SiteAssure Terms of Service

These Terms of Service ("Terms") govern access to and use of SiteAssure, a health and safety compliance management platform provided by Crimson Compass Advisory Limited, a company registered in England and Wales (company number 16935590) whose registered office is at Silverstream House, 45 Fitzroy Street, London W1T 6EB ("Supplier", "we", "us", "our").

By signing an Order Form, or by authorising any User to access SiteAssure, the organisation named in the Order Form ("Client", "you") agrees to these Terms. SiteAssure is supplied to businesses only and is not offered to consumers. If you do not agree to these Terms, do not subscribe to or use the Service.

1. Definitions

“Agreement” means these Terms, the Order Form and Schedule 1 (Data Processing Agreement).

“Client Data” means all data, documents, files and records entered into or generated within the Service by or on behalf of the Client.

“Confidential Information” means non-public information disclosed by one party to the other that is marked as confidential or would reasonably be understood to be confidential.

“Documentation” means the user guides and help material we make available for the Service.

“Intellectual Property Rights” means patents, copyright, database rights, trade marks, rights in designs, trade secrets and all other intellectual property rights, whether registered or unregistered, anywhere in the world.

“Onboarding Fee” means the one-off fee for configuring the Service and onboarding the Client, as set out in the Order Form.

“Order Form” means the written order or proposal, accepted by both parties, that sets out the number of Sites, pricing tier, billing frequency, Subscription Fee and Onboarding Fee.

“Service” means the SiteAssure platform, accessed at app.siteassure.app and made available as software-as-a-service.

“Site” means a physical location or operational unit registered by the Client in the Service.

“Subscription Fee” means the recurring fee for the Service, as set out in the Order Form.

“Subscription Period” means the initial term set out in the Order Form and each renewal term.

“Users” means individuals authorised by the Client to access the Service under the Client's account, in the roles of client administrator, site manager or responsible person.

2. The Service

2.1Subject to payment of the fees and compliance with these Terms, we grant the Client a non-exclusive, non-transferable licence to access and use the Service during the Subscription Period, solely for the Client's own internal business purposes.

2.2The Service supports health and safety compliance management across the Client's registered Sites. It may not be resold or used to manage compliance on behalf of the Client's own customers unless we agree in writing.

2.3The Service sends automated email reminders and escalations to Users, based on review dates, obligation status and action deadlines recorded in the Service. These emails are sent from hello@siteassure.app, which does not receive replies.

2.4We may update and improve the Service from time to time. We will give at least 30 days' written notice of any change that materially reduces existing functionality.

2.5We may release new features or modules. These may be included in the Client's subscription or offered at additional cost, as we will notify in advance.

3. User accounts

3.1The Client may create as many User accounts as it needs. There is no per-user charge.

3.2Each User must have their own login. Credentials must not be shared between individuals.

3.3The Client is responsible for keeping User credentials secure, for ensuring Users comply with these Terms, and for all activity under its Users' accounts.

3.4The Client must tell us promptly at info@crimson-compass.com if it becomes aware of unauthorised access to the Service or of compromised credentials.

3.5We may suspend a User account where we reasonably suspect a security incident or a breach of these Terms. We will notify the Client promptly when we do so.

4. Acceptable use

4.1The Client must use the Service in accordance with these Terms, the Documentation and all applicable laws.

4.2The Client must not, and must ensure its Users do not:

(a)reverse-engineer, decompile or attempt to derive the source code of the Service;

(b)sub-license, resell, rent or provide access to the Service to anyone outside the Client's organisation;

(c)use bots, scrapers or other automated extraction tools against the Service;

(d)introduce viruses, malware or other harmful code;

(e)attempt to gain unauthorised access to the Service or its underlying systems; or

(f)use the Service in a way that disrupts or impairs it for other customers.

4.3The Client is responsible for the accuracy and completeness of Client Data and for keeping it up to date.

5. Fees and payment

5.1The Subscription Fee is charged per Site per month at the rate for the Client's pricing tier, as set out in the Order Form. Our current list prices are published at siteassure.app.

5.2Where annual billing is selected, the Subscription Fee for the year is invoiced in advance at the start of each Subscription Period, at the annual-billing rate. Where monthly billing is selected, the Subscription Fee is invoiced monthly in advance.

5.3The Onboarding Fee is invoiced when the Order Form is signed. It covers configuration and onboarding and is non-refundable once onboarding work has started.

