Terms of Service.

About these terms

These terms explain how we provide our website, tool and related services. Read them alongside your written quotation before accepting it, particularly the provisions about licensing, third-party services, cancellation and liability.

Custom web applications and portals are outside these terms. They require a separate agreement, prepared for the particular project, as explained in clause 11.

1. Who we are and who these terms are for

1.1 We are Notla Ventures Limited, trading as Notla.Wales, a company registered in England and Wales with company number 16673455. Our registered office is 144 Walter Road, Swansea SA1 5RW. Our contact email is hello@notla.wales.

1.2 "We", "us" and "our" mean Notla Ventures Limited. "You" and "your" mean the contracting person or legal entity identified in our quotation, not merely a trading name.

1.3 These terms are for customers purchasing in connection with their business, trade, profession or organisational activities, including charities and not for profit organisations. They are not intended for individuals purchasing mainly for personal use. Nothing removes consumer rights that apply by law.

1.4 Anyone accepting a quotation or authorising work for an organisation confirms that they have authority to do so.

1.5 A "business day" is Monday to Friday, excluding public holidays in England and Wales. Other references to days mean calendar days. Times are UK local time.

2. Your contract with us

2.1 Our website and estimator provide information and indicative prices. They do not themselves constitute an offer to supply services or a facility through which a service contract is purchased.

2.2 Your contract consists of our written quotation, its expressly incorporated specification and schedules, these terms, and variations subsequently agreed in writing. Each accepted quotation forms a separate contract unless expressly agreed otherwise.

2.3 A contract forms when you accept our quotation in writing and we receive the initial payment it requires. Where no initial payment is required, including an agreed free build, it forms when you accept the quotation and we confirm the booking in writing.

2.4 Quotations remain open for 30 days unless stated otherwise. An expired quotation requires our written reconfirmation.

2.5 Subject to the exclusion in clause 11, a separately signed services agreement takes priority over conflicting provisions, followed by the quotation and specification, then these terms. A services agreement replaces these terms entirely only where it expressly says so.

2.6 Schedule 1 takes priority concerning personal data processed on your behalf, unless replaced by an expressly agreed data processing agreement meeting applicable legal requirements.

2.7 Your purchase order terms or other purchasing conditions do not apply unless we expressly accept them in writing.

2.8 These documents record the agreement concerning the services. Nothing in this clause excludes liability for misrepresentation. Changes require written agreement by authorised representatives; email is sufficient.

2.9 Changes to our published website terms do not retrospectively alter an existing contract. Existing contracts change only by agreement, except for prospective recurring price changes permitted by clause 10.

3. Services, scope and prices

3.1 These terms cover the websites and standalone or embedded tools identified in your quotation, together with any quoted copywriting, photography, hosting, Website Care and Tool Refresh services.

3.2 Tools may include calculators, quizzes, educational experiences, visualisations and similar features. Their agreed functionality, rather than the name given to them, determines whether they fall within these terms or require a separate agreement under clause 11.

3.3 The quotation and specification identify included pages, functionality, content, integrations, deliverables and ongoing services. Work not included is outside scope. Additional work requires your written approval of its price and any effect on delivery.

3.4 Prices are in pounds sterling. The quotation will state whether VAT applies and the total payable.

3.5 Before you commit, we will identify material third-party dependencies, recurring charges, usage limits and licensing restrictions relevant to the agreed service. We will not substitute materially different deliverables or remove agreed functionality without agreement.

4. Payment

4.1 Payment is due as quoted. Unless otherwise agreed, the full project price must be received in cleared funds before work begins. Recurring plans are payable in advance.

4.2 Later invoices are payable within 14 days unless a different payment date was agreed before the charge was incurred.

4.3 Tell us promptly about a genuine invoice dispute and explain the reason. We will investigate. Undisputed amounts remain payable when due, and neither party loses its legal rights merely because a dispute is raised.

4.4 Where legally applicable, we may claim statutory interest, fixed compensation and recoverable debt recovery costs under the Late Payment of Commercial Debts (Interest) Act 1998. Suspension for non-payment is governed by clause 19.

4.5 Payment for agreed work is not conditional on obtaining funding, receiving payment from your customers, launching your business or achieving commercial results.

5. Your information, materials and cooperation

5.1 You must provide the information, access, decisions and materials reasonably needed for the work, and identify an authorised contact for instructions, consolidated feedback and approvals.

