Client services framework

Service & Support Terms

These terms form part of the agreement between Nullshift Development Ltd (“Nullshift”, “we”) and the Client (“you”). They define what the recurring fee buys, what “support” means, how new work is priced, and what happens if you do not take a plan. Accepting the proposal accepts these terms.

1. What the pricing words mean

Our recurring pricing has two independent parts, and both appear on your proposal:

• —Plan level (Core, Pro, Max or Enterprise) — the level of service your platform needs. It determines what is covered and how quickly we respond.
• —Scale band — a multiplier reflecting the size, usage, complexity and commercial importance of your system. Two businesses on the same plan level can pay different amounts, because the responsibility we carry differs.

Prices published on our website are shown as “from”figures. A “from” price is the entry point for that plan level at the smallest scale band — it is not a quotation. The rate that binds is the monthly figure stated in your proposal, which you see and accept before anything is charged.

We may review your scale band no more often than every six months, or after a material change to your system or organisation. An increase requires at least 30 days’ written notice, and you may cancel before it takes effect. Where your third-party consumption (hosting, database, AI, email and similar) rises materially, we may pass through or re-band that cost on the same notice.

2. What “support” covers

Support preserves, restores, operates or configures a capability your system already has. It does not create new capability. The test we apply, in both directions, is this:

If a request changes what your product can do, it is development. If it keeps an existing capability working, or configures that capability within its original design, it is support.

Included in your plan:

• —Fixing functionality that has stopped behaving as it did when signed off.
• —Diagnosing outages, errors, integration failures and delivery failures.
• —Changing a setting, value, content item or rule the system was already built to allow.
• —Helping you use, administer or understand functionality already present.
• —Routine technical upkeep required to keep the platform operating safely and reliably.

Defects in our own signed-off implementation are always corrected under support, at no additional charge, on every plan level. Response targets are stated in your proposal and are targets for a first substantive response, not guaranteed resolution times, except where an Enterprise agreement states otherwise in writing.

3. New capability is quoted and billed separately

No plan level includes development work. The recurring fee buys the platform, the service level and the technical partnership. Anything that creates or materially changes a capability is a separate, fixed-price project.

Work that is quoted separately includes:

• —Letting a user do something the system could not previously do.
• —A new screen, workflow, user journey, automation, business rule, role or permission model.
• —Adding a third-party service, or substantially changing an existing integration.
• —New data structures, reporting, booking, payment, ticketing or portal capability.
• —Materially redesigning part of the product, as opposed to correcting a defect.

Before any such work begins you will receive a written proposal stating the defined capability, what is included and excluded, the acceptance criteria, a fixed price and a delivery window. Work starts only once you approve it. We do not bill you by the hour, and we will not carry out chargeable work without your written agreement.

Higher plan levels change the access and priority you get around that work — feature discovery and technical scoping are included at Max, and accepted projects are scheduled ahead of standard work — but they do not include the build itself. Moving up a plan level for a period does not create an entitlement to development work, credits or a backlog of free changes.

4. If you do not take a plan

You own your system outright — the code, the data and every account — so you are free to run it yourself or have someone else run it. If you do not take a plan, or when a plan ends, responsibility transfers to you.

Where we currently hold accounts or pay running costs on your behalf, we will, on request, transfer them to you and provide the information reasonably needed to take them over. Any credentials or infrastructure remaining under our control after that transfer are held as an accommodation only, and we may require you to assume them on 30 days’ notice.

5. A plan is a separate agreement

The build agreement and the monthly plan are separate arrangements, and neither is conditional on the other:

• —Your ownership of the delivered system is not conditional on holding a plan. Cancelling a plan does not affect what you own or your licence to use it.
• —Cancelling a plan does not cancel any separately agreed fixed-price project, and cancelling a project does not cancel your plan.
• —Plans are monthly and may be cancelled at any time, effective at the end of the current billing period. Fees already paid for the current period are not refunded, and we do not charge an exit fee.
• —Sums owed for completed build work remain payable whether or not you take, or keep, a plan.

No plan is included in this proposal. Unless you take one, clause 4 applies from the point your system is delivered.

6. Acknowledgement

By accepting the proposal, you confirm that you have read and understood:

• —that published prices are “from” figures, and that your rate is the figure stated in your proposal (clause 1);
• —what support does and does not cover, and that response targets are targets rather than guaranteed resolution times (clause 2);
• —that no plan includes development work, and that new capability is quoted and invoiced as a separate fixed-price project (clause 3);
• —that without a plan you are responsible for hosting, maintenance, security and the running costs of your system, and we are not liable for what follows from that (clause 4);
• —that a plan is a separate agreement from the build, and cancelling it does not affect what you own (clause 5).

These terms are accepted by the typed signature on the proposal above. They are not a substitute for the Data Processing Agreement, which governs personal data and is provided separately.

Between:

(1) Client name, a company registered in country (company number client company number) whose registered office is at client registered address(the "Controller" or "Client"); and

(2) Nullshift Development Ltd, a business registered in the United Kingdom (company number 17284213, ICO registration ZC214743) whose registered office is at 66 Paul Street, London, England, United Kingdom, EC2A 4NA ("Nullshift", the "Processor").

each a "party" and together the "parties".

Effective date: effective date — per engagement

1. Background and purpose

1.1 This Data Processing Agreement ("DPA") governs the Processing of Personal Data by Nullshift on behalf of the Client in connection with the website development, hosting, maintenance and related services that Nullshift provides to the Client (the "Services"), as set out in the parties' main services agreement or statement of work (the "Principal Agreement").

