Compass Gateway

Compass Gateway Ltd

Terms of Business

Effective
17 September 2026
Version
1.2

These terms are published at compassgateway.com/terms.

Contents
  1. 1Who we are
  2. 2These terms and how we contract
  3. 3Our services
  4. 4What you must do
  5. 5Fees, expenses and payment
  6. 6Cancelling, postponing and ending an engagement
  7. 7Intellectual property
  8. 8Confidentiality
  9. 9Data protection
  10. 10Our working relationship
  11. 11Liability and insurance
  12. 12General

Schedules

  1. 1Consultancy, Advisory and Fractional Leadership Services
  2. 2Training and Instruction Services
  3. 3Clinical Governance and Event Medical Services
  4. 4Childcare and Family Support Services
  5. 5Software, Proofs of Concept, Hosting and Support

Annex

  1. AData Processing Annex (Schedule 5)

Who we are

Clause 1.1. We are Compass Gateway Ltd, a company registered in England and Wales (company number 15488605). Our registered office is 27 Old Gloucester Street, London, WC1N 3AX. Our VAT number is GB464737364.

Clause 1.2. In these terms, “we”, “us” and “our” mean Compass Gateway Ltd, and “you” and “your” mean the client named in the Engagement Confirmation.

These terms and how we contract

Clause 2.1. Every engagement is made up of three parts, in this order of priority:

  • the Engagement Confirmation — the email, proposal or letter in which we confirm what we will do, when, and for what fee;
  • the Service Schedule at the end of these terms that applies to the type of work; and
  • these general terms.

If they conflict, the Engagement Confirmation wins, then the Schedule, then these general terms.

Clause 2.2. A contract is formed when you accept our Engagement Confirmation in writing — email or instant message (for example WhatsApp) is fine — or when you ask us to start work and we do, whichever happens first. In these terms, “in writing” includes email and instant messaging, except formal notices under clause 12.5, which must be by email.

Clause 2.3. For business clients, these terms apply to the exclusion of any terms you seek to impose (for example, terms attached to a purchase order).

Clause 2.4. Consumers. These terms are written mainly for business clients. If you engage us as a consumer (for example, a family engaging childcare support under Schedule 4), nothing in these terms affects your statutory rights, and where these terms conflict with consumer law, the law prevails.

Clause 2.5. Formal changes only. Some things take effect only where they are set out in a formal Engagement Confirmation (a letter, proposal or order form that states the position expressly) or in a written variation we expressly agree: any assignment of intellectual property to you, any grant of exclusivity, any transfer of source code, and any change to clause 11. An informal message, discussion or proposal does not create them, even where it would otherwise form a contract under clause 2.2.

Our services

Clause 3.1. We will provide the services described in the Engagement Confirmation with reasonable skill and care.

Clause 3.2. Where the Engagement Confirmation names an individual, that person will perform the services, subject to any substitution rights in the applicable Schedule. Otherwise, we choose who performs them, and we may use suitably qualified subcontractors — we remain responsible for their work.

Clause 3.3. Our advice, reports and deliverables are prepared for you alone, for the purpose described in the Engagement Confirmation. No one else may rely on them, and we accept no responsibility to anyone else.

Clause 3.4. We are management consultants and practitioners, not solicitors, accountants, tax advisers or regulated financial advisers. Where our work touches legal, tax, financial or regulatory matters, we are giving business input, not regulated professional advice, and you should take your own advice from an appropriately regulated professional before acting.

Clause 3.5. Decisions remain yours. We do not guarantee any particular business outcome or result from following our advice.

Clause 3.6. Software. Where we design, build, configure, host, license or support software, apps, automations, integrations or AI-driven tools, Schedule 5 applies. We offer those services to business clients only.

What you must do

Clause 4.1. Good outcomes need your active involvement. For every engagement, you will, at your own cost:

  • give us timely, accurate and complete information, and timely decisions and approvals;
  • provide access to the people, premises, systems, records, facilities and equipment we reasonably need;
  • provide a safe working environment and comply with health and safety law at your sites;
  • obtain any licences, consents and permissions needed for us to do the work; and
  • carry out the tasks allocated to you in the Engagement Confirmation.

Clause 4.2. We will rely on the information you give us without independently verifying it.