5.2 Unless copywriting or content production is included, you must supply final, checked wording and suitable images. Photography is included only where quoted.

5.3 Your materials remain yours. You confirm that you have the rights and permissions necessary for their agreed use, and authorise us and our authorised subcontractors to use, copy and adapt them as needed to perform the contract.

5.4 You are responsible for the accuracy of information you provide, your business claims and approvals allocated to you in the specification.

5.5 Access must be supplied securely. Keep your credentials confidential, retain copies of original materials, and notify us promptly of suspected unauthorised access.

5.6 Missing, inaccurate or changed information may affect delivery or create additional work. We will explain the effect and obtain approval before undertaking additional chargeable work.

6. Delivery and fast lane services

6.1 Unless quoted otherwise, standard delivery is within one calendar month of purchase. "Purchase" means receipt of the required initial payment. For an agreed free build, the start date is confirmed in writing.

6.2 A calendar month ends on the corresponding date in the next month, or its last day if there is no corresponding date. A one week fast lane means seven calendar days. A 24 hour or 72 hour fast lane means consecutive elapsed hours, including weekends, unless the quotation states otherwise.

6.3 Delivery means a substantially complete build meeting the specification and ready for review and, subject to approval and agreed dependencies, launch. A materially incomplete draft or build with a defect preventing its principal agreed use is not delivery.

6.4 The clock pauses only to the extent progress is prevented by something reasonably required from you or an identified dependency. We will tell you what is outstanding and record any revised deadline. Ordinary staffing shortages or overbooking on our part do not pause the clock.

6.5 Changes to scope may alter delivery. The revised timetable must be agreed with the change.

6.6 The quotation will identify any fast lane premium separately from the standard price. If we miss the applicable deadline because of our failure, we will refund that premium within 14 days. This is not your sole remedy for a separate failure to deliver or other breach.

6.7 Photography is scheduled separately unless expressly included within the build deadline. Where photographs will arrive later, we will agree whether delivery uses approved placeholders or a revised timetable.

7. Review, acceptance and amendments

7.1 We will notify you when work is ready for review. Provide approval or a consolidated explanation of non-conformity with the specification within ten business days.

7.2 Acceptance occurs when you approve the deliverable in writing, authorise launch, or put it into ordinary business use other than agreed testing.

7.3 Following no response, we may send a reminder allowing five further business days. We may then treat a substantially conforming deliverable as accepted for project administration and payment purposes. This does not authorise publication, constitute regulatory approval or remove rights concerning defects.

7.4 We will not launch without written approval unless the quotation expressly authorises another launch process.

7.5 Website and tool builds include two within scope amendment rounds. Each round means one consolidated set of feedback and our implementation of it. Correcting our errors against the specification does not use a round.

7.6 Rounds may be used during the build or within 30 days after launch. Where launch is delayed at your request or because we are waiting for you, unused rounds remain available for 60 days after acceptance unless otherwise agreed. Unused rounds have no separate cash value.

7.7 Further within scope website amendments during that period cost £90 per page changed, per round, unless otherwise quoted. We will confirm the pages and total before proceeding. Site wide and tool only changes will be priced expressly.

7.8 New features, redesigns, changed business rules and requests outside the amendment period are separately quoted or handled under an applicable care plan.

8. Our standards and defect correction

8.1 We will perform the services with reasonable care and skill and materially in accordance with the agreed specification.

8.2 Unless another compatibility standard is agreed, builds will be tested against the current stable versions of Chrome, Edge, Firefox and Safari available at delivery and representative current mobile screen sizes. Identical appearance on every device is not promised.

8.3 We provide an additional 90 day defect correction warranty from acceptance. We will correct, without charge, reproducible errors reported during that period that cause our work not to meet the agreed specification. A timely reported defect remains covered even if correction takes place afterwards.

8.4 Provide sufficient information and reasonable access to investigate. We will respond and correct covered defects within a reasonable time, taking account of severity and impact.

8.5 This warranty excludes new requirements, later legal or business rule changes, subsequent third-party platform changes, misuse and alterations by others, except to the extent the problem results from our breach.

8.6 This is not a lifetime maintenance commitment. Expiry does not extinguish other rights or remedies for breach. Where a material failure cannot adequately be corrected within a reasonable time, clause 17 applies, subject to clause 21.

