Licence Agreement

1. Parties

PELLCOMP SOFTWARE LIMITED incorporated and registered in England and Wales, company number 01970712, whose registered office is at:

Gladstone House, 28 St. Giles Street, Norwich NR2 1LL (the "Supplier"); and

the purchaser of this Software and any other services provided by the Supplier as agreed in the formal Proposal; (the “Customer”).

The Supplier is the entire legal and beneficial owner and licensor of certain software products and the provider of a customer/data hosting services.

2. Definitions

The definitions and rules of interpretation in this clause apply in this Agreement. “Agreement” this is this Software Licence Agreement willingly entered in to by the Parties.

“Agreement Start Date” the date that the first Software is made available for live use to the Customer.

“Agreement Stop Date” one calendar year from the Agreement Start Date, or the last day of any calendar month thereafter unless the Agreement is terminated in accordance with its terms.

“Data Centres” purposed, Tier 3, centres where the Supplier hosts the Software and the Customer’s data.

“Data Protection Legislation” all applicable data protection and privacy legislation in force from time to time in the UK including without limitation the UK GDPR; the Data Protection Act 2018 (and regulations made thereunder) (“DPA 2018”); and the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) as amended; and all other legislation and regulatory requirements in force from time to time which apply to a party relating to the use of personal data (including, without limitation, the privacy of electronic communications); and the guidance and codes of practice issued by the Commissioner or other relevant regulatory authority and which are applicable to a party.

"Fee" the fee payable by the Customer to the Supplier.

"Intellectual Property Rights" patents, utility models, rights to inventions, copyright and related rights, trademarks and service marks, trade names and domain names, rights in get-up, goodwill and the right to sue for passing off or unfair competition, rights in designs, rights in computer software, database rights, rights to preserve the confidentiality of information (including know-how and trade secrets) and any other intellectual property rights, including all applications for (and rights to apply for and be granted) renewals or extensions of, and rights to claim priority from, such rights and all similar or equivalent rights or forms of protection which subsist or will subsist, now or in the future, in any part of the world.

"Maintenance Releases and Modifications" releases of Software that correct faults, adds functionality or otherwise amend or upgrade the Software.

“Proposal” the proposal sent by the Supplier to the Customer setting out a Fee quotation, as accepted by the Customer.

“Release Notes” the release notes that relate to each Maintenance Release and Modification which shall be available for download from the Supplier's website.

"Routine Maintenance Window" the weekly time period that routine patches and upgrades to hosting systems are performed, including security updates and patches, system configuration changes, planned hardware updates etc. The Routine Maintenance Window is Thursday 18:00 - Friday 06:00 every week.

"Software" the computer programs listed in the Proposal and any Maintenance Release which is acquired by the Customer during the term of this Agreement.

“Support Hours” 9.00 am to 5.30 pm Monday to Thursday, 9.00 am to 4.00 pm on Friday except for English bank holidays and for the Christmas period when the Supplier will be closed (details are published on the Supplier's website).

“Support Services” the support services described in Schedule 1 of this Agreement which are to be provided by the Supplier to the Customer.

“Term” the period starting on (and including) the Agreement Start Date and ending on (and including) any Agreement Stop Date supplied by the Customer to the Supplier.

“UK GDPR” the retained EU law version of the General Data Protection Regulation ((EU) 2016/679).

“Warranty Period” the period of 30 days following the Agreement Start Date during which the Customer may report errors or anomalies in the data that have arisen from any data migration from sources delivered to the Supplier by the Customer.

3. Agreement

Each party confirms it is acting on its own behalf and not for the benefit of any other person.

3.1 Description

The Supplier agrees to supply to the Customer, a non-exclusive licence to use the Software in accordance with the terms of this Agreement for the purpose of processing the Customer's data for the normal business purposes of the Customer (which shall not include allowing the use of the Software by, or for the benefit of, any person other than an employee of the Customer or consultant engaged by the Customer).

