Broadsight Labs Ltd.
Version 2.0 · Effective date: 6 September 2026 · Supersedes the Terms of Use dated July 2026

Contents

Part A – Introduction

1. Who we are
2. How these Terms work and who they apply to
3. Definitions

Part B – Website Terms (broadsightlabs.co.uk and broadsight.energy)

4. Use of our websites

Part C – Platform Terms (Customers of the Broadsight Energy platform)

5. Order Forms, licences and trials
6. Authorised Users and accounts
7. Customer responsibilities
8. Acceptable use
9. Customer Data, data protection and security
10. Modules, professional judgement and safety
11. Metering data, accuracy and telemetry
12. Third-party services, data sources and integrations
13. Availability, maintenance and support
14. Fees, payment and taxes
15. Intellectual property
16. Confidentiality
17. Warranties and disclaimers
18. Indemnities
19. Limitation of liability
20. Term, suspension and termination

Part D – Authorised User Terms (individuals who use the Platform or the App)

21. Your obligations as an Authorised User

Part E – Broadsight Mobile End User Licence

22. Licence to use the App
23. Device permissions, offline data and security
24. App store terms

Part F – Metering Equipment and Connectivity Terms

25. Supply of Metering Equipment
26. Installation, use and safety
27. Connectivity

Part G – Support System and Status Page

28. Support portal, knowledge base and status page

Part H – General

29. Changes to the Services and to these Terms
30. Electronic communications, signatures and records
31. Notices
32. General legal terms
33. Governing law and jurisdiction

Schedules

• Schedule 1 – Data Processing Addendum
• Schedule 2 – Acceptable Use Policy
• Schedule 3 – Support Services
• Schedule 4 – Additional terms for app store distribution

Part A – Introduction

1. Who we are

1.1 These Terms of Service ("Terms") are issued by Broadsight Labs Ltd. ("Broadsight Labs", "we", "us", "our"), a company registered in England and Wales under company number 17126211, whose registered office is at 1 Tower House, Tower Centre, Hoddesdon, Hertfordshire, EN11 8UR, United Kingdom. We are registered with the Information Commissioner's Office as a data controller under reference ZC194002. We hold Cyber Essentials certification.

1.2 You can contact us at [email protected], by telephone on +44 (0)204 538 5011, or by post at our registered office. Security matters should be reported to [email protected] (see https://broadsightlabs.co.uk/.well-known/security.txt). Data protection matters should be sent to our Data Protection Officer at [email protected].

2. How these Terms work and who they apply to

2.1 These Terms govern the use of all of the products and services we provide (together, the "Services"):

2.2 Customers. If you are an organisation that has entered into an Order Form with us, or that otherwise holds a licence to use the Platform, you are a "Customer", and Part C, Schedule 1 (the Data Processing Addendum), Schedule 2 and Schedule 3 form part of your agreement with us. Where you have signed a separate written agreement with us that expressly overrides these Terms, that agreement prevails to the extent of any conflict.

2.3 Authorised Users. If you are an individual who uses the Platform or the App, whether as a member of a Customer's organisation, a contractor or freelancer granted access by a Customer, or a member of our staff, you are an "Authorised User" and Parts D and E (as applicable) and Schedule 2 apply to you personally. By signing in to the Platform or the App you accept them. Your organisation's licence, not these Terms, is what entitles you to use the Services.

2.4 Recipients. If you receive an email, a shared report, a certificate, a danger report or a work-order document from the Platform, or are asked to sign a document electronically through it, you are a "Recipient", and clauses 21.8, 30 and Part H apply to you.

2.5 Website visitors. If you only browse our websites, Parts B and H apply to you.

2.6 Business use only. The Services are designed for and supplied to businesses and other organisations. By using the Services you confirm that you are doing so in the course of a business, trade or profession and not as a consumer. If, despite this, you are a consumer within the meaning of the Consumer Rights Act 2015, nothing in these Terms affects your statutory rights.

2.7 How the contract is formed. A Customer's contract with us is formed when both parties sign an Order Form, or when we confirm a trial or licence in writing. An Authorised User's or Recipient's agreement to the relevant Parts is formed by using the Services. We do not file individual contracts; these Terms are available on our websites at all times and you should keep a copy. These Terms are available in English only.

