Last updated 25 October 2026

This page sets out the terms that apply to this OnTrack365 system. Part A covers access to and use of the system by all users. Part B contains the OnTrack365 SaaS Terms & Conditions that apply to our customers. Our use of personal data is explained in our Privacy Policy.

Part A — Use of this system

A1. About this system

This system is the OnTrack365 platform, provided by OnTrack365 Ltd (company number 10600776, registered in England and Wales; Apex House, Caerphilly, CF83 8DP; ICO registration ZA561612). This instance is licensed to Richardson Rail Services Ltd for use by its authorised users.

A2. Authorised use only

Access is restricted to authorised users. Unauthorised access, attempted access or misuse is prohibited and may be an offence under the Computer Misuse Act 1990. Activity on this system is logged and may be monitored to protect its security. Suspected misuse may be reported to the police.

A3. Terms that apply

Use of this system by our customers and their users is governed by the OnTrack365 SaaS Terms & Conditions in Part B below and the OnTrack365 Data Processing Agreement. Our use of personal data is explained in our Privacy Policy.

A4. Ownership and copyright

The OnTrack365 software, its design, screens, layouts, workflows, templates, forms, database structures and code, and the OnTrack365 name and logo, are owned by OnTrack365 Ltd and its licensors and are protected by copyright and other intellectual property laws. All rights are reserved. Data entered by our customers belongs to them.

You may use this system only as permitted by the Terms & Conditions. You must not copy, reproduce, modify, reverse engineer, scrape or republish any part of the software or its design, or use it to build or assist in building a competing system, without our written permission.

A5. Acceptable use

You must not use this system in any way that is unlawful, harmful or fraudulent; upload malicious code; attempt to access data or accounts you are not authorised to access; or carry out automated data collection or security testing without our written consent.

A6. Disclaimer

This system is provided "as is" and "as available". It is a management and record-keeping tool. Users remain responsible for checking all data, documents and outputs before relying on them, and for all operational, safety, competency and compliance decisions. Our liability is limited as set out in the Terms & Conditions.

A7. Law

This notice is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

A8. Contact

To report misuse or ask for permission to use any material, contact support@ontrack365.co.uk or write to OnTrack365 Ltd, Apex House, Caerphilly, CF83 8DP.

Part B — OnTrack365 SaaS Terms & Conditions

Version 3.0 · Effective 5 May 2026

These Terms govern customers' use of the OnTrack365 platform and replace all earlier versions. For existing customers, they apply as set out in Clause 1.4.

Document control

Related documents (together, the "Document Pack"):

1. OnTrack365 SaaS Terms & Conditions (this document)

2. OnTrack365 Data Processing Agreement (UK GDPR)

3. OnTrack365 Privacy & Security Statement

4. OnTrack365 Service Level & Support Policy

Important notice. Please read these Terms carefully. Clause 16 (Limitation of liability) limits and excludes our liability to you. Clause 1.3 explains that continued use of the Platform on or after the Effective Date means you accept these Terms.

1. Parties, background and acceptance

1.1 Parties. These Terms are made between OnTrack365 Ltd, a company registered in England and Wales under company number 10600776 whose address is Apex House, Caerphilly, CF83 8DP ("OnTrack365", "we", "us", "our"), and the organisation that subscribes to, accesses or uses the Services (the "Customer", "you", "your").

1.2 Background. OnTrack365 has provided cloud-hosted software services to organisations in the UK rail sector since 2018. The Services support railway training and assessment, drug and alcohol (D&A) and medical screening, labour supply, and fatigue and hours monitoring. These Terms, Version 3.0, consolidate and replace all earlier terms on which the Services, including the Legacy Platform, were provided.

1.3 Acceptance by continued use. You accept these Terms, and they bind you, on the earliest of:

1. you signing an Order Form or other document that refers to these Terms;

2. you ticking a box, clicking to accept, or otherwise accepting these Terms electronically; or

3. you or any Authorised User continuing to access or use the Platform on or after the Effective Date.

1.4 Existing customers. If you were using the Services before the Effective Date, we will notify you of these Terms by email, and they are also published on our website and linked from the Platform login page. They apply to you from the earlier of: (a) your acceptance of them on the Platform or in writing; or (b) 30 days after we notify you, if you continue to use the Platform after that date. Until then, the terms that previously applied to you continue. If you do not accept these Terms, you must stop using the Platform and notify us in writing, and Clause 18.6 (Consequences of termination), including your data export rights, will apply.

1.5 Authority. The individual who accepts these Terms on your behalf confirms that they have authority to bind the Customer. Authorised Users who use the Platform do so on your behalf, and you are responsible for their use.

1.6 Business use only. The Services are supplied only to businesses and organisations for business purposes. You confirm that you are not entering into these Terms as a consumer.

1.7 Order of precedence. If there is any conflict between documents, the following order applies (highest first): (a) the Data Processing Agreement, in relation to the processing of Personal Data; (b) any Order Form, in relation to commercial terms specific to you; (c) these Terms; (d) the Service Level & Support Policy; (e) the Privacy & Security Statement.