The Supplier agrees to provide a secure data hosting service to Customers, in accordance with the terms of this Agreement.

Both the licence to use the Software and provision of the hosting service commence on, and include, the Agreement Start Date and will continue for the Term.

3.2 What is included

The Supplier grants to the Customer a non-exclusive licence to use the Software in accordance with the terms of this Agreement.

The Supplier agrees to host the Customer’s data at the UK Data Centres.

The Supplier will provide and install Maintenance Releases and Modifications (within the Term) free of charge.

The Supplier will install Patches and security updates on a regular basis in line with the Service Availability Statement in Schedule 2.

3.3 What is excluded

The Customer or any third party may not copy, adapt, reverse engineer, decompile, disassemble, modify, adapt or make error corrections to the Software in whole or in part.

The Customer may not use information provided by the Supplier or obtained by the Customer to create any software whose expression is substantially similar to that of the Software nor use such information in any manner which would be restricted by any copyright subsisting in it.

The Customer shall not sub-license, assign or novate the benefit or burden of this Licence in whole or in part or allow the Software to become the subject of any charge, lien or encumbrance; and deal in any other manner with any or all of its rights and obligations under this Agreement, without the prior written consent of the Supplier.

Should the Customer wish to grant access to the Software to any third party such as a contractor or sub-contractor not employed or engaged by the Customer for a legitimate business use it shall first obtain the prior written consent of the Supplier. The Customer hereby agrees to pay the reasonable costs for broadening the scope of the licence granted via this Agreement to cover this additional access or use of the Software as agreed in writing between the Parties.

No third party contractor or sub-contractors working for the Customer will be granted access to the Data Centres.

The Supplier will not be liable for any costs incurred by the Customer where physical and IT security has to be improved by the Customer in connection with any licence or service provided by the Supplier.

3.4 Copyright

The Supplier is the holder of the copyright for all software developed and supplied by them. Where the Supplier utilises software created or owned by others it is done so under licence from the copyright holder.

3.5 Notification regarding data collection and processing

The Supplier must collect data about the Customer including financial information and contact details for individuals to create a Customer account. The Customer should make efforts to

maintain the ongoing accuracy and validity of the data they provide for this purpose in accordance with Data Protection Legislation.

To transfer details of Customer clients into the Software the Supplier must process data about the clients (where the action of processing is defined by Data Protection Legislation). To do this the Supplier requires access to the Customer’s existing software and the Customer's data.

To provide Support Services to the Customer there may be occasion when the Supplier requires access to the Software and the client data where client data is determined by the Customer as the information needed in support of their business function. Access to this data will be restricted and, where possible, the data will be anonymised. Personal data processed in a support capacity will only be retained for as long is necessary and in line with Data Protection Legislation.

4. Obligations of the Supplier

4.1 Installation

The Supplier shall install on the Supplier’s hosting environment one copy of the Software, and if agreed with the Customer additional copies for testing and/or training.

The Supplier will provide access details to the Customer to enable access to the Software.

4.2 Initial Training

The Supplier shall provide or procure Training (“Initial Training”) for a number of the Customer’s staff. The quantity, timing and format of the Initial Training will be agreed with the Customer to suit the Customer’s needs. Initial Training not taken within six months of the Agreement Start Date may be forfeited.

The Supplier may use a copy of the Customer's client data for the Initial Training, to maximise the effectiveness of the Training. In this case that copy(s) of the data will be held securely and only used for the Initial Training and permanently deleted after the training. Customer data will not be shared with any third party or used to train any other third party.

4.3 Set Up

The Supplier shall create accounts for Customer staff to access the Software, and provide at least one supervisor account to the Customer to allow management of further customer accounts.

If Data is being imported from other systems, this will be made available to the Customer and the data migration will be deemed to have been accepted when the Customer starts operational use of the Software and no representations have been made within the warranty period.

4.4 Support

The Supplier shall supply Support Services as part of the Licence as set out in Schedule 1 of this Agreement.

