NightWarden Terms and Conditions

1. About these Terms

These Terms and Conditions govern access to and use of the NightWarden website, software platform, mobile applications, control room applications, client portals, partner portals, integrations and related services.

NightWarden provides subscription-based security operations, workforce management and field service software.

These Terms apply only to customers purchasing or using the Services for business purposes.

In these Terms:

“Authorised User” means any employee, worker, contractor, manager, client, partner or other person whom the Customer permits to access or use the Services.

“Customer”, “you” and “your” mean the business, organisation or sole trader purchasing, accessing or using the Services.

“Customer Data” means information, documents, photographs, recordings, location information, records, instructions, reports and other content uploaded to, stored within, transmitted through or generated using the Services on behalf of the Customer.

“Documentation” means user guides, help material, support articles, operating instructions and other documentation made available by NightWarden.

“NightWarden”, “we”, “us” and “our” mean the sole trader identified in section 49.

“Order Form” means any accepted quotation, proposal, subscription confirmation, online order, invoice or other agreement setting out the selected Services, subscription plan, charges or Subscription Period.

“Services” means the NightWarden software platform, applications, portals, features, integrations, support and related services purchased or accessed by the Customer.

“Subscription Period” means the period stated in the Order Form or, where no period is stated, 12 months.

2. Agreement and order of priority

The agreement between NightWarden and the Customer consists of:

1. The accepted Order Form.
2. Any separately signed Data Processing Agreement or Service Level Agreement.
3. These Terms.
4. Any policy expressly stated in the Order Form or these Terms to form part of the agreement.

If there is a conflict, the document appearing earlier in the list will take priority, but only in relation to the conflicting provision.

An Order Form will not amend these Terms unless it clearly identifies the provision being amended and states that it is intended to override these Terms.

No purchase order, procurement terms or other Customer document will apply unless NightWarden expressly agrees to it in writing.

The NightWarden Client Support, Business Continuity and Contingency Plan explains operational support routes, incident arrangements and continuity recommendations.

The contingency plan does not create a guaranteed response time, recovery time, uptime commitment, service credit or other service level unless expressly agreed in an Order Form or separate Service Level Agreement.

3. Business use and authority

The Services are provided for business use only and are not intended for consumers acting mainly for personal, family or household purposes.

By creating an account, accepting an Order Form, paying an invoice or using the Services, the Customer agrees to be bound by the agreement.

Anyone accepting the agreement on behalf of a business confirms that they have authority to bind that business.

The Customer is responsible for ensuring that all Authorised Users comply with the agreement.

A breach by an Authorised User will be treated as a breach by the Customer.

If the Customer does not agree to these Terms, it must not access or use the Services.

4. The NightWarden Services

NightWarden provides software designed to assist businesses with the management of field staff, security operations, clients, sites, assignments and operational records.

Depending on the Customer’s subscription plan, the Services may include:

• Client and site management.
• Staff scheduling and availability.
• Shift offers, assignments and run sheets.
• Patrol and checkpoint management.
• NFC, QR and GPS records.
• Clocking in and clocking out.
• Alarm response and keyholding records.
• Vacant property inspections.
• Lone worker and hazardous task monitoring.
• Incident, patrol and inspection reports.
• Risk assessments.
• SIA licence monitoring.
• BS7858 screening administration.
• Staff training and Toolbox Talks.
• Client and partner portals.
• Control room applications.
• Vehicle tracking.
• Email, SMS, Telegram and push notifications.
• Weather, crime and mapping information.
• AI-assisted reports and administrative tools.
• Third-party integrations.

The functionality available to the Customer depends on the subscription plan selected.

Descriptions, demonstrations, screenshots, development roadmaps and marketing materials are illustrative. They do not create a contractual commitment to provide a feature unless it is included in the Customer’s selected subscription plan or Order Form.

NightWarden may improve, update, replace or modify the Services.

NightWarden will not materially reduce the overall core functionality purchased by the Customer during a paid Subscription Period without reasonable notice, unless the change is required for legal, security, safety or technical reasons.

New features may be introduced as optional extras or as part of another subscription plan.

NightWarden may withdraw, suspend or replace a feature where:

• The feature is no longer technically or commercially reasonable to provide.
• A relevant third-party service is withdrawn or materially changed.
• Continued provision creates a legal, security, safety or operational risk.
• The feature is obsolete or has been replaced by substantially equivalent functionality.
• Usage of the feature is insufficient to justify continued support.

5. Licence to use the Services

Subject to payment of all applicable charges and compliance with the agreement, NightWarden grants the Customer a limited, non-exclusive, revocable, non-transferable and non-sublicensable right to use the Services during the Subscription Period for its internal business operations.

The Customer may allow Authorised Users to access the Services and may provide approved portal access to its clients, partners or subcontractors.

The Customer may download and use reports generated from its own Customer Data for legitimate business activities.

The Customer must not:

• Sell, rent, lease, sublicense or commercially exploit access to the Services.
• Copy, reproduce, modify or create derivative works from the Services.
• Reverse engineer, decompile or attempt to discover source code.
• Circumvent subscription, user, feature or usage restrictions.
• Use NightWarden software, designs, workflows or Documentation to create a competing product.
• Allow a competitor of NightWarden to access non-public areas without written permission.
• Remove or obscure copyright, branding or proprietary notices.
• Access the Services to benchmark or monitor them for competitive purposes.
• Use the Services to operate a software bureau or provide access as a standalone software service to third parties.

Any rights not expressly granted are reserved by NightWarden.

6. Customer accounts and account security

The Customer must provide accurate and complete account and billing information and appoint at least one account administrator.

The Customer is responsible for:

• Deciding who may access its account.
• Allocating appropriate roles and permissions.
• Reviewing access rights regularly.
• Removing access promptly when a person changes role or leaves.
• Keeping administrator access appropriately restricted.
• Ensuring login credentials are kept confidential.
• Securing devices used to access the Services.
• Activity carried out using its accounts, except to the extent directly caused by NightWarden’s breach.

Each Authorised User should use their own account where individual accounts are provided.

Login credentials must not be shared.

The Customer must notify NightWarden promptly if it becomes aware of:

• Unauthorised account access.
• Compromised credentials.
• Suspicious activity.
• Loss or theft of a device.
• Unauthorised disclosure of Customer Data.
• Any other security incident affecting the Services.

NightWarden may require password resets, identity verification, multifactor authentication or other reasonable security measures.

NightWarden may treat instructions received through an authenticated administrator account as authorised by the Customer unless NightWarden has actual knowledge that the account has been compromised.

The Customer must not create an account for a person under 16.