5.4Sites added during a Subscription Period are charged pro rata from the date they are added, at the Client's tier rate. If the total number of Sites moves the Client into a different pricing tier, the new tier rate applies from the next invoice.

5.5All fees are exclusive of VAT, which is payable in addition at the applicable rate.

5.6Invoices are payable by bank transfer within 30 days of the invoice date.

5.7We may charge interest on overdue amounts under the Late Payment of Commercial Debts (Interest) Act 1998.

5.8If an invoice remains unpaid 14 days after its due date, we may suspend access to the Service on written notice until all overdue amounts are paid. Suspension does not affect the Client's obligation to pay.

5.9We may change the Subscription Fee with effect from a renewal date by giving at least 60 days' written notice. The Client may then cancel by notice before the renewal date instead of accepting the new fee.

6. Term, renewal and cancellation

6.1The Subscription Period starts on the date set out in the Order Form and runs for the initial term selected (monthly or annual).

6.2Unless either party gives written notice at least 30 days before the end of the current Subscription Period, the subscription renews automatically for a further period of the same length.

6.3The Client may cancel by written notice to info@crimson-compass.com. Cancellation takes effect at the end of the current Subscription Period. Except under clause 6.4, no refund is given for any unused part of a prepaid period.

6.4Within the first 14 days of an initial annual Subscription Period, the Client may cancel and receive a full refund of the Subscription Fee paid for that period. The Onboarding Fee is not refundable once onboarding work has started.

7. Availability and support

7.1We will use reasonable endeavours to make the Service available at least 99% of the time in each calendar month, excluding planned maintenance and events outside our reasonable control.

7.2We will try to carry out planned maintenance outside UK business hours and give reasonable advance notice where practicable.

7.3We cannot guarantee delivery of every automated email, for example where delivery is blocked by the recipient's email systems.

7.4Support is available by email at info@crimson-compass.com and by phone on 01256 410642, Monday to Friday, 09:00 to 17:30 UK time, excluding public holidays in England. We aim to respond within two business days.

8. Client Data

8.1The Client owns all Client Data. We claim no ownership of it.

8.2The Client grants us a limited licence to process Client Data only to provide, maintain and support the Service for the Client.

8.3We will not sell Client Data or use it for any other purpose, except where required by law.

8.4We maintain appropriate technical and organisational security measures, including encryption in transit and at rest, and role-based access controls.

8.5The Client is responsible for having the rights and permissions needed to put Client Data into the Service, including personal data about its staff.

8.6Each party's data protection obligations are set out in Schedule 1 (Data Processing Agreement).

9. Intellectual property

9.1We and our licensors own all Intellectual Property Rights in the Service, including its software, design, Documentation and our curated library of compliance obligations. These Terms do not transfer any of those rights to the Client.

9.2The Client retains all Intellectual Property Rights in Client Data.

9.3If the Client gives us feedback or suggestions, we may use them freely without obligation.

9.4We may name the Client as a customer, including using its name and logo on our website and in proposals, unless the Client asks us in writing not to.

10. Confidentiality

10.1Each party will keep the other party's Confidential Information confidential and use it only to perform or receive the Service under these Terms.

10.2Confidential Information may be disclosed only to employees, contractors and advisers who need to know it and who are bound by equivalent obligations of confidentiality.

10.3These obligations do not apply to information that is or becomes public through no breach of these Terms, was already known to the recipient without restriction, is independently developed, or must be disclosed by law or by a court or regulator (in which case the recipient will give prompt notice where lawful).

10.4This clause continues for five years after the Agreement ends.

11. Compliance disclaimer and warranties

11.1To the extent permitted by law, all warranties, conditions and terms implied by statute or common law are excluded.

11.2We do not warrant that the Service will be uninterrupted or error-free, or that it will meet requirements the Client has not agreed with us in writing.

11.3The Client should keep its own records of material compliance information and should not rely on the Service as its only record.

12. Limitation of liability

12.1Nothing in these Terms limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot be limited or excluded by law.

12.2Subject to clause 12.1, our total liability arising under or in connection with the Agreement, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to the total fees paid by the Client in the 12 months before the event giving rise to the claim.

12.3Subject to clause 12.1, neither party is liable for loss of profits, revenue, business, contracts, anticipated savings or goodwill, or for any indirect or consequential loss.

12.4We are not liable for loss caused by inaccurate or incomplete Client Data, by the Client's failure to keep its own records, or by the Client's breach of these Terms.

