Goldline Consultancy Ltd, General Terms of Business

1.1 In these General Terms:

"Agreement" means the Engagement Letter, these General Terms, each Statement of Work and any Schedule, taken together.

"Background IP" means all Intellectual Property Rights owned or licensed by a party before the Effective Date, or created outside the performance of the Services, including in the Consultant's case its methodologies, frameworks, templates, assessment tools, question sets, checklists, control mappings, models, software and know-how.

"Deliverable" means an item identified as a deliverable in a Statement of Work.

"Effective Date" means the date of the Engagement Letter.

"Engagement Letter" means the letter from the Consultant to the Client describing the engagement and incorporating these General Terms.

"Fees" means the amounts payable for the Services as set out in the Engagement Letter or the relevant Statement of Work.

"Foreground IP" means Intellectual Property Rights created by the Consultant in the course of performing the Services and embodied in a Deliverable, excluding Background IP.

"Intellectual Property Rights" means patents, rights to inventions, copyright and neighbouring and related rights, trade marks, business names, goodwill, rights in designs, database rights, rights to use and protect confidential information including know-how, and all other intellectual property rights, in each case whether registered or unregistered and including all applications and rights to apply for and be granted them, and all equivalent rights subsisting anywhere.

"Services" means the services described in the Engagement Letter and in each Statement of Work.

"Statement of Work" or "SOW" means a document agreed and signed by both parties describing a specific assignment and expressed to be a Statement of Work under this Agreement.

1.2 A reference to writing includes email. A reference to a statute includes it as amended. Clause headings do not affect interpretation. "Including" is not limiting.

2.1 This Agreement is the entire agreement between the parties in relation to the Services.

2.2 If there is a conflict, the following order of precedence applies:

(a) these General Terms, in relation only to clauses 10 (Intellectual property), 11 (Restrictions on use and reliance), 12 (Confidentiality), 13 (Data protection), 15 (Impartiality and conflicts), 17 (Liability) and 18 (Insurance);

(b) the Statement of Work;

(c) the Engagement Letter;

(d) the remainder of these General Terms;

(e) any Schedule.

2.3 A Statement of Work may vary a clause listed in clause 2.2(a) only if it identifies that clause by number, states expressly that it varies it, and is signed by an authorised signatory of each party. A general statement that the Statement of Work prevails is not sufficient for this purpose.

2.4 No terms or conditions submitted by the Client, including any printed on or referred to in a purchase order, form part of this Agreement.

3.1 The Consultant shall perform the Services with the reasonable skill and care to be expected of a competent professional consultant experienced in providing services of a similar scope and complexity.

3.2 The Consultant does not warrant, and the Client does not rely on any representation, that any particular outcome will be achieved. Without limiting that:

(a) the decision to grant, refuse, suspend or withdraw any certification, accreditation or approval rests with the relevant certification body, accreditation body, regulator or customer, and the Consultant does not control and cannot warrant that decision;

(b) the Consultant does not warrant that the Client will pass any audit, assessment, assurance questionnaire or supplier review, or that any third party will accept any Deliverable;

(c) where the Consultant's website, proposal or marketing material describes a typical duration or a typical outcome, it describes what comparable engagements have typically achieved, and is an objective and not a term of this Agreement; and

(d) the Consultant's obligation is to perform the Services and produce the Deliverables described in the relevant Statement of Work.

3.3 Any timetable is an estimate based on the assumptions recorded in the Statement of Work and on the Client performing its obligations under clause 6. Time is not of the essence.

3.4 The Consultant is not a certification body, does not perform certification, and does not carry out accredited conformity assessment.

4.1 The Consultant shall submit each Deliverable in the format and by the date stated in the Statement of Work.

4.2 The Client has ten business days from submission to review a Deliverable against the acceptance criteria stated in the Statement of Work and either accept it or reject it by written notice specifying, with reasonable particularity, each respect in which it does not meet those criteria.

4.3 A Deliverable is deemed accepted if the Client does not give notice of rejection within that period, or if the Client uses the Deliverable for its intended purpose. Deemed acceptance does not apply where the Client was unable to carry out its review because of a failure by the Consultant.

4.4 Where a Deliverable is validly rejected, the Consultant shall correct and resubmit it within a reasonable period, and clauses 4.2 and 4.3 apply again. The Consultant is required to carry out one correction cycle at no additional charge. Any further cycle is a change under clause 5.

4.5 Acceptance confirms conformity with the acceptance criteria. It does not extend the Consultant's obligations beyond clause 3.1.