Where an account is created for a person under 18, the Customer is responsible for ensuring that their employment, engagement and access to the Services are lawful, appropriate and properly supervised.

7. Customer operational responsibilities

NightWarden provides software tools. It does not take over the Customer’s operational, employment, management, legal or regulatory responsibilities.

The Customer is responsible for how it configures and uses the Services.

The Customer must maintain complete, accurate and current information concerning:

• Staff and Authorised Users.
• Clients and sites.
• Vehicles and equipment.
• Site risks.
• Assignment instructions.
• Emergency contacts.
• Escalation arrangements.
• Access information.
• Operational procedures.
• Schedules and deployments.
• Alert recipients.
• Licences and qualifications.

The Customer is responsible for:

• Checking site and assignment instructions.
• Training, managing and supervising personnel.
• Ensuring workers are competent and appropriately licensed.
• Maintaining risk assessments and emergency procedures.
• Deciding how to respond to alarms, incidents and alerts.
• Deciding when emergency services should be contacted.
• Maintaining suitable insurance.
• Maintaining compatible devices and connectivity.
• Reviewing reports, alerts and records.
• Testing relevant functions before operational reliance.
• Ensuring notifications and device permissions are correctly enabled.
• Complying with employment, health and safety, security and data protection law.
• Maintaining suitable backup and business continuity procedures.
• Investigating discrepancies or suspected false records.
• Correcting inaccurate information promptly.

NightWarden does not employ, manage, supervise or direct the Customer’s personnel.

NightWarden is not a party to any agreement between the Customer and its clients, employees, contractors, subcontractors or service partners.

The Customer remains responsible for all operational and commercial decisions made using the Services.

8. Business continuity, independent backups and offline arrangements

The Customer must maintain its own proportionate business continuity and disaster recovery arrangements.

The Customer must not use NightWarden as the sole repository for information that it is legally, contractually or operationally required to retain.

The Customer must use the backup and data export features made available within NightWarden and maintain appropriate independent copies of information required for its operations.

The Customer is responsible for:

• Determining an appropriate export and backup frequency.
• Completing exports regularly.
• Checking that exported files have been created successfully.
• Retaining suitable historical versions.
• Avoiding reliance on a single continually overwritten file.
• Securely storing and protecting exported information.
• Testing whether exported information can be accessed and used.
• Maintaining appropriate offline operational information.
• Establishing suitable retention and deletion periods.
• Protecting personal, confidential and security-sensitive information.
• Maintaining alternative communication and dispatch procedures.

Where information is required for safety-critical or time-sensitive operations, the Customer must maintain a method of accessing that information if NightWarden, internet services, mobile networks, devices or third-party services are unavailable.

NightWarden maintains reasonable platform-level backup, security and recovery arrangements for the Services.

Those arrangements do not replace the Customer’s responsibility to maintain independent copies required for its own legal, contractual and operational continuity.

NightWarden’s internal backups are not intended to operate as the Customer’s archive service.

NightWarden does not guarantee that:

• A particular item or historical version of Customer Data can be restored.
• Deleted or overwritten Customer Data can be recovered.
• An individual Customer restoration can always be completed.
• Backup data will be retained indefinitely.
• Backup data will be available in a format selected by the Customer.

To the fullest extent permitted by law, NightWarden will not be responsible for loss that would have been avoided or reduced if the Customer had complied with this section.

9. Critical and emergency use

NightWarden is not an emergency service.

The Services are not intended to replace:

• The police, fire, ambulance or coastguard services.
• A staffed alarm receiving centre.
• A staffed control room, unless expressly contracted separately.
• Emergency telephone systems.
• The Customer’s internal emergency procedures.
• Direct human supervision.
• Independent safety-critical communication arrangements.

The Customer must not rely on a single NightWarden feature, alert, notification, device or communication channel as the sole means of protecting life or responding to an emergency.

Where there is an immediate risk to life, safety or property, the Customer and its users must contact the appropriate emergency services and follow the Customer’s emergency procedures.

10. Acceptable use

The Customer must not use the Services unlawfully, fraudulently or in a way that could harm NightWarden, another customer or another person.

The Customer and its Authorised Users must not:

• Attempt to gain unauthorised access to accounts, systems or networks.
• Introduce viruses, malware or harmful code.
• Bypass security controls or usage restrictions.
• Interfere with the availability or performance of the Services.
• Scrape or extract data using unauthorised automated systems.
• Impersonate another person or organisation.
• Falsify attendance, patrol, inspection, training or compliance records.
• Falsify or manipulate GPS, NFC, QR or timestamp information.
• Upload unlawful, defamatory, infringing or malicious material.
• Carry out unlawful or unjustified monitoring.
• Publish performance testing or benchmarking without permission.
• Permit a competitor to access non-public parts of the Services.
• Use the Services to facilitate criminal, fraudulent or abusive activity.
• Attempt to obtain NightWarden source code.
• Use the Services in breach of sanctions, export controls or other applicable law.
• Use automated scripts, bots or integrations that have not been approved by NightWarden.
• Place an unreasonable or abnormal load on the Services.

NightWarden may investigate suspected misuse and preserve relevant records where reasonably necessary for security, fraud prevention, dispute resolution or legal compliance.

NightWarden may suspend access where reasonably necessary to protect the Services, another customer, a third party or NightWarden.

11. Customer Data

The Customer retains ownership of its Customer Data.

The Customer grants NightWarden a non-exclusive right to host, store, copy, transmit, process, display, back up and otherwise use Customer Data to the extent reasonably necessary to:

• Provide the Services.
• Provide support.
• Maintain and secure the Services.
• Prevent fraud and misuse.
• Comply with law.
• Exercise NightWarden’s rights under the agreement.

The Customer confirms that:

• It has the right to provide Customer Data to NightWarden.
• Its collection and use of Customer Data are lawful.
• It has provided required privacy information.
• It has obtained any required consents.
• Customer Data and instructions do not infringe third-party rights.
• Customer Data does not contain unlawful or malicious content.

The Customer is responsible for the accuracy, quality, legality, relevance and completeness of Customer Data.

NightWarden is not responsible for checking Customer Data for accuracy or completeness.

NightWarden may remove, quarantine or restrict access to content that reasonably appears unlawful, harmful, insecure or in breach of the agreement.

Where reasonably practicable, NightWarden will notify the Customer before taking such action unless notification would create a security risk, prejudice an investigation or be prohibited by law.

NightWarden may use aggregated or anonymised information to improve the Services, analyse performance, develop features and produce non-identifying statistics, provided the information does not identify the Customer or any individual.

