, but every promise in this section stands.

22. Claims from other people

We will defend you against any claim by a third party that the Deliverables, including material we made with AI tools, infringe its intellectual property rights, and we will pay the damages and costs a court awards against you, or that we agree in a settlement.

That does not cover a claim arising from the Client Materials or facts you gave us, from changes made to the Deliverables by anyone other than us, from using them in a way the agreement does not intend, or from third-party materials used within the licence we told you about.

If such a claim is made or seems likely, we may, at our cost, obtain the right for you to keep using the Deliverable, or change or replace it so that it no longer infringes and still does the same job.

You will defend us in the same way against any claim by a third party that the Client Materials or facts you gave us infringe its rights or are unlawful.

Whoever is claiming the protection of this section must tell the other promptly, let it control the defence and any settlement, and give it reasonable help at the other’s cost. Neither of us may settle a claim in a way that admits fault on the other’s behalf without its agreement.

This section is subject to “Limits on liability”, whose separate limit for these claims applies to it.

23. Limits on liability

Nothing in the agreement limits or excludes either party’s liability for death or personal injury caused by its negligence, for fraud or fraudulent misrepresentation, or for anything else the law does not allow to be limited or excluded. Nothing limits your duty to pay Fees that are properly due, or our duty to make the refunds these terms say we make.

Neither of us is liable to the other for loss of profit, revenue, business, contracts, goodwill or anticipated savings, or for any indirect or consequential loss, whether it arises from breach of contract, negligence or otherwise. This exclusion does not apply to damages, costs or settlements payable to a third party under “Claims from other people”.

Loss of data. Where we are responsible for backing up data, because your Care plan or engagement schedule includes backups or we host the data, we are liable, within the limit below, for the reasonable cost of restoring lost or corrupted data and, if we did not keep the backup we were responsible for, of reconstructing it. For data that you were responsible for backing up, our liability for its loss or corruption is limited to the reasonable cost of restoring it from your most recent backup. A claim for breach of the data processing schedule, including one about lost personal data, falls under the separate limit for those claims and not under this paragraph.

Otherwise, each party’s total liability to the other under or in connection with the agreement is limited to the greater of the Fees paid or payable under the agreement in the twelve months before the event that gave rise to the claim and, for a claim about a project, that project’s price.

That limit applies once, separately, to claims under “Claims from other people”, and once, separately, to claims for breach of the data processing schedule, so that a claim of either kind does not use up the limit available for other claims. For our liability in those two kinds of claim, each separate limit is that amount or, if more, what our insurers pay for the claim, and we will make and pursue a claim under our insurance wherever it may respond.

Neither of us is liable for a failure caused by the other not doing what the agreement requires of it.

24. How long the agreement lasts, and how it ends

The agreement starts when it is made, as “The agreement and which document wins” describes, and lasts until its project is finished and its recurring services have ended, or until it is ended under this section. These terms apply in the same way to each engagement schedule you sign.

You may end a project at any time by telling us in the portal or in writing. You may cancel a recurring service as “Recurring services, trials and cancelling” describes.

We may end a recurring service by giving you at least thirty days’ notice, or the longer notice your engagement schedule states, ending at the end of a period. We may end a project when you are not at fault only by giving you notice, refunding any part of what you have paid that is not matched by work done that you can use, and handing over everything as “What happens when it ends” describes, at no charge. The notice in your engagement schedule applies to recurring services, and gives neither of us any other right to end a project.

Either of us may end the agreement, or the engagement affected, at once by notice if the other:

• commits a material breach and, where it can be put right, has not put it right within thirty days of being told in writing what it is, or within fourteen days where the breach is a failure to pay an undisputed invoice or our breach of the data processing schedule, which also lets you end the services affected as it describes; or
• becomes insolvent, enters administration, liquidation or an arrangement with its creditors, or stops trading, so far as the law allows that to be a reason for ending.

If a project has been waiting for something from you for more than sixty days despite our reminders, we may give you formal notice under “Notices”, sent to the person who signed the engagement schedule for you and to every client admin, saying what we are waiting for and that we intend to close the project. If nobody has responded within fourteen days of that notice, we may close the project. Closing it is not a finding that either of us is at fault: you pay for the work done as “What happens when it ends” says for a project you end, we refund anything you have paid beyond that, and we hand over everything. Closing a project does not end any recurring service.

25. What happens when it ends

If you end a project early, you pay for the work done up to the day it ends, at our day or hour rate, and for third-party costs you approved that cannot be cancelled. The total is never less than the payments for the milestones you have already approved, and never more than the total that would have been due once the next payment milestone was reached. If you have paid more than that total, we refund the difference within fourteen days.

If we end a project when you are not at fault, or you end the agreement because of our material breach or our insolvency, or after we have transferred it as “General” describes, you pay nothing more than you have already paid, and we refund within fourteen days any part of it that is not matched by work done that you can use.