4.5 Maintenance

The Supplier shall deliver and install any Maintenance Releases and Modifications in accordance with this Agreement.

In order to maintain sufficient levels of security around any hosted data the Supplier will conduct regular monitoring of Supplier activity, of Customer data move requests investigating and reporting on any unusual activity. Additionally, the Supplier will provide security updates and patches to the hosted environment on a regular basis.

5. Obligations of the Customer

5.1 Recording of Customer contacts

As part of the process of agreeing to a Proposal the Customer will provide the Supplier with contact details for the person(s) who will be responsible for checking and maintaining the details of the data controllers, Customer provided data processors (as defined in the Data Protection Legislation) and all other parties who need access to the Software and client data as well as the details of the person(s) involved in the management and support of this Agreement including, but not limited to, IT support, the finance department, etc.

It is the responsibility of the Customer to keep all user and supporting staff records up to date. Requests from unregistered users for access to the Software or from end users for increased access will always be declined by the Supplier unless the request is accompanied by an authorisation sent separately from a registered Supervisor or Manager. The Supplier will not accept responsibility should contact be made with an unauthorised user where the Customer has not provided updates and corrections as required.

The Customer and the Supplier agree and acknowledge that for the purpose of the Data Protection Legislation:

the Customer is the Controller and the Supplier is the Processor (such terms as defined in the Data Protection Legislation).

the Customer retains control of the Personal Data (as defined in the Data Protection Legislation) and remains responsible for its compliance obligations under the Data Protection Legislation, including but not limited to, providing any required notices and obtaining any required consents, and for the written processing instructions it gives to the Provider.

5.2 Integrity of the data

The Supplier will deliver data for use with the Software that may include data that has been migrated from legacy systems. Whilst the Supplier will check data for errors and report any issues with migrated data to the Customer, it is the Customer’s responsibility to check the data for errors and report any errors to the Supplier before live use of the Software. Acceptance of the Software deems acceptance of any migrated data. The Supplier will retain any source data supplied by the Customer and data delivered to the Customer (in line with its data protection policy) for up to 3 months after the Agreement Start Date to assist in the resolution of any anomalies reported by the Customer and will commit to correcting such anomalies that can

6.2 Renewal and consent

The Term continues indefinitely until terminated. At any time after an initial period of 12 months from the Agreement Start Date the Customer or the Supplier may Terminate this Agreement on accordance with the provisions set out in section 7.

During the Term, all terms within this Agreement (and therefore the Licence), including consents to process data, apply.

7. Termination of the Agreement

For avoidance of doubt, any reference to the Customer in this section 7 includes any appointed representative, administrator, agent of the court or equivalent acting for the Customer where the Customer has eased trading for reasons of insolvency, administration, pending prosecution.

7.1 Termination for convenience

Should a Customer choose to terminate the services of the Supplier they should provide notice to the Supplier in writing at least 1 calendar month before the desired Agreement Stop Date.

Should the Supplier choose to terminate this Agreement, it will provide notice to the Customer in writing at least 3 calendar months (or such longer period as may be agreed in advance in writing between the parties) before the specified Agreement Stop Date.

Whether notice is given by the Customer or the Supplier, the Agreement Stop Date must be the last day of a calendar month that is 12 months or more after the Agreement Start Date. After the Agreement Stop Date support to the Customer will be suspended and monthly Fees will stop. The Supplier will advise the customer on options for archiving the data in an accessible format prior to termination.

7.2 Notice period

If a Customer fails to pay any monies due under this Agreement on the stated due date and remains in default for 14 days or more after being notified in writing to make such payment, access to the Software may be disabled until the account is in credit. If payment continues to be withheld then the Supplier will be entitled to terminate this Agreement and take actions to recover monies owed and to return or delete the data. The Supplier reserves the right to retain Customer data in a secure, off-line location until any outstanding business transactions are concluded.