Clause 4.3. If you cause delay — for example late information, unavailable people, or cancelled access — timescales move accordingly, and we may charge for time reserved for you that we could not use and for costs we have already committed.

Fees, expenses and payment

Clause 5.1. Fees are as set out in the Engagement Confirmation. All fees and charges are exclusive of VAT, which we add at the applicable rate.

Clause 5.2. Unless the Engagement Confirmation says otherwise, we charge time-based fees monthly in arrears, fixed fees as stated (which may include payment on booking or in stages), and retainers as described in Schedule 1. We may ask new clients for payment on account before starting.

Clause 5.3. Expenses. You will reimburse our reasonable out-of-pocket expenses incurred in delivering the services, including travel (mileage at the prevailing HMRC approved rate), parking, accommodation, subsistence, materials, and third-party costs, all recharged at cost. We will get your approval before incurring any single expense over £100.

Clause 5.4. Travel time. Where a venue or site is involved, travel time beyond one hour each way is chargeable at half the applicable rate, unless the Engagement Confirmation says otherwise.

Clause 5.5. Payment is due within 14 days of the invoice date, in full and without set-off or deduction. Payment is by bank transfer only, to the account shown on the invoice, unless the Engagement Confirmation states otherwise. We will never notify a change of bank details by email or message alone — if you receive one, verify it with us by phone before paying.

Clause 5.6. If you believe an invoice is wrong, tell us within 7 days of receiving it and pay the undisputed part on time while we resolve the rest.

Clause 5.7. If payment is late, we may charge interest and fixed compensation under the Late Payment of Commercial Debts (Interest) Act 1998 (or, if you are a consumer, simple interest at 4% a year above the Bank of England base rate), and we may suspend work (including withholding deliverables) until your account is up to date. Suspension does not affect your obligation to pay.

Cancelling, postponing and ending an engagement

Clause 6.1. Date-specific bookings (training days, consulting days, shifts, sessions) are subject to the cancellation charges in the applicable Schedule. These charges reflect time we have reserved and costs we have committed, and are payable in addition to any non-recoverable expenses already incurred. In cancellation periods, “days” means calendar days unless stated as business days.

Clause 6.2. Ongoing engagements and retainers may be ended by either party on 30 days’ written notice, unless the Engagement Confirmation says otherwise. Fees and expenses accrued to the end of the notice period remain payable.

Clause 6.3. Either party may end an engagement immediately by written notice if the other commits a material breach and does not fix it within 14 days of being asked, or becomes insolvent. We may also end or suspend an engagement immediately if you fail to pay on time.

Clause 6.4. On termination for any reason, you will pay for all work done and expenses incurred up to the end date.

Intellectual property

Clause 7.1. We keep ownership of everything we bring to the engagement and everything reusable that we create: our methods, know-how, templates, tools, software, prototypes, course materials and working papers. This includes anything created by our directors, employees, personnel and subcontractors in the course of delivering the services, which belongs to us and not to them individually, and not to you.

Clause 7.2. Once you have paid in full, we grant you a non-exclusive, non-transferable licence to use the deliverables for your own internal business purposes (or, for consumers, your own personal purposes). You may not resell them, publish them, or use them to provide services to others unless the Engagement Confirmation says you can.

Clause 7.3. Anything you provide to us remains yours; you licence us to use it to deliver the services.

Clause 7.4. In these terms, “deliverables” means only the specific reports, documents, materials or other outputs that the Engagement Confirmation says we will deliver to you. Drafts, working papers, tools, software, prototypes and other materials that we create or use in the course of an engagement are not deliverables unless the Engagement Confirmation names them.

Clause 7.5. We, our personnel and our associated businesses may develop, own and commercialise products, software, services, methods and businesses independently of any engagement, including ones that address problems or opportunities we encountered while working for you. Nothing in an engagement gives you any right, interest or option in them, or requires us to offer them to you, provided that we do not use your confidential information or personal data in doing so.

Clause 7.6. Where we use artificial intelligence or other software tools to help create materials, we use our own tools and accounts unless the Engagement Confirmation says otherwise. Materials generated with those tools are treated as created by us and belong to us under clause 7.1. Where any of them form part of the deliverables, the licence in clause 7.2 applies.