However and whenever the agreement ends:

• we hand over, or confirm that you already hold, every Deliverable you have paid for, in a form you can use, including source code, design files and the media we made for you, with the list of the Background IP inside it;
• where your site is hosted on an account of ours, we move it to an account you control, or give you everything needed to host it elsewhere, as you choose;
• we remove our access, and our AI agents’ access, to your accounts, systems and repositories, record each removal in your Ledger, and give you the list so you can check;
• you can export your Ledger and the data our services hold for you for 90 days, after which we delete that data, except the Ledger, the signed agreement and the records of what we did and charged; we keep those for six years after the end of the financial year in which our relationship ends, because tax law requires the accounting records and either of us may need the evidence for a claim, and then delete them, except that if a claim has been made by then, we keep what it needs until it is resolved;
• our backups are overwritten within ninety days; and
• each of us returns or deletes the other’s Confidential Information, except what the law requires it to keep.

Handing over what is yours costs you nothing. Further help in moving to another supplier is charged at our day or hour rate, agreed before it starts.

Ending the agreement does not affect rights either of us already has. The sections on payment, ownership, confidentiality, data protection, claims, liability and this section continue after it ends.

26. Our people and yours

While the agreement lasts and for six months after it ends, neither of us will, without the other’s agreement, offer employment or work to an employee or contractor of the other who worked on the engagement in the previous twelve months. A general job advertisement, and anyone who answers one, is not covered.

27. Who does the work

We may use subcontractors and freelancers, for example for video production, as well as the AI agents and service providers described in “How we use AI” and the data processing schedule. We remain responsible for their work as if it were our own.

Everyone who works on your engagement for us is bound to keep your Confidential Information confidential and to pass the rights in what they make to us, so that we can pass them to you.

Our AI agents act only with the permissions and tools we give them, for the task and within the budget we set, and every action they take is recorded. An AI agent cannot change the agreement or make a commitment for either of us.

28. Events outside our control

Neither of us is responsible for a delay or failure caused by an event beyond its reasonable control, such as a natural disaster, war, civil unrest, an epidemic, an act of government, or a failure of the national power or communications networks. This never excuses a late payment.

A cyber attack, a failure of our own systems or a failure at one of our suppliers counts only if we had taken the reasonable security, backup and continuity measures that would have prevented it or limited its effect.

The party affected will tell the other promptly, do what it reasonably can to limit the effect, and resume as soon as it can. If the event stops the work for more than thirty days, either of us may end the services affected by notice, and “What happens when it ends” applies as if you had ended them.

29. Notices

Day-to-day communication is through the portal and by email. A formal notice under the agreement, such as a notice of breach, of ending or of a claim, must be in writing.

A notice to us is valid if it is sent by email to our address for notices in the engagement schedule, posted in the portal, or sent by post to our registered office. A notice to you is sent by email to the person who signed the engagement schedule for you and to every client admin, at the addresses on their portal accounts, and is also posted in the portal while you have access to it. Either of us may change its address by notice.

A notice sent by email or posted in the portal is received when it is sent, if that is between 9am and 5pm on a working day, and otherwise at 9am on the next working day, unless the sender is told that it was not delivered. A notice sent by first-class post is received on the second working day after posting.

This section does not apply to the service of legal proceedings, which must be served as the court rules require.

30. Signing electronically

We sign first. Before we issue an engagement schedule to you, Michelle Wynne, our director, or a person Michelle Wynne has authorised in writing, with the authority recorded in our Ledger, as “The agreement and which document wins” describes, confirms on our platform that it is them and makes their signature for us, stating the authority they sign under. They make it as you make yours: by typing their own name, drawing it, or uploading a picture of it. We sign when we send the engagement schedule to you, and you can see our signature, as it was made, on the agreement in the portal before you sign.

You sign in the portal, signed in to your own account with a passkey or a single-use email link. Just before you sign, the portal asks you to confirm again that it is you. You then:

• give your full name and your role, and tick to confirm that you have read the documents and have authority to sign for the business;
• make your signature, by typing your name, drawing it, or uploading a picture of it;
• initial each key section of the documents, which is marked as one, in the box beside its heading; and
• press “Sign and accept”.

Your initials show that you saw each key section. They are not a second signature: your signature signs the whole agreement, including the sections you do not initial. Only you initial: our signature, like yours, signs the whole agreement.

Each of us agrees that the signatures and initials made electronically in this way, ours when we send the engagement schedule and yours in the portal, are as valid and binding as a handwritten signature and initials on paper, and that the agreement is in writing and signed by each of us wherever the law asks for that. Neither of us will dispute the agreement, or any part of it, only because it was made, signed or initialled electronically. An electronic signature is admissible in evidence under section 7 of the Electronic Communications Act 2000, and the law of England and Wales accepts it as a way of signing a contract.

