Terms & Conditions

Introduction

These Terms and Conditions explain how we provide our services and calculate our fees. We are committed to delivering expert, cost-effective data protection solutions tailored to your needs.

Once we accept your instructions, we will provide a Client Agreement. Please read these Terms alongside that Agreement, as together they form our contract with you.

Definitions

In these Terms:

Additional Services: Any tasks beyond the initial scope agreed upon in writing between the Consultant and the Client.
Agreement: The complete legal contract between the Consultant and the Client, formed by these Terms and the specific Client Agreement.
Applicable Laws: All laws, regulations and codes of practice applicable to the Services in the UK, including the Data Protection Laws.
Breach Intelligence Lab: The proprietary data analysis environment where anonymised incident data is processed to generate Predictive Resilience Alerts and Network Effect intelligence.
Business Day: Monday to Friday, excluding public holidays in England when clearing banks are open for business.
Client Agreement: The document, such as a proposal or statement of work, specifying the bespoke services, fees and timelines for a specific project.
Client Materials: All data, documentation and assets provided by the Client to the Consultant for the performance of the Services.
Client Personal Data: Personal Data provided by the Client that the Consultant processes solely to deliver the Services.
Confidential Information: Any non-public information, including trade secrets and technical data, disclosed by either party during the engagement.
Data Protection Fee: The annual fee paid to the Information Commissioner’s Office (ICO). As a sole trader, you must confirm that you are registered and have paid this fee.
Data Protection Laws: All applicable data protection and privacy legislation in force in the UK, including the UK GDPR and the Data Protection Act 2018, as amended.
Digital Records: The electronic records the Consultant is required to maintain from April 2026 under Making Tax Digital (MTD) for income tax purposes.
EEA: The European Economic Area.
GDPR: The UK GDPR or the EU GDPR, whichever applies to the specific processing activity.
Initial Triage Period (ITP): The first 30 minutes of expert advice provided immediately following the reporting of a suspected incident via the Rapid Resilience Link.
Instructions: The written directions from the Client detailing how the Consultant should process Client Personal Data.
Professional Indemnity Insurance: The insurance policy held by the Consultant to cover professional negligence, as required by many consultancy frameworks.
Rapid Resilience Link: The 24/7/365 emergency access service providing priority communication with a Senior Data Protection Consultant for the purpose of the Initial Triage Period.
Reportable Incident: Any suspected or confirmed personal data breach that meets the threshold for notification to the Information Commissioner’s Office (ICO) or other relevant regulatory bodies.
Services: The consultancy and data protection services, including deliverables, as defined in the Client Agreement.
Strategic Advisory Blocks: Pre-paid increments of professional time, such as 5- or 10-hour blocks, used to fund work within the Tactical Response Bridge or for proactive consultancy.
Sub-processor: Any third party, excluding the Consultant’s direct employees, engaged by the Consultant to process Client Personal Data.
Tactical Response Bridge: The period of active incident management occurring after the Initial Triage Period and within the 72-hour regulatory window, primarily focused on containment and mandatory filings.
UK GDPR: Has the meaning given in section 3(10) of the Data Protection Act 2018.
Consultant / Us / We / Our: True North Data Governance and Compliance Consultancy Ltd, whose primary place of business is Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA.
You / Your: The individual or organisation identified as the Client in the Client Agreement.

Our Services

When we are instructed to act for you, we will issue a Client Agreement detailing the specific services, deliverables and fees.

The Client Agreement must be read alongside these Terms and, together, they form our complete contract.

In the event of any conflict or inconsistency between these Terms and the specific Client Agreement, the terms of the Client Agreement shall take precedence.

Our Agreement officially begins on the date you provide written confirmation of the details and fees set out in the Client Agreement (the Commencement Date).

We will perform the Services as instructed in our Client Agreement. All quoted prices and schedules are estimates and may be adjusted if the scope of work changes or if additional tasks are requested.

We will always confirm significant variations with you in writing.

