Terms of service.

Parties and definitions

These terms (the "Terms") are entered into between CIaaS Limited, a company registered in England and Wales (company number 14519311) with its registered office at C/O Aardvark Accounting, 1 Cedar Office Park, Cobham Road, Wimborne, BH21 7SB, trading as ComplyChat (the "Provider", "we", "us") and the organisation identified on the order form or signing the subscription (the "Customer", "you").

Capitalised terms used in these Terms have the following meanings:

• Service – the ComplyChat platform and the related onboarding, capture, and Article 17 erasure tooling made available under your subscription, operating against the message archive held in your own Microsoft 365 tenant (where retention, legal hold, and access and export via Microsoft Purview eDiscovery are applied inside your own tenant).
• Governed Channel – any channel we capture into your own Microsoft 365 tenant under your subscription, namely our own secure web space (including the SMS-verified web room reachable by a published number) or a Microsoft Teams channel. The channels available to you depend on the tier you have chosen and on how far we have rolled out each channel.
• Customer Data – any data submitted to or processed through the Service on your behalf, including the contents and metadata of Governed Channels.
• Order Form – the document or online sign-up record that identifies the tier, term and pricing of your subscription.
• DPA – the Data Processing Agreement we make available to Customers, which forms part of these Terms.

Acceptance and ordering

You accept these Terms when you sign an Order Form or otherwise confirm acceptance. The person who accepts on behalf of the Customer warrants that they have authority to bind the Customer. Each Order Form, together with these Terms and the DPA, forms the entire agreement for the subscription it describes.

If there is a conflict between an Order Form, these Terms and the DPA, the order of precedence is: (1) the Order Form for commercial matters (tier, term, price, named contacts); (2) the DPA for matters relating to personal data; (3) these Terms for everything else.

The Service

The Service keeps a record of your work conversations in your own Microsoft 365. It captures Governed Channels from more than one place – our own secure web space and Microsoft Teams – into your own Microsoft 365 tenant, with retention and legal hold, and Article 17 erasure tooling; access and export requests are served via Microsoft Purview eDiscovery inside your own tenant. Exactly what you get (the channels available to you, the number of Governed Channels, any client-named published numbers, and so on) is set out in your Order Form and reflects the tier you have chosen and how far we have rolled out each channel.

Our own secure web space is the cleanest channel, in which the record is made in our system and lands in your own Microsoft 365 with no other messaging platform in the middle and no separate number per group; it also includes an SMS-verified web room that anyone can reach with a plain text, so families and the public need no separate app. Microsoft Teams (one-to-one and whole-group) is also available; Telegram is on the roadmap; and your Order Form records which channels are available to you at the time you order.

We will provide the Service with reasonable skill and care and in accordance with the description on chat.org.uk as it stood on the date of your Order Form. We may improve and develop the Service, including by adding channels and relying less on any single underlying platform, so that the governed record does not depend on the fortunes of one messaging platform. We will not make changes during your subscription term that materially reduce the features or security you relied on at the time of ordering.

Your responsibilities as Customer

You are the controller of the personal data flowing through your Governed Channels. The decisions that go with that role – who joins, what is discussed, what is captured, what is kept and for how long, what notices are given to participants, what lawful basis is relied on – are yours. We provide tools, templates and guidance, but we do not, and could not, make those decisions for you.

In particular, you will:

• Identify and document a lawful basis under Article 6 UK GDPR and, where applicable, an Article 9 condition, for each category of processing carried out via the Service.
• Provide a privacy notice to every participant of a Governed Channel, on or before they join, in line with Articles 13 and 14 UK GDPR. Our template wording is a starting point; you are responsible for ensuring it reflects your specific processing.
• Maintain an Article 30 record of processing activities for the use of the Service, and update it when material changes occur.
• Manage the membership of your Governed Channels (including removing leavers promptly) using the administrative tools we provide.
• Configure retention rules appropriate to your sector, regulator and policies.
• Respond, as controller, to data subjects' requests, using our Article 17 erasure tooling to assist; access and export requests are served via Microsoft Purview eDiscovery inside your own tenant.
• Notify us promptly of any actual or suspected security incident or personal data breach affecting Customer Data, and of any complaint or regulatory enquiry that touches the Service.