Clause 7.7. Software and related materials are licensed under Schedule 5, not delivered under clause 7.2. Where Schedule 5 and clause 7.2 differ, Schedule 5 applies (clause 2.1). Nothing in a software engagement transfers ownership of the software to you unless a formal Engagement Confirmation says so (clause 2.5).

Confidentiality

Clause 8.1. Each of us will keep the other’s confidential information confidential, use it only for the engagement, and share it only with people who need it and are bound to keep it confidential.

Clause 8.2. This does not apply to information that is public (other than through a breach), already lawfully known, or that must be disclosed by law or a regulator. This clause continues after the engagement ends.

Clause 8.3. Nothing in this clause prevents us from using the general knowledge, skills, experience and ideas that our personnel retain in their unaided memory from an engagement, so long as we do not disclose your confidential information or copy your materials.

Data protection

Clause 9.1. Each party will comply with UK data protection law, including the UK GDPR and the Data Protection Act 2018.

Clause 9.2. We normally act as an independent controller of the personal data we handle (for example, your contact and billing details). Our privacy policy at compassgateway.com/privacy explains how we handle personal data.

Clause 9.3. Where we process personal data on your behalf and on your instructions (for example, delegate lists you give us, or patient data held in your clinical systems), we will: process it only on your written instructions; keep it confidential and secure; not appoint sub-processors without your consent; assist you with data subject requests and security obligations as reasonably required; tell you without undue delay of any personal data breach affecting it; and delete or return it when the engagement ends, unless the law requires us to keep it.

Clause 9.4. Where we host software that processes your personal data, or access your systems containing it, the Data Processing Annex to Schedule 5 applies in place of clause 9.3. Under that Annex you give general authorisation for the sub-processors listed in the Engagement Confirmation, and we give you notice of changes to them.

Our working relationship

Clause 10.1. We are an independent contractor. Nothing in these terms creates an employment relationship, partnership, joint venture or agency between us, or between you and any of our personnel.

Clause 10.2. We are responsible for our own tax and National Insurance, and we will not claim employment-related rights or benefits from you.

Clause 10.3. While we are working for you and for 6 months afterwards, neither party will solicit for employment or engagement any person through whom the other delivered or managed the engagement. If you engage one of our personnel in breach of this clause, you will pay us an introduction fee of 20% of their first-year gross remuneration. This does not prevent hiring through genuine public advertising not targeted at that person.

Liability and insurance

Clause 11.1. Nothing in these terms excludes or limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be excluded or limited.

Clause 11.2. Subject to 11.1, we are not liable for indirect or consequential loss, loss of profit, loss of revenue, loss of anticipated savings, loss of data, or loss of business or goodwill.

Clause 11.3. Subject to 11.1, our total liability arising out of or in connection with an engagement is limited to the fees paid or payable under that engagement for the 12 months before the event giving rise to the claim.

Clause 11.4. To bring a claim, you must notify us in writing within 12 months of the date you became aware (or ought reasonably to have become aware) of the grounds for it.

Clause 11.5. We hold professional indemnity and public liability insurance appropriate to our services, and medical malpractice cover where clinical services are provided. Details are available on request.

Clause 11.6. Clauses 11.2 to 11.4 do not apply to consumers. If you are a consumer, we are responsible for foreseeable loss and damage caused by our breach of these terms or our negligence, but we are not responsible for loss that was not foreseeable when the contract was made, or that was not caused by us.

Clause 11.7. Where the limit in clause 11.3 would be less than £1,000, for example on free or low-fee work, the limit is £1,000 instead. This clause does not apply to consumers.

General

Clause 12.1. Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control. If such an event continues for more than 30 days, either party may end the affected engagement on written notice.

Clause 12.2. Entire agreement. The Engagement Confirmation, the applicable Schedule and these terms are the entire agreement between us for the engagement and replace all earlier discussions.

Clause 12.3. Changes. Changes to an engagement must be agreed in writing (email is fine). We may update these published terms from time to time; the version in force when an engagement is confirmed applies to it.

Clause 12.4. Assignment. You may not transfer an engagement without our written consent. We may subcontract as described in clause 3.2.

Clause 12.5. Notices. Formal notices may be given by email to the addresses used to agree the engagement and take effect on the next business day.