2. Definitions and interpretation

2.1 Definitions. In these Terms:

2.2 Interpretation. In these Terms: (a) clause headings do not affect interpretation; (b) "including" and similar words mean "including without limitation"; (c) a reference to a law includes that law as amended, extended or re-enacted; (d) "writing" includes email; (e) the singular includes the plural and vice versa; and (f) a reference to a party includes its permitted successors and assigns.

3. The Services

3.1 Provision of the Services. Subject to these Terms and payment of the Fees, we grant you a non-exclusive, non-transferable, non-sublicensable right during the Subscription Term to permit your Authorised Users to access and use the Platform and the Modules you have subscribed to, solely for your internal business operations.

3.2 Hosting. The Platform is hosted on dedicated virtual private server (VPS) infrastructure located in the United Kingdom, operated by us or our hosting sub-processors. Customer Data is hosted and stored in the United Kingdom. To send emails and text messages, we use established international delivery providers, which process only the contact details and message content needed for delivery, under UK GDPR transfer safeguards. Details of sub-processors are set out in the DPA.

3.3 Updates and improvements. We continually develop the Platform. We may update, modify or improve the Platform, its features, design, templates and automated forms at any time. All updates are included in your subscription at no extra charge. We will not make a change that materially reduces the core functionality of a Module you subscribe to during your Subscription Term without giving you at least 30 days' notice under Clause 19.

3.4 Automated documents. The Platform generates documents automatically, including joining instructions, booking confirmations, medical consent forms, resource sheets, renewal reminders, certificates and reports. These documents are generated from Customer Data and templates configured by or for you. You are responsible for checking that templates, wording and data are accurate and appropriate before documents are relied on or issued.

3.5 Mobile App. Use of the Mobile App is subject to these Terms and to the terms of the relevant app store. Minimal data is stored on devices. You are responsible for the security of devices used by your Authorised Users, including screen locks and prompt reporting of lost or stolen devices.

3.6 Third-party services. The Platform may integrate with third-party services, such as email delivery, SMS, payment or mapping providers. We are not responsible for the availability or performance of third-party services outside our reasonable control.

3.7 Professional services. Configuration, bespoke development, training, data cleansing or Migration work beyond the standard onboarding described in Clause 12 may be quoted separately and will be charged at our then-current rates unless agreed otherwise in an Order Form.

4. Subscriptions, Authorised Users and free trials

4.1 User Subscriptions. Each User Subscription is for one named Authorised User. User credentials must not be shared between individuals. A User Subscription may be reassigned to a new individual when the previous Authorised User no longer requires access, but not so as to allow several people to use one User Subscription.

4.2 Adding and removing users. You may add Authorised Users at any time through the Platform or by contacting us; additional User Subscriptions are charged from the start of the next billing period unless the Order Form states otherwise. You may reduce User Subscriptions with effect from the next billing period.

4.3 Plans. Plans are currently structured by number of active users (for example Starter, 1–2 users; Professional, 3–9 users; Business, 10+ users). Plan names, bands and inclusions are set out on our website or in your Order Form and may change under Clause 5.5.

4.4 Audit of usage. We may monitor the number of active users and use of the Platform to confirm compliance with these Terms. If you exceed your purchased User Subscriptions, we may invoice the additional users at the applicable rate from the date the excess use began.

4.5 Account security. You must ensure that each Authorised User keeps their password and any multi-factor authentication method confidential, and you must notify us without delay at support@ontrack365.co.uk if you become aware of any unauthorised access. You are responsible for all activity under your account, except to the extent caused by our breach of these Terms.

4.6 Free trials. We may offer a free trial (currently 30 days). During a trial: (a) the Services are provided "as is" without any warranty or service level commitment; (b) subject to Clause 16.1, we have no liability to you of any kind; (c) we may end the trial at any time; and (d) if you do not take out a paid subscription by the end of the trial, we may delete trial data 30 days after the trial ends. You should not upload live special category data (including D&A or medical results) during a trial unless we have agreed this in writing.

4.7 Demonstration and test environments. Any demonstration or test environment is provided for evaluation only and must not be used to store live Personal Data.

5. Fees, billing and payment

5.1 Fees. You will pay the Fees set out in your Order Form or, if none, our published prices at the time of order. Fees are calculated per active User Subscription per month unless otherwise agreed.

5.2 Billing. Subscription Fees are invoiced monthly in advance. All invoices are payable in full within 14 days of the invoice date.

5.3 VAT. OnTrack365 Ltd is not currently registered for VAT and does not charge VAT on its Fees. If we become VAT registered, we will give you at least 30 days' written notice, and VAT will then be added to the Fees at the applicable rate. Adding VAT is not a price increase under Clause 5.5.

5.4 Late payment and suspension. We do not charge interest or late payment penalties. If any invoice remains unpaid 2 months after its due date, we may suspend access to the Platform under Clause 18.3 until all overdue sums are paid. Fees continue to accrue during suspension. We may charge a reinstatement fee to restore the Services after a suspension for non-payment, and we will tell you the amount before restoring access. If overdue sums remain unpaid 30 days after suspension, we may terminate your subscription under Clause 18.4, and Clause 11.5 will then apply to your Customer Data.