7.3 Termination for cause

If either party commits a material breach of any term of this Agreement and fails to remedy that breach within a period of 14 days after being notified in writing to do so; is unable to pay its debts as they fall due or admits an inability to pay its debts or is deemed unable to pay its debts within the meaning of section 123 of the Insolvency Act 1986 then;

• The Customer shall immediately return, retain or destroy (at the Supplier's discretion) all copies of the Software then in its possession, custody or control and, in the case of destruction, certify to the Supplier that it has done so; and

• The Supplier shall immediately return, retain or securely destroy (at the Customer’s discretion) all client data belonging to the Customer and other confidential information pertaining to the Customer and certify to the Customer that it has done so

8. Data protection and security

Each party, during the term of this Agreement and thereafter, shall not use for its own purposes (other than implementation of this Agreement) without the prior written consent of the other, disclose to any third party (except its professional advisors or as may be required by any law or any legal or regulatory authority) any information of a confidential nature (including trade secrets and information of commercial value) which may become known to each party from the other and which relates to the other party or any of its affiliates. This will not apply where that information is public knowledge or already known to such party at the time of disclosure, or subsequently becomes public knowledge other than by breach of this Agreement, or subsequently comes lawfully into the possession of either party from a third party.

8.1 Supplier commitments

The Supplier agrees only to process the data for and on behalf of the Customer for the purposes of performing its obligations under this Agreement and only in accordance with the terms of this Agreement and any instructions from the Customer where the instructions do not conflict with current legislation or are contrary to the terms set out in this Agreement.

The Supplier agrees to process the data in accordance with Data Protection Legislation and shall not, whether by act or omission, cause the Customer to breach any of its obligations under the Data Protection Legislation.

The Supplier is committed to the secure storage of data, both of its Customers, their clients and the activities of all. The Supplier shall take, implement and maintain appropriate technical and organisational security measures to protect the data.

Data and Disaster Recovery backups are stored in secure data storage facilities. All storage devices are encrypted and destroyed at end of life.

The Supplier is ISO-27001:2013 certified and annually audited by UKAS recognised auditors.

The Supplier shall take all reasonable steps to confirm the reliability of any of its personnel or subcontractors who have access to Customer data and shall ensure that such personnel or subcontractors are subject to a duty of confidentiality in respect of the data. The Supplier confirms that no subcontractor has access to the Customer’s client data. The Supplier agrees not to transfer or permit the transfer of Customer controlled data outside of the UK or the European Union without the prior written consent of the Customer. Where the Customer provides written consent to a transfer the Supplier agrees to comply with any reasonable instructions the Customer deems necessary to ensure that the transfer has adequate protections and is compliant with the Data Protection Legislation.

The Supplier agrees not to subcontract any Services which involve the processing of the Customer’s client data without the Customer’s prior written consent. Where the Customer provides written consent to the subcontracting of such services, the Supplier agrees to impose on the subcontractor terms which are substantially the same as, and in any case no less onerous than, the terms set out in this Section 8 The Supplier agrees to provide the Customer with details of the subcontractors involved in the support of the Supplier’s business dealings with the Customer upon request.

In support of this Agreement, and its business functions, the Supplier currently uses some ‘off the shelf’ software under agreement. Some of these products are cloud based and the servers supporting these products may be based outside of the UK and the EEU. The Supplier requires that the third party providers operate in accordance with the GDPR, or similar legislation providing comparable levels of protection. The third party providers only process the information that is provided by the Supplier as required in support of our business functions, these functions include, but are not limited to, the processing of payments from the Customer to the Supplier and the compiling of financial reports for the Supplier

If the Supplier receives a request from an individual connected to the Customer to exercise their rights under Data Protection Legislation in relation to the data, or a complaint from an individual connected to the Customer under Data Protection Legislation, the Supplier will notify the Customer within 5 working days. The Supplier shall not respond to any such request or complaint without first consulting the Customer and obtaining their consent to the terms of the response. The Supplier further agrees to provide the Customer with all reasonable cooperation and assistance required by the Customer to comply with the request or complaint.