Clause 12.6. Third parties. No one other than you and us has any rights under these terms.

Clause 12.7. Severability. If any part of these terms is found unenforceable, the rest still applies.

Clause 12.8. Law and disputes. These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction — except that consumers may bring proceedings in their home courts within the UK. We would always rather talk first: each party agrees to try to resolve any dispute through good-faith discussion between senior people before starting proceedings.

Schedule 1

Consultancy, Advisory and Fractional Leadership Services

This Schedule applies to management consultancy, business advisory, coaching, strategy, project management and fractional leadership services (for example, fractional commercial director roles).

Clause S1.1. Nature of the services. We provide experienced business input, analysis, recommendations and hands-on leadership support. Clause 3.4 of the general terms applies with particular force to this work: where we comment on legal, financial, tax or regulatory matters, take your own regulated advice before acting.

Clause S1.2. Days and time. A “day” is up to 8 hours including reasonable breaks; part days are charged pro rata in half-day units unless agreed otherwise. Time beyond 8 hours in a day is chargeable at the pro-rata hourly equivalent, by agreement on the day where practical.

Clause S1.3. Cancelling booked days. If you cancel or postpone a booked consulting or coaching day:

  • 5 or more business days before — no fee (committed expenses recharged);
  • 2 to 4 business days before — 50% of the fee;
  • less than 2 business days before — 100% of the fee.

Clause S1.4. Retainers and fractional roles. Fractional leadership roles (for example, a fractional commercial director) are provided as retained consultancy services focused on agreed outcomes and value delivery — they are the supply of services by a business, not the filling of a post. Retainer fees are invoiced on the 1st of each month for that month, with expenses for the previous month invoiced in arrears at the same time. Retainer fees are payable whether or not you use the full allocation in a period, and unused time does not roll over unless the Engagement Confirmation says it does. Retainers may be ended on 30 days’ written notice under clause 6.2.

Clause S1.5. How we deliver retained services. We are engaged to deliver services, not to be at your disposal:

  • we decide how the services are performed and, subject to reasonable coordination with you, when and where;
  • any regular working pattern (for example, a usual day each week) is indicative only, is chosen by us for mutual convenience, and may be varied by us from time to time;
  • beyond the agreed services, you are not obliged to offer us further work and we are not obliged to accept any that is offered;
  • we may provide a suitably qualified substitute for a named consultant, subject to your approval (not to be unreasonably withheld); we remain responsible for the services and bear any handover cost;
  • we use our own equipment, except where you reasonably require the use of your systems for security or access reasons;
  • we may provide services to other clients, our personnel are not part of your organisation and receive no employee-style benefits, and we will correct defective work at our own cost.

Clause S1.6. Statutory appointments. A retainer does not include appointment as a statutory director, company secretary or other office holder. Any such appointment is optional, agreed separately (and may carry a separate fee), and may be declined, or resigned, independently of the retained services. Where one of our consultants does hold such an office, they owe the duties that the law attaches to that office personally, and this cannot be changed by contract. You will: include them in your directors’ and officers’ (D&O) insurance on the same basis as your other officers; provide the information and access they need to discharge those duties; and not require them to act unlawfully. Where a consultant holds such an office, you will deal with any conflicts of interest they disclose in accordance with the Companies Act 2006, including recording any board authorisation given, and clause 7.5 continues to apply to the consultant and to us.

Clause S1.7. Implementation. You are responsible for deciding whether and how to implement our recommendations and for the results of doing so.

Schedule 2

Training and Instruction Services

This Schedule applies to the design and delivery of training, instruction and train-the-trainer courses.

Clause S2.1. What you provide. Unless the Engagement Confirmation says otherwise, you will provide and pay for: the venue and its suitability, safety and insurance; AV, equipment and printing; delegate recruitment, joining instructions and attendance; and refreshments. You are responsible for ensuring delegates meet any prerequisites we notify to you.

Clause S2.2. Numbers. Courses are priced for the delegate numbers stated in the Engagement Confirmation. We may decline to admit delegates above the stated maximum, and the fee is unchanged if fewer attend.