2.8 Order of precedence. If there is a conflict between documents, the following order applies (highest first): (a) an Order Form, for the commercial terms it sets out; (b) Schedule 1, for data protection matters; (c) the body of these Terms; (d) the other Schedules; (e) any documentation, help content or policies we publish.

3. Definitions

In these Terms the following words have the meanings given below. Other capitalised terms are defined where they first appear.

• "Acceptable Use Policy" means Schedule 2.
• "Affiliate" means any entity that controls, is controlled by or is under common control with a party.
• "Applicable Data Protection Law" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 and all other laws relating to data protection and privacy applicable in the United Kingdom, each as amended (including by the Data (Use and Access) Act 2025) or replaced from time to time.
• "Business Day" means a day other than a Saturday, Sunday or public holiday in England.
• "Connectivity" means cellular or other data connectivity that we supply for Metering Equipment, including SIM cards and associated services.
• "Customer Data" means all data, content and materials that a Customer or its Authorised Users upload to, enter into or generate through the Platform or the App, including telemetry received from the Customer's Metering Equipment, and all personal data within it.
• "Documentation" means the user guides, technical documentation and knowledge-base articles we make available for the Services.
• "Fees" means the charges for the Services set out in an Order Form.
• "Intellectual Property Rights" means patents, rights to inventions, copyright and related rights, trade marks, business names and domain names, rights in get-up, goodwill and the right to sue for passing off, rights in designs, database rights, rights to use and protect the confidentiality of confidential information (including know-how), and all other intellectual property rights, whether registered or unregistered, and all applications, renewals and extensions of them, anywhere in the world.
• "Licensed Modules" means the modules of the Platform that a Customer is licensed to use under an Order Form (for example Device Metrics and Map, Custom Map, Reports, PAT Testing, BS 7909 Testing, Carbon Footprint, Power Designer, Work Orders and Alerts).
• "Metering Equipment" or "Equipment" means power meters, generator monitoring equipment, current transformers, cellular routers, gateways and other hardware that we supply, hire, lend or configure for use with the Platform, together with their firmware.
• "Order Form" means an order form, quotation, proposal, statement of work or licence confirmation that references these Terms and is agreed between a Customer and us, including any renewal.
• "Privacy Policy" means our privacy policy published at https://broadsightlabs.co.uk/legal/privacy, as updated from time to time.
• "Subscription Term" means the initial term stated in an Order Form together with any renewal term.
• "Support Services" means the support described in Schedule 3.
• "Third-Party Services" means services, software, data and content provided by third parties that are integrated with or accessed through the Services, as described in clause 12.
• "UK GDPR" has the meaning given in section 3(10) of the Data Protection Act 2018.
• "Virus" means anything (including software code, files or programs) that may prevent, impair or otherwise adversely affect the operation of any computer software, hardware or network, or that may adversely affect the user experience, including worms, trojan horses, viruses and other similar things or devices.

Part B – Website Terms

4. Use of our websites

4.1 These Website Terms apply to https://broadsightlabs.co.uk and https://broadsight.energy (the "Websites"). By using the Websites you agree to them.

4.2 Access. We make the Websites available free of charge and may suspend, withdraw or change them at any time without notice. We do not guarantee that the Websites will always be available or uninterrupted.

4.3 Content. The content of the Websites is provided for general information about our business and products only. Descriptions of product features, performance figures and screenshots are illustrative; the features available to a Customer are those set out in its Order Form and Documentation. Testimonials reflect the experience of the individuals quoted. The content is not advice and you should not rely on it to make decisions; we exclude liability for any reliance on it to the extent permitted by law.

4.4 Intellectual property. We own or license all Intellectual Property Rights in the Websites and their content, including the names "Broadsight", "Broadsight Labs" and "Broadsight Energy" and our logos. You may view, print and download extracts for your own internal reference, but you must not modify them, use them for commercial purposes without our written permission, or remove any copyright or proprietary notice. Our status as the author of content must always be acknowledged.

4.5 Contact form. You may use the contact form to make genuine enquiries. You must not use it to send unsolicited marketing, unlawful or offensive material, or automated submissions. The form is protected by rate limiting and Cloudflare Turnstile, and submissions are relayed to us by email. We aim to reply to enquiries within one Business Day but this is not a guarantee.

