Riseway Systems
Terms & Conditions
Version dated 10 October 2026
1. Who we are and who these terms apply to
Riseway Systems is a trading name of Roseborough Limited, registered in England and Wales under company number 04128959. Our registered office is Thorndales, Warley, Brentwood, Essex, England, CM14 5DE. References to Riseway, we, us and our mean Roseborough Limited. Contract notices may be sent to accounts@risewaysystems.co.uk or our registered office.
These terms apply to services purchased for business purposes. You means the business named in the order form, including a sole trader or partnership. The person accepting the agreement confirms they have authority to bind that business. We do not offer these services for personal, household or other consumer use.
Browsing our website does not itself create a paid service agreement. Website visitors must use the site lawfully and respect the intellectual property rights in its content.
2. Your agreement with us
Order Form means the proposal, quotation or order confirmation identifying your services, charges and commercial arrangements. The agreement comprises the accepted Order Form, these terms, the usage provisions in clause 8 and, where we process personal data for you, Schedule 1 and the completed processing particulars.
An agreement starts when you accept an Order Form in writing or through an electronic acceptance process and we confirm acceptance. Before acceptance, we will make the applicable terms and usage charges available to you. An invoice alone does not introduce new terms or unapproved charges.
An expressly agreed provision in the Order Form takes priority over these terms for the matter it addresses. Schedule 1 takes priority for personal-data processing. Any agreed international-transfer instrument takes priority where legally required. Clause 8 sets out phone and SMS usage charges unless the Order Form expressly agrees different charges.
Each subscription covers only the business, locations, service areas, websites and accounts specified in the Order Form. Extra locations, brands or services require agreement; they are not automatically included or charged.
3. Services and scope
Our subscription plans include Riseway Foundation, Riseway Growth and Riseway Performance. Services may include Harder-Working Websites; hosting and maintenance; Local SEO Foundations; Review Engine; Missed Call Recovery; Business Phone System; All-In-One Inbox; Enquiry Response & Follow-Up; Repeat & Referral Campaigns; website and campaign updates; account management; and strategy sessions.
Depending on your plan and agreed scope, services may also include Google Maps & AI Visibility, Google Business Profile optimisation, citations, ongoing SEO, content expansion, paid advertising management, Google Local Services Ads and AI Receptionist / Call Handling. Listing a service here does not include it in every plan.
The Order Form must specify the selected plan, deliverables, update or support allowances, locations, any express variations to the usage allowances in clause 8, launch dependencies and any separately charged add-ons. We will not charge you twice for a service already included in your plan.
Changes outside the agreed scope require written agreement on the additional work, price and timetable before we proceed. An upgrade or add-on does not restart your minimum commitment unless expressly agreed when ordered.
4. How we deliver the services
We will perform the services with reasonable care and skill, using suitably competent personnel. We may use contractors and specialist suppliers, while remaining responsible for our contractual obligations.
Launch dates depend on receiving the agreed information, access and approvals and on relevant third-party checks. Unless expressly guaranteed in the Order Form, dates are estimates. We will explain material delays and agree a revised timetable where reasonably possible.
We will provide the website or system for review before launch. You must check business information, prices, claims, photographs, contact details and routing instructions, and identify corrections promptly. We will correct departures from the agreed scope without additional charge. Launch requires your approval or another expressly agreed approval process; silence alone is not approval.
Support channels, hours and response commitments are as stated in the Order Form. A response target is not a promise that every issue will be resolved within that period. No service-level credit or uptime guarantee applies unless expressly agreed.
5. Your responsibilities
You must provide accurate business information and materials, appropriate permissions, secure account access and timely approvals reasonably needed for delivery. We will identify reasonable response deadlines. If your delay affects delivery, we may revise dates, but must tell you what is missing and its effect.
You are responsible for the legality and accuracy of your services, offers, trading claims, licences and customer-facing information, and for having rights to supplied content. We remain responsible for our own work and must not knowingly publish unlawful material.