Personal-device obligations.

The Service governs Governed Channels created on our own secure web space (including the SMS-verified web room) and Microsoft Teams. Governed Channels cannot reach conversations that your staff, volunteers or other personnel may hold on their own personal messaging accounts, such as WhatsApp. This is a built-in limit of any lawful Governed Channel and is true regardless of platform. Using Governed Channels in place of personal messaging removes this limit for the conversations they carry.

Acceptable use

You will not, and will not permit any user of the Service to:

• Use the Service to engage in unlawful activity, including processing of personal data in breach of UK GDPR or the Data Protection Act 2018;
• Add a person to a Governed Channel without first providing the notice required by Articles 13/14 UK GDPR (and obtaining consent where consent is the lawful basis);
• Attempt to intercept, decrypt or otherwise access content from any conversation that is not a Governed Channel under your subscription;
• Misrepresent the Service or this organisation to participants of a Governed Channel;
• Reverse engineer, decompile or otherwise attempt to derive the source code of the Service, except to the extent that such restriction is prohibited by applicable law;
• Use the Service for bulk marketing communications or anything that would breach the Privacy and Electronic Communications Regulations 2003.

Third-party platform terms

ComplyChat does not use WhatsApp, the WhatsApp Business API, or any other Meta platform to provide the Service. No part of the Service is subject to WhatsApp's Business Solution Terms, Business Messaging Policy or any other terms Meta publishes, and no Meta account, number or portfolio is set up or operated on your behalf. You own the Customer Data and the record held in your own Microsoft 365 tenant, whichever Governed Channel it came from.

Where the SMS-verified web room relies on a third-party SMS or telephony network to deliver a verification code or reach a published number, that network's own terms may apply to the delivery of that message; they do not apply to the Service as a whole, and our own secure web space and Teams are designed so that the lasting record does not depend on any one third-party network's terms staying stable.

Fees, billing and founding-partner terms

Subscription fees are as set out on your Order Form and reflect the tier you have chosen. Fees are payable yearly in advance unless the Order Form provides otherwise. The fees on chat.org.uk are the fees you pay; we do not charge hidden platform fees, fees per message or fees per person. The only per-message amount we ever pass on is the carrier's own SMS charge, at cost and notified to you in advance, where a channel's conversational SMS exceeds fair use. Adding volunteers, families and residents to a Governed Channel does not increase your fee.

Fees are exclusive of VAT, which will be added at the prevailing rate where applicable. Late payment of an undisputed invoice may attract statutory interest under the Late Payment of Commercial Debts (Interest) Act 1998.

If you joined under our founding-partner programme, you receive: 50% off the published list price for two years from the date of your first Order Form; thereafter, the list price published at the date of your first Order Form, locked for the life of your subscription; and onboarding and migration included at no extra charge – in exchange for participating as a named reference and contributing to a published case study once you are satisfied the Service has earned them.

The Answerable Guarantee. If a Subject Access Request touches your Governed Channels and you cannot produce the governed record across your channels within one working day via Microsoft Purview eDiscovery in your own tenant, our team will work it with you at no additional charge. If, despite that, the material still cannot be produced, we will refund the subscription fees paid for the then-current annual period. The refund does not apply where the failure results from your own deliberate deletion of the governed record, or from changes made in your own Microsoft 365 tenant that depart from the supported configuration we documented with you at onboarding – and it is never excluded on account of configuration we set up or advised ourselves. This is your exclusive remedy in respect of the guarantee; it applies notwithstanding the disclaimers in the warranties clause and counts toward, rather than adds to, the limitation of liability.

The no-hostage clause. Leaving is dealt with in the termination clause below: no exit fees, export in open formats within fourteen days of request, and written confirmation of deletion. We do not believe a renewal we have to enforce is worth having.