4.6 Acceptable use. You must not misuse the Websites, including by introducing Viruses, attempting to gain unauthorised access to the Websites, the servers on which they are hosted or any connected system, attacking the Websites by way of a denial-of-service attack, or scraping content by automated means. Breach of this clause may be a criminal offence under the Computer Misuse Act 1990; we will report breaches to the relevant authorities and may disclose your identity to them.

4.7 Cookies and analytics. The Websites use strictly necessary cookies and, with your consent, Google Analytics. Details are in our Privacy Policy.

4.8 Links. The Websites contain links to third-party websites and resources, including our support portal and status page (Part G). We provide these for information only and have no control over their content.

4.9 Liability. Part H applies to the Websites. In particular, to the extent permitted by law, we exclude all conditions, warranties and representations implied by law in relation to the Websites and will not be liable to any business user for any loss of profit, business, revenue, goodwill or data, or for any indirect or consequential loss, arising from use of or inability to use the Websites or reliance on their content.

Part C – Platform Terms

5. Order Forms, licences and trials

5.1 Licence grant. Subject to the Customer's compliance with these Terms and payment of the Fees, we grant the Customer a non-exclusive, non-transferable, non-sublicensable right during the Subscription Term to access and use the Platform and the Licensed Modules, and to permit its Authorised Users to do so, solely for the Customer's internal business purposes of planning, testing, monitoring, managing and reporting on electrical installations and associated operations.

5.2 Organisation-based licensing. Licences are granted per Customer organisation, not per user. Each Licensed Module has its own validity window as shown in the Platform's licence pages. An Order Form may cap the number of active (non-archived) projects the Customer may hold; the Platform enforces that cap when a project is created.

5.3 Affiliates and multiple organisations. A licence covers the single organisation identified in the Order Form. Additional organisations, tenancies or Affiliates require their own Order Form or an express extension.

5.4 Reservation of rights. All rights not expressly granted are reserved. The Platform is licensed, not sold. Nothing in these Terms transfers any Intellectual Property Rights in the Platform to the Customer.

5.5 Restrictions. Except as expressly permitted by these Terms or by law that cannot be excluded, the Customer must not, and must not allow anyone else to: (a) copy, modify, translate or create derivative works of the Platform; (b) reverse engineer, decompile or disassemble the Platform, except to the extent that sections 50A to 50C of the Copyright, Designs and Patents Act 1988 permit; (c) sell, resell, rent, lease, sublicense, time-share or otherwise make the Platform available to third parties other than Authorised Users and Recipients; (d) use the Platform to build a competing product or to benchmark it for publication without our consent; (e) access the Platform other than through the interfaces we provide, or circumvent any licence, tenancy, rate-limiting or security control; or (f) remove or obscure any proprietary notice.

5.6 Trials. We may offer the Platform on a free trial for a period we specify. A trial is provided "as is" without warranty or Support Services commitments, may be limited in features, and may be ended by either party at any time. Unless the Customer enters into a paid Order Form before the trial ends, its access will cease and we may delete its Customer Data after the trial ends. Part C otherwise applies to trials.

5.7 Beta features. From time to time we may make preview or beta features available. They are provided for evaluation, may be changed or withdrawn without notice, are excluded from any service level or warranty, and should not be relied on for production operations.

6. Authorised Users and accounts

6.1 The Customer is responsible for deciding who may be an Authorised User, for assigning roles, permissions and project access, and for removing access when a person leaves or no longer needs it. Authorised Users may be the Customer's employees, contractors and freelancers, and the Customer is responsible for their compliance with these Terms as if they were the Customer's own acts.

6.2 Each Authorised User must have their own account. Accounts must not be shared. Password-based accounts require two-factor authentication; where the Customer uses single sign-on (SAML 2.0, Microsoft Entra ID or Microsoft Entra External ID), the Customer is responsible for the security and configuration of its identity provider and for the accuracy of the users and groups it federates.

6.3 The Customer must ensure that Authorised Users keep their credentials confidential, use strong unique passwords, protect their authenticator devices, and notify the Customer's administrator and us promptly of any suspected compromise. We may treat any action taken through an Authorised User's account as authorised by the Customer.