You must maintain appropriate access to business accounts, protect passwords, use multi-factor authentication where available, keep authorised users current and notify us promptly of suspected unauthorised access. Use delegated access rather than sharing passwords wherever possible.
You remain responsible for handling enquiries, quotations, appointments and customer work. Keep opening hours, availability, service areas and escalation instructions accurate. Failure to respond can affect results but does not excuse a separate failure by us to perform the agreed services.
6. Subscription commitment and billing periods
Your subscription has a minimum initial term of three months, starting on signup when your first subscription payment is taken. Fees are collected monthly in advance. Your Order Form will state the signup date, billing date and initial minimum-term end date.
You cannot cancel the subscription during the initial minimum term. All fees falling due for that term are payable. This does not restrict a right to terminate for our material breach or another express termination right under this agreement.
After the initial minimum term, your subscription continues on a monthly rolling basis until cancelled under clause 9. Each monthly billing period starts on the anniversary of your first payment date. If that date does not occur in a month, the billing date is the last day of that month.
Billing starts at signup, not website launch. Delays caused by missing client information or approvals do not pause billing. If a material delay is caused by us, we will agree a reasonable timetable and appropriate remedy; this clause does not remove your rights for our breach.
7. Fees, taxes and recurring payments
Charges and payment dates are stated in the Order Form. Subscription fees are payable monthly in advance. No setup fee applies unless expressly identified and accepted for the relevant service. VAT is added only where legally chargeable and will be shown clearly before purchase and on invoices.
You authorise our payment processor to collect the agreed recurring subscription charges and separately authorised usage charges or add-ons using the agreed payment method. We do not have authority to collect an unagreed charge. We will supply invoices or payment confirmations and give advance notice of changes.
You may withdraw recurring card-payment authority through us or your card issuer. We will stop collecting under that authority when withdrawn. Stopping a payment authority does not itself cancel the service agreement or extinguish amounts properly due; an alternative payment method may be needed.
Advertising spend, domains, premium licences and other third-party purchases are separate only where stated in the Order Form or approved before purchase. Advertising spend is normally paid directly to the platform. We may not exceed your approved budget without authorisation.
We will not increase subscription prices during the initial commitment. Later increases require at least 30 days' written notice. If you notify us before an increase takes effect that you do not accept it, you may end the affected service before the increase without an additional commitment or a seven-day notice requirement. No increase applies retrospectively.
8. Calls, messages, email and AI usage
Your Business Phone System is provided through HighLevel. Phone and SMS usage is accounted for in US dollars (USD). Each plan includes a monthly usage credit: Riseway Foundation, $10; Riseway Growth, $20; and Riseway Performance, $40. Unused credit expires at the end of the month and is not carried forward.
Usage above the included monthly credit is charged at the rates below. Rates are in USD and exclude VAT, which is added where legally chargeable.
| Mobile-number usage | Rate (USD, excluding VAT) |
|---|---|
| Outbound calls | $0.0336 per minute |
| Inbound calls | $0.0110 per minute |
| Outbound SMS | $0.0616 per segment |
| Inbound SMS | $0.0083 per segment |
SMS usage is charged by message segment, normally up to 160 standard characters. Longer messages or messages using certain characters may comprise several chargeable segments. MMS prices are available on request.
Usage is calculated monthly and included on your next invoice. We will give at least 14 days' advance notice of changes to these usage rates. Where settlement is made in pounds sterling, the invoice will show the USD usage amount, the exchange rate applied by the payment or billing provider and the resulting sterling charge.
9. Cancellation and pauses
After the initial minimum term, send written cancellation notice to accounts@risewaysystems.co.uk, clearly identifying your business and subscription. We will acknowledge it and confirm the final service date and charges. Failure to acknowledge does not invalidate a notice demonstrably received by us.
Cancellation requires at least seven calendar days' written notice before your next billing date and ends the service at the end of the paid billing period. If notice arrives fewer than seven calendar days before the next billing date, one further monthly period will be charged and the service will end at the end of that period.