12. Employee monitoring and location information

The Services may allow the Customer to collect information about staff attendance, location, patrol activity, vehicle movements, check-ins, assignments and operational activity.

The Customer is responsible for deciding whether and how these features are used.

Before using monitoring features, the Customer must ensure that the monitoring is:

• Lawful.
• Necessary.
• Proportionate.
• Transparent.
• Restricted to legitimate purposes.
• Subject to appropriate access and retention controls.

The Customer must provide appropriate privacy information to affected individuals and complete a data protection impact assessment where required.

NightWarden does not determine whether the Customer’s monitoring practices are lawful or appropriate.

The Customer is responsible for:

• Employee consultation where required.
• Handling complaints.
• Responding to data subject requests.
• Employment decisions.
• Disciplinary action.
• Disputes arising from monitoring.
• Ensuring monitoring is not excessive or discriminatory.

13. GPS, NFC, QR and timestamp records

GPS, NFC, QR and timestamp information may be affected by:

• Device accuracy.
• Satellite availability.
• Buildings and physical obstructions.
• Internet or mobile connectivity.
• Battery level.
• Operating system restrictions.
• Application permissions.
• Offline operation.
• Incorrect device time.
• User error.
• Device faults.
• Deliberate device manipulation.

NightWarden does not guarantee that every location or timestamp record will be completely accurate, genuine or immediately available.

An NFC or QR checkpoint record indicates that a compatible device registered an interaction with the relevant checkpoint.

A checkpoint record does not, by itself, prove:

• That every required duty was completed.
• That every area was inspected.
• That the correct person attended.
• That the person remained at the location.
• That an incident did or did not occur.

Photographs, signatures, GPS records, clock-in records and checkpoint records should be considered with the Customer’s supervision and other available evidence.

Information recorded offline may not become visible until the device reconnects and successfully synchronises.

The Customer must investigate material discrepancies and maintain alternative procedures where immediate access is required.

14. Lone worker and hazardous task features

NightWarden may provide functions assisting with:

• Lone worker check-ins.
• Timed welfare checks.
• Hazardous task monitoring.
• Missed check-in alerts.
• Escalation communications.
• Location information.

NightWarden is not an emergency service, alarm receiving centre or personal emergency response provider.

NightWarden does not guarantee that:

• An alert will always be generated.
• An alert will be delivered.
• An alert will be seen.
• A recipient will respond.
• A location will be accurate or available.
• Injury, crime, damage, loss or death will be prevented.

These features depend on matters including device power, signal, internet access, GPS availability, application permissions, notification settings, correct configuration and accurate contact details.

The Customer must:

• Maintain suitable risk assessments.
• Maintain emergency and escalation procedures.
• Nominate suitable alert recipients.
• Maintain backup communication methods.
• Train users.
• Test relevant functions.
• Keep contact details current.
• Monitor whether alerts have been received.
• Contact emergency services directly where necessary.

NightWarden does not automatically contact emergency services unless expressly agreed as a separate service.

Use of NightWarden does not, by itself, make the Customer compliant with health and safety or lone worker requirements.

15. Alarm response and keyholding functions

NightWarden may assist with recording and managing alarm activations, keyholding information, dispatch records, access instructions and response reports.

NightWarden does not provide guarding, keyholding, alarm response or alarm receiving centre services under these Terms.

The Customer remains responsible for:

• Verifying alarm information.
• Maintaining accurate access details.
• Selecting and checking responders.
• Dispatching personnel.
• Contacting clients.
• Contacting emergency services.
• Managing keys and access codes.
• Determining the appropriate operational response.
• Maintaining alternative arrangements if the Services are unavailable.

NightWarden is not responsible for operational decisions made by the Customer, its personnel, clients or service partners.

16. SIA, screening and compliance tools

NightWarden may provide administrative tools relating to:

• SIA licences.
• BS7858 screening.
• Right-to-work records.
• Qualifications.
• Training.
• Employment records.
• Document expiry dates.
• Compliance reporting.

These tools are administrative aids only.

NightWarden does not certify, warrant or guarantee that:

• A person is suitable for employment.
• Screening is complete or compliant.
• A licence is valid at the exact time of deployment.
• External information is current or accurate.
• The Customer has complied with a particular standard.
• A regulator, auditor or client will accept a record.

The Customer remains responsible for recruitment, screening, licensing, training, employment, auditing and deployment decisions.

Automated reminders do not replace the Customer’s responsibility to check records, source documents, licences and expiry dates.

17. Risk assessments and external information

NightWarden risk assessment templates, scores and recommendations are intended to assist the Customer with recording and organising information.

They do not replace an assessment completed and approved by a competent person.

The Customer must review and adapt every assessment to the relevant:

• Site.
• Task.
• Worker.
• Equipment.
• Hazard.
• Environment.
• Circumstances.

Weather, crime, mapping and other information may be provided by third parties and may be delayed, unavailable, incomplete or inaccurate.

The Customer must not rely solely on NightWarden for safety-critical weather, crime, travel or emergency information.

18. AI-assisted features

NightWarden may use artificial intelligence or automated processing to produce reports, summaries, classifications, suggestions, recommendations and administrative content.

AI-generated content may be inaccurate, incomplete, outdated, misleading or unsuitable.

The Customer must ensure that AI-generated content is reviewed by a suitably competent person before it is:

• Issued to a client.
• Used for an operational decision.
• Used in employment or disciplinary action.
• Treated as a risk assessment.
• Used to determine a person’s suitability.
• Submitted to a regulator.
• Relied upon for legal or compliance purposes.

AI-generated content is not legal, employment, regulatory, financial, medical, security or health and safety advice.

The Customer remains responsible for every decision made using AI-generated content.

The Customer must not submit passwords, access codes or unnecessary personal data to an AI feature.

The Customer must not submit special category data, criminal offence information or highly confidential information unless:

• The feature is approved for that purpose.
• The processing is necessary.
• The Customer has a lawful basis.
• Appropriate safeguards are in place.

NightWarden may use specialist third-party providers to deliver AI functionality.

AI features may be modified, restricted or withdrawn and are subject to the Fair Usage Policy.

19. Client and partner portals

The Customer may provide portal access to clients, subcontractors, service partners or other approved users.

The Customer is responsible for:

• Deciding who receives access.
• Setting permissions.
• Confirming portal users are authorised.
• Removing access promptly.
• Checking what information is visible.
• Information published through its portals.
• Obtaining permission to use names, logos and branding.

White-label or branded portal functionality does not transfer ownership of the underlying NightWarden software.

The Customer must not represent that it owns or developed the underlying NightWarden software.