Clause S2.3. Course materials. Course materials remain ours (clause 7). Delegates may keep their personal copies. You may not copy, share, or use our materials to deliver training yourself or through others, except that on a train-the-trainer course, your trainers who complete the course may use the materials we designate to deliver the course within your own organisation, for as long as the Engagement Confirmation allows.

Clause S2.4. Assessment and certificates. Where a course involves assessment, certificates are issued only to delegates who meet the published criteria. We may decline to certify a delegate who does not, and that is not a failure of the services.

Clause S2.5. Conduct and safety. We may exclude any delegate whose behaviour is unsafe, disruptive or inappropriate, without refund for that delegate.

Clause S2.6. Cancelling or postponing a course. If you cancel a booked course date:

  • 15 or more days before — no fee (committed expenses recharged);
  • 7 to 14 days before — 50% of the fee;
  • less than 7 days before — 100% of the fee.

You may postpone a course once without charge on 15 or more days’ notice, to a new date within 3 months, subject to availability. Later postponements are treated as cancellations.

Clause S2.7. If we have to cancel. If the named instructor is unavailable (for example, illness), we will offer a substitute instructor or the earliest practical new date. If neither works for you, we will refund fees paid for that course, and that refund is the limit of our liability for the cancellation.

Schedule 3

Clinical Governance and Event Medical Services

This Schedule applies to clinical governance and assurance work, and to the provision of registered clinical personnel (for example, an HCPC-registered paramedic) to event medical providers and similar organisations.

Clause S3.1. Registration and checks. Clinical personnel hold current registration with their professional regulator (for example, the HCPC) and maintain the training, revalidation and DBS checks appropriate to the role. Evidence is available on request.

Clause S3.2. Your clinical framework. Where our personnel work within your service (for example, as part of your event medical cover or governance provision), the services form part of your regulated activity. You are responsible for: overall clinical governance, policies and protocols; medicines management and the legal authorities under which medicines are supplied and administered; the event or service medical plan and its adequacy; equipment, consumables and medicines (unless the Engagement Confirmation says we provide specific items); and holding any registration required for the activity (for example, with the CQC). Our personnel will work within your framework and their own scope of practice.

Clause S3.3. Professional judgement. Our personnel must comply with their professional and legal obligations. They may decline to act outside their scope of practice, competence or the law, and may withdraw from a situation that is unsafe. Doing so is not a breach of the engagement.

Clause S3.4. Clinical records. Clinical records are made in accordance with your systems and requirements. As between us, you are the controller of patient data; we access and process it only as needed to deliver the services (clause 9.3 applies).

Clause S3.5. Briefing and welfare. You will provide a proper briefing, site and risk information, welfare arrangements (including breaks and facilities) and a safe working environment for each shift or visit.

Clause S3.6. Shifts and overruns. Shifts are billed at the agreed rate with a minimum of 4 hours per shift. If an event or shift overruns at your request or due to operational need, the additional time is chargeable at the same hourly rate.

Clause S3.7. Cancelling shifts or booked visits. If you cancel a booked shift or site visit:

  • 8 or more days before — no fee (committed expenses recharged);
  • 2 to 7 days before — 50% of the fee;
  • less than 2 days before — 100% of the fee.

Clause S3.8. Governance and assurance work. Audit, assurance and governance reports reflect the evidence sampled and the position at the time of review. They are not a guarantee of compliance, of the performance of the audited service, or of the outcome of any regulatory inspection, and they are for your internal use only (clause 3.3).

Schedule 4

Childcare and Family Support Services

This Schedule applies to ad-hoc childcare and family support, typically for early-years children and sometimes involving additional care needs, provided by experienced personnel with a clinical background.

Clause S4.1. Nature of the service. This is home-based childcare support provided in the child’s own home (or another setting you arrange and are responsible for). We are not a childminder, nursery or childcare agency, and we are not registered with Ofsted; care in the child’s own home does not require compulsory registration. If a proposed arrangement would require registration, we will tell you and may decline it.

Clause S4.2. Consumers. Families engaging this service are usually consumers. Your statutory rights apply, including (where the contract is made at a distance or away from business premises) a 14-day cancellation right under the Consumer Contracts Regulations 2013. If you ask us to provide care within that 14-day period, you agree we may start early and you will pay for care provided before any cancellation.