Cancelling a subscription does not cancel a separately contracted service unless your notice also identifies it. Each separately agreed minimum commitment must be disclosed before purchase. We will explain which services depend on the subscription and cannot continue independently.
Pauses require written agreement covering charges, availability, data retention and restart. Simply ceasing to use a service does not pause or cancel it.
10. Non-payment and suspension
If a payment fails, we will notify you and allow at least seven days to resolve it before suspending for non-payment. If you raise a genuine, reasonably explained invoice dispute, we will investigate and will not suspend solely for the disputed amount while you cooperate and pay undisputed charges.
We may suspend affected functions immediately where reasonably necessary to address a credible security threat, unlawful use or a binding platform or legal requirement. We will limit suspension to what is reasonably necessary and explain the reason promptly unless legally prohibited.
We will restore suspended services promptly when the cause is resolved. Suspension does not extend the minimum commitment. Fees continue where the services are maintained and suspension results from your breach, but charges saved because of suspension will be taken into account. Fees are not payable for services we permanently discontinue without a contractual entitlement to payment.
11. Websites, content and intellectual property
The subscription website is supplied as a hosted service, not sold to you. We retain the rights we own in its design, code, templates, structure, reusable materials and configurations. Third-party materials remain subject to their owners' rights.
During your paid subscription we grant you a non-exclusive, non-transferable licence to use the agreed website and systems for your business. It ends when the relevant service ends. We may reuse our general methods and templates, but not your confidential information, branding or identifiable customer data.
You retain ownership of your domain, brand assets and files and content you supply. Content we create, including website copy and creative files, remains ours or our licensors' unless transferred under a website purchase agreement or expressly assigned separately in writing. We will identify third-party restrictions affecting content included in a purchase. Your customer records remain under your control, subject to individuals' legal rights.
You give us permission to use your supplied materials to deliver the services. Neither party warrants ownership of rights it does not hold. No provision prevents use permitted by law.
Website ownership is optional. You may purchase a standalone Ownership Website, or buy out the website provided under your subscription, at the separate fixed price stated in a written purchase quotation. Once accepted, that buyout price does not reduce with time on the subscription, and past subscription payments are not credited towards it. Those payments cover the service already supplied. The purchase quotation will state its validity period; a price not yet accepted may change for future quotations.
The purchase agreement will define the website pages, final content, code and files included, the rights being assigned, third-party exclusions, handover timetable and any migration or recreation needed. Following full payment, we will transfer the agreed website rights and deliver the purchased website using the agreed handover method. We will identify material differences from the subscription website and obtain approval before handover.
Ownership applies to the purchased website, not our wider CRM, phone system, inbox, review tools, automations, campaigns or AI services. These continue only under separately identified subscriptions. We retain our general-purpose frameworks and reusable components, granting a continuing licence to any of them necessary to operate the purchased website; third-party components remain subject to their licences.
The purchase agreement must identify whether you control the website and connected accounts directly or Riseway manages hosting on your behalf. It must specify ongoing hosting, domain and third-party charges and the arrangements for future handover. A website purchase does not transfer ownership of third-party software or services.
After a buyout, the website subscription element ends on the agreed handover date and any agreed hosting and care service is charged separately. The purchase quotation will specify ongoing care prices and scope. Continuing leads-system subscriptions must be priced and identified separately, without automatically charging the full combined website-and-systems plan. A standalone purchase may include an initial hosting and care period only where its duration and subsequent charges are expressly stated.
12. Domains, business accounts and telephone numbers
A domain purchased for you must be registered in your name or with you as the beneficial owner. You retain it when the subscription ends. Renewal fees and renewal responsibility must be identified in the Order Form. We will provide reasonable assistance to move domain control and will not withhold it solely because of an unrelated invoice dispute.
Your Google Business Profile and advertising accounts remain your accounts where held in your name. We normally use delegated access and will relinquish our access when services end, subject to completing authorised handover work.