5.5 Price changes. Your monthly Fees are fixed for the first 12 months of your subscription. After that, we may increase the Fees, but only: (a) by no more than 10% in any 12-month period; and (b) after giving you at least 60 days' written notice before the increase takes effect. The new Fees apply from the first billing period after the notice period ends. If you do not accept an increase, you may cancel your subscription under Clause 18.2 before it takes effect. Changes in Fees caused by adding or removing User Subscriptions or Modules are not price increases.

5.6 No refunds or credits. All Fees are non-refundable. No refunds, credits, discounts or compensation are payable in any circumstances, including cancellation or termination by either party, suspension, downtime, faults, loss of data, withdrawal of features or Modules, or force majeure, except where required by law.

5.7 Disputed invoices. If you dispute an invoice in good faith, you must notify us in writing within 14 days of the invoice date with reasons, and pay any undisputed part when due. Both parties will try to resolve the dispute promptly under Clause 22.

5.8 Set-off. You must pay all amounts in full without any set-off, counterclaim, deduction or withholding, except as required by law.

6. Customer obligations and acceptable use

6.1 Your obligations. You will:

1. comply with all applicable laws and regulations in using the Services, including Data Protection Legislation, employment law, and rail-industry standards and rules that apply to you;

2. ensure Authorised Users use the Platform in accordance with these Terms and the Documentation, and be responsible for any breach by them;

3. provide us with information, access and co-operation reasonably needed to deliver the Services, including for Migration and support;

4. be responsible for the accuracy, quality, legality and completeness of Customer Data, and for the decisions you make using it;

5. obtain and maintain all consents, notices and lawful bases needed for us to process Customer Data on your behalf; and

6. maintain your own network, devices and internet connections needed to access the Platform.

6.2 Acceptable use. You must not, and must ensure that Authorised Users do not:

1. upload or transmit anything that is unlawful, defamatory, discriminatory, infringing, or that contains viruses, malware or other harmful code;

2. attempt to gain unauthorised access to the Platform, other customers' data, or our systems or networks;

3. carry out penetration testing, vulnerability scanning or load testing of the Platform without our prior written consent;

4. copy, modify, translate, adapt, decompile, disassemble or reverse engineer any part of the Platform, except to the extent expressly permitted by law that cannot be excluded;

5. access the Platform in order to build a competing product or service, or copy its features, functions, workflows, templates or user interface;

6. sell, resell, rent, sublicense or otherwise make the Platform available to any third party, except Authorised Users;

7. use automated scripts, bots or scraping tools to extract data or content from the Platform, other than through APIs we provide for that purpose;

8. remove or obscure any proprietary notices, branding or labels on the Platform or outputs; or

9. use the Platform in a way that could damage, overload or impair its operation or interfere with other customers' use.

6.3 Breach of acceptable use. If we reasonably believe there has been a breach of Clause 6.2, we may suspend access for the affected Authorised Users or account under Clause 18.3, remove offending content, and require you to remedy the breach.

7. Module-specific provisions

7.1 Tools, not decisions. Each Module is a management and record-keeping tool. You remain solely responsible for all operational, safety, competency, employment, medical and compliance decisions, and for meeting the requirements of Network Rail, Rail Safety and Standards Board (RSSB) standards, Sentinel scheme rules, sponsors, regulators and any other body that applies to you.

7.2 Training & Assessments. You are responsible for: (a) the content, delivery and quality of training and assessments; (b) verifying candidate identity, eligibility and competence; (c) the accuracy of any certificate, competency record or Personal Track Safety (PTS) record created in the Platform; and (d) submitting information to any external scheme or database where required. Renewal reminders are provided as an aid only; subject to Clause 16.1, we are not liable for any lapse of a competency, certificate or qualification.

7.3 D&A & Medical Screening. You acknowledge that screening results, consent forms and medical information are special category Personal Data. You are responsible for: (a) obtaining valid consent and having a lawful basis and an Article 9 condition for processing; (b) collection procedures, chain of custody, laboratory selection and medical review; (c) the clinical interpretation of results and any fitness-for-work decision; and (d) restricting access to such data to Authorised Users who need it. The Platform records and manages results; it does not test samples or provide any medical opinion.

7.4 Labour Supply. You are responsible for: (a) right-to-work checks, competency checks and suitability of workers you allocate; (b) compliance with the Conduct of Employment Agencies and Employment Businesses Regulations 2003, working time rules and any client contract; and (c) the accuracy of resource sheets, timesheets and invoices generated from your data before you issue them.

7.5 Fatigue & Hours Monitoring — advisory only. The Fatigue & Hours Monitoring Module is an advisory tool. It calculates hours worked and rest gaps from data you enter and raises alerts against thresholds you configure. It is not a fatigue risk management system, is not a substitute for specialist fatigue modelling tools, and does not by itself demonstrate compliance with Network Rail standards, the Working Time Regulations 1998, the Railways and Other Guided Transport Systems (Safety) Regulations 2006 or any other requirement. Outputs depend entirely on the completeness and accuracy of the data entered. You must maintain your own fatigue risk management processes and must not rely on the Module as the sole control for fatigue risk. Subject to Clause 16.1, we accept no liability for any fatigue-related incident, injury or loss.

7.6 Safety-critical reliance. The Platform is not designed or certified for use as a safety-critical system. You must not use it as the sole means of determining whether any person is safe, competent or fit to work on or near the railway.