Clause S4.3. What you provide and tell us. Before care starts, you will give us in writing: full and accurate information about the child’s health, needs, allergies and routines; emergency contacts and GP details; written instructions for any medication; and the consents we ask for (including consent to seek emergency medical treatment and call 999 if needed). You will provide all supplies (food, nappies, medication, specialist equipment). We rely on what you tell us.

Clause S4.4. Medication and clinical limits. We administer medication only in line with your written instructions and within our competence. Although our personnel have clinical training, this service is childcare with informed support — it is not nursing or medical care, and it is not a substitute for advice or treatment from the child’s own clinicians.

Clause S4.5. Your ongoing responsibility. You remain responsible for your child’s overall care, medical decisions and wellbeing. You must remain contactable throughout each session.

Clause S4.6. Safeguarding. We follow safeguarding good practice and are legally and ethically obliged to report safeguarding concerns to the appropriate authorities. Doing so is not a breach of confidentiality or of the engagement.

Clause S4.7. Cancelling sessions. If you cancel a booked session:

  • 48 hours or more before — no charge;
  • less than 48 hours but at least 24 hours before — 50% of the session fee;
  • less than 24 hours before — 100% of the session fee.

We will always try to be flexible where cancellation is due to the child’s illness or a family emergency. If we have to cancel, we will tell you as soon as possible and you will not be charged for that session.

Schedule 5

Software, Proofs of Concept, Hosting and Support

This Schedule applies to the design, build, configuration, hosting, licensing and support of software, apps, automations, integrations and AI-driven tools. It is offered to business clients only, not to consumers. Where this Schedule and clause 7.2 differ, this Schedule applies (clause 2.1).

Clause S5.1. Modes of engagement. Every software engagement runs in one or more of three modes, chosen in the Engagement Confirmation: (a) proof of concept or evaluation; (b) build project; (c) ongoing licence with hosting and support. If the Engagement Confirmation does not choose, mode (a) applies.

Clause S5.2. What we own. We own the software and everything that makes it up: the platform, source code, designs, specifications, documentation, product names and know-how. This includes work generated with AI tools (clause 7.6) and improvements made in response to your feedback. You give us a free, perpetual and irrevocable licence to use any feedback and suggestions you provide.

Clause S5.3. What you own. You own your data, your brand, your content, and the configuration values (such as site names, user lists and settings) that you enter into the software. We use them only to deliver the services and as the Data Processing Annex allows.

Clause S5.4. Licence. Software is licensed, not sold. Unless the Engagement Confirmation says otherwise, your licence is non-exclusive, non-transferable, for your internal business use only, limited to the sites, users and term stated in the Engagement Confirmation, and conditional on payment of the fees. Every licence is one of: (a) evaluation, which is time-limited and not for production use; (b) subscription, which lasts for as long as the fees are paid; or (c) perpetual, which applies only where the Engagement Confirmation says so.

Clause S5.5. Source code, exclusivity and assignment. Source code is not a deliverable unless the Engagement Confirmation says so. Exclusivity applies only where the Engagement Confirmation expressly grants it and defines its scope, field and duration, and it never restricts our use of the underlying platform unless that is also stated. Assignment of ownership, any grant of exclusivity and any transfer of source code take effect only through a formal Engagement Confirmation (clause 2.5), never through an informal message or discussion.

Clause S5.6. Optional extras. These are off by default and apply only where priced and stated in the Engagement Confirmation: (a) source code escrow, or a continuity licence that takes effect if we stop supporting the product; (b) a priced buy-out of the software; (c) assignment to you of specific bespoke elements, with a licence back to us to keep using them.

Clause S5.7. Restrictions. You may not copy, adapt, reverse engineer, decompile, sublicense, rent or resell the software except where the law allows, and you may not use our software, specifications or designs to build, or to commission someone else to build, something similar. You remain free to buy or build alternatives without using our materials. Third-party and open-source components are licensed under their own terms, which we will identify on request.

Clause S5.8. Our freedom to reuse. Clause 7.5 applies: we may productise the software and sell the same or similar solutions to others. We may demonstrate de-branded versions and describe the problem the software solves, but we will not name you or use your brand without your permission.