Telephone numbers are allocated and used under the relevant provider's rules; allocation does not mean ownership. Before activation, the Order Form must state whether a number is client-controlled, provider-allocated or shared, and any porting restrictions.
On request we will reasonably assist with porting an eligible dedicated number, subject to provider verification, lawful restrictions and separately approved provider or migration costs. Request porting before cancellation and keep the service active until completion. We cannot guarantee a provider's porting decision, but will not deliberately obstruct a permitted transfer.
13. Leaving Riseway and retrieving your materials
At the end of the relevant service, the hosted subscription website, CRM access, inbox, automations and other subscription functions cease, except for a website purchased and handed over under clause 11 or separately continued services. Arrange replacement hosting, communications and workflows before that date if you need continuity.
You may request your supplied materials, content expressly assigned to you and reasonably exportable business records before termination or within 30 days afterwards. We will provide an ordinary export in an available standard format without a separate export fee. Custom conversion, migration or reconstruction is chargeable only if agreed in advance.
Personal data will be returned or deleted under Schedule 1 and will not be held hostage for unpaid fees. An export does not include our operational website, platform licences, templates or automation configurations, and may not reproduce all third-party functionality.
We will give notice of the export window and intended deletion timetable. After the window, materials may be deleted subject to Schedule 1, legal retention requirements and any agreed extension. Backup copies may remain only under the safeguards and expiry arrangements in Schedule 1.
14. Marketing, messages and review requests
Each party must comply with laws and platform rules applicable to its activities, including UK data-protection law and the Privacy and Electronic Communications Regulations. You must have a lawful basis for supplied contact data and any consent or other permission required for the proposed communication. Buying a list or receiving an enquiry does not automatically authorise every later marketing campaign.
We will configure agreed identification, opt-out and suppression functions with reasonable care. You must honour objections and keep suppression information current. We must not knowingly send unlawfully or continue marketing contrary to a notified objection. Outsourcing a campaign does not remove either party's own legal responsibilities.
Responses needed to handle a requested enquiry must be distinguished from promotional follow-up. Campaign content, audiences, sending frequency and any automated outbound calling require agreed instructions and appropriate permissions before activation.
Review Engine supports requests for honest customer feedback. Neither party may create fake reviews, offer incentives prohibited by the platform, suppress legitimate negative feedback or direct only customers expected to be positive towards public reviews. We do not guarantee review numbers, star ratings or removal of reviews.
15. AI Receptionist and automated call handling
AI features apply only where ordered. You must approve the knowledge base, opening hours, routing, escalation arrangements and limits on what the assistant may say or do. We will test agreed functions before activation and provide reasonable assistance to correct configuration problems.
AI can misunderstand speech, omit information or produce inaccurate responses. It supplements business processes and requires proportionate human oversight. Unless expressly authorised in an approved workflow, it must not bind you to prices or contracts, give regulated advice or make decisions with legal or similarly significant effects on individuals.
AI call handling is not an emergency service. We will agree a reasonable fallback for unavailable or failed routing. Your ordinary phone service and human contact arrangements must remain appropriate for your business needs.
AI interaction, recording and transcription notices must be configured where required. Each party will fulfil its own legal obligations; you must approve the relevant business instructions and privacy information, and we must implement the agreed configuration with reasonable care. Recordings and transcripts are processed under Schedule 1. Your customer data may not be used to train general-purpose AI models without a separate lawful agreement.
16. Search visibility, advertising and results
We commit to the agreed work, not a particular commercial result. We do not guarantee rankings, inclusion in AI answers, enquiries, jobs, revenue or return on advertising spend. Results depend on competition, customer demand, platform changes, budget, your business and how enquiries are handled.
Google Local Services Ads and other platform services depend on eligibility, verification and platform approval. You must provide accurate supporting documents and maintain any required licences and insurance. We will reasonably assist with agreed setup and management, but cannot guarantee approval, reinstatement or platform-issued lead refunds.
A calculator, case study, testimonial or forecast illustrates a scenario or past experience, not a promised result. Estimated job value is not profit or an established loss. Any measurement target or Qualified Enquiry definition applies only if expressly agreed with its measurement method, exclusions and remedy in the Order Form.