8. Support and service levels

8.1 Support Hours. Support is provided during Support Hours: 09:00 to 17:00 UK time, Monday to Friday, excluding bank holidays in England and Wales. Requests received outside Support Hours are treated as received at 09:00 on the next Business Day.

8.2 How to raise a request. Support requests should be raised by email to support@ontrack365.co.uk or by telephone on 07445 561011. Requests should include the account name, the Authorised User affected, a description of the issue, and screenshots where helpful.

8.3 Service levels. Response targets, priority definitions, availability targets and maintenance windows are set out in the OnTrack365 Service Level & Support Policy. Service levels are targets, and our sole obligation in relation to them is as set out in that Policy.

8.4 Platform availability. The Platform is generally available 24 hours a day, 7 days a week, but we do not guarantee uninterrupted or error-free availability. Availability outside Support Hours is not monitored or supported unless the Service Level & Support Policy states otherwise.

8.5 Planned maintenance. We will try to carry out planned maintenance outside Support Hours and, where reasonably practicable, give at least 48 hours' notice of maintenance likely to cause significant disruption. Emergency maintenance may be carried out without notice where needed to protect the security or integrity of the Platform.

8.6 Exclusions. Support does not cover issues caused by: (a) your own equipment, networks, browsers or internet service; (b) use of the Platform other than in accordance with these Terms or the Documentation; (c) inaccurate or incomplete Customer Data; (d) third-party services outside our control; or (e) your failure to apply updates or follow reasonable instructions. We may charge for support in these cases at our then-current rates, after telling you in advance.

9. Data protection (UK GDPR)

9.1 Roles. For Personal Data contained in Customer Data, you are the Controller and OnTrack365 is the Processor. For Personal Data we collect to manage your account, billing, support and our relationship with you (such as the names and contact details of your staff), OnTrack365 is an independent Controller and processes it as described in the Privacy & Security Statement.

9.2 Registration. OnTrack365 Ltd is registered with the Information Commissioner's Office under registration number ZA561612.

9.3 Compliance. Each party will comply with its obligations under Data Protection Legislation. This Clause 9 is in addition to, and does not relieve, remove or replace, a party's obligations under that legislation.

9.4 Data Processing Agreement. The DPA forms part of these Terms and sets out the subject matter, duration, nature and purpose of processing, the types of Personal Data and categories of Data Subjects, and the parties' obligations, as required by Article 28 of the UK GDPR. A summary is in Schedule 1.

9.5 Our obligations as Processor. Without limiting the DPA, when processing Personal Data on your behalf we will:

1. process it only on your documented instructions, which you give through these Terms, your configuration of the Platform and your use of it, unless UK law requires otherwise (in which case we will tell you, unless the law prohibits this);

2. ensure that people authorised to process it are bound by confidentiality obligations;

3. implement appropriate technical and organisational measures to protect it, as required by Article 32 of the UK GDPR and described in Clause 10;

4. not engage a sub-processor without your general written authorisation, which you give by accepting these Terms for the sub-processors listed in the DPA; we will give you at least 30 days' notice of any new or replacement sub-processor, and you may object on reasonable data protection grounds;

5. ensure each sub-processor is bound by written terms giving equivalent protection, and remain liable for its performance;

6. not transfer Personal Data outside the United Kingdom unless the transfer complies with Chapter V of the UK GDPR, for example under UK adequacy regulations or the International Data Transfer Agreement or Addendum;

7. assist you, taking into account the nature of processing, in responding to Data Subject requests and in meeting your obligations on security, breach notification, data protection impact assessments and prior consultation;

8. notify you without undue delay after becoming aware of a Personal Data breach affecting Customer Data, and provide the information you reasonably need to meet your own notification obligations;

9. at your choice, delete or return Personal Data at the end of the Services in accordance with Clause 11, unless UK law requires storage; and

10. make available information reasonably necessary to demonstrate compliance with Article 28, and allow for audits as set out in the DPA.

9.6 Your obligations as Controller. You warrant that: (a) you have a lawful basis, and where relevant an Article 9 condition, for all processing of Customer Data; (b) you have provided all necessary privacy information to Data Subjects, including candidates, workers and screening subjects; (c) your instructions to us comply with Data Protection Legislation; and (d) you will not ask us to process Personal Data in a way that breaches that legislation.

9.7 Data Subject requests. If we receive a request from a Data Subject relating to Customer Data, we will pass it to you without undue delay and will not respond directly except on your instructions or where required by law. The Platform provides tools allowing you to search, export, correct and delete records.

9.8 Anonymised and aggregated data. We may create anonymised and aggregated statistical data from use of the Platform (which does not identify you, any Authorised User or any Data Subject) and use it to operate, secure and improve the Services. We will never sell Customer Data or use it for marketing or advertising.

9.9 Conflict. If there is a conflict between this Clause 9 and the DPA, the DPA prevails.

10. Security

10.1 Our measures. We maintain technical and organisational security measures appropriate to the risk, taking into account the special category data that may be processed through the D&A & Medical Screening Module. These include: encryption of data in transit (TLS); access controls and role-based permissions within the Platform; password and authentication controls; firewalling and hardening of hosting infrastructure; regular backups; logging of administrative access; and staff confidentiality obligations. Further detail is given in the Privacy & Security Statement.