Clause S5.9. Proofs of concept. A proof of concept is provided for evaluation only, for 60 days unless the Engagement Confirmation says otherwise, using demo or test data, and must not be used for live or operational reliance. It is provided as is, with no promise of availability or continued access, and either of us may end it at any time by written notice. Neither of us is obliged to proceed to a build project or a licence.

Clause S5.10. Build projects: scope and changes. The agreed specification defines the scope. Changes must be agreed in writing (clause 12.3) and may change fees and dates. You will provide the dependencies listed in the Engagement Confirmation, typically environment access, IT contacts, app registrations, test users and timely decisions (clause 4).

Clause S5.11. Acceptance. You have 10 business days from delivery to test the software against the specification. It is accepted when you tell us so, when the test window ends without a written rejection that identifies a defect, or when you put it into live use, whichever comes first. A defect is a material failure to meet the specification.

Clause S5.12. Warranty. For 30 days after acceptance we will fix defects free of charge. After that, fixes are provided under a support agreement or charged at our rates. The warranty does not cover problems caused by changes made by you or others, changes to third-party platforms or services, misuse, or your environment.

Clause S5.13. Payment and suspension. Build projects are paid in the stages stated in the Engagement Confirmation. If you do not pay on time, we may suspend the licence, hosting and support under clause 5.7 as well as stopping work.

Clause S5.14. Third-party costs. Cloud hosting, software licences, API and AI usage and similar third-party costs are recharged at cost. We will get your approval before committing to any single cost, or any new recurring monthly cost, over £100 (clause 5.3).

Clause S5.15. Your environment. Once software is deployed in your own tenant or infrastructure, you are responsible for that environment, including its costs, security settings, access control and backups, unless you buy support that expressly covers them.

Clause S5.16. Hosting and support: what you get. Where we host or support the software, the Engagement Confirmation sets the support hours, response targets, maintenance windows and backup arrangements. Targets are targets, not guarantees, and we make no uptime commitment unless the Engagement Confirmation states one. Support covers fixing defects, security patches, dependency updates and keeping the software working with changes to the platforms it relies on. New features and changes to scope are chargeable.

Clause S5.17. Hosting and support: term and notice. Hosted services run for the initial term in the Engagement Confirmation and then renew for successive periods of the same length, unless either of us gives at least 90 days’ written notice to end at the end of the current term. This replaces the 30 days in clause 6.2 for hosted services. We may change the fees at a renewal, giving at least 60 days’ notice before the renewal date. If you do not accept the change, you may end the service at the end of the current term by telling us before the renewal date, even if that is less than 90 days’ notice.

Clause S5.18. Suspension. We may suspend hosting, support or the licence, giving as much notice as is practical, if you do not pay on time, if there is a security risk to the software, our systems or other clients, or if the software is being misused. We will restore service once the issue is resolved. Fees continue during a suspension caused by you.

Clause S5.19. Exit. When a hosted service ends, your licence ends. You may ask us within 30 days for an export of your data in a standard format, such as CSV or JSON. After that we delete your data from live systems, and from backups as they expire. Further exit help, such as migration or extended access, is chargeable at our rates.

Clause S5.20. Data protection and AI. Where we host software that processes your personal data, or access your systems containing it, the Data Processing Annex applies (clause 9.4). As controller, you are responsible for the lawful basis for processing, privacy notices, any impact assessments, and telling your staff about any monitoring the software carries out. Where the software uses AI services, we name the providers in the Engagement Confirmation, we use those services on terms under which your data is not used to train their models, and AI outputs are not guaranteed to be accurate and should be checked before being relied on.

Clause S5.21. Safety-critical use. The software is not designed for safety-critical use, such as lone-worker protection, fire, medical or life-safety systems, unless the Engagement Confirmation expressly says so. You must keep your own arrangements for those purposes.

Clause S5.22. Warranties. We provide the software with reasonable skill and care. We do not promise that it will be error-free or run without interruption. So far as we are aware, the software as delivered by us does not infringe third-party intellectual property rights. This does not cover third-party or open-source components, or anything you provide or specify. If a claim arises, we will, at our choice, modify or replace the affected part or refund the fees paid for it, and that is your sole remedy for infringement.

Clause S5.23. Liability. Clause 11 applies. Our total liability under a software engagement is limited to the greater of the fees paid or payable in the 12 months before the event and £1,000 (clauses 11.3 and 11.7). Your sole remedy for loss of or damage to data we host is restoration from the latest available backup.