5.1 Neither party is obliged to perform any change to the Services, the Deliverables, the timetable, the assumptions, the acceptance criteria or the Fees until that change has been recorded in a written change request signed by an authorised representative of each party.

5.2 A change request shall state the change, the reason for it, its effect on scope, Deliverables, timetable, assumptions, resources, risk and Fees, and its effective date.

5.3 The Consultant may issue a change request where a delay by the Client, a change in the Client's instructions, or an assumption recorded in the Statement of Work proving inaccurate, has increased the work required or delayed performance.

5.4 Any activity, deliverable, dependency or responsibility not expressly stated in the Statement of Work is excluded from the Services.

6.1 The Client shall:

(a) provide the information, documents, evidence, systems access and personnel identified in the Statement of Work, by the dates stated, in the formats stated;

(b) ensure that all information it provides is complete and accurate in all material respects;

(c) nominate a single point of contact with authority to give instructions, provide approvals and resolve queries, and respond to reasonable requests within five business days unless a different period is stated;

(d) obtain and maintain all consents, licences and permissions required for the Consultant to perform the Services, including any third party consents required for access to systems or data; and

(e) make all management decisions and perform all management functions relating to the Services.

6.2 The Consultant is entitled to rely on the information provided by the Client without independent verification, unless the Statement of Work expressly provides for verification. The Consultant is not liable for any Deliverable to the extent that it is affected by incomplete or inaccurate information provided by the Client.

6.3 If the Client does not perform an obligation under clause 6.1, the Consultant may suspend performance, extend the timetable day for day, and issue a change request under clause 5.3.

7.1 The Consultant determines how the Services are performed, who performs them and the methods used, subject to the Statement of Work.

7.2 The Consultant may at any time substitute or add any suitably qualified person to perform the Services, subject where the Statement of Work names key personnel to the Client's approval, which shall not be unreasonably withheld or delayed.

7.3 The Consultant is an independent contractor. Nothing in this Agreement creates a relationship of employment, partnership, agency or joint venture. The Consultant is responsible for all taxes and national insurance contributions relating to its own personnel.

7.4 The Consultant is not obliged to be available at any particular time or place, or for any minimum number of days, except as expressly stated in a Statement of Work.

8.1 The Client shall pay the Fees stated in the Engagement Letter or Statement of Work, in accordance with the payment schedule stated there.

8.2 Unless stated otherwise, fifty per cent of the Fees is payable on the Effective Date and the balance on submission of the final Deliverable.

8.3 Certification body audit fees and any GRC platform subscription are payable by the Client directly to the relevant provider, unless the Engagement Letter states otherwise. Where the Consultant incurs a third party cost on the Client's behalf, it is passed through at cost with no mark-up. Other expenses are pre-approved and reimbursed at cost on production of receipts.

8.4 All amounts are exclusive of VAT, which is payable in addition at the applicable rate.

8.5 Invoices are payable within 14 days of the invoice date. Payment shall be made in full and cleared funds without set-off, counterclaim, deduction or withholding, except any deduction or withholding required by law.

8.6 If the Client disputes an invoice in good faith it shall notify the Consultant in writing within seven days of receipt, specifying the amount disputed and the grounds. The Client shall pay all undisputed amounts by the due date.

8.7 The Consultant reserves its rights under the Late Payment of Commercial Debts (Interest) Act 1998 to statutory interest at the Bank of England base rate plus eight per cent, to the fixed sum compensation provided by section 5A of that Act, and to reasonable recovery costs.

8.8 If any undisputed amount remains unpaid fourteen days after its due date, the Consultant may on written notice suspend the Services until payment is received. The timetable extends by the period of suspension and the Consultant is not liable for any consequence of that suspension.

9.1 This Agreement takes effect on the Effective Date and continues until the Services are completed or it is terminated under this clause 9.

9.2 Either party may terminate this Agreement or any Statement of Work for convenience on thirty days' written notice.

9.3 Either party may terminate this Agreement immediately by written notice if the other:

(a) commits a material breach which is not remediable, or which is remediable and is not remedied within twenty business days of written notice requiring it to be remedied;

(b) suspends or threatens to suspend payment of its debts, is unable to pay its debts as they fall due, enters or proposes any composition or arrangement with its creditors, has a receiver, administrator or administrative receiver appointed, or has a petition presented or resolution passed for its winding up; or

(c) undergoes a change of control to a person who is a competitor of the terminating party.

9.4 The Consultant may terminate this Agreement immediately by written notice if continuing to perform the Services would breach clause 15, or if any undisputed amount remains unpaid thirty days after its due date.