6.4 Customer administrators can see Authorised Users' sign-in history (including IP address and country) and signed-in mobile devices, and can reset credentials and revoke access. The Customer is responsible for informing its Authorised Users of this, and of any technician location monitoring it enables (clause 23.5), in accordance with Applicable Data Protection Law.

6.5 We may provision break-glass administrative access for our own staff to operate and support the Platform. Our access to Customer Data is limited to what is necessary to provide the Services, resolve incidents, comply with law or enforce these Terms, and is logged.

7. Customer responsibilities

7.1 The Customer must: (a) use the Platform only in accordance with these Terms, the Documentation and applicable law; (b) obtain and maintain all licences, consents and permissions needed for us to perform the Services and for the Customer to use them; (c) ensure that its network, devices and browsers meet the requirements in the Documentation; (d) keep its account information, billing details and contact details accurate; (e) configure Licensed Modules, alert rules, notification channels, report schedules, share links, integrations and Metering Equipment appropriately for its own needs and review them regularly; and (f) maintain its own records and backups of information it needs to retain, including by exporting reports, certificates and data from the Platform.

7.2 The Customer is responsible for the accuracy, quality, legality and completeness of Customer Data and for the means by which it obtained it. We do not monitor Customer Data and are not responsible for its content.

7.3 Where the Customer uses the Platform under its own branding or domain name, the Customer warrants that it owns or is licensed to use that branding and domain, grants us a licence to use them for the purpose of providing the Services, and will configure DNS records as we direct. We may remove branding that infringes third-party rights or these Terms.

7.4 The Customer must not use the Platform to send unsolicited communications. Emails, notifications and share links generated by the Platform may only be sent to people who reasonably expect to receive them in connection with the Customer's business, and must comply with the Privacy and Electronic Communications (EC Directive) Regulations 2003.

8. Acceptable use

8.1 The Customer and every Authorised User must comply with the Acceptable Use Policy in Schedule 2.

8.2 We may investigate any suspected breach of the Acceptable Use Policy and take any action we reasonably consider appropriate, including removing content, suspending accounts, revoking tokens, rate-limiting traffic, notifying the Customer, and reporting unlawful activity to the authorities.

9. Customer Data, data protection and security

9.1 Ownership. As between the parties, the Customer owns all Customer Data. The Customer grants us a non-exclusive, worldwide, royalty-free licence during the Subscription Term and any post-termination retention period to host, copy, transmit, display, process, back up and otherwise use Customer Data as necessary to provide the Services, prevent and address technical and security problems, comply with law, and enforce these Terms.

9.2 Aggregated data. We may create and use aggregated, de-identified data derived from Customer Data and from the operation of the Services (for example load profiles, feature usage and accuracy statistics) for the purpose of operating, analysing, benchmarking and improving the Services and developing new products, provided that such data does not identify the Customer, any Authorised User or any other individual and cannot reasonably be re-identified. We own such aggregated data.

9.3 Data protection. The parties will comply with Applicable Data Protection Law. For Customer Data that is personal data, the Customer is the controller and we are the processor, and Schedule 1 (Data Processing Addendum) applies. For personal data we process for our own purposes (such as account security, audit logging, analytics and support), we are a controller and our Privacy Policy applies. The Customer must not upload special category data (as defined in Article 9 UK GDPR) or data relating to criminal convictions and offences to the Platform, and must ensure that photographs, notes and other free-text content do not contain personal data beyond what is necessary for the purpose.

9.4 Security. We will implement and maintain appropriate technical and organisational measures to protect Customer Data against unauthorised or unlawful processing and against accidental loss, destruction or damage, as summarised in Annex 2 to Schedule 1 and governed by our Information Security Policy (POL-IT-002) and our Cyber Essentials certification. We will not be responsible for security incidents caused by the Customer's failure to comply with clause 6, by the Customer's own systems or identity provider, or by the Customer's configuration choices (including share links, webhook endpoints, alert recipients and API tokens).

9.5 Backups and data loss. We back up the Platform database at least twice daily with a rolling 14-day retention. Backups are for disaster recovery and are not a substitute for the Customer's own record-keeping. We will use reasonable endeavours to restore lost or corrupted Customer Data from the latest available backup, but we are not otherwise liable for loss of data except as set out in clause 19.