Opening Times

We are contactable on Business Days between 08:00 and 19:00 UK time.

We will respond to telephone calls as soon as possible and within the same day the call is received.

All other correspondence will be responded to within 2 Business Days. We will respond to communications electronically unless another communication method has been agreed.

Responsibilities

Our responsibilities

We are responsible for:

Delivering the Services with reasonable care and skill and in accordance with relevant established professional standards.
Delivering the Services in line with agreed timescales outlined in the Client Agreement.

We provide specialist consultancy, regulatory guidance and guidance on legal frameworks as an unregulated provider.

We are not solicitors and are not regulated by the Solicitors Regulation Authority (SRA).

Our Services do not include “reserved legal activities”, as defined by the Legal Services Act 2007, such as the conduct of litigation or the preparation of court documents.

Our professional relationship is that of Consultant and Client. Advice is therefore not subject to legal professional privilege, and there is no client compensation fund or access to the Legal Ombudsman.

Your responsibilities

Accuracy of Information:
You shall provide all documents, data and information required for the Services in a timely manner. You warrant that all information provided is accurate, complete and not misleading.

We shall not be liable for advice given on the basis of inaccurate or incomplete information provided by you.

Access and Cooperation:
You shall provide us with such access to your personnel, premises and data systems as is reasonably required to perform the Services.

Legal Basis for Sharing Data:
You warrant that you have a valid lawful basis under applicable UK or EU Data Protection Laws to share any Personal Data with us for the purposes of the consultancy.

Final Responsibility for Compliance:
You acknowledge that, while we provide specialist guidance and regulatory advice, ultimate responsibility for your organisation’s legal and regulatory compliance remains with you.

Our advice does not absolve you of your statutory duties as a Data Controller.

Timely Feedback:
You agree to review deliverables and provide feedback or approvals within 5 working days.

Delays in your response may result in an adjustment to the project timeline and/or final quote.

Security and Health & Safety:
You shall inform us of any security protocols or health and safety requirements applicable to your premises or systems before work begins.

Confidential Information

During this Agreement, we may share confidential information with each other. This may include technical details, business plans or personal information relating to customers, suppliers or employees.

Both parties agree to keep this information confidential, not disclose it to third parties, and use it only to carry out their responsibilities under this Agreement, unless disclosure is required by law or by a court.

Information will not be considered confidential where it is already publicly available, becomes public through no fault of the receiving party, or is lawfully received from another person without a duty of confidentiality.

We may refer to the fact that we are working together and to the type of Services being provided, but only with each other’s permission.

We will comply with all relevant Data Protection Laws when storing and processing Personal Data you provide to us.

Fees and Charges

Our fees are calculated according to the rates set out in your Client Agreement.

Quoted fees exclude external costs. These will be agreed separately and invoiced at cost.

We will maintain a digital record of all time spent on work, with time recorded in 10-minute units. For example, a 5-minute call will be recorded as one 10-minute unit.

We reserve the right to charge for reasonable and evidenced expenses incurred as a result of our obligations to you in relation to the Services.

These expenses will be approved by you in writing in advance, except where we have made reasonable efforts to obtain approval and have been unable to do so.

We will provide at least 90 days’ written notice before increasing our standard rates.

If work is delayed by you or by a third-party supplier working for you, we reserve the right to charge for additional time required to manage the rescheduling, regardless of any initial fixed estimate.

All fees are subject to applicable UK taxation. VAT will only be charged if our turnover exceeds the applicable VAT registration threshold.

Cancellation and Rescheduling

We reserve specific time in our schedule to deliver your consultancy. If you need to cancel or postpone a scheduled session, the following provisions apply:

Virtual or Remote Meetings:
No fee will be charged if written notice is received at least 2 Business Days before the scheduled time.
On-site or Full-Day Sessions:
No fee will be charged if written notice is received at least 5 Business Days before the scheduled time.
Late Cancellation:
If notice is received later than the periods stated above, we reserve the right to charge 50% of the scheduled fee.