Intellectual property

As between us, we own all intellectual property rights in the Service, including the software, branding, documentation and templates. You receive a non-exclusive, non-transferable, revocable licence to use the Service for the term of your subscription and for your internal organisational purposes.

You own Customer Data. We claim no licence in it beyond what is necessary to provide the Service to you, comply with the law, and produce aggregated, fully anonymised statistics that cannot be used to identify you or any individual.

If you give us feedback about the Service, you grant us a non-exclusive, perpetual, royalty-free licence to use that feedback to improve the Service. We will not identify you as the source of feedback without your consent.

Confidentiality

Each party will keep the other's confidential information confidential, use it only to perform under these Terms, and protect it with at least the standard of care it applies to its own confidential information (and never less than a reasonable standard). This obligation continues for three years after termination, except in respect of trade secrets and personal data, which remain protected indefinitely.

Data protection

Each party will comply with its respective obligations under the UK GDPR, the Data Protection Act 2018 and other applicable data protection laws. The DPA governs the processing of personal data we carry out on your behalf and, by accepting these Terms, you also accept the DPA.

If you have not received a copy of the DPA, request one at compliance@chat.org.uk. Our privacy practices as a controller (for example, in respect of your account administrators and prospect data) are described in our Privacy notice.

Security and data custody

We will operate the Service in accordance with the security commitments described in the security section of chat.org.uk and the DPA, including UK-region data residency, encryption in transit and at rest, role-based access, audit logging and our incident response programme.

The message archive at rest resides in your own Microsoft 365 tenant and is protected by your tenant's encryption, retention, legal hold and eDiscovery controls (including, where you run it, Microsoft 365 Customer Key). Our capture and relay processing is transient, runs in UK-region Microsoft Azure, is encrypted in transit and at rest for the duration of that processing, and retains no copy of your archive. You are responsible for the configuration of your own tenant, including not deleting or de-licensing the archive (a restricted SharePoint document library) the Service delivers into; we will advise on a supported configuration during onboarding.

Availability and support

We target 99.9% monthly availability for the Service, measured at the platform's public endpoints, excluding (a) planned maintenance announced at least 48 hours in advance, (b) emergency maintenance, (c) outages of Microsoft Azure or your own Microsoft 365 tenant (which holds your record) that we cannot reasonably mitigate, (d) outages of third-party SMS or telephony networks affecting the SMS doorbell, which we cannot reasonably mitigate and which do not affect our own secure web space or Teams, and (e) force majeure events.

Support response times are tier-dependent and stated on chat.org.uk and in your Order Form. Where you have purchased Enterprise support, the service level agreement (with credits) attached to your Order Form prevails over the general targets in this clause.

Suspension

We may suspend your access to the Service, in whole or in part, where we reasonably believe that (a) your use breaches the acceptable use clause and you have not cured the breach within a reasonable time of being asked to, (b) your use poses a security risk to the Service or to other Customers, (c) you have failed to pay an undisputed invoice within 30 days of its due date, or (d) we are required to do so by law. We will give you notice in advance where it is practicable and proportionate to do so. Suspension does not relieve you of the obligation to pay fees that have accrued.

Termination and return of data

Either party may terminate these Terms (and the affected Order Form): (a) for material breach, if the breach is not cured within 30 days of written notice; (b) if the other party becomes insolvent or enters an analogous process; or (c) where these Terms expressly so provide. You may also terminate for convenience at any time on 30 days' written notice; fees prepaid for the unexpired part of the term are not refunded except where these Terms expressly provide otherwise (the Answerable Guarantee being one such provision). If a subscription reaches the end of its term without notice having been given either way, it continues month to month at the same rate until either party gives 30 days' notice – it does not renew for a further full term.