9. Copyright, your permanent licence and third-party materials

9.1 Your pre-existing materials remain yours. We retain copyright and other intellectual property rights in work we create, including our reusable code, components, templates and technical foundations. No copyright assignment takes place unless expressly agreed in writing and signed on our behalf.

9.2 On full payment of the charges for the relevant deliverable, we grant you a perpetual, irrevocable, worldwide, non-exclusive and royalty free licence, with no separate licence fee or ongoing royalties, to all Notla created material included in that deliverable.

9.3 This includes the website or tool and its Notla created code, incorporated components, layouts, graphics, text, photographs and supplied documentation. The same arrangement applies to paid for additions and amendments. For an agreed free build, the licence takes effect on delivery.

9.4 You may use, reproduce, publish, display, host, maintain, adapt, modify and embed the licensed work for your business or organisation. You may appoint developers, hosting providers and other contractors to exercise those rights on your behalf.

9.5 The licence may transfer with a sale or transfer of your business or the relevant part of it. It does not permit commercial resale or distribution of our reusable components as a standalone software product or template library unless expressly agreed.

9.6 The licence survives termination of hosting, care and other services. Moving provider or an unrelated payment dispute does not revoke it. It does not include free hosting, domain registration, maintenance, future development or third-party subscriptions.

9.7 We may reuse non-confidential technical foundations and general know how. We will not resell your customer specific branding, original business photographs, bespoke business copy or confidential material without permission.

9.8 Third-party software, libraries, fonts, stock assets, embedded services and other third-party material are supplied under their own applicable licences or agreements, not our licence. We will identify material restrictions, attribution obligations, charges and relevant terms before inclusion. Nothing here reduces rights granted under an applicable open source licence.

9.9 We will obtain the rights needed to grant the promised licence to our contributions, including work produced for us by subcontractors. Third-party materials remain subject to clause 9.8.

9.10 The licence does not extend to unused concepts, internal tools or materials not included in your deliverables. This does not permit withholding code, incorporated components or build information reasonably needed to exercise your licensed rights and receive the handover in clause 18. Uncommissioned mock-ups remain subject to clause 13.

10. Hosting and Website Care

10.1 Hosting and Website Care are separate ongoing services, billed in advance at the quoted frequency and price. Billing begins on the agreed activation date, not automatically when a build is purchased.

10.2 Hosting uses infrastructure we arrange with external providers. Our normal website and tool workflow uses GitHub for source code management and Netlify for deployment and hosting, where appropriate. Use of those platforms does not replace your licence to Notla created work.

10.3 Hosting does not include domain registration, email hosting or other subscriptions unless quoted. Your domain must be registered in your or your organisation's name, and you remain responsible for renewals. We provide the agreed connection assistance.

10.4 Website Care is priced using the agreed page count and per page rate, charged per visit, pay as you go. The quotation identifies the per page rate and the editing allowance for a visit. A visit is a scheduled remote maintenance and content editing session, not an on site attendance. A regular visit rhythm may be agreed but is not required.

10.5 Care includes the small content edits, routine checks, applicable updates and priority support described in the plan. Redesigns, new features, new pages, major repairs to work altered by others and changes to tool business logic are excluded unless quoted.

10.6 Hosting is a separate service at the quoted monthly price and is not included in Website Care. For a commissioned build, hosting with us is included free for the first year from launch unless the quotation states otherwise, and continues at the quoted monthly price after that unless cancelled.

10.7 Unless agreed otherwise, support operates between 9 am and 5 pm on business days. Priority support means prioritisation over equivalent non plan requests, not immediate resolution or continuous monitoring. Guaranteed response or restoration times require express agreement.

10.8 We do not promise uninterrupted availability. We will exercise reasonable care in providing the service and addressing faults within our responsibility. Agreed backup arrangements must distinguish website source files from any separately stored form submissions or other changing data.

10.9 The quotation will identify relevant usage allowances and any agreed usage based charging or spending limits. Unapproved upgrades and additional charges are not automatically payable by you.

10.10 Tool Refresh is separately quoted against agreed updated figures and rules. Hosting and ordinary care do not include continuous legal or regulatory monitoring.

10.11 Recurring services renew for the stated billing period unless cancelled before renewal. You may cancel in writing at any time, effective at the end of the current paid period. Unused time is not normally refunded where you choose to cancel, except where these terms or applicable law require otherwise.

10.12 We may end an ongoing service without alleging breach on at least one calendar month's written notice, refunding prepaid fees for the period after termination.