20. Communications, SMS and AI fair usage

The Services may send communications through email, SMS, Telegram, push notifications, in-application messaging or other supported methods.

The Customer confirms that it has authority to provide the relevant contact details and initiate those communications.

NightWarden does not guarantee that every communication will be delivered, received, read or acted upon.

Delivery may be affected by mobile networks, internet providers, spam filters, messaging platforms, invalid details, outages, device settings and third-party restrictions.

The Customer must not rely on one electronic communication method for emergency or safety-critical communications.

SMS alerts and AI-assisted features may be included within certain subscription plans on a fair usage basis.

Fair usage is intended to cover normal day-to-day security operations.

Fair usage does not include:

• High-volume marketing or promotional messaging.
• Repeated bulk messaging.
• Use as a mass communications platform.
• Excessive generation of AI content.
• Automated AI use through unauthorised scripts or bots.
• Resale of included SMS or AI capacity.
• Usage creating abnormal processing or third-party costs.
• Usage materially affecting other customers.
• Attempts to circumvent usage controls.

If the Customer expects unusually high SMS or AI usage, it should contact NightWarden before subscribing so that an appropriate allowance, subscription package or separate commercial arrangement can be agreed.

Where usage exceeds the level reasonably expected for the Customer’s plan, NightWarden may:

• Contact the Customer to discuss its usage.
• Require usage to be reduced or modified.
• Move the Customer to a suitable plan.
• Require purchase of additional capacity.
• Apply agreed usage-based charges.
• Recover reasonable third-party charges caused by abnormal usage.
• Restrict or suspend the affected feature.

NightWarden will normally provide reasonable notice before applying additional charges or restrictions.

Advance notice is not required where usage creates a security risk, technical disruption, significant unexpected cost or risk to service availability.

Fair usage may be assessed by reference to the Customer’s plan, user numbers, historical usage, operational requirements and third-party costs.

21. Mobile applications and devices

NightWarden applications may be made available through Apple, Google or other application stores.

The Customer is responsible for ensuring that devices are:

• Compatible.
• Secure.
• Properly configured.
• Updated.
• Charged.
• Connected to suitable internet or mobile services.

NightWarden does not guarantee compatibility with every device, operating system or configuration.

Users may need to install updates to continue using the Services.

Application store terms may also apply.

Apple, Google and other application store providers are not responsible for providing or supporting the NightWarden Services.

NightWarden may stop supporting obsolete devices or operating systems where continued support is no longer technically, commercially or securely reasonable.

22. Third-party services and integrations

NightWarden may depend on or integrate with third-party services, including:

• Cloud hosting.
• Databases.
• Mapping and GPS services.
• SMS and email providers.
• Push notification services.
• Telegram.
• Application stores.
• Payment providers.
• AI providers.
• Vehicle tracking systems.
• External data providers.

NightWarden does not control independent third-party services.

NightWarden is not responsible for third-party outages, inaccuracies, security incidents, pricing changes, account restrictions or service withdrawals outside NightWarden’s reasonable control.

The Customer may be required to accept separate third-party terms.

NightWarden may replace a third-party service with a reasonably suitable alternative.

Where no suitable alternative is reasonably available, NightWarden may withdraw or restrict the affected feature without being required to provide a substantially different service.

The Customer is responsible for its own contracts and accounts with third parties where an integration requires them.

23. Availability, maintenance and support

NightWarden will provide the Services with reasonable care and skill.

Unless a separate Service Level Agreement expressly states otherwise, NightWarden does not guarantee:

• Continuous availability.
• Any percentage uptime.
• A fixed response time.
• A fixed recovery time.
• That the Services will be error-free.
• Compatibility with every system or device.
• That every defect will be corrected.
• That support will resolve every issue.

The Services may be unavailable because of:

• Planned maintenance.
• Emergency maintenance.
• Security updates.
• Software releases.
• Infrastructure failures.
• Internet or telecommunications failures.
• Third-party failures.
• Cyber incidents.
• Events outside NightWarden’s reasonable control.

NightWarden will aim to give reasonable notice of planned maintenance likely to cause significant disruption.

Emergency maintenance may be carried out without advance notice.

Support is provided through the channels made available by NightWarden.

Routine support hours, the 24/7 support chatbot, critical incident contact arrangements and continuity recommendations are described in the current NightWarden Client Support, Business Continuity and Contingency Plan.

The support chatbot provides general assistance and may produce incomplete or inaccurate answers. It does not replace emergency services, operational judgement or human support for a genuine critical platform incident.

24. Onboarding, configuration and data migration

NightWarden may provide onboarding, configuration and data-import assistance.

The Customer is responsible for:

• Preparing its data.
• Maintaining an original copy.
• Checking accuracy and completeness.
• Checking imported records.
• Testing workflows.
• Confirming configuration.
• Approving operational use.

NightWarden does not guarantee that all data from another system can be imported, converted or mapped.

The Customer must verify migrated data before operational reliance.

NightWarden is not responsible for:

• Errors in original data.
• Missing fields in third-party exports.
• Duplicate records.
• Inconsistent formats.
• Inaccurate mapping instructions.
• Errors caused by Customer changes after migration.

Bespoke migration, configuration, training or development may be charged separately.

25. Fees, taxes and payment

The Customer must pay the charges shown in the accepted Order Form, quotation, invoice or subscription confirmation.

Where there is a difference between a public Pricing page and an accepted Order Form, the accepted Order Form will take priority.

NightWarden is not currently registered for VAT and will not charge VAT unless and until NightWarden becomes VAT registered or is otherwise legally required to account for VAT.

If NightWarden becomes VAT registered, or another applicable tax becomes payable, all charges will be treated as exclusive of that tax unless expressly stated otherwise.

The Customer must pay applicable VAT or other tax in addition to the agreed charges from the date on which NightWarden is legally required to charge or account for it.

The addition or alteration of VAT or another tax required by law will not be treated as an increase in NightWarden’s base subscription price.

Unless stated otherwise:

• Subscription fees are payable in advance.
• The Subscription Period is 12 months.
• Usage-based and third-party charges are payable in arrears.
• Invoices are payable within 14 days.

The Customer must provide accurate payment and billing information.

Where recurring payment has been agreed, the Customer authorises NightWarden and its payment provider to collect the relevant charges, together with VAT or another tax that NightWarden is legally required to charge.

Payments must be made in full without set-off, counterclaim, deduction or withholding, except where required by law.

The Customer must pay any undisputed part of an invoice by the due date even where another part is disputed.

The Customer must notify NightWarden of a disputed invoice promptly and provide reasonable details.

Failure to access or use the Services does not remove the Customer’s obligation to pay during the Subscription Period.