17. Third-party services and availability
The services may depend on hosting, CRM, telecommunications, payment, email, AI and advertising providers. Their applicable terms and material restrictions will be identified where relevant. We will not accept a material new financial obligation on your behalf without authorisation.
We do not control third-party outages or policy decisions. We remain responsible for reasonable selection, configuration and management within our agreed scope and for any data-processing duties allocated to us. An outside provider's involvement does not automatically exclude our liability.
We may carry out maintenance and security updates and substitute equivalent tools. We will minimise disruption and give reasonable notice of planned material changes. If we remove or materially reduce an agreed core function without an equivalent replacement, you may terminate the affected service without an early termination charge and receive a proportionate refund of prepaid unused fees.
18. Confidentiality and publicity
Each party must protect the other's confidential information and use it only to perform the agreement. Disclosure is permitted to personnel and advisers who need it and are bound by appropriate confidentiality duties, or where legally required. Publicly available information, independently developed information and information lawfully obtained elsewhere are excluded.
We will obtain your permission before publishing a testimonial, identifiable case study, logo endorsement or non-public business results. Customer records and private communications will not be used as marketing examples without appropriate authority and a lawful basis.
19. Data protection
Each party must comply with applicable UK data-protection law. We act as an independent controller for our own sales, billing and business administration. Our Privacy Policy explains that processing; it is not a substitute for our processor obligations.
Where we handle your customer or prospect personal data on your instructions, Schedule 1 applies. Processing particulars and the initial sub-processor list must be completed and supplied before processing begins. Neither party acquires ownership of individuals' personal data or overrides their legal rights.
20. Ending the agreement for breach or other cause
Either party may terminate an affected agreement if the other commits a material breach and fails to remedy it within 30 days of written notice explaining the breach and required remedy. A breach incapable of remedy may justify immediate termination. We may terminate for non-payment after the suspension process if you do not remedy it within that notice period.
Either party may terminate if the other ceases trading or becomes insolvent, but only to the extent permitted by applicable insolvency law. We may end a rolling subscription for convenience on at least 30 days' notice after the initial commitment and refund prepaid fees for periods we will not supply.
Termination does not remove accrued payment obligations or existing claims. If you validly terminate for our unremedied material breach, future minimum-commitment payments for the affected services cease and we will refund prepaid fees attributable to services not supplied. Confidentiality, accrued rights, intellectual-property provisions, applicable liability limits and data return or deletion duties survive as needed.
21. Refunds
We do not offer an automatic satisfaction or results guarantee. Ordinary cancellation does not entitle you to a refund of fees for a paid billing period already begun, subject to the remedies expressly set out in this agreement and rights that cannot lawfully be excluded.
We will correct billing errors, refund unapproved charges and provide refunds due under clauses 17 or 20. Non-refundable third-party costs may be retained only where properly authorised, genuinely incurred and not recoverable. This clause does not allow us to retain payment for an unjustified failure to perform.
22. Liability
Nothing limits or excludes liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any liability that cannot lawfully be limited or excluded.
Subject to clause 22.1, we are not liable for indirect or consequential loss, or loss of anticipated profits, revenue, business opportunity or expected savings arising from the services. This does not exclude reasonable direct costs of restoring or reconstructing data lost through our breach, or prevent recovery of a refund expressly due under this agreement.
Subject to clause 22.1, our aggregate liability for all claims relating to a subscribed location arising in a contract year is limited to the fees you actually paid us for that location in the six months immediately preceding the first event giving rise to those claims. Contract years are consecutive twelve-month periods from the agreement start date. Claims arising from the same or related events are treated as arising in the contract year of the first event. Where an Order Form covers several locations, it must identify the fees attributable to each. A claim involving several locations is subject to the combined caps for the affected locations, without double recovery.