10.2 Backups. We take regular backups of Customer Data for disaster recovery purposes. Backups are retained on a rolling basis as described in the Service Level & Support Policy. Backups are not an archive or a substitute for your own data export, and restoration of individual records at your request may be chargeable.

10.3 Your security responsibilities. You are responsible for: (a) configuring user roles and permissions appropriately, especially for access to screening and medical data; (b) removing access promptly when an Authorised User leaves or no longer needs it; (c) the security of your own devices, email accounts and networks; and (d) keeping your own copies of any data you are legally required to retain.

10.4 No absolute guarantee. No system is completely secure. Except for our obligations in this Clause 10 and the DPA, we do not warrant that the Platform will be free from all security vulnerabilities or unauthorised access.

11. Customer Data, data export and retention

11.1 Ownership of Customer Data. You own all rights in Customer Data. We acquire no ownership rights in it. You grant us a non-exclusive, royalty-free licence to host, copy, process, transmit and display Customer Data only as needed to provide, secure and support the Services and to comply with law.

11.2 Export during the Subscription Term. You may export Customer Data at any time during the Subscription Term using the export and reporting tools available in the Platform, in common machine-readable formats such as CSV, Excel or PDF.

11.3 Export on termination — our format, data only. If you request it within the Export Window in Clause 11.5, we will provide one export of the Customer Data held in the Platform, in a format chosen by us (for example CSV, Excel or PDF files). The export contains only the data entered into the Platform by you or your Authorised Users. It does not include, and we will not provide: database structures, schemas or table designs; formatting, templates, layouts, certificate or report designs; configuration, workflows or business logic; source code or object code; or any other part of the Platform. We are not obliged to provide data in any format, structure or system you specify, or to convert, map or transform it for import into another system.

11.4 Retention during the Subscription Term. We retain Customer Data for as long as your subscription is active. You are responsible for setting and applying retention periods for the records you hold, including deleting records you no longer have a lawful reason to keep, using the tools in the Platform.

11.5 Retention and permanent deletion after termination. When your subscription ends for any reason:

1. Access ends. Access to the Platform and Mobile App ends on the termination date.

2. Export Window (days 1–14). For 14 days after the termination date (the "Export Window"), you may request and collect your export under Clause 11.3. After the Export Window closes, we have no obligation to provide any data.

3. Deletion Period (days 15–28). During the following 14 days (the "Deletion Period"), we permanently and irreversibly delete all Customer Data from the Platform and all our systems, including backup copies. Deletion is complete no later than 28 days after the termination date. The Export Window and Deletion Period together are the "Retention Period".

4. No recovery. Once deleted, Customer Data cannot be recovered, restored or provided to you for any reason.

5. No request, no export. If you do not request an export within the Export Window, your Customer Data will be deleted without an export being provided, and we will have no obligation or liability in relation to it.

6. Legal retention. We will keep Customer Data beyond the Retention Period only where UK law requires us to, and only for as long as required.

7. Confirmation. On written request made within the Export Window, we will confirm in writing once deletion has been completed.

11.6 Your retention obligations. Rail-sector, employment, health and safety, and medical record-keeping obligations may require you to keep records for set periods. It is your responsibility to export and retain any records you must keep before the Export Window ends. We are not responsible for any loss resulting from your failure to do so.

11.7 Your own copies. You are responsible for keeping your own copies of Customer Data. We are not liable for any loss, corruption or destruction of Customer Data, however caused. If data is lost, we may, at our discretion and without any obligation, try to restore it from an available backup, and may charge for doing so.

12. Legacy platform migration

12.1 Purpose. OnTrack365 has provided services since 2018. Customers who used the Legacy Platform are being, or have been, moved to the current Platform. This Clause 12 sets out how Migration works and how responsibility is shared.

12.2 Continuity of terms. From the Effective Date, these Terms govern both the current Platform and any continued use of the Legacy Platform. Your existing Customer Data, User Subscriptions and pricing carry over unless we notify you otherwise under Clause 5.5.

12.3 Migration plan. We will agree a Migration plan with you, covering the data to be moved, the target date, any cut-over period, and the checks you will carry out. Standard Migration of Customer Data from the Legacy Platform into the equivalent structures of the current Platform is included in your subscription. Data cleansing, restructuring, bespoke mapping, or migration from a third-party system is chargeable unless agreed otherwise.

12.4 Data mapping. The current Platform may structure data differently from the Legacy Platform. We will map data to the nearest equivalent fields. Some historic data, formats, attachments, custom fields or calculated values may not transfer exactly, and some legacy features may be replaced by different functionality.

12.5 Your verification and sign-off. You must review migrated data within 14 days of being notified that Migration is complete and tell us in writing of any material errors or omissions. We will correct errors caused by our Migration process at no charge. If you do not report material errors within that period, or you begin live use of the migrated data, the Migration is treated as accepted.

12.6 Source data quality. We are not responsible for errors, gaps or inconsistencies that existed in the Legacy Platform data or in data you supply. Migration does not verify the accuracy of historic records, certificates, competencies or screening results.