1.2 This DPA forms part of, and is subject to, the Principal Agreement. Where there is any conflict between this DPA and the Principal Agreement on the subject of data protection, this DPA prevails.

1.3 The parties agree that, in respect of the Personal Data processed under the Services, the Client is the Controller and Nullshift is the Processor.

2. Definitions

2.1 In this DPA:

• —"Data Protection Law" means all laws applicable to the Processing of Personal Data under this DPA, including the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations 2003 (PECR), each as amended or replaced from time to time.
• —"UK GDPR" means Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of the European Union (Withdrawal) Act 2018, as amended.
• —"Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing", "Special Category Data" and "Sub-processor" have the meanings given in Data Protection Law.
• —"Restricted Transfer" means a transfer of Personal Data to a country or territory outside the United Kingdom that is subject to restrictions under Data Protection Law.
• —"UK Transfer Mechanism" means the International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Standard Contractual Clauses, as issued by the Information Commissioner, or any successor mechanism.

3. Scope and details of Processing

3.1 The subject matter, duration, nature and purpose of the Processing, the types of Personal Data, and the categories of Data Subjects are set out in Annex 1.

3.2 Nullshift will Process the Personal Data only for the purposes of providing the Services and as described in Annex 1, and not for any of its own purposes.

4. Nullshift's obligations

Nullshift will:

4.1 Process only on instructions.Process the Personal Data only on the Client's documented instructions, including the instructions set out in this DPA and the Principal Agreement, unless required to do otherwise by law (in which case Nullshift will, where legally permitted, inform the Client before Processing).

4.2 Flag unlawful instructions.Immediately inform the Client if, in Nullshift's opinion, an instruction infringes Data Protection Law.

4.3 Confidentiality. Ensure that persons authorised to Process the Personal Data are bound by appropriate obligations of confidentiality.

4.4 Security. Implement and maintain the technical and organisational measures set out in Annex 2 to ensure a level of security appropriate to the risk, in accordance with Article 32 UK GDPR.

4.5 Assist with Data Subject rights. Taking into account the nature of the Processing, assist the Client by appropriate technical and organisational measures, insofar as possible, to respond to requests by Data Subjects exercising their rights under Data Protection Law (including access, rectification, erasure, restriction, portability and objection).

4.6 Assist with compliance. Assist the Client in ensuring compliance with its obligations relating to security, Personal Data Breach notification, data protection impact assessments and prior consultation with the Information Commissioner, taking into account the nature of Processing and the information available to Nullshift.

4.7 Breach notification. Notify the Client without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting the Personal Data, and provide the Client with sufficient information to allow it to meet any obligations to report the breach to the Information Commissioner or affected Data Subjects.

4.8 Records and demonstration of compliance. Make available to the Client all information reasonably necessary to demonstrate compliance with this DPA, and maintain written records of its Processing activities as required by Data Protection Law.

4.9 Audits. Allow for and contribute to audits, including inspections, conducted by the Client or another auditor mandated by the Client, on reasonable prior written notice (and no more than once per year except where required by a regulator or following a Personal Data Breach), subject to reasonable confidentiality and security conditions.

5. Sub-processors

5.1 The Client provides general authorisation for Nullshift to engage the Sub-processors listed in Annex 3 to Process the Personal Data.

5.2 Nullshift will impose on each Sub-processor, by written contract, data protection obligations substantially equivalent to those set out in this DPA, and remains fully liable to the Client for the performance of each Sub-processor's obligations.

5.3 Nullshift will inform the Client of any intended addition or replacement of a Sub-processor at least 14 days in advance, giving the Client the opportunity to object on reasonable data protection grounds. If the Client objects and the parties cannot agree a resolution, either party may terminate the affected Services.

6. International transfers

6.1 Nullshift will not carry out a Restricted Transfer of the Personal Data without the Client's prior authorisation, except as already described in Annex 1 or Annex 3.

6.2 Where the Services involve a Restricted Transfer, Nullshift will ensure an appropriate safeguard is in place, such as a UK Transfer Mechanism, and will configure hosting so that Personal Data is stored in a UK or European region where reasonably practicable.

7. Deletion and return of data

7.1 On termination or expiry of the Services, and at the Client's choice, Nullshift will delete or return all the Personal Data to the Client and delete existing copies, unless Data Protection Law requires continued storage.

7.2 Nullshift will, on request, certify in writing that it has complied with this clause.

8. Liability

8.1 Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Principal Agreement.

9. General

9.1 Duration. This DPA takes effect on the Effective Date and continues for as long as Nullshift Processes Personal Data on behalf of the Client.

9.2 Governing law. This DPA is governed by the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.

9.3 Order of precedence. Except as stated in clause 1.2, the Principal Agreement continues in full force.

Annex 1 — Details of the Processing

Annex 2 — Technical and organisational security measures

Nullshift maintains measures including:

• —Encryption of Personal Data in transit (TLS) and at rest, as provided by the hosting platform.
• —Row-Level Security and least-privilege access controls on the database, separating each Client's data into its own dedicated project/organisation.
• —Access to production systems restricted to authorised personnel using strong authentication (including multi-factor authentication where available).
• —Regular automated backups and a documented restore process.
• —Logging and monitoring of access to systems holding Personal Data.
• —Secure software development practices and prompt application of security updates.
• —A documented Personal Data Breach response process.
• —Secure deletion of Personal Data on termination.

Annex 3 — Authorised Sub-processors

This list reflects the tools currently used and is updated to match the actual tools used for each Client.