The Customer is responsible for taxes, duties and charges arising from its purchase or use of the Services, excluding taxes based on NightWarden’s income.

26. Late payment

Where payment is overdue, NightWarden may:

• Charge statutory interest and compensation where applicable.
• Recover reasonable debt recovery costs.
• Suspend access.
• Restrict the addition of users, vehicles or data.
• Refuse additional services.
• Require advance payment.
• Terminate the agreement in accordance with these Terms.

NightWarden may allocate payments against the oldest outstanding invoice first.

Suspension or restriction does not remove the Customer’s obligation to pay.

27. Free trials and promotional access

NightWarden may offer free trials, pilot accounts, demonstrations or promotional access.

Trial Services may have:

• Limited functionality.
• Reduced support.
• Lower usage limits.
• Shorter data retention.
• Experimental features.
• No service commitments.

NightWarden may modify or withdraw a free trial at any time.

Where the Customer agrees that a paid subscription will begin after a trial, charges will begin when the trial ends unless the Customer cancels in accordance with the stated trial conditions.

Promotional pricing applies only for the stated promotional period.

At the end of that period, the agreed standard subscription price will apply unless the Order Form states otherwise.

The trial allows the Customer to assess whether the Services are suitable for its requirements, devices, workflows and operating environment.

The trial does not remove or limit any rights or obligations that cannot lawfully be excluded.

28. Annual price protection and fee changes

The base subscription price agreed at the beginning of a Subscription Period will remain fixed for that 12-month period.

Annual price protection does not prevent additional charges where the Customer:

• Adds users, vehicles or optional features.
• Upgrades its plan.
• Requests additional storage, communications or capacity.
• Exceeds usage or fair usage allowances.
• Requests bespoke work.
• Purchases additional services.
• Incurs usage-based third-party charges.

The addition or alteration of VAT or another tax required by law will not be considered an increase in NightWarden’s base subscription price and may take effect during a current Subscription Period where legally required.

NightWarden may change prices for the next Subscription Period by giving at least 30 days’ notice before renewal.

The revised price will apply from the renewal date.

If the Customer does not accept the revised price, it may prevent renewal by giving written notice before the renewal date.

29. Annual renewal and cancellation

Unless otherwise agreed, subscriptions are purchased for an initial 12-month Subscription Period.

The subscription will automatically renew for further 12-month periods unless either party gives at least 30 days’ written notice before the renewal date.

Cancellation takes effect at the end of the current paid Subscription Period.

The Customer remains responsible for charges due up to the cancellation date.

Fees already paid are non-refundable except where required by law or expressly agreed.

NightWarden is not required to refund:

• Unused months.
• Unused users.
• Unused features.
• Unused allowances.
• A downgrade during a Subscription Period.
• Cancellation before the end of a committed Subscription Period.

Deleting an application, stopping use, removing users or cancelling a payment method does not constitute valid cancellation.

A cancellation request must be sent through a cancellation method approved by NightWarden, including email where accepted.

30. Upgrades, downgrades and additional services

The Customer may request an upgrade or additional service at any time.

An upgrade may take effect immediately and may result in a proportionate charge for the remainder of the current Subscription Period.

A downgrade will normally take effect at the next renewal date.

A downgrade may result in:

• Reduced functionality.
• Lower limits.
• Restricted access.
• Loss of integrations.
• Loss of access to data exceeding the downgraded plan’s limits.

The Customer is responsible for exporting or reorganising information before a downgrade takes effect.

NightWarden is not responsible for loss of functionality resulting from a Customer-requested downgrade.

31. Suspension and termination

NightWarden may suspend or restrict access where:

• Charges are overdue.
• The Customer breaches the agreement.
• An account creates a security risk.
• The Services are being misused.
• Usage threatens service availability.
• Suspension is required by law.
• Continued access may expose NightWarden or another person to liability.
• The Customer fails to cooperate with a security investigation.
• Information provided by the Customer appears false or misleading.

Where reasonably possible, NightWarden will give the Customer an opportunity to correct the issue before suspension.

Immediate suspension may be used where necessary to prevent harm, fraud, unlawful activity, security compromise or material disruption.

Suspension does not remove the obligation to pay.

Either party may terminate the agreement if the other commits a material breach and fails to correct it within 14 days after written notice.

NightWarden may terminate immediately where the Customer:

• Acts unlawfully or fraudulently.
• Deliberately falsifies records.
• Attempts to compromise NightWarden systems.
• Seriously infringes intellectual property.
• Creates a serious risk to another person.
• Remains materially overdue after notice.
• Repeatedly breaches the agreement.
• Becomes insolvent, ceases trading or is unable to pay its debts.

NightWarden may terminate for convenience by giving notice taking effect at the end of the current Subscription Period.

On termination:

• The Customer’s right to use the Services ends.
• Outstanding charges become due.
• Each party must return or destroy the other’s confidential information where reasonably required.
• Provisions intended to survive termination will continue.

32. Data export, retention and deletion

The Customer may use available export functions during the Subscription Period.

The Customer is responsible for exporting records it is legally, contractually or operationally required to retain.

Following termination, NightWarden may allow up to 30 days for the Customer to request an available export.

NightWarden may require:

• All outstanding charges to be paid.
• Payment for bespoke export work.
• Identity and authority verification.
• Agreement on a secure transfer method.

NightWarden is not required to provide data in a format that is not ordinarily available without additional payment.

After the export period, NightWarden may delete Customer Data from active systems unless retention is required for legal, security, backup or claims-handling purposes.

Information in protected backups may remain until securely overwritten or deleted through the normal backup cycle.

Backup data will not normally be restored solely to provide post-termination access.

NightWarden is not responsible for the Customer’s failure to request or complete an export within the available period.

33. Data protection

Each party must comply with applicable data protection law, including the UK GDPR and the Data Protection Act 2018.

Where NightWarden processes personal data on behalf of the Customer:

• The Customer will normally act as controller.
• NightWarden will normally act as processor.
• The Data Processing Schedule in Schedule 1 will apply.

NightWarden may act as an independent controller for:

• Account administration.
• Billing.
• Fraud prevention.
• Service security.
• Legal compliance.
• Business records.
• Its own communications.
• Establishing or defending legal claims.

The Customer is responsible for ensuring that it has an appropriate lawful basis for personal data it collects and uses through the Services.

This includes responsibility for:

• GPS and location information.
• Employee monitoring information.
• Identification documents.
• Health information.
• Criminal offence information.
• Vetting and screening information.
• Photographs and signatures.
• Client and site contact details.

Further information is contained in the NightWarden Privacy Policy.