12.7 Parallel running and decommissioning. We may provide read-only access to the Legacy Platform for a transition period of up to 90 days after cut-over, or as stated in the Migration plan. After that period we may decommission the Legacy Platform. Before decommissioning, you may request an export of your Legacy Platform data under Clause 11.3, and that data will then be retained and deleted in accordance with Clause 11.5.

12.8 Legacy features. Features of the Legacy Platform that are not carried into the current Platform will not be maintained after decommissioning. The withdrawal of a legacy feature does not entitle you to a refund or compensation, provided the core functionality of the Modules you subscribe to remains available.

12.9 Intellectual property. The Legacy Platform, its code, databases, schemas and design remain the property of OnTrack365 as described in Clause 13. Migration does not transfer any rights in it to you.

13. Intellectual property

13.1 Our ownership. OnTrack365 and its licensors own all Intellectual Property Rights in and to the Platform, the Legacy Platform, the Services and System Data (but not Customer Data), including: source and object code; databases, database structures and schemas; software architecture; workflows and business logic; the user interface, look and feel, screens and layouts; automated forms, document templates, certificate and report designs; the Mobile App; Documentation; APIs; and the OnTrack365 name, logos and trade marks. This applies whether these were created before or after the Effective Date.

13.2 No transfer. Except for the limited right of use in Clause 3.1, nothing in these Terms transfers or grants you any Intellectual Property Rights or other rights in the Platform. All rights not expressly granted are reserved.

13.3 Improvements and feedback. All enhancements, modifications, customisations, configurations, integrations and developments made to the Platform, including those made at your request, using your ideas, or paid for by you as professional services, belong to OnTrack365 unless we agree otherwise in a signed written agreement. If you or your Authorised Users give us suggestions, ideas or feedback, we may use them freely without any obligation to you, and you assign to us any rights you have in them.

13.4 Customer branding. You grant us a non-exclusive, royalty-free licence during the Subscription Term to use your name, logo and branding within your instance of the Platform, Mobile App and generated documents, solely to provide the Services. You warrant that you have the right to grant this licence.

13.5 Outputs. Documents generated by the Platform from Customer Data (such as certificates, resource sheets and reports) may be used by you for your business purposes without restriction. Our underlying templates, layouts and designs remain our property, and you may not extract or reproduce them for use outside the Platform.

13.6 Protection of the Platform. You must not, and must not allow any third party to: (a) copy, reproduce, imitate or create derivative works of the Platform, its screens, workflows, templates or database structure; (b) use our Confidential Information, or copy the Platform's design, screens, workflows, templates or database structure, to develop, commission or assist in developing a competing system; or (c) register or use any trade mark, domain name or business name that is the same as or confusingly similar to "OnTrack365".

13.7 Remedies. You acknowledge that a breach of this Clause 13 may cause us irreparable harm for which damages would not be an adequate remedy. We are entitled to seek injunctive or other equitable relief in addition to any other remedy. This Clause survives termination.

13.8 Third-party IP claims. We give no indemnity for third-party intellectual property claims. If a third party claims that the Platform infringes its rights, we may, at our option, modify the Platform, obtain a licence, or end your subscription under Clause 18.2. This is your sole remedy for any such claim.

14. Confidentiality

14.1 Confidential Information. Confidential Information means any information disclosed by one party (the discloser) to the other (the recipient) that is marked as confidential or would reasonably be regarded as confidential, including Customer Data, pricing, business plans, and the non-public features, code, security arrangements and design of the Platform.

14.2 Obligations. The recipient will: (a) keep the discloser's Confidential Information confidential; (b) use it only to perform or receive the Services; and (c) disclose it only to its employees, officers, contractors, sub-processors and professional advisers who need to know it and are bound by equivalent confidentiality obligations.

14.3 Exceptions. These obligations do not apply to information that: (a) is or becomes public other than through breach of these Terms; (b) was lawfully known to the recipient before disclosure; (c) is lawfully received from a third party without restriction; or (d) is independently developed without use of the discloser's information. A party may disclose Confidential Information where required by law, court order or a regulator, giving the discloser notice where lawful.

14.4 Duration. This Clause 14 continues for 5 years after termination, and indefinitely for trade secrets, source code and Personal Data.

15. Warranties and disclaimers

15.1 Provided as is. The Platform and Services are provided "as is" and "as available". You enter, manage and use your Customer Data in the Platform as it stands, at your own risk, and you are responsible for checking all data and outputs before relying on them.

15.2 No warranty and no obligation to fix. We give no warranty, representation or undertaking that the Platform or Services will be available, uninterrupted, error-free, accurate, secure or fit for any purpose. We may fix faults reported to us, in line with the Service Level & Support Policy, but this is at our discretion and is not a contractual obligation. You have no remedy, refund or claim for any fault, error, defect or unavailability of the Platform or Services.

15.3 Exceptions. We have no obligation under Clause 15.2 for faults caused by use of the Platform contrary to these Terms or the Documentation, modification by anyone other than us, Customer Data, your equipment or networks, or third-party services.

15.4 Disclaimer. Except as expressly set out in these Terms, the Services are provided "as is" and all warranties, conditions and terms implied by statute, common law or otherwise, including as to satisfactory quality and fitness for a particular purpose, are excluded to the fullest extent permitted by law. We do not warrant that: (a) use of the Services will be uninterrupted or error-free; (b) the Services or any outputs will meet your specific requirements or ensure your compliance with any law, standard or industry rule; or (c) the Platform will be free from all vulnerabilities.