9.5 On termination for any reason the Client shall pay: the Fees for all Services performed to the date of termination, all expenses incurred and all third party costs committed before termination that cannot reasonably be cancelled, and any milestone payment that has fallen due.

9.6 The Consultant shall on request provide reasonable transition assistance for up to twenty working days after termination, at its standard rates then in force.

9.7 Clauses 8, 9.5, 9.7, 10, 11, 12, 13, 17, 18, 19, 20, 24, 25 and 26 survive termination, together with any other clause that by its nature is intended to survive.

10.1 All Background IP remains the absolute property of the party that owns it. Nothing in this Agreement transfers any Background IP.

10.2 The Consultant retains ownership of all Foreground IP.

10.3 On payment in full of all Fees due, the Consultant grants the Client a perpetual, non-exclusive, non-transferable, royalty-free licence to use, copy and adapt the Deliverables for the Client's own internal business purposes and for the purpose stated in the Engagement Letter. The licence does not permit resale, sublicensing, distribution outside the Client's group, or use as the basis of a service provided to a third party.

10.4 The Client grants the Consultant a non-exclusive licence to use the Client's materials to the extent necessary to perform the Services.

10.5 Nothing in this Agreement restricts the Consultant from using the general knowledge, skills, techniques, know-how and experience acquired in the course of performing the Services, in providing services to any other person, provided that it does not disclose the Client's Confidential Information.

10.6 Where an assignment of Foreground IP is agreed in a Statement of Work, that assignment takes effect only on payment in full of all Fees due, is limited to the Foreground IP embodied in the named Deliverables, does not extend to any Background IP, and is subject to a perpetual, irrevocable, royalty-free licence back to the Consultant to use that Foreground IP for any purpose other than provision of the same Deliverable to a competitor of the Client.

11.1 Each Deliverable is prepared solely for the Client and solely for the purpose stated in the Engagement Letter. It may not be used for any other purpose.

11.2 The Client shall not disclose any Deliverable, or any part of it or extract from it, to any other person without the Consultant's prior written consent, except that the Client may disclose a Deliverable in full, on a non-reliance basis, to its professional advisers, its insurers, its auditors and any regulator entitled to require it, provided the Client informs the recipient that the Deliverable is provided for information only, that the recipient may not rely on it, and that the Consultant accepts no responsibility to the recipient.

11.3 The Consultant owes no duty of care and accepts no responsibility or liability to any person other than the Client in respect of any Deliverable or of the Services, whatever the purpose for which such person may use or seek to rely on it.

11.4 No person other than the Client may rely on any Deliverable unless the Consultant has signed a reliance letter in favour of that person. The Consultant may charge a fee for a reliance letter and may decline to provide one.

11.5 A draft Deliverable, and any oral or interim advice, is provided for discussion only, may not be relied on, and is superseded by the final Deliverable.

11.6 The Client shall indemnify the Consultant against any claim brought by a third party arising from a disclosure by the Client in breach of this clause 11.

12.1 Each party shall keep confidential all information disclosed to it by the other that is marked as confidential or that a reasonable person would regard as confidential, and shall use it only for the purposes of this Agreement.

12.2 Clause 12.1 does not apply to information that is or becomes public other than through breach of this Agreement, that the receiving party already lawfully held free of any obligation of confidence, that is lawfully received from a third party free of any obligation of confidence, or that is independently developed without use of the disclosing party's information.

12.3 A party may disclose confidential information to the extent required by law, by a court of competent jurisdiction, or by a regulatory or governmental body, giving the other party as much notice as is lawful and practicable.

12.4 Each party may disclose confidential information to those of its personnel, professional advisers and subcontractors who need to know it for the purposes of this Agreement, and shall ensure they are bound by obligations of confidence at least as protective as this clause 12.

12.5 These obligations continue for five years after termination, and indefinitely in respect of information relating to the security posture, vulnerabilities, controls or incidents of either party.

13.1 In this clause, "Data Protection Legislation" means the UK GDPR, the Data Protection Act 2018 and all other applicable law relating to the processing of personal data, and "controller", "processor", "personal data", "processing" and "data subject" have the meanings given in that legislation.

13.2 Each party shall comply with the Data Protection Legislation. This clause 13 does not relieve either party of any obligation under it.

13.3 The parties acknowledge that in performing the Services the Consultant acts as an independent controller in respect of its own business records, its engagement and client acceptance records, its working papers and its professional and regulatory obligations.

13.4 Where the Consultant processes personal data on behalf of and on the documented instructions of the Client, the Consultant acts as a processor and a Data Processing Schedule applies and is incorporated into this Agreement. That schedule is provided with the Engagement Letter where it applies.