13. Indemnity

The Client will indemnify us against claims, losses and reasonable costs arising from (a) Client Data that infringes a third party's rights, or (b) the Client's use of the Service in breach of applicable law.

14. Termination

14.1Either party may terminate the Agreement immediately by written notice if the other party (a) commits a material breach and, where the breach can be remedied, fails to remedy it within 30 days of written notice, or (b) becomes insolvent, enters administration, liquidation or receivership, or makes an arrangement with its creditors.

14.2We may terminate or suspend the Service immediately by written notice if the Client fails to pay an overdue invoice following a written reminder, or breaches clause 4.2 in a way that puts the Service or other customers at risk.

15. What happens when the Agreement ends

15.1All User access ends when the Agreement ends.

15.2For 30 days after the Agreement ends, the Client may request an export of Client Data in CSV or JSON format by emailing info@crimson-compass.com. We will provide it within 5 business days of the request.

15.3We will delete Client Data within 90 days after the end of that 30-day export window, unless the law requires us to keep it.

15.4Clauses 1, 8.3, 9, 10, 11, 12, 13, 15 and 17 survive the end of the Agreement.

16. Events outside our control

Neither party is liable for delay or failure to perform caused by events outside its reasonable control, including failures of the internet, hosting providers or other third-party infrastructure. The affected party will notify the other promptly and take reasonable steps to limit the impact.

17. General

17.1Entire agreement. The Agreement is the entire agreement between the parties about the Service and replaces any earlier discussions or arrangements. If the Order Form conflicts with these Terms, the Order Form prevails.

17.2Changes to these Terms. We may update these Terms by giving at least 30 days' written notice. If a change materially disadvantages the Client, the Client may terminate before it takes effect and receive a pro rata refund of any prepaid Subscription Fee.

17.3Severability. If any provision is found unenforceable, the rest of the Agreement continues in force.

17.4Waiver. A delay in exercising a right is not a waiver of it.

17.5Assignment. The Client may not assign the Agreement without our written consent. We may assign it as part of a reorganisation or sale of our business.

17.6Third parties. No one other than the parties has any right to enforce these Terms under the Contracts (Rights of Third Parties) Act 1999.

17.7Notices. Notices must be in writing. Notices to us go to info@crimson-compass.com or our registered office. Notices to the Client go to the contact details in the Order Form.

17.8Governing law. These Terms and any dispute arising from them are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

S1. Definitions

"Data Protection Legislation" means the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications Regulations 2003, each as amended. "Controller", "Processor", "Personal Data", "Data Subject", "Personal Data Breach" and "processing" have the meanings given in the Data Protection Legislation.

S2. Roles

S2.1The Client is the Controller and we are the Processor of Personal Data contained in Client Data.

S2.2We process Personal Data only on the Client's documented instructions. The Agreement and the Client's configuration and use of the Service are those instructions. We will tell the Client if we believe an instruction breaks the Data Protection Legislation.

S3. Our obligations

We will:

(a)process Personal Data only to provide the Service and as instructed by the Client;

(b)ensure that anyone authorised to process Personal Data is bound by confidentiality;

(c)maintain appropriate technical and organisational security measures, including encryption in transit and at rest, and role-based access controls;

(d)notify the Client without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Client Data;

(e)help the Client respond to Data Subject requests, as far as reasonably possible;

(f)help the Client meet its obligations on security, breach notification and data protection impact assessments, taking into account the nature of the processing;

(g)delete or return Personal Data when the Agreement ends, in line with clause 15; and

(h)make available the information reasonably needed to demonstrate compliance with this Schedule and allow reasonable audits on written notice, at the Client's cost.

S4. Sub-processors

S4.1The Client authorises us to use the following sub-processors:

S4.2We will give at least 30 days' written notice before adding or replacing a sub-processor. The Client may object on reasonable data protection grounds within 15 days, and the parties will discuss the objection in good faith.

S4.3We impose data protection terms on each sub-processor that are no less protective than this Schedule, and we remain responsible for their performance.

S5. International transfers

S5.1Transfers from the UK to the European Economic Area are covered by UK adequacy regulations.

S5.2Where Personal Data is transferred to or accessed from the United States or another country without UK adequacy, we rely on the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the International Data Transfer Agreement or the International Data Transfer Addendum issued by the Information Commissioner.

S5.3Details of the safeguards used are available on request from info@crimson-compass.com.

S6. Details of processing