34. Confidentiality

Each party must protect the other party’s confidential information and use it only for the purposes of the agreement.

Confidential information includes:

• Non-public commercial information.
• Pricing.
• Software and technical information.
• Client and supplier information.
• Site and access information.
• Security procedures.
• Staff information.
• Customer Data.
• Account credentials.

A party may disclose confidential information to employees, contractors, insurers and professional advisers who need to know it and are subject to suitable confidentiality obligations.

A party may disclose confidential information where required by law, a court or regulator.

Confidentiality obligations do not apply to information that:

• Is lawfully public.
• Was already lawfully known without restriction.
• Is received lawfully from another source.
• Is independently developed without use of confidential information.

These obligations continue after termination.

35. Intellectual property

NightWarden and its licensors own all intellectual property rights in:

• The Services.
• Software.
• Applications.
• Designs.
• Databases.
• Documentation.
• Branding.
• Templates.
• Workflows.
• Updates.
• Developments.
• Related technology.

The Customer does not acquire ownership of the NightWarden platform.

The Customer retains ownership of its Customer Data, logos and original materials.

The Customer may use reports generated from its Customer Data for its legitimate business and client service activities.

The Customer must not reproduce, sell or distribute NightWarden software, Documentation or templates as a standalone product.

The Customer grants NightWarden permission to use its logos and materials only where reasonably necessary to provide the Services or where separately approved.

36. Feedback and development requests

The Customer may provide suggestions, ideas or feedback.

NightWarden may use feedback to improve, develop and market the Services without payment or other obligation.

Feedback does not include Customer Data or the Customer’s confidential information.

Where the Customer requests bespoke development, ownership and charges will be governed by the relevant Order Form.

Unless expressly agreed otherwise, improvements and developments to the NightWarden platform remain owned by NightWarden even where developed following Customer feedback or requests.

NightWarden is not required to implement a suggestion, development request or proposed completion date unless expressly agreed in writing.

37. Security

NightWarden will maintain reasonable technical and organisational measures intended to protect Customer Data against unauthorised access, accidental loss, unlawful disclosure, alteration and misuse.

No online service can guarantee absolute security.

The Customer remains responsible for:

• Account permissions.
• Passwords and authentication.
• User access.
• Device security.
• Employee conduct.
• Secure handling of exports.
• Protecting access codes and site instructions.
• Promptly reporting incidents.

The Customer must not carry out penetration testing, vulnerability scanning or other security testing without prior written permission.

Suspected vulnerabilities must be reported privately.

The Customer must not publicly disclose a suspected vulnerability before NightWarden has had a reasonable opportunity to investigate and address it, unless disclosure is legally required.

38. Beta, preview and experimental features

NightWarden may make beta, preview, trial or experimental features available.

Such features may:

• Contain errors.
• Change without notice.
• Be withdrawn.
• Have limited support.
• Have reduced security or availability commitments.
• Produce incomplete or inaccurate results.

Beta and preview features must not be used as the sole basis for safety-critical, regulatory, legal or employment decisions.

Unless expressly agreed otherwise, no service level or availability commitment applies to beta or preview features.

39. Warranties and disclaimers

NightWarden will provide the Services with reasonable care and skill.

NightWarden does not guarantee that the Services will:

• Meet every Customer requirement.
• Remain continuously available.
• Be completely error-free.
• Produce a particular commercial result.
• Prevent loss, crime, injury or misconduct.
• Detect every incident.
• Meet every regulatory or contractual requirement.
• Be accepted by every customer, auditor or regulator.

NightWarden does not guarantee that every message, alert, notification or record will be delivered, received, accurate or acted upon.

Use of the Services does not guarantee compliance with SIA, BS7858, employment, health and safety, data protection or other requirements.

The Customer acknowledges that operational software must be supported by appropriate management, supervision, human judgement, insurance, training and backup procedures.

Except where expressly stated, warranties and conditions implied by law are excluded to the fullest extent permitted by law.

40. Customer duty to mitigate and report issues

The Customer must take reasonable steps to prevent and reduce loss arising from any issue affecting the Services.

The Customer must notify NightWarden promptly after becoming aware of:

• A material defect.
• Incorrect processing.
• Suspected data loss.
• A security incident.
• A material service failure.
• An inaccurate integration result.

The Customer must provide reasonable information and cooperation to assist investigation.

NightWarden will not be responsible for additional loss caused by the Customer’s unreasonable delay in reporting an issue or failure to take reasonable mitigating action.

41. Limitation of liability

Nothing in the agreement excludes or limits liability for:

• Death or personal injury caused by negligence.
• Fraud or fraudulent misrepresentation.
• Any liability that cannot legally be excluded or limited.

Subject to this, NightWarden will not be liable for:

• Indirect or consequential loss.
• Loss of profit.
• Loss of revenue.
• Loss of business.
• Loss of contracts.
• Loss of opportunity.
• Loss of anticipated savings.
• Loss of goodwill.
• Reputational damage.
• Wasted management time.
• Wasted expenditure.
• Loss or corruption of data to the extent avoidable through compliance with section 8.
• The cost of recreating data that the Customer was required to back up.
• Regulatory penalties resulting from the Customer’s acts or omissions.
• Claims by the Customer’s clients, personnel or service partners except to the extent directly caused by NightWarden’s breach.

NightWarden will not be liable for loss caused or contributed to by:

• Inaccurate or incomplete Customer Data.
• Incorrect Customer configuration.
• Customer security failures.
• Unsupported or incorrectly configured devices.
• Third-party services.
• Failure to maintain backups.
• Failure to maintain offline contingency arrangements.
• Failure to respond to a notification.
• Operational decisions.
• Unlawful or inappropriate monitoring.
• Failure to maintain emergency procedures.
• Failure to test features.
• Failure to update contact details.
• Customer or Authorised User misuse.
• Fair usage restrictions properly applied under the agreement.

NightWarden will not be responsible for employment claims, operational incidents or client disputes arising from decisions made by the Customer.

NightWarden’s total aggregate liability arising from or connected with the agreement, whether in contract, tort, negligence, misrepresentation, breach of statutory duty, restitution or otherwise, will not exceed 125 per cent of the subscription fees paid or payable by the Customer during the 12 months immediately preceding the event giving rise to the claim.

Where the event occurs during the first 12 months, the cap will be based on fees paid or payable for the initial Subscription Period.

A series of connected events will be treated as one event.

The limitations apply to the fullest extent permitted by law.

The Customer acknowledges that:

• The charges reflect the allocation of risk in the agreement.
• Higher liability limits may be available subject to separate agreement and additional charges.
• The Customer should maintain insurance for risks exceeding NightWarden’s accepted liability.