10.13 Recurring prices may change only for a future renewal after at least 30 days' written notice. You may cancel before the increase takes effect. Fixed project prices and already paid periods are unaffected.

11. Web applications and portals: excluded services

11.1 Custom web applications, customer or staff portals, bespoke account and authentication systems, operational databases and managed business workflow systems are outside these terms, including their development, hosting, support and management.

11.2 Such projects require a separate written agreement before work begins, prepared case by case according to functionality, data, infrastructure, security, ongoing support and business requirements. That agreement must address pricing, licensing or ownership, responsibilities, service levels, data protection, liability and exit arrangements.

11.3 A reference to these services on our website or in discussions does not bring them within this contract. A website quotation or amendment request cannot add them under these standard terms. Where requirements develop into an excluded service, we will identify that change and agree a separate contract before undertaking the affected work.

11.4 A simple contact form, third-party booking embed or similar expressly quoted integration does not by itself make a website an excluded custom application. Our work on that integration is covered by these terms; the external service operates under its provider's agreement. Bespoke backend functionality requires separate assessment and contracting.

11.5 These terms, including their licensing and liability provisions, do not automatically apply to excluded services. Any provisions used for a separate project must be expressly incorporated into that project's agreement.

12. Photography

12.1 Photography is included only where quoted. The quotation identifies the location, duration, deliverables, formats and editing timetable.

12.2 The package price includes agreed travel, accommodation where needed, the agreed day on site, editing and finishing. Standard coverage is England, Scotland and Wales where reachable by road without a ferry. Ferry or flight dependent locations are individually priced.

12.3 There is no additional expenses invoice for the agreed shoot. Extra locations, attendance or customer requested rescheduling costs require prior written approval.

12.4 You arrange lawful premises access and permissions, notices or releases needed for the agreed photography and your intended use. We remain responsible for obligations applying to our own activities.

12.5 Finished photographs are licensed under clause 9. Raw files and unselected photographs are excluded unless quoted. Weather, safety and unavoidable disruption will be handled through reasonable rescheduling or clauses 17 and 20.

13. Free homepage mock-up

13.1 We may offer one free homepage mock-up per organisation at our discretion.

13.2 Our original contributions remain ours and are for private evaluation only. You may not publish them or have another supplier reproduce or adapt them without written permission. Your pre-existing materials remain yours.

13.3 If commissioned, the incorporated mock-up becomes subject to clause 9 when that licence takes effect. We may decline a free mock-up request before accepting it, but this does not permit unrestricted withdrawal from an agreed build.

14. Content, compliance and tools

14.1 You are responsible for your business's products, services, claims, professional approvals and legal notices. Tell us before quotation about specific accessibility, regulatory, security or compliance requirements.

14.2 We remain responsible for implementing agreed requirements with reasonable care and skill and for duties applying to our own services. Customer approval does not excuse our negligent implementation.

14.3 A calculator or tool specification must identify its purpose, rules, assumptions, relevant rates, reference date, exclusions and appropriate test examples. You approve its business, legal and regulatory requirements and obtain necessary professional sign off.

14.4 We implement and test the specification with reasonable care and skill. You must review results before publication. Later changes to rates, laws, policies or requirements need an agreed update unless continuing monitoring is expressly included.

14.5 We do not provide legal, tax, financial, medical or other regulated professional advice through a build. Our own demonstration tools and payback illustrations are explanatory examples, not personalised advice or forecasts. We do not guarantee rankings, traffic, revenue or commercial success.

14.6 You must not supply unlawful, infringing or malicious material. Where a third-party claim results from your breach of clause 5.3, you must reimburse losses and reasonable external legal costs finally awarded against us, or included in a settlement you approve, to the extent attributable to that breach.

14.7 We must promptly notify you of such a claim, permit reasonable participation in its defence, mitigate loss and obtain consent before settlement, not unreasonably withheld. You are not responsible to the extent our breach or unauthorised alteration caused the claim.

15. Confidentiality and showing our work

15.1 Each party must protect information identified as confidential or reasonably understood to be confidential. It may be used only to perform the contract or exercise related legal rights.

15.2 Necessary disclosure is permitted to personnel, authorised subcontractors and professional advisers under appropriate confidentiality duties, or where legally required. This protection does not cover information lawfully public, already lawfully known, independently developed or lawfully received without restriction.

15.3 We may display publicly launched work and name your business in our portfolio. Tell us in writing if you object; we will make no new use and remove material under our control within a reasonable time.