Annex A

Data Processing Annex (Schedule 5)

Clause A1. When this Annex applies. This Annex applies where we host software that processes personal data on your behalf, or access your systems containing personal data, under Schedule 5. It replaces clause 9.3 for that processing (clause 9.4). Where the Engagement Confirmation and this Annex differ, the Engagement Confirmation applies.

Clause A2. Roles. You are the controller. We are your processor. Each of us complies with UK data protection law.

Clause A3. Details of the processing. The Engagement Confirmation (or the Software Order Form) records, for each engagement:

ItemDescription
Subject matter and purposeThe software service described in the Engagement Confirmation
DurationThe term of the engagement plus the exit period in S5.19
Nature of processingHosting, storage, transmission, display, reporting, backup and deletion
Types of personal dataAs listed (for example names, work email addresses, employer, check-in times)
Special category dataNone, unless expressly listed
Data subjectsAs listed (for example your staff, contractors and visitors)

Clause A4. Our obligations. We will:

  • process personal data only on your documented instructions, which include the Engagement Confirmation and your use of the software, unless the law requires otherwise, in which case we will tell you first where we can;
  • make sure everyone we allow to access the data is bound by confidentiality;
  • apply the security measures in A5;
  • assist you, as far as reasonably possible, with data subject requests, security, breach notification and impact assessments, and charge for time beyond what is reasonably needed;
  • tell you without undue delay, and in any event within 48 hours of becoming aware, of a personal data breach affecting your data, with the information you need to meet your own obligations;
  • give you the information reasonably needed to demonstrate compliance and allow audits as set out in A7; and
  • return or delete the data at the end of the engagement as set out in A8.

Clause A5. Security measures. We apply measures appropriate to the risk, including: encryption in transit and at rest; role-based access control and least-privilege access; multi-factor authentication for administrative access; logging of administrative activity; regular backups; timely security patching; and separation of client data. Specific measures for an engagement, including hosting location and backup frequency, are recorded in the Engagement Confirmation.

Clause A6. Sub-processors. You give general authorisation for us to use the sub-processors listed in the Engagement Confirmation, which will typically include a cloud hosting provider, an email service and any AI service provider the software uses. We will give you at least 30 days’ notice before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we cannot resolve it, you may end the affected service on written notice without a termination charge. We remain responsible for our sub-processors’ performance.

Clause A7. Audit. Once in any 12 months, on 30 days’ written notice and at your cost, you may audit our compliance with this Annex, or accept a written report or certification we provide instead. Audits must be reasonable in scope, conducted during business hours, and must not compromise other clients’ data.

Clause A8. International transfers. We store data in the UK or the EEA unless the Engagement Confirmation says otherwise. Where a sub-processor transfers data outside the UK, we make sure a safeguard recognised under UK law is in place, such as adequacy regulations or the UK International Data Transfer Agreement or Addendum.

Clause A9. Return and deletion. At the end of the engagement, and subject to S5.19, we will export your personal data in a standard format on request within 30 days, then delete it from live systems within a further 30 days and from backups as they expire (normally within 90 days), unless the law requires us to keep it. We will confirm deletion in writing on request.

Clause A10. Your responsibilities. You are responsible for the lawfulness of the processing, including the lawful basis, privacy notices to staff and other data subjects, any impact assessment, and for the accuracy and appropriateness of the data you enter into the software.

Version history

  • v1.2 (17 September 2026) — added Schedule 5 (Software, Proofs of Concept, Hosting and Support) and the Data Processing Annex; added clauses 2.5 (formal changes only), 3.6, 7.7, 9.4 and 11.7 (£1,000 minimum liability limit); added a contents list.
  • v1.1 (15 September 2026) — clarified ownership of materials created by our personnel, defined deliverables, added independent development, AI-generated output and residual knowledge provisions, and added conflict-of-interest handling for statutory appointments.
  • v1.0 (27 July 2026) — first published version.

Compass Gateway Ltd · Company number 15488605 · Registered office: 27 Old Gloucester Street, London, WC1N 3AX · VAT GB464737364 · enquiries at compassgateway dot com

Back to Compass Gateway