13.5 The Client shall ensure that it has a lawful basis for disclosing any personal data to the Consultant and that it has provided all required information to the relevant data subjects.

13.6 The Client shall not provide the Consultant with personal data that is not necessary for the Services, and shall minimise or pseudonymise evidence provided to the Consultant wherever it is practicable to do so.

14.1 The Consultant may use artificial intelligence tools in performing the Services. Where such tools are used to produce material analytical content, that content is reviewed by a suitably qualified person before it is included in a Deliverable.

14.2 The Consultant remains responsible for performing the Services in accordance with clause 3.1 regardless of the tools used. The Consultant gives no warranty as to the accuracy of any output of an artificial intelligence tool, and no Deliverable is provided on the basis of unreviewed output.

14.3 The Consultant shall not enter the Client's confidential information or personal data into any consumer or publicly available artificial intelligence service, shall use only tools configured so that inputs and outputs are not used to train, fine-tune or improve any model, and shall delete prompts, inputs and outputs relating to the Client on termination, subject to clause 13.3 and to any legal retention requirement.

14.4 The parties acknowledge that copyright may not subsist in material generated by an artificial intelligence tool. The Consultant grants such rights in the Deliverables as it is validly able to grant under clause 10 and gives no warranty that copyright subsists in any particular part of a Deliverable.

15.1 The Consultant is not a certification body and does not perform certification or accredited conformity assessment.

15.2 The Consultant shall not provide internal audit services in respect of a management system that the Consultant has designed or implemented for the Client, and shall not provide both implementation and independent audit services in respect of the same scope.

15.3 Where a conflict of interest or a threat to impartiality arises or is identified, the Consultant shall disclose it to the Client in writing and shall either decline the relevant work or propose an independent alternative.

15.4 Where the Consultant holds a commercial relationship with a technology or platform provider that it recommends to the Client, the Consultant shall disclose the nature of that relationship in writing before the Client commits to that provider.

15.5 The Consultant provides services to other clients, including clients that may compete with the Client. Nothing in this Agreement restricts the Consultant from doing so, subject to clause 12.

16.1 Each party warrants that it has the authority to enter into this Agreement and that the person signing on its behalf is duly authorised.

16.2 The Consultant warrants that it will perform the Services in accordance with clause 3.1 and that the Deliverables will conform in all material respects to the acceptance criteria in the Statement of Work at the time of acceptance.

16.3 Except as expressly stated in this Agreement, all warranties, conditions and terms implied by statute or common law are excluded to the fullest extent permitted by law.

17.1 Nothing in this Agreement limits or excludes either party's liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be limited or excluded.

17.2 Subject to clause 17.1, neither party is liable to the other, whether in contract, tort including negligence, breach of statutory duty or otherwise, for any loss of profit, revenue, turnover, production, anticipated savings, business opportunity, contract, goodwill or reputation, or for any wasted management time, in each case whether direct or indirect, or for any indirect or consequential loss.

17.3 Subject to clauses 17.1 and 17.2, the Consultant's total aggregate liability arising out of or in connection with this Agreement, whether in contract, tort including negligence, breach of statutory duty, misrepresentation, restitution or otherwise, and whether arising before or after termination, is capped at the Fees paid by the Client under this Agreement, with an absolute ceiling of £100,000.

17.4 The limit in clause 17.3 is an aggregate limit for all claims however many. Where more than one claim arises from the same act, omission, event or series of connected events, those claims count as a single claim. The limit applies to any indemnity given by the Consultant under this Agreement.

17.5 The Client shall not bring any claim under or in connection with this Agreement more than two years after the date on which it first became aware, or ought reasonably to have become aware, of the circumstances giving rise to it.

17.6 The Client shall bring any claim arising out of or in connection with the Services only against the Consultant, and not against any individual director, employee, subcontractor or agent of the Consultant, each of whom may enforce this clause 17.6 under the Contracts (Rights of Third Parties) Act 1999.

17.7 The Consultant is not liable to the extent that a loss is caused or contributed to by the Client's breach of this Agreement, by information provided by the Client that is incomplete or inaccurate, or by a decision or act of a certification body, regulator, customer or other third party.

17.8 The parties acknowledge that the allocation of risk in this clause 17 has been negotiated, is reflected in the level of the Fees, is proportionate to the nature and value of the Services and to the insurance maintained under clause 18, and is a fair and reasonable allocation of risk between them.

18.1 The Consultant maintains professional indemnity insurance with a limit of indemnity of £1,000,000 in the aggregate, inclusive of costs and expenses.