15.5 Your warranties. You warrant that you have full authority to enter into these Terms, and that Customer Data and its use in accordance with these Terms will not infringe the rights of any third party or breach any law.

16. Limitation of liability

16.1 Unlimited liability. Nothing in these Terms limits or excludes either party's liability for: (a) death or personal injury caused by its negligence; (b) fraud or fraudulent misrepresentation; (c) your obligation to pay Fees; or (d) any other liability that cannot be limited or excluded by law.

16.2 Excluded losses. Subject to Clause 16.1, we will not be liable to you, whether in contract, tort (including negligence), breach of statutory duty, misrepresentation or otherwise, for any of the following, even if the loss was foreseeable or we were told it might occur:

1. loss of profits, revenue, sales, business or anticipated savings;

2. loss of contracts, business opportunity, goodwill or reputation;

3. loss, corruption or destruction of data, or the cost of reconstructing it;

4. any loss arising from downtime, suspension, unavailability, errors, delays or failure of the Platform, the Mobile App or support;

5. any loss arising from reliance on data, documents, alerts, reports, certificates or other outputs generated by the Platform;

6. fines, penalties, regulatory costs, compensation paid to third parties, or costs of notifying Data Subjects or regulators;

7. costs of substitute services, wasted expenditure or management time; or

8. any indirect, special or consequential loss.

16.3 Maximum liability — 12 months' Fees. Subject to Clause 16.1, our total aggregate liability arising out of or in connection with these Terms, the DPA and the Services, whether in contract, tort (including negligence), breach of statutory duty (including Data Protection Legislation) or otherwise, for all claims combined, is limited to the total subscription Fees paid by you in the 12 months immediately before the event giving rise to the first claim.

16.4 Single cap. The limit in Clause 16.3 applies to every type of claim, including claims under Clauses 9 (Data protection), 10 (Security), 11 (Customer Data), 12 (Legacy platform migration) and 17 (Indemnities) and under the DPA. No separate or additional cap applies.

16.5 No liability for your decisions. We are not liable for any loss arising from: (a) decisions you make about the competence, fitness, safety or deployment of any person; (b) the content or accuracy of Customer Data or documents generated from it; (c) reliance on the Fatigue & Hours Monitoring Module, which is advisory only; or (d) your failure to export or retain data before deletion under Clause 11.

16.6 Contribution. Each party's liability is reduced to the extent that the loss was caused or contributed to by the other party, its Authorised Users or its contractors.

16.7 Time limit. No claim may be brought more than 2 years after the claimant became aware, or ought reasonably to have become aware, of the facts giving rise to it.

16.8 Reasonableness. You acknowledge that the Fees reflect the allocation of risk in this Clause 16, that the limits are reasonable in the circumstances, and that you have had the opportunity to take independent advice on them.

17. Indemnities

17.1 Your indemnity. You will indemnify us against all losses, damages, costs (including reasonable legal fees) and expenses arising from any third-party claim relating to: (a) Customer Data, including any claim that it infringes rights or was collected or processed unlawfully on your instructions; (b) your or your Authorised Users' breach of Clause 6 (Customer obligations and acceptable use); or (c) decisions you make using the Services, including competency, fitness-for-work, screening, allocation and fatigue decisions.

17.2 No indemnity from us. OnTrack365 gives no indemnity of any kind under these Terms, the DPA or otherwise.

17.3 Conditions. The indemnified party must: (a) notify the other promptly in writing of the claim; (b) not make any admission or settlement without the other's consent; (c) give the indemnifying party conduct of the claim; and (d) provide reasonable co-operation at the indemnifying party's cost.

17.4 Exclusive remedies. The rights and remedies expressly set out in these Terms are your only rights and remedies against us, and replace all others to the fullest extent permitted by law.

18. Term, suspension and termination

18.1 Term. These Terms start on the date you accept them under Clause 1.3 and continue until your subscription ends. Unless your Order Form sets a minimum term, subscriptions run on a rolling monthly basis.

18.2 Cancellation on one month's notice (either party). Either you or we may end your subscription for any reason by giving at least one month's written notice to the other. Your notice must be sent to support@ontrack365.co.uk. The subscription ends when the notice period expires (the "termination date"). Fees remain payable up to the termination date. If your Order Form sets a minimum term, notice from you cannot take effect before that term ends.

18.3 Suspension. We may suspend access to all or part of the Services, without liability, if: (a) any invoice remains unpaid 2 months after its due date, as set out in Clause 5.4; (b) we reasonably believe there has been a breach of Clause 6.2 or a security threat to the Platform; or (c) suspension is required by law or a regulator. We will give notice where reasonably practicable. Once the cause is resolved, we will restore access, subject to payment of any reinstatement fee under Clause 5.4.

18.4 Termination by either party. Either party may terminate these Terms immediately by written notice if the other party: (a) commits a material breach that is irremediable, or, if remediable, is not remedied within 30 days of written notice; or (b) becomes insolvent, enters administration, liquidation or a voluntary arrangement with creditors, has a receiver appointed, or ceases to trade.