The Supplier may disable Customer user Active Domain accounts that remain unused for a period longer than 60 days, to maintain the security of the system. However the Customer may re-enable these accounts if they are required.

All payment processing conducted by the Supplier will be done in accordance with current legislation. Legislation is reviewed regularly to ensure the Supplier is compliant and up to date.

8.2 Exceptions

The Supplier is committed to the security, and privacy, of the Customer’s data and the data controlled by the Customer. Details of the data will never knowingly be revealed except under conditions described in the Data Protection Legislation.

8.3 In the event of breaches

The Supplier will indemnify and shall keep indemnified the Customer against any claims or liabilities that might arise from loss of data where such loss of data can be proven to be a direct result of any breach of the terms of this Agreement by the Supplier.

Each party shall make reasonable efforts to prevent the unauthorised disclosure of any information.

The Customer shall immediately notify the Supplier as soon as it becomes aware of any unauthorised use of the Software by any person. In the event that unauthorised access to the

Software has occurred the Customer and Supplier may agree a reasonable cost for broadening the scope of the Licence granted under this Agreement to cover this additional access or use of the Software.

The Supplier will notify the Customer immediately and within 24 hours of becoming aware of an actual or potential personal data breach involving the Customer’s data. In the event of a personal data breach the Supplier will make every reasonable effort to recover any lost data and to undertake a thorough investigation as to the cause of the breach and to undertake any and all necessary actions to prevent such an occurrence from happening again. Where appropriate, and with the Customer’s consent, the Supplier will notify the Information Commissioner’s Office and/or any affected data subjects about the breach in accordance with the Data Protection Legislation.

8.4 Deletion of data

In the event of a material breach between the Customer and the Supplier (as described in Termination of the Agreement) the Supplier agrees to return the Customer's data within 45 days. If the Customer refuses receipt of the data then, in accordance with Data Protection Legislation the Supplier will no longer have any legitimate cause to retain the data and will take the necessary steps to delete it in accordance to the terms set out in this Agreement.

In accordance with the Data Protection Legislation the Customer can request that the Supplier deletes any information held by the Supplier on the Customer, and on any third parties or contractors working for or on behalf of the Customer, information held on identities, financial arrangements, contact details and details about their Agreement at the end of the Term. The Supplier will comply except where the information also forms part of the Supplier’s records for financial and security purposes then the Supplier will undertake the necessary steps to archive the information in an off-line, secure location anonymising records where appropriate.

The Supplier agrees to delete all Personally Identifiable Information (PII) (as defined by the Data Protection Legislation) within three months of a Customer terminating their Agreement with the Supplier. This information will be stored in an off-line location with access restricted to key personnel. NOTE: the deletion will be permanent, any Customer returning to the Supplier after this time will need to go through the install process again.

9. Legal

9.1 Intellectual property rights

The Customer acknowledges that all Intellectual Property Rights in the Software, and any Maintenance Releases or New Versions of the Software, belong to the Supplier and the Customer has no rights to the Software other than the right to use it in accordance with the terms of this Agreement.

The Customer shall keep a complete and accurate record of the Customer's copying and disclosure of the Software and its users and produce such record to the Supplier on request.

9.2 Supplier warranties - Software

If, within the Warranty Period, the Customer notifies the Supplier in writing of any defect or fault in the Software and as a consequence the Software fails to conform in all material respects to the specification and the defect, or fault, does not result from the Customer; or anyone acting with the authority of the Customer; having amended the Software or used it outside the terms of this Agreement for a purpose or in a context other than the purpose or context for which it was designed; or in combination with any other software not provided by the Supplier; or it has not been loaded onto Customer specified suitably configured equipment, the Supplier shall, at the Supplier's discretion, do one of the following:

• repair the Software;

• replace the Software; or

• terminate this Agreement immediately by notice in writing to the Customer and refund

  any of the monies paid by the Customer at the date of termination (less a reasonable sum in respect of the Customer's use of the Software to the date of termination). This is subject to the Customer having provided all the information that may be necessary to assist the Supplier in resolving the defect or fault including a documented example of any defect or fault or sufficient information to enable the Supplier to re-create the defect or fault.