There are no fees to exit, end, export or leave. Your message record already sits in your own Microsoft 365 tenant and is unaffected by termination; there is nothing you need to get back from us to keep it. Where we operated a published number for you, on termination we will, where your phone provider allows, help you port it to your own account, or otherwise release and close it. On termination – and at any point during your subscription, on request – we will provide a full export of any Customer Data we do hold (account records, configuration, routing metadata and any in-flight transient data) in open, machine-readable formats within fourteen days of your written request, and we will keep that export available for at least 60 days after termination. Once you confirm your export is complete, we will delete that data from our active systems within 30 days and provide written confirmation of the deletion. Residual copies in encrypted backups are overwritten within the standard backup-retention cycle (typically not exceeding 90 further days) and remain protected by the same controls as live data until they are; the written confirmation will say so explicitly. These obligations do not apply to data we are required to retain by law.

Warranties and disclaimers

We warrant that the Service will be provided with reasonable skill and care, materially in accordance with its description, and that it will not knowingly infringe the intellectual property rights of any third party.

To the maximum extent permitted by law, and except as expressly set out in these Terms, the Service is provided "as is", and we exclude all other warranties, conditions and representations, whether express or implied (including any implied warranty of satisfactory quality, fitness for purpose or non-infringement).

Nothing in these Terms excludes or limits liability for fraud, fraudulent misrepresentation, death or personal injury caused by negligence, or any other liability that cannot be excluded under English law.

Limitation of liability

Subject to the immediately preceding paragraph, each party's total aggregate liability arising out of or in connection with these Terms, whether in contract, tort (including negligence), under statute or otherwise, is limited per twelve-month period to 125% of the fees paid or payable by you in the twelve months preceding the event giving rise to liability.

Neither party is liable for any indirect or consequential loss, loss of profit, loss of revenue, loss of business, loss of anticipated savings, or loss of or corruption of data (except to the extent that loss or corruption of Customer Data results from our breach of these Terms).

The cap above does not apply to a party's liability for: (a) payment of fees lawfully due; (b) breach of the confidentiality obligations; or (c) breach of the data protection obligations and the DPA, in respect of which a higher, separately negotiated cap may be set out on the Order Form.

Indemnity

We will indemnify you against third-party claims that your authorised use of the Service infringes that third party's UK intellectual property rights, provided you (a) notify us promptly, (b) let us conduct the defence, and (c) cooperate reasonably. If the Service is held to infringe, we may, at our option, procure a right to continue using it, modify it to avoid infringement, replace it with non-infringing functionality, or refund the fees paid for the affected period and terminate the affected Order Form.

You will indemnify us against third-party claims arising from (a) your breach of the acceptable use clause, (b) Customer Data in breach of law or third-party rights, or (c) your failure to provide notices to participants as required by data protection law.

Force majeure

Neither party is liable for failure or delay caused by events beyond its reasonable control, including acts of God, war, terrorism, cyber-attack on third-party infrastructure, failure of public communications networks or utilities, or pandemic. The affected party will notify the other promptly and use reasonable endeavours to mitigate. If the event continues for more than 60 days, either party may terminate the affected Order Form by notice.

Changes to these Terms

We may update these Terms from time to time. We will not make a change that is materially adverse to you during a subscription term without giving you at least 30 days' notice and a right to terminate the affected Order Form without penalty. Other changes take effect on renewal. The current version is always available at this URL; archived versions can be requested.

Notices

Notices to us must be sent to enquiries@chat.org.uk (with a copy to compliance@chat.org.uk for data protection or compliance matters) and, for matters with legal effect, also to our registered office. Notices to you will be sent to the administrator email address on the Order Form.

General

Assignment. Neither party may assign these Terms without the other's prior written consent, except that either party may assign to a successor in connection with a merger, acquisition, corporate reorganisation or sale of substantially all of its business.

Subcontracting. We may engage sub-processors as described in the DPA and listed at /sub-processors.html.

Entire agreement. The Order Form, these Terms and the DPA together constitute the entire agreement and supersede all prior agreements and representations on the same subject matter.

Severance. If any provision is held invalid or unenforceable, it is severed and the remainder remains in force.

Third parties. A person who is not a party to these Terms has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce them.

No waiver. Failure to enforce any provision is not a waiver of the right to enforce it later.

Governing law and jurisdiction

These Terms and any non-contractual obligations arising in connection with them are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction to settle any dispute (including non-contractual disputes) arising out of or in connection with these Terms.