15.4 We will not publish confidential material, private customer information or non public work without approval. Use of identifiable people in our marketing requires an appropriate lawful basis and necessary permissions.

16. Personal data

16.1 Each party must comply with the data protection legislation applying to its activities.

16.2 We act as an independent controller for our account administration, billing, business communications and legal obligations, as explained in our privacy notice.

16.3 Where we process personal data on your behalf through website development, hosting, forms, support or maintenance, Schedule 1 applies. Actual processing arrangements determine the parties' roles; a website being described as "static" does not determine them.

16.4 You must provide lawful instructions and necessary privacy information and permissions. We remain responsible for our processor obligations.

16.5 Do not instruct us to collect or store special category data, criminal offence data, identity documents or other information outside the agreed processing record without prior written agreement and appropriate assessment. Where the requirement falls within clause 11, a separate contract is required.

16.6 We will not use personal data processed on your behalf to train general purpose artificial intelligence models or authorise its use for that purpose. We will select and configure relevant services consistently with this commitment.

17. Cancellation, stalled projects and termination

17.1 You may cancel an unfinished project in writing. Unless cancellation results from our breach, you must pay for work reasonably performed and approved, and non-cancellable third-party commitments reasonably incurred up to cancellation.

17.2 Charges follow agreed milestone values or a reasonable proportion of the fixed price reflecting actual work. We will provide an itemised account, avoid double charging and reduce avoidable costs. Charges cannot exceed the agreed price, including approved variations.

17.3 We do not automatically retain all advance payments. Within 14 days of termination, we will account for the work and refund any undisputed excess. Any undisputed balance owed by you is payable within the same period.

17.4 After 60 consecutive days of progress being prevented by missing customer input, we may give 14 days' written notice identifying what is required. If it remains outstanding, we may close the project and account under clauses 17.1 to 17.3. Restarting requires agreement, not an automatic charge.

17.5 Either party may terminate for material breach not remedied within 14 days of written notice describing the breach and required remedy. A material breach incapable of remedy may justify immediate termination.

17.6 Where we cannot complete through our own failure, or you validly terminate for our material breach, we will refund payments for unsupplied services and affected work that cannot reasonably serve its agreed purpose. No cancellation charges apply to failure caused by us.

17.7 Other remedies remain available, subject to clause 21 and no double recovery. Ending a build does not automatically end a separately ordered ongoing service, or vice versa; the notice should identify the affected services.

18. Handover and leaving

18.1 You may move your website or tool elsewhere without an exit fee for receiving licensed deliverables.

18.2 Within ten business days of a verified request after the relevant payment, we will supply current deployable files, relevant source code, incorporated assets, necessary build configuration and available instructions reasonably needed to host, maintain and modify the deliverable.

18.3 We will provide access or credentials for customer owned accounts where held. We need not transfer shared business accounts, unrelated repository history, other customers' information or unrelated internal systems.

18.4 Provider specific functions, such as external form handling or booking services, may need replacement accounts or configuration when moving. We will identify relevant dependencies. Your licence to our work continues, but third-party access, migration and subscriptions are separate.

18.5 One standard handover and up to one hour of remote transition assistance are included. Extra conversion, deployment, training or redevelopment requires an approved quotation. We will not charge to remedy an inadequate standard handover.

18.6 We will not withhold your original materials, required personal data return or fully paid deliverables over unrelated invoices. The licence to unpaid work need not take effect until the charges properly due for it are paid.

18.7 On cancellation, paid for completed or partial work will be handed over with the corresponding licence. Incomplete elements will be identified and are not represented as launch ready.

18.8 Hosting ends on the effective termination date unless agreed otherwise. You must arrange replacement services and retain your handover copy. Once handover is supplied and ongoing services end, we do not provide permanent archival storage. Schedule 1 governs personal data retention and deletion.

19. Suspension

19.1 We may suspend affected services where an undisputed payment remains overdue after seven days' written warning, or where reasonably necessary to address unlawful use, serious security risk, legal requirements or a material breach affecting the service.

19.2 We will give notice and an opportunity to remedy where practicable. Immediate action is permitted where delay creates material risk or would breach a legal requirement.

19.3 Suspension must be proportionate. We will explain it where legally permitted and restore services promptly when resolved. It does not revoke an already granted permanent licence or remove confidentiality, data protection or handover obligations.