9.6 Security testing. The Customer must not carry out or authorise penetration testing, vulnerability scanning, load testing or similar activity against the Services without our prior written consent and an agreed scope. We conduct our own independent testing and operate a coordinated vulnerability disclosure process; suspected vulnerabilities should be reported to [email protected].

9.7 Legal requests. If we receive a request from a court, regulator or law enforcement body to disclose Customer Data, we will (unless legally prohibited) notify the Customer promptly and give it a reasonable opportunity to object, and will disclose only what we are legally required to disclose.

10. Modules, professional judgement and safety

10.1 The Platform is a tool, not a competent person. The Platform records, organises, calculates and presents information that the Customer and its Authorised Users enter or that Metering Equipment reports. It does not carry out inspections, tests, designs or risk assessments, does not certify installations, and does not replace the judgement of a competent person. The Customer remains solely responsible for compliance with the Electricity at Work Regulations 1989, the Health and Safety at Work etc. Act 1974, BS 7671 (the IET Wiring Regulations), BS 7909 (Code of practice for temporary electrical systems for entertainment and related purposes), the IET Code of Practice for In-service Inspection and Testing of Electrical Equipment and all other applicable standards, codes and laws, and for ensuring that all electrical work is designed, installed, inspected, tested and signed off by suitably competent persons.

10.2 BS 7909 and PAT testing modules. Certificates, schedules, registers, danger reports and other documents generated by these modules are records of the information entered by the Customer's Authorised Users. Pass or fail results are calculated from the values entered and the thresholds configured for the Customer's organisation; the Customer is responsible for confirming that those thresholds are appropriate, that test instruments are calibrated, and that the persons who complete and sign records are competent and authorised to do so. We make no representation that a document produced by the Platform constitutes a valid certificate or satisfies any legal or contractual requirement.

10.3 Power Designer and Cable Planner. Load calculations, generator sizing, cable-length estimates, distribution designs and similar outputs are indicative planning aids based on the parameters and assumptions entered. They must be verified by a competent designer before any installation is built or energised. We are not liable for any installation built in reliance on them.

10.4 Alerts and notifications. Alerting is provided to assist operational monitoring. Alerts depend on Metering Equipment, Connectivity, third-party delivery services (email providers, push-notification services, webhook endpoints, Slack, Microsoft Teams and similar) and the rules the Customer configures, and may be delayed, suppressed by cooldown settings, or not delivered. The Platform is not a safety system, a protective device, an alarm system for life safety, or a substitute for electrical protection, physical monitoring or emergency procedures, and the Customer must maintain independent measures to detect and respond to dangerous conditions.

10.5 Carbon Footprint module. Carbon and emissions figures are estimates calculated from energy data and published grid carbon-intensity and generation-mix data from third parties (the National Energy System Operator and Elexon). They are provided for information and reporting purposes and are not certified emissions measurements. The Customer is responsible for any use of them in regulatory or contractual reporting.

10.6 Reports and share links. Reports may be shared with anyone by email or by public share links. A share link allows anyone who has the link to view the report until it expires or is revoked, without signing in. The Customer is responsible for deciding what to share, for setting appropriate expiry dates, for revoking links when no longer needed, and for the consequences of sharing.

10.7 Maps. Map data, addresses, coordinates, georeferenced overlays and satellite imagery are provided by Google Maps Platform and other Third-Party Services and may be inaccurate, incomplete or out of date. They must not be relied on for safety-critical positioning, for locating underground or overhead services, or for legal purposes.

11. Metering data, accuracy and telemetry

11.1 Readings displayed in the Platform originate from Metering Equipment and depend on the correct installation, configuration and calibration of that equipment (including current transformer sizing, orientation and phase assignment), on the equipment's stated accuracy class, and on Connectivity. Readings may be delayed, sampled at intervals, missing during outages, or affected by clock drift. The Platform marks data as stale when it has not been updated within the configured interval, and the Customer must treat stale data accordingly.

11.2 Energy (kWh) figures in the Platform are calculated by the Platform from sampled power readings over time and are estimates; they are not fiscal or tariff measurements. Unless an Order Form expressly states otherwise, Metering Equipment is not approved under the Measuring Instruments Regulations 2016 for use in billing, and neither the Equipment nor the Platform may be used as the basis for charging any person for electricity supplied.