  Updates to the Software issued by the Supplier will be subject to the above warranties with a similar 30 day warranty period applying to each update.

9.3 Supplier warranties – Data hosting

The Supplier will make every reasonable effort to maintain the security and privacy of all data provided by the Customer. The security systems of the Supplier will be monitored and regularly reviewed to ensure the highest standards are being maintained; the latest security alerts are acted on where appropriate; security patches and updates are applied to both the Supplier’s systems and the Customer’s data; access to both the Data Centres and the Customer’s data is restricted to specific personnel and to licenced sub-contractors to the Supplier.

9.4 Customer rights

The Customer has the right to request support and assistance with the operation of the Software supplied in accordance with the terms set out in this Agreement.

The Customer has the right to repairs to and/or the replacement of faulty Software in accordance with the terms set out in this Agreement.

The Customer has the right to carry out an inspection, or equivalent, of the Supplier, the Supplier will make every effort to comply with reasonable requests made of it in the course of this enquiry.

9.5 Limits of liability

The Supplier shall not, under any circumstances, have any liability for any losses or damages which may be suffered by the Customer (or any person claiming under or through theCustomer), whether the same are suffered directly or indirectly or are immediate or consequential, and whether the same arise in contract, tort (including negligence) or otherwise, which fall within any of the following categories:

• special damage even if the Supplier was aware of the circumstances in which such special damage could arise;

• loss of profits;

• loss of anticipated savings;

• loss of business;

• loss of goodwill;

• loss or corruption of data unless such a loss or corruption can be directly attributed to the Supplier’s negligence or failure of the Supplier’s hardware or security systems.

9.6 Governing law

This Agreement, and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims), shall be governed by and construed in accordance with the law of England and Wales.

Schedule 1 – Support Services

• The Supplier shall provide the Customer and a number of its staff (chosen by agreement between the Supplier and Customer) with the Initial Training in accordance with clause 4.2.

• The Customer, in consideration of payment of the Fee, shall have access throughout the Term to the Supplier’s web site resources including the Supplier’s support documents library and video library.

• The Supplier shall also provide the Customer with a help-desk service and shall ensure sufficient Support Staff are employed to fulfil its obligations under the terms of this Agreement. The Support Staff shall be suitably trained and experienced in the support and maintenance of the Software.

• The Supplier shall provide these Support Services during the Support Hours to provide first-line technical support to users of the Software in order to assist the Customer with general enquiries in connection with the Software.

• The Supplier may at its sole discretion, on prior notice to the Customer, make changes to the Support Hours.

• If the Customer reports a Minor Error (as defined in the table below) and this Minor Error is to be corrected in a forthcoming Maintenance Release, then for a reasonable period before the issue of such Maintenance Release the Supplier may decline to provide assistance in respect of that Minor Error.

• The Supplier shall issue Modifications of the Software as and when required and in whatever form by way of a local fix or patch of the Software or a temporary by-pass solution in the absolute discretion of the Supplier

• Save where faults arise from Customer following the directions of the Supplier, the Supplier shall have no obligation to provide the Support Services where faults arise from:

  • misuse, incorrect use of or damage to the Software from whatever cause (other than any act or omission by the Supplier), including failure or fluctuation of electrical power;

  • use of the Software in combination with any equipment or software not provided by the Supplier or not designated by the Supplier for use with any Modification forming part of the Software, or any fault in any such equipment or software;

  • any breach of the Customer's obligations under this Agreement howsoever arising or having the Software maintained by a third party;

  • any Modification not authorised by the Supplier; or

  •  operator error.