20. Third-party software, providers and external events

20.1 Third-party products and services remain subject to their applicable provider agreements. Where you must contract directly with a provider, we will identify that before commitment. Our use of a business account does not, by itself, make you a party to every provision of our supplier's contract.

20.2 Where you request particular software, we will agree the integration scope, account ownership, licences, charges and responsibility for renewals. We may decline unsuitable, insecure or improperly licensed software and will explain material limitations identified through reasonable assessment.

20.3 We do not control third-party pricing, availability, product changes or discontinuation. Necessary adaptation following subsequent changes may require a new quotation. This does not excuse defective original implementation, failure to exercise reasonable care or other responsibilities we have expressly accepted.

20.4 We may appoint suitably selected subcontractors and infrastructure providers. We remain responsible for our contractual obligations and for subprocessors as required by Schedule 1. The customer selecting a provider does not automatically remove our obligations for work we undertake.

20.5 Neither party is responsible for delay or failure to the extent caused by an event beyond reasonable control that appropriate care and planning could not reasonably prevent or overcome. The affected party must notify the other promptly and mitigate the impact. An outage, cyberattack or supplier failure is not automatically an excuse for inadequate precautions.

20.6 If affected services cannot materially resume for 30 days, either party may terminate that part of the contract. We will account for properly supplied services and refund unused advance payments. Accrued payment, confidentiality, security and data protection duties continue.

21. Liability

21.1 Nothing excludes or limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any liability that cannot lawfully be excluded or limited.

21.2 Subject to clause 21.1, our total aggregate liability under or connected with each contract, whether in contract, negligence, misrepresentation or otherwise, is limited to the greater of:

(a) £1,000; or

(b) the agreed one off charges under that contract, including approved variations, plus twelve months of its recurring charges calculated at the rate applying immediately before the first event giving rise to liability.

21.3 The calculation excludes VAT. The cap covers all claims under that contract together, not each incident separately. A different cap requires express written agreement.

21.4 Subject to clause 21.1, we exclude indirect or consequential loss and loss of profit, revenue, anticipated savings, business opportunity or goodwill, whether direct or indirect.

21.5 Clause 21.4 does not exclude reasonable direct costs of correcting or replacing defective services or restoring or reconstructing data to the extent caused by our breach. Such losses remain subject to clause 21.2.

21.6 Refunds expressly required under these terms are payable independently of the damages cap. There is no double recovery. These restrictions govern claims between us and you, not individuals' statutory data protection rights or regulators' powers.

21.7 Each party must reasonably mitigate losses. Report problems promptly to help investigation; delay does not automatically extinguish a claim.

21.8 Tell us before accepting a quotation about unusually high financial, operational or regulatory consequences. Different safeguards or liability limits may require a separate agreement, different pricing or insurance.

22. Complaints and general provisions

22.1 Send complaints to hello@notla.wales with sufficient information for investigation. We will acknowledge and address them within a reasonable time.

22.2 We will seek a practical resolution and may agree mediation. This does not prevent urgent relief or action needed to preserve a legal deadline.

22.3 Formal contractual notices must go to the email or postal address stated in the quotation or subsequently notified. Emails are treated as received on the next business day after sending where no delivery failure message is received. This does not govern formal service of court proceedings.

22.4 Contractual obligations cannot be transferred without the other party's written consent, not unreasonably withheld. This does not restrict permitted licence transfers or authorised subcontracting.

22.5 Delay in enforcing a right is not a waiver. An unenforceable provision will be severed where possible without changing the substance of the remaining agreement.

22.6 No third party may enforce the contract under the Contracts (Rights of Third Parties) Act 1999. Independently existing statutory rights are unaffected.

22.7 Provisions intended to survive termination, including licences, accrued payments, confidentiality, data protection and liability, continue.

22.8 The contract and related non contractual disputes are governed by the law of England and Wales. Its courts have exclusive jurisdiction, subject to mandatory legal rules.

Schedule 1: Processing personal data on your behalf

A. Application and processing record

A.1 This schedule applies where we process personal data on your behalf in providing services covered by these terms. It does not bring excluded applications or portals within their scope.

A.2 "Data Protection Legislation" means the UK GDPR, Data Protection Act 2018 and other applicable data protection and privacy legislation, as amended or replaced.

A.3 You are the controller and we are the processor for the recorded activities. Where you act as another controller's processor, disclose this and obtain authority to appoint us as a subprocessor. The record must reflect that relationship.