With each signature, ours and yours, we record the following, and keep all of it with the agreement, in our database and in the certified copy described below:

• the name and role of the person signing, and the email address of the account they signed in with;
• their signature exactly as they made it, and, with yours, your initials exactly as you made them;
• how they signed in, and when they last confirmed that it was them;
• the IP address their request reached us from, and the description their browser gave of itself;
• the date and time they signed, by our server’s clock, and, for each of your initials, the time your browser gave, where it gave one, and the time we received it; and
• the SHA-256 fingerprint of the exact text they signed, which changes if a single character changes, so that either of us can later prove what was signed.

Your Ledger records each signature too: ours in the entry for our sending you the agreement, and yours in the entry for your signing. Each entry names who signed and their role, the date and time, how the signature was made, and the SHA-256 fingerprints of the text signed, of the signature where it was drawn or uploaded, and of our record of the signature. The entry for ours also names the authority our signatory signed under. The entry for yours also names how you signed in and when you last confirmed that it was you, how your initials were made, with their SHA-256 fingerprint where they were drawn or uploaded, the sections you initialled, whether you ticked the separate box agreeing that we may record our meetings, and the SHA-256 fingerprint of the certified copy.

Those entries do not hold an IP address, a browser’s description of itself, an email address, or a signature or initials as they were made. We keep those in our record of each signature and in the certified copy, for as long as we keep the signed agreement, and of that record each entry holds only its reference and fingerprint, which would change if the record did. Everyone you give access to the portal can see those entries, both signatures as they were made on the agreement in the portal, and the certified copy, and the agreement and the copy show the IP address recorded with each signature.

Before you sign, the portal shows you the IP address we will record with your signature, and whoever signs for us is shown theirs in the same way. Our privacy notice explains why we keep this record and for how long.

The certified copy. When you sign, we make a certified copy of the agreement: a PDF of the documents exactly as signed, with both signatures as they were made, your initials beside each key section, and a certificate of what we recorded with each signature. We record the certified copy’s own SHA-256 fingerprint in your Ledger and keep the copy unchanged: once made, it cannot be altered or deleted while we keep it. Each of us agrees that the certified copy is the record of what was signed. To check any other copy, compare its SHA-256 fingerprint with the one in your Ledger.

The person who signs for you can download the certified copy from the portal as soon as they have signed, and we email it to them at the same time. Anyone you have given access to the portal can download it there while you have access, and we send you a copy whenever you ask.

The agreement may be signed in any number of counterparts, and signatures given on the same text together make one agreement.

31. Changes to these terms

We show the version, and the date it takes effect, at the top of these terms. A new version never appears on our website before that date, and it applies to every engagement agreed once it appears there. An engagement already agreed runs on the version you signed, which we keep and you can download from the portal, unless both of us agree to move it to a new version by signing a new engagement schedule, as “General” describes.

We never change the terms of an engagement you have signed without your agreement.

32. General

Entire agreement. The agreement is the whole of what we have agreed about its subject, and replaces any earlier agreement or understanding between us about it. Nothing in this clause limits or excludes liability for fraud or for misrepresentation.

Changes to the agreement. A change to the agreement is made only by a new engagement schedule signed by both of us in the same way as the first, and a change to these terms or to a special condition needs the approval of Michelle Wynne, our director. An approved change request adds to the work under the agreement and does not change its terms.

Transfer. Neither of us may transfer the agreement without the other’s written consent, which will not be unreasonably withheld. Either of us may transfer it to a buyer of all or most of its business by telling the other, who may then end the agreement by notice within thirty days without paying for any remaining minimum term. An ending of that kind is treated as though we had ended the agreement when you were not at fault. None of this limits your right to transfer the licence in “Who owns what” with your site or your business.

Third parties. Only you and we have rights under the agreement, and no one else may enforce it under the Contracts (Rights of Third Parties) Act 1999.

No waiver. If either of us delays in using a right, or does not use it, the right is not lost.

Severance. If a court decides that part of the agreement cannot be enforced, the rest continues, and the part concerned applies with the smallest change that makes it enforceable.

Relationship. We are independent businesses. Nothing in the agreement makes us partners, or makes either of us the other’s agent or employer, except where you ask us to act for you on a particular matter and we agree in writing.

Costs. Each of us pays its own costs of entering into the agreement.

33. Complaints, disputes and the law

If something goes wrong, tell us in the portal or by email to our address for notices in your engagement schedule. We acknowledge within one working day and answer properly within five.

If that does not settle it, either of us may refer it to Michelle Wynne and a senior person for you, who will meet or speak within ten working days to try to resolve it. Either of us may suggest mediation, and the other will consider it in good faith. None of this stops either of us going to court for urgent relief, such as an injunction to protect confidential information or intellectual property.

The agreement, and any dispute or claim arising from it or its subject, including a non-contractual dispute or claim, is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.