Nothing in this section limits the Customer’s obligation to pay charges or its liability under the indemnity, intellectual property, confidentiality or acceptable use provisions.

42. Customer indemnity

The Customer will indemnify NightWarden against reasonable losses, liabilities, damages, costs and third-party claims arising from:

• Unlawful Customer Data.
• Unlawful monitoring.
• Infringement of third-party rights.
• Misuse of the Services.
• False or misleading records.
• Operational services delivered by the Customer.
• Injury or property damage caused by the Customer’s personnel.
• The Customer’s breach of data protection law.
• The Customer’s material breach of the agreement.
• A claim by the Customer’s employee, contractor, client or partner arising from the Customer’s use of the Services.

The indemnity will not apply to the extent a claim was directly caused by NightWarden’s breach, negligence or unlawful conduct.

NightWarden must:

• Notify the Customer of a relevant third-party claim within a reasonable period.
• Provide reasonable cooperation at the Customer’s cost.
• Not make an admission or settlement materially prejudicing the Customer without reasonable consultation.

NightWarden may take control of the defence where its reputation, intellectual property, security or regulatory position may be affected.

43. Force majeure

Neither party will be liable for delay or failure caused by events outside its reasonable control.

Such events may include:

• Natural disasters.
• Fire or flood.
• War.
• Terrorism.
• Civil disorder.
• Industrial disputes.
• Government action.
• Power failure.
• Internet failure.
• Telecommunications failure.
• Major cyberattack.
• State-sponsored cyber activity.
• Failure of critical infrastructure.
• Failure of a critical third-party service.
• Epidemic or pandemic.
• Acts or omissions of authorities.

The affected party must take reasonable steps to reduce the effect and resume performance.

The Customer must continue paying for Services that remain available.

If an event materially prevents the affected Services for more than 60 consecutive days, either party may terminate the affected Services by written notice.

Termination under this section does not create a right to compensation, but NightWarden will refund any prepaid base subscription fees relating solely to the period after termination for Services that cannot be provided.

44. Changes to the Services and Terms

NightWarden may update the Services, these Terms and its policies to reflect:

• Changes to functionality.
• Changes in law.
• Security requirements.
• Third-party changes.
• Operational requirements.
• Reasonable commercial requirements.

NightWarden will normally give at least 30 days’ notice of a material change to these Terms.

A shorter notice period may apply where urgently required for legal, security or operational reasons.

If a material change to these Terms substantially disadvantages the Customer, the Customer may cancel the affected subscription before the change takes effect.

Cancellation will take effect when the revised provision would otherwise apply.

Any refund will be limited to prepaid base subscription fees relating to the unused period after cancellation.

Continued use after the effective date constitutes acceptance.

Changes that do not materially disadvantage the Customer may take effect on publication or on the date stated.

45. Notices

NightWarden may send notices to:

• The account administrator.
• The billing email address.
• The registered account.
• The Customer’s last known business address.

The Customer must keep contact details current.

The Customer may send notices using the contact details in section 49 or another method approved by NightWarden.

Email notices will normally be treated as received when sent, provided no delivery failure notification is received.

Notices sent outside normal business hours will be treated as received on the next business day.

This section does not apply to formal service of court proceedings.

46. Assignment and subcontracting

The Customer may not assign, transfer, charge or otherwise deal with the agreement without NightWarden’s written permission.

NightWarden may assign or transfer the agreement:

• As part of a business sale.
• As part of a restructuring.
• To a successor business.
• To an associated business.
• In connection with financing or investment.

NightWarden may use subcontractors and third-party providers.

NightWarden remains responsible for subcontractors to the extent required by law and the agreement.

47. No partnership, agency or employment relationship

Nothing in the agreement creates:

• A partnership.
• Joint venture.
• Agency.
• Employment relationship.
• Fiduciary relationship.
• Franchise.

The Customer has no authority to bind NightWarden or make commitments on its behalf.

NightWarden has no authority or responsibility to direct the Customer’s personnel or operational services.

48. General provisions

The agreement forms the entire agreement relating to the Services and replaces previous statements, discussions and representations relating to its subject matter.

The Customer acknowledges that it has not relied on any statement not expressly included in the agreement.

Nothing excludes liability for fraudulent misrepresentation.

If a provision is invalid or unenforceable, it will be modified to the minimum extent necessary. The remaining provisions will continue.

A failure or delay in enforcing a right does not waive that right.

Rights and remedies are cumulative.

The agreement may be accepted electronically and in counterparts.

Except for applicable application store provisions, a person who is not a party has no right to enforce the agreement under the Contracts (Rights of Third Parties) Act 1999.

Section headings do not affect interpretation.

Words including “including” and “include” are illustrative and do not limit the words preceding them.

Provisions concerning payment, confidentiality, intellectual property, data protection, liability, indemnities and accrued rights survive termination.

49. Legal and contact information

NightWarden is the trading name of C.Connors, a sole trader operating from 66 Paul Street, London, EC2A 4NA, United Kingdom.

Email: info@nightwarden.co.uk

The Customer must use the designated support channels for technical and operational support.

The email address above may be used for contractual notices unless another address is notified.

50. Governing law and jurisdiction

The agreement and any dispute or claim arising from it are governed by the laws of England and Wales.

The courts of England and Wales have exclusive jurisdiction over disputes arising from or connected with the agreement.

1. Application

This Schedule applies where NightWarden processes personal data on behalf of the Customer.

The parties acknowledge that the Customer will normally act as controller and NightWarden will normally act as processor for Customer Data.

The Customer’s documented instructions consist of:

• The agreement.
• The Customer’s configuration and use of the Services.
• Information entered into the Services.
• Instructions submitted through authorised support channels.
• Other written instructions accepted by NightWarden.

NightWarden is not required to follow an instruction that is unlawful, technically unreasonable, outside the Services or inconsistent with the agreement.

2. Processing details

Subject matter

Providing, hosting, maintaining, securing and supporting the NightWarden Services.

Duration

For the Subscription Period and any limited retention period following termination, subject to legal, security and backup retention requirements.

Nature of processing

Processing may include:

• Collection.
• Recording.
• Organisation.
• Structuring.
• Storage.
• Adaptation.
• Retrieval.
• Consultation.
• Transmission.
• Reporting.
• Analysis.
• Synchronisation.
• Backup.
• Restriction.
• Deletion.

Purpose of processing

Processing Customer Data to:

• Provide the Services.
• Maintain accounts.
• Generate reports.
• Deliver notifications.
• Support operational workflows.
• Provide technical support.
• Maintain security.
• Prevent fraud and misuse.
• Perform data exports.
• Comply with documented instructions.