These limits apply to claims in contract, negligence, breach of statutory duty and otherwise, so far as lawfully enforceable. They do not limit a data subject's statutory rights or a regulator's powers. Each party must take reasonable steps to mitigate its losses. Payment of fees properly due is not limited by this clause.
23. Third-party claims caused by supplied content
If a third party establishes that material you supplied infringes its intellectual-property rights, you will reimburse our reasonable, evidenced losses and defence costs to the extent caused by that infringement. This does not cover our unauthorised alteration or use, or our own breach or negligence.
We must notify you promptly, take reasonable steps to reduce loss and allow you a reasonable opportunity to participate in the defence. Neither party may agree a settlement imposing an admission or obligation on the other without its consent, not to be unreasonably withheld. No general unlimited indemnity applies for every contractual breach.
24. General provisions and notices
Neither party is responsible for delay caused by events beyond its reasonable control where it promptly notifies the other and takes reasonable mitigating steps. Lack of funds is not such an event. If an event prevents a material service for more than 30 consecutive days, either party may terminate that affected service without future commitment fees; prepaid unused fees will be refunded.
Changes to an existing agreement require written agreement, except prospective price or service changes expressly permitted here. Publishing revised website terms does not retrospectively amend your contract. New terms may be proposed for future renewals on at least 30 days' notice, with a right to cancel before they take effect without the seven-day notice requirement; existing terms otherwise continue until agreement is reached.
Contract notices must be sent by email to the addresses stated in the Order Form or by prepaid post to the stated business addresses. Cancellation may use clause 1.1. Email is received when delivered without a failure notification; post is received two business days after posting. Business days exclude weekends and public holidays in England. This notice clause does not govern service of court proceedings.
Neither party may transfer the agreement without the other's consent, not to be unreasonably withheld, except as expressly agreed. Subcontracting does not transfer our responsibility. No partnership, employment or authority to bind the other party is created.
Failure to enforce a right immediately does not waive it. If a provision is unenforceable, the remaining provisions continue so far as legally possible. No third party has a contractual right to enforce the agreement under the Contracts (Rights of Third Parties) Act 1999; statutory rights remain unaffected.
The agreement records the agreed service arrangement and supersedes earlier discussions on that arrangement. It does not exclude liability for fraud or override an expressly incorporated promise or a right that cannot lawfully be excluded.
The agreement is governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction. Before proceedings, the parties will attempt in good faith to resolve a notified dispute through their authorised representatives; this does not prevent urgent relief or required action to preserve a claim.
Schedule 1
Customer data processing
1. Scope and instructions
This schedule applies where you are controller and we are processor of customer, prospect or other personal data on your behalf. If you act as processor for another controller, you must have authority to appoint us as a sub-processor; equivalent obligations apply through the relevant processing chain.
Processing is limited to delivering the ordered website, CRM, communications, review, campaign and AI functions, associated support, security and agreed export or deletion. Operations can include collection, recording, organisation, storage, retrieval, transmission, recording or transcription of calls where ordered, and deletion. Processing continues during the service and authorised handover and retention periods. Calls handled through the subscribed phone and AI services are recorded and transcribed. Recordings and transcripts are retained for six months from the relevant call, then deleted, unless an earlier deletion instruction, termination requirement or applicable legal obligation requires a different period.
Data subjects can include prospects, customers, callers, website visitors and your authorised staff. Data can include names, contact details, business and service addresses, enquiries, appointment details, communication histories, consent and suppression records, technical identifiers, and recordings or transcripts where enabled. Special-category or criminal-offence data is not intentionally included unless specifically agreed with appropriate safeguards.
We will process only on your documented instructions, including for transfers, unless UK law requires otherwise. Where lawful, we will inform you of that requirement before processing. We will notify you immediately if an instruction appears to infringe applicable data-protection law and may pause the affected processing while it is resolved.
2. Confidentiality and security
We will ensure persons authorised to process the data are subject to confidentiality obligations and have access only as needed. We will implement technical and organisational measures appropriate to the risks under Article 32 UK GDPR, taking account of the nature of the data and processing.