We will always endeavour to use the allocated time to progress other tasks on your behalf in order to minimise any loss to your project.

Billing and Payment Terms

To ensure consistent service delivery, we apply the following payment structures based on the total value of the Client Agreement:

Projects up to £2,500

A fee equal to 100% of the total cost will be invoiced upon signing the Client Agreement. Work will commence once payment is received.

Projects from £2,501 to £7,500

Payment is due in two stages. 50% of the total fee is invoiced upon signing and is payable immediately.

The remaining 50% is due upon completion of the project or 6 months from the Commencement Date, whichever is sooner.

Projects over £7,501

Payment is due in three stages:

40% upon signing the Client Agreement;
30% at the project midpoint; and
30% upon completion.

Standard Terms:
Unless otherwise agreed in the Client Agreement, our standard payment terms are 14 days from the date of invoice.

Payment Method:
Payments should be made by direct bank transfer to the account details shown on our invoices.

Project Stalls:
Where we have submitted work for your comment or approval, we request a response within 14 days.

After this period, we reserve the right to invoice any remaining balance due for that stage of work.

Late Payment:
In accordance with the Late Payment of Commercial Debts (Interest) Act 1998, we reserve the right to charge interest on overdue amounts and suspend all Services until the account is settled.

Invoice Queries:
Any queries regarding an invoice must be submitted in writing within 7 days of the invoice date.

Agreements for a fixed term of 12 months begin on the Effective Date. The Service will automatically terminate at 23:59 on the 365th day.

No Service will be provided after this point unless a new 12-month term is purchased.

Any hours remaining unused at the expiry of the term will be forfeited and have no cash value.

At the Consultant’s discretion, unused hours may instead be converted into a one-off Resilience Audit report in any service area.

Notices

All important communications relating to this Agreement must be in writing. They may be sent by hand, email or first-class post using the contact details provided by each party.

A notice will be considered received:

By hand: when it is delivered.
By email: when it is sent, unless the sender receives an error message.
By post: two working days after posting within the UK, or five working days after posting internationally.

If a notice arrives after 5:00 pm, it will be treated as received on the next working day.

If either party changes its contact details, it must notify the other party in writing.

The new details will take effect on the date stated in the notice or, if no date is given, five working days after the notice is sent.

Intellectual Property

You may use the materials we create for you for the purpose for which they were prepared.

We retain ownership of all copyright and intellectual property rights in any documents, reports, advice or other materials we provide, unless otherwise agreed in writing.

If you wish to use those materials for a different purpose, you will require our written permission.

Any content we create specifically for you and which relates solely to your business will belong to you once it has been delivered.

You retain ownership of all intellectual property rights in materials you provide to us.

You grant us permission to use those materials while working with you, solely for the purpose of providing the agreed Services.

Personal Data and Data Protection

If we process Personal Data on your behalf as part of our Services, we will comply with all applicable Data Protection Laws, including the UK GDPR.

We will only process Personal Data in accordance with your instructions and as necessary to provide the agreed Services.

You confirm that you have a lawful basis for sharing Personal Data with us and that the information provided is accurate and up to date.

We will keep Personal Data secure and confidential and will only share it with trusted third parties, including subcontractors, where necessary to deliver the Services.

Where we appoint such third parties, we will ensure that they are subject to appropriate data protection obligations.

We will not transfer Personal Data outside the UK or EEA unless appropriate safeguards are in place.

If there is a Personal Data Breach affecting Personal Data we process for you, we will notify you promptly and work with you to address it.

You are responsible for informing individuals about how their Personal Data will be used and for responding to requests from those individuals.

We will provide reasonable assistance where required.

For further information about how we handle Personal Data, please see our Privacy Notice.

Document Storage and Retention

We may store your documents electronically.

You should retain all documents relating to the work we undertake for you, including emails and other electronic data.