Categories of data subjects

Data subjects may include:

• Customer employees.
• Workers and contractors.
• Job applicants.
• Former workers.
• Customer managers and administrators.
• Customer clients and contacts.
• Subcontractors and service partners.
• Site visitors.
• Members of the public appearing in incident records.
• Witnesses.
• Alleged offenders.
• Vehicle drivers.
• Emergency contacts.
• Portal users.

Types of personal data

Personal data may include:

• Names.
• Contact details.
• Addresses.
• Dates of birth.
• Employment information.
• Work schedules.
• Attendance information.
• Location and GPS information.
• Vehicle information.
• Photographs.
• Signatures.
• Identification information.
• Licence and qualification information.
• Training information.
• Incident information.
• Site access records.
• Communications.
• Device and technical information.
• Reports and notes.

Where the Customer chooses to process it, Customer Data may also contain:

• Health information.
• Criminal offence information.
• Vetting and screening information.
• Equality and diversity information.
• Other special category data.

The Customer is responsible for ensuring that processing such information is lawful, necessary and proportionate.

3. NightWarden processor obligations

NightWarden will:

• Process personal data only on documented instructions, unless required by law.
• Inform the Customer where legally permitted if NightWarden is required to process data by law.
• Notify the Customer if an instruction appears to infringe applicable data protection law.
• Ensure persons authorised to process personal data are subject to confidentiality obligations.
• Maintain appropriate technical and organisational security measures.
• Assist with data subject requests, taking account of the nature of processing.
• Assist with security, breach notification, impact assessments and regulatory consultation where reasonably required.
• Notify the Customer without undue delay after becoming aware of a confirmed personal data breach affecting Customer Data.
• Maintain records required of it by law.
• Delete or return personal data at the end of the Services, subject to legal and backup retention requirements.
• Make reasonable information available to demonstrate compliance.

NightWarden may charge reasonable fees for assistance that is unusually extensive, repetitive, technically complex or caused by the Customer’s breach, except where the assistance is required because of NightWarden’s breach.

4. Customer controller obligations

The Customer will:

• Comply with data protection law.
• Provide lawful documented instructions.
• Establish an appropriate lawful basis.
• Provide required privacy information.
• Respond to data subject requests.
• Determine appropriate retention periods.
• Ensure monitoring is necessary and proportionate.
• Restrict access appropriately.
• Maintain accurate information.
• Complete impact assessments where required.
• Notify NightWarden of unusual processing risks.
• Avoid providing personal data that is not necessary.
• Ensure special category and criminal offence data are processed lawfully.

The Customer warrants that NightWarden’s processing in accordance with the Customer’s instructions will not cause NightWarden to breach applicable law.

5. Security measures

NightWarden will maintain security measures appropriate to the nature and risk of processing.

These measures may include, where appropriate:

• Access controls.
• Authentication controls.
• Role-based permissions.
• Encryption in transit.
• Secure hosting arrangements.
• Logging and monitoring.
• Backup and recovery arrangements.
• Vulnerability and patch management.
• Incident response procedures.
• Confidentiality obligations.
• Supplier and subprocessor controls.
• Secure deletion processes.
• Measures supporting availability and resilience.

The Customer acknowledges that security measures may develop over time and NightWarden may replace a measure with an equivalent or stronger measure.

6. Subprocessors

The Customer gives NightWarden general written authority to appoint subprocessors.

NightWarden will:

• Use appropriate written agreements with subprocessors.
• Require substantially equivalent data protection obligations.
• Remain responsible for subprocessors to the extent required by law.
• Maintain information concerning material subprocessors through an online list, policy or customer communication.

NightWarden will provide reasonable advance notice of a new material subprocessor where the change is likely to create a materially different data protection risk.

The Customer may object on reasonable data protection grounds within 14 days.

The parties will attempt to resolve the objection.

Where a reasonable objection cannot be resolved, NightWarden may offer an alternative arrangement or either party may terminate the affected Services.

7. International transfers

Personal data may be processed in the United Kingdom, European Economic Area, United States or another location used by NightWarden or a subprocessor.

Where a restricted international transfer occurs, NightWarden will use a lawful transfer mechanism where required, which may include:

• UK adequacy regulations.
• The UK International Data Transfer Agreement.
• The UK Addendum to the European Commission Standard Contractual Clauses.
• Another legally approved safeguard.

The Customer authorises transfers necessary to provide the Services subject to these safeguards.

8. Personal data breaches

NightWarden will notify the Customer without undue delay after becoming aware of a confirmed personal data breach affecting Customer Data.

Where reasonably available, the notification will include:

• The nature of the breach.
• Categories of affected information.
• Categories of affected individuals.
• Likely consequences.
• Measures taken or proposed.
• Available contact information.

NightWarden may provide information in stages where it is not immediately available.

Notification does not constitute an admission of fault or liability.

The Customer remains responsible for deciding whether notifications must be made to individuals, regulators, clients or other parties.

9. Data subject requests

Where NightWarden receives a request from an individual relating to Customer Data, NightWarden will normally direct the individual to the Customer unless prohibited by law.

NightWarden will provide reasonable assistance where required, taking account of the nature of processing and available functionality.

The Customer is responsible for verifying identity, determining the response and meeting applicable deadlines.

10. Audits and compliance information

NightWarden will make reasonable compliance information available, which may include:

• Security information.
• Policies.
• Questionnaires.
• Independent reports.
• Certifications where held.
• Subprocessor information.

The Customer must use existing information before requesting a separate audit.

Any audit must:

• Be limited to once in any 12-month period unless required by law or following a material incident.
• Be conducted on reasonable notice.
• Take place during normal business hours.
• Avoid disruption.
• Protect other customers’ information.
• Be conducted by an independent auditor subject to confidentiality.
• Be paid for by the Customer unless a material NightWarden breach is identified.

NightWarden may refuse access to information that would compromise security, another customer’s confidentiality, legal privilege or a third party’s rights.

11. Return and deletion

At the end of the Services, the Customer may use available export functions or request an available export within the period stated in section 32.

After that period, NightWarden may delete Customer Data from active systems.

Data in protected backups may remain until securely overwritten or deleted through the normal backup cycle.

NightWarden may retain information where required by law, security requirements or the handling of legal claims.

The Customer is responsible for retaining its own required records and completing exports before deletion.

12. Liability

Liability arising under this Schedule is subject to section 41 of the Terms, except where liability cannot legally be limited.

Nothing in this Schedule limits either party’s direct statutory obligations under applicable data protection law.