18.2 The Consultant shall maintain that insurance for the term of this Agreement and shall on reasonable request provide evidence of it.

18.3 The existence of insurance does not increase or otherwise affect the limit in clause 17.3, and the Client's remedies are not limited to or dependent on any recovery under any policy.

19.1 Neither party shall, during the term and for twelve months after termination, directly or indirectly solicit for employment or engagement, or employ or engage, any individual who has been materially involved in the performance or receipt of the Services on behalf of the other party, without that party's prior written consent.

19.2 Clause 19.1 does not apply to a person who responds to a public recruitment advertisement not specifically targeted at that person.

19.3 If a party breaches clause 19.1 it shall pay the other a sum equal to thirty per cent of the annual remuneration or fees payable to the individual concerned in the first twelve months of the new engagement, which the parties agree is a genuine pre-estimate of the loss suffered.

20.1 The Client grants the Consultant a non-exclusive, royalty-free licence to use the Client's name and logo, and to describe the general nature of the Services, in the Consultant's marketing materials, website, proposals and credentials documents.

20.2 The Client shall, on request and acting reasonably, approve a short written quotation attributed to a named individual for use in those materials.

20.3 The Client may withdraw the permission in clause 20.1 in respect of future use on thirty days' written notice. Withdrawal does not require the recall or amendment of materials already published in printed form or already distributed.

20.4 Nothing in this clause 20 permits the Consultant to disclose any of the Client's confidential information, any finding, or any detail of the Client's security posture, controls, vulnerabilities or incidents.

20.5 The Client shall not use the Consultant's name, logo or any statement about the Services externally without the Consultant's prior written consent, and shall not represent that the Consultant has certified, approved or endorsed the Client or any of its systems.

21.1 Each party shall comply with all applicable laws relating to bribery and corruption, including the Bribery Act 2010, to modern slavery, including the Modern Slavery Act 2015, and to applicable sanctions and export control regimes.

21.2 Each party shall maintain policies and procedures adequate to ensure that compliance, and shall notify the other promptly of any breach.

22.1 Neither party is liable for any failure or delay in performing its obligations, other than an obligation to pay, to the extent caused by an event beyond its reasonable control.

22.2 The affected party shall notify the other as soon as practicable. If the event continues for more than sixty days, either party may terminate this Agreement on written notice, and clause 9.5 applies.

23.1 The Consultant may subcontract the performance of any part of the Services, and remains responsible for the acts and omissions of its subcontractors as if they were its own.

23.2 Neither party may assign, transfer or otherwise deal with any of its rights or obligations under this Agreement without the other's prior written consent, not to be unreasonably withheld, except that either party may assign to a group company on written notice.

24.1 A notice under this Agreement shall be in writing and sent to the address or email address stated in the Engagement Letter, or to such other address as a party notifies.

24.2 A notice is deemed received: if delivered by hand, on signature of a delivery receipt; if sent by pre-paid first class post, at 9.00am on the second business day after posting; if sent by email, at the time of transmission, or if that is outside business hours, at 9.00am on the next business day.

24.3 This clause does not apply to the service of proceedings.

25.1 This Agreement constitutes the entire agreement between the parties and supersedes all previous agreements, understandings, representations and proposals relating to its subject matter, including any terms published on the Consultant's website. Each party acknowledges that it does not rely on any statement not set out in this Agreement. Nothing limits liability for fraudulent misrepresentation.

25.2 No variation of this Agreement is effective unless in writing and signed by both parties. A later version of these General Terms published by the Consultant does not affect this Agreement.

25.3 No failure or delay in exercising a right is a waiver of it.

25.4 If any provision is or becomes invalid, illegal or unenforceable, it shall be deemed modified to the minimum extent necessary to make it valid, and if that is not possible it shall be deemed deleted. The remainder of this Agreement is unaffected.

25.5 Nothing in this Agreement creates a partnership, joint venture, agency or employment relationship.

25.6 Except as stated in clause 17.6, a person who is not a party has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of this Agreement.

25.7 This Agreement may be executed in counterparts, and signature by electronic means is valid.

26.1 This Agreement and any dispute or claim arising out of or in connection with it, including any non-contractual dispute or claim, are governed by and construed in accordance with the law of England and Wales.

26.2 The parties irrevocably submit to the exclusive jurisdiction of the courts of England and Wales.

26.3 Before commencing proceedings the parties shall each nominate a senior representative who shall meet, in person or remotely, within fifteen business days of a written escalation notice, to attempt to resolve the dispute in good faith. This clause does not prevent either party from seeking interim relief.