If this Agreement ends while amounts remain outstanding, we may retain your documents until payment is received.

We will retain our files for at least six years after the Agreement ends, or for a longer period if we notify you in writing.

After this period, files may be securely destroyed without further notice.

Termination of this Agreement

This Agreement starts on the Commencement Date and will continue until the Services are completed, it is terminated in accordance with these Terms, or any applicable drawdown arrangement expires.

You may end this Agreement at any time by providing written notice.

If you do so, all outstanding payments, including payment relating to unused contracted time, will become immediately payable and we will have no further obligation to provide Services.

Either party may terminate this Agreement immediately by written notice if the other party commits a serious breach and fails to remedy that breach within 30 days of being requested to do so.

We may also terminate this Agreement immediately if you:

cease or threaten to cease trading;
become insolvent;
make arrangements with creditors; or
persistently breach this Agreement.

The Agreement may also be terminated at any time by mutual written consent.

If we are unable to complete the Services for reasons caused by you and this continues for more than three months after we notify you, we may terminate the Agreement.

In that case, all outstanding payments, including unused contracted time, will become immediately payable.

When this Agreement ends, our obligations to provide Services will cease.

You must return any property or documents belonging to us on request or by the termination date, unless the law requires you to retain them.

Limitation of Liability

Neither party shall be liable to the other for any indirect or consequential loss or damage, including but not limited to:

loss of profits;
loss of contracts;
loss of reputation or goodwill;
increased costs of working; or
claims made by third parties.

To the fullest extent permitted by law, and except as expressly stated in this Agreement, we shall not be liable, whether in contract, tort (including negligence) or otherwise, for any loss arising from any person acting or failing to act in reliance on advice, information or materials provided as part of the Services or Additional Services, whether given orally or in writing.

We shall also not be liable for loss resulting from any failure to ensure that a document or form generated from the Services is appropriate or complete for its intended purpose.

All triage and advisory Services provided through the Rapid Resilience Link are based solely on the information provided by the Client at the time of the Incident.

The Client acknowledges that such advice is preliminary and dependent upon the accuracy and completeness of the information disclosed during the Initial Triage Period.

The Consultant is an advisory service provider and is not an insurer.

The Consultant does not provide any indemnity, express or implied, against regulatory fines, penalties or third-party claims arising from a Data Breach.

The Client remains at all times the Data Controller and retains ultimate legal responsibility for regulatory compliance and any associated financial liabilities.

Nothing in this Agreement shall limit or exclude liability for death or personal injury caused by negligence.

Subject to this, the total liability of either party under this Agreement shall not exceed the total fees paid under this Agreement or £10,000, whichever is lower.

Force Majeure

If an event occurs that is outside either party’s reasonable control, including war, fire, pandemic, epidemic, industrial disputes or civil unrest, the affected party must notify the other.

While the event continues, the affected party’s obligations under this Agreement will be suspended until it notifies the other party that the event has ended.

Dispute Resolution

If there is any disagreement concerning the meaning or effect of this Agreement, or any dispute connected with it, both parties will first attempt to resolve the matter through discussion and negotiation.

This does not apply to payments which are due under the Agreement.

Where a dispute arises, both parties agree to make reasonable efforts to resolve it amicably before considering legal proceedings, including consideration of mediation where appropriate.

Legal Status

Our relationship is that of independent contractor and client, not employer and employee.

This Agreement is non-exclusive and either party may work with other businesses.

Nothing in this Agreement creates a partnership or joint venture and neither party may make commitments or enter into agreements on behalf of the other unless expressly permitted by this Agreement.

General

This Agreement constitutes the entire agreement between us and overrides any other terms contained in your documents.

If any provision is found by a court to be invalid or unenforceable, the remaining provisions will continue in effect.

The Agreement may only be amended in writing and signed by both parties.

If either party does not enforce a provision at any particular time, this does not constitute a waiver of its right to enforce that provision later.

You may not transfer this Agreement or your rights under it without our prior written consent.