Before processing begins, the processing particulars will record the measures actually applicable, including access controls, authentication, encryption arrangements, device security, backup and recovery arrangements, logging, vulnerability management, staff confidentiality and secure deletion. We will review measures appropriately and will not materially reduce agreed protection.
3. Sub-processors and international transfers
You give general written authorisation for HighLevel to provide CRM, business phone and AI call-handling services and for Google to provide email services, to the extent they process customer data on our behalf. The processing particulars will identify the applicable contracting entities, processing locations and their authorised downstream providers. We will give at least 30 days' written notice of intended additions or replacements, identifying their function and processing locations, and allow an objection on reasonable data-protection grounds.
We will seek a reasonable solution to an objection. If none is available, either party may terminate the affected service before the change without an early termination charge, with a proportionate refund of prepaid unused fees. We will not appoint the disputed provider for your data while that process remains unresolved.
We must bind each sub-processor to equivalent applicable data-protection obligations and remain responsible to you for its performance of those obligations. A provider acting independently as controller must be identified separately rather than treated automatically as a sub-processor.
Restricted international transfers require a valid legal mechanism and any necessary assessment or supplementary safeguards before transfer. Processing particulars must identify relevant countries, recipients and mechanisms. This general authorisation does not itself legalise an international transfer.
4. Assistance and incidents
Taking account of the nature of processing and information available, we will assist you with individuals' rights requests, security obligations, breach notifications, impact assessments and prior consultation with the ICO where required. We will promptly pass on relevant requests and not respond substantively except on your instructions or where legally required.
We will notify you without undue delay after becoming aware of a personal-data breach affecting data processed for you, providing available information about its nature, affected data and individuals, likely consequences and response measures. We will provide further information as it becomes available and cooperate in containment and remediation. We will not delay notice while an investigation is incomplete.
Each party remains responsible for notifications legally required of it. Ordinary compliance assistance is included. Exceptional additional work may be priced in advance where lawful, but we will not charge you to rectify our breach or delay legally required assistance pending payment.
5. Assurance and audits
We will make available information needed to demonstrate compliance with our processor obligations and allow and contribute to audits or inspections by you or an authorised auditor. Audits should use proportionate documentary assurance first where suitable, with reasonable notice and confidentiality safeguards.
Restrictions on frequency, timing or access must not prevent an audit required by law, a regulator, or a material suspected breach. You may not access another client's confidential data. Each party normally bears its own costs; we bear reasonable audit costs attributable to a material breach established on our part.
6. Return, deletion and backups
At the end of processing, we will, at your choice, return or securely delete the personal data and delete existing copies unless UK law requires retention. We will contact you for your choice before termination or promptly afterwards. Unless you instruct otherwise, we will make a standard export available during the 30-day handover window and then delete active copies in accordance with the disclosed deletion timetable.
The processing particulars must specify the active-data deletion period and the maximum backup expiry period before processing starts. Backup copies awaiting expiry must be put beyond ordinary use, protected, not used for another purpose and deleted at the disclosed expiry. If restored for disaster recovery, deletion instructions must be reapplied.
Legally retained data must be limited to what is required, protected and used only for that legal purpose. We will confirm completion of return or deletion on reasonable request. Billing disputes do not suspend these obligations.
7. Processing particulars to complete with each Order Form
Identify the selected services and processing purpose; relevant data subjects and data categories; any approved sensitive data; processing duration; controller contact and breach-notification contact; approved instructions; security measures; and export format.
Identify each initial sub-processor by legal entity, function and processing country, together with any restricted-transfer mechanism. State which providers act as independent controllers. Supply an accessible current list and a process for notifying changes.
Call recordings and transcripts have a six-month retention period measured from the relevant call, subject to clause 1.2 and the end-of-contract requirements in clause 6 of this schedule. State the active-data deletion deadline and maximum backup expiry period for other customer data and any agreed lawful retention exceptions. These particulars must describe the actual service arrangements and be agreed before customer-data processing begins.