18.5 No refund on termination. No refund, credit or compensation is payable when the subscription ends, whichever party gives notice and for whatever reason, except where required by law.

18.6 Consequences of termination. On termination for any reason:

1. all rights granted to you end and Authorised Users must stop using the Platform and Mobile App;

2. you must pay all Fees due up to the termination date;

3. Customer Data will be made available for export and then deleted under Clause 11.5;

4. each party will return or destroy the other's Confidential Information, subject to Clause 11 and legal retention requirements; and

5. accrued rights and remedies of either party are not affected.

18.7 Survival. Clauses 5 (in respect of unpaid Fees), 9, 11, 13, 14, 16, 17, 18.6, 18.7, 21 and 22 survive termination, together with any other clause intended to do so.

19. Changes to the Terms and Services

19.1 Changes to these Terms. We may update these Terms from time to time. We will give you at least 30 days' written notice of any material change, by email to your account contact or by notice within the Platform. The updated Terms will state a new version number and effective date.

19.2 Acceptance of changes. If you continue to use the Platform after the effective date of updated Terms, you accept them. If you do not accept a material change, you may cancel your subscription by written notice before the change takes effect, and the previous Terms will apply until cancellation takes effect.

19.3 Immediate changes. We may make changes with immediate effect where required by law, a regulator, or to address a security risk. We will notify you as soon as reasonably practicable.

19.4 Changes to Services. Changes to the Platform are governed by Clause 3.3. Non-material changes, such as wording, layout and new features, do not require notice.

20. Force majeure

20.1 Relief. Neither party is liable for any delay or failure to perform its obligations (other than payment obligations) caused by events beyond its reasonable control, including acts of God, flood, fire, pandemic, war, terrorism, civil unrest, government action, failure of public utilities or telecommunications networks, failure of hosting or data-centre providers, cyber attacks that could not reasonably have been prevented by appropriate security measures, or industrial action (other than by that party's own staff).

20.2 Notice and mitigation. The affected party must notify the other promptly and use reasonable efforts to mitigate the effect of the event.

20.3 Prolonged event. If an event continues for more than 60 days, either party may terminate these Terms by 14 days' written notice. No refund or compensation is payable.

21. General

21.1 Entire agreement. These Terms, the DPA, any Order Form and the documents referred to in them form the entire agreement between the parties and supersede all previous agreements, terms, arrangements and understandings relating to their subject matter, including terms that applied to the Legacy Platform. Each party acknowledges that it has not relied on any statement or representation not set out in these documents. Nothing in this clause limits liability for fraud.

21.2 Your terms excluded. These Terms apply to the exclusion of any terms you seek to impose, including in a purchase order, supplier portal or similar document, even if we accept or sign it.

21.3 Assignment. You may not assign, transfer or subcontract your rights or obligations without our prior written consent. We may assign or transfer our rights and obligations to a group company or to a purchaser of all or part of our business, provided that your rights under these Terms and the DPA are not reduced.

21.4 Subcontracting. We may use subcontractors and sub-processors to provide the Services, subject to Clause 9.5, and remain responsible for their performance.

21.5 Notices. Notices must be in writing and sent by email or by post. Notices to us must go to support@ontrack365.co.uk or OnTrack365 Ltd, Apex House, Caerphilly, CF83 8DP. Notices to you will go to the email or postal address on your account. An email notice is treated as received at the time of sending if sent within Support Hours on a Business Day, and otherwise at 09:00 on the next Business Day. A postal notice is treated as received 2 Business Days after posting.

21.6 Waiver. A failure or delay in exercising any right is not a waiver of it. A waiver is effective only if in writing.

21.7 Severance. If any provision is found invalid or unenforceable, it will be modified to the minimum extent needed to make it valid, and the rest of these Terms will remain in force.

21.8 No partnership. Nothing in these Terms creates a partnership, joint venture or agency between the parties.

21.9 Third-party rights. No one other than the parties has any right to enforce these Terms under the Contracts (Rights of Third Parties) Act 1999.

21.10 Publicity. We may name you as a customer of OnTrack365 in our marketing materials unless you ask us in writing not to. Neither party will otherwise make any public statement about the other without consent.

21.11 Non-solicitation. During the Subscription Term and for 12 months afterwards, you will not solicit or employ any of our staff who have been involved in providing the Services to you, without our written consent.

21.12 Anti-bribery and modern slavery. Each party will comply with the Bribery Act 2010 and the Modern Slavery Act 2015 in connection with these Terms.

22. Governing law and jurisdiction

22.1 Dispute resolution. If a dispute arises, either party may give written notice to the other. Senior representatives of each party will meet (in person or remotely) within 14 days of the notice to try to resolve it in good faith. If the dispute is not resolved within 30 days of the notice, either party may refer it to mediation or start court proceedings. Nothing in this clause prevents a party from seeking urgent injunctive relief.

22.2 Governing law. These Terms and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with them are governed by the law of England and Wales.

22.3 Jurisdiction. The courts of England and Wales have exclusive jurisdiction to settle any such dispute or claim.

23. Contact details

Schedule 1: Data processing particulars

This summary is provided under Article 28(3) of the UK GDPR. The full terms are in the OnTrack365 Data Processing Agreement.

End of OnTrack365 SaaS Terms & Conditions, Version 3.0.