A.4 Before the relevant processing begins, the quotation or attached processing record must identify:

A.5 GitHub, Netlify and any customer requested services must be assessed according to their actual role and configuration. Naming a provider in these terms does not automatically authorise unrestricted processing.

A.6 We will not begin the relevant processing until the record is agreed. This does not remove duties concerning data already received.

B. Instructions and confidentiality

B.1 We will process data only on documented instructions, including concerning international transfers, unless applicable UK law requires otherwise. We will explain any such legal requirement before processing where legally permitted.

B.2 We will immediately tell you if an instruction, in our opinion, infringes applicable data protection law and may suspend that instruction pending clarification.

B.3 Authorised personnel must be subject to appropriate confidentiality duties and receive access only as needed.

C. Security

C.1 We will maintain technical and organisational measures appropriate to the processing risks and meeting Article 32 UK GDPR.

C.2 The record must describe applicable access controls, authentication, encryption, patching, logging, recovery, deletion and review arrangements. We will not materially reduce agreed protection during the service.

C.3 You remain responsible for your users, devices and instructions. This does not reduce our responsibilities for systems and measures within our control.

D. Subprocessors

D.1 You authorise the subprocessors and arrangements identified in the agreed record. We will provide advance written notice of proposed additions or replacements and a reasonable opportunity to object before affected processing begins.

D.2 The record must identify workable notice arrangements for infrastructure providers and onward subprocessors. We will pass on relevant notices promptly and seek to resolve reasonable data protection objections.

D.3 Where no suitable resolution is available, either party may terminate the affected service before the change takes effect, with a refund of unused prepaid fees.

D.4 Subprocessors must be bound by the data protection obligations required by Article 28 UK GDPR. We remain responsible to you for their performance of those obligations.

E. International transfers

E.1 We will not make a restricted international transfer, including relevant overseas access, without documented authorisation and a lawful transfer arrangement.

E.2 Required safeguards and transfer assessments must be in place and identified in the record. Neither UK facing branding nor a UK customer address constitutes a promise of UK only processing.

F. Individual rights and assistance

F.1 Taking account of the processing, we will assist through appropriate technical and organisational measures, insofar as possible, with individuals' rights requests.

F.2 We will promptly forward relevant requests and complaints and will not respond substantively without instructions unless legally required.

F.3 Taking account of available information, we will assist with security, breach notifications, impact assessments and required regulatory consultation.

F.4 Charges for substantial additional assistance may be agreed in advance, except where caused by our breach. A fee dispute will not justify withholding assistance needed to meet a legal obligation or deadline.

G. Personal data breaches

G.1 We will notify you without undue delay after becoming aware of a personal data breach affecting data processed on your behalf, supplementing information as it becomes available.

G.2 Information will include the nature of the breach, affected data and individuals where known, likely consequences, a contact point, and measures taken or proposed.

G.3 We will take reasonable containment and remediation steps and cooperate with your response. We will not notify individuals or make notifications on your behalf without instruction unless legally required.

H. Information and audits

H.1 We will provide information needed to demonstrate Article 28 compliance and allow and contribute to audits and inspections by you or an appropriately qualified appointed auditor.

H.2 Reasonable notice and safeguards may protect security, confidentiality and other customers. They must not obstruct an audit required by law, a regulator or a reasonably suspected material breach.

I. Return and deletion

I.1 On ending the processing service, we will, at your choice, return or securely delete personal data and delete remaining copies unless UK law requires retention.

I.2 Unless another period is agreed, we will make a standard export securely available within ten business days. The processing record must identify the collection period and what information is included. Live hosting need not continue during collection.

I.3 Unless earlier deletion is instructed or another lawful period agreed, active copies will be deleted within 30 days after termination or completion of the instructed return, whichever is later.

I.4 Where residual backup copies cannot reasonably be individually deleted immediately, they must be put beyond ordinary use and erased as soon as practicable through documented deletion cycles. The record must identify applicable maximum periods before processing begins.

I.5 Retained data remains protected. We will provide deletion confirmation on reasonable request and will not withhold a required personal data return because of unpaid invoices.

J. Continuing obligations

J.1 You remain responsible for lawful purposes, instructions, retention decisions and required privacy information within your role.

J.2 Our obligations continue while we retain data processed on your behalf.

J.3 Clause 21 applies to contractual claims to the extent lawful. Neither party's direct statutory responsibilities are removed.