11.3 The Customer is responsible for validating readings before relying on them for commercial, contractual, regulatory or safety decisions, and for retaining any raw data it requires.

11.4 Ingest credentials. Each device that sends data directly to the Platform is issued with a token bound to that device. The Customer (or, where we manage the Equipment, we) must keep tokens confidential, configure devices only as directed in the Documentation, and ask us to revoke a token immediately if it may have been disclosed. We may revoke, rotate, rate-limit or reject ingest traffic that is malformed, excessive, unauthenticated or that threatens the stability or security of the Platform, and may disable the ingest service temporarily in an emergency.

11.5 We do not warrant that readings from any device will be accepted if the device is not supported, is misconfigured, or sends data outside the formats described in the Documentation.

12. Third-party services, data sources and integrations

12.1 The Services use and interoperate with Third-Party Services, including Cloudflare (edge security, load balancing, tunnels, Turnstile and object storage), DigitalOcean (hosting), Google (Maps Platform, Analytics, Firebase Cloud Messaging), Apple (push notifications and the App Store), Microsoft (Entra ID and Entra External ID), Mailgun (email delivery), Atlassian (support portal, knowledge base and status page), postcode look-up services, the National Energy System Operator Carbon Intensity API and Elexon. Third-Party Services are provided by their owners under their own terms and privacy notices, and we do not control them.

12.2 The Customer may connect the Platform to services it controls, for example by configuring webhook endpoints for alerts (including Slack, Microsoft Teams, Discord or any HTTPS endpoint), email recipients, SAML or Entra identity providers, and Teltonika or other gateway devices. The Customer is responsible for those services, for the data it chooses to send to them, and for ensuring it has the right to do so. Data sent to a Customer-configured endpoint is outside our control once delivered.

12.3 We are not responsible for the availability, accuracy or performance of Third-Party Services or for any loss caused by them, except to the extent that a Third-Party Service is one of our sub-processors acting under our instructions, in which case Schedule 1 applies. If a Third-Party Service changes or is withdrawn we will use reasonable endeavours to provide an alternative or workaround but may modify or remove the affected functionality.

12.4 The Platform includes open-source software components. Their licences are listed in the software bill of materials available on request and do not affect the Customer's rights under these Terms.

13. Availability, maintenance and support

13.1 We will use commercially reasonable endeavours to make the Platform available 24 hours a day, 7 days a week, except for planned maintenance, emergency maintenance and events outside our reasonable control. Our maintenance practices are described in Schedule 3. Any availability target or service level applies only if it is set out in an Order Form, and a target that is not expressed as a service level with agreed remedies is a target only and does not give rise to any remedy.

13.2 We publish service status and incident updates at https://broadsightlabs.statuspage.io and recommend that Customers subscribe to updates.

13.3 We will provide Support Services in accordance with Schedule 3. Support Services do not include training, consultancy, custom development, data migration, on-site services, or support for the Customer's own systems, networks, identity providers or third-party equipment, unless set out in an Order Form.

13.4 We may update the Platform from time to time with new features, improvements, security fixes and changes. We may also retire features that are no longer viable, and will give Customers reasonable notice of any material reduction in functionality of a Licensed Module during the Subscription Term.

14. Fees, payment and taxes

14.1 The Customer will pay the Fees in the amounts and currency, by the method and at the times set out in each Order Form.

14.2 Fees are exclusive of any applicable taxes, which the Customer will pay in addition at the applicable rate where they apply.

14.3 If any undisputed amount is not paid by the due date, we may (a) charge interest on the overdue amount at the rate and in the manner provided by the Late Payment of Commercial Debts (Interest) Act 1998, and (b) after giving written notice, suspend the Customer's access to the Platform, the App, Connectivity and Support Services until payment is received. The Customer will pay the Fees for the full Subscription Term notwithstanding any suspension.

14.4 The Customer must notify us in writing of any disputed invoice promptly after receipt, giving reasons, and pay the undisputed part. The parties will work together in good faith to resolve the dispute promptly.

14.5 Fees for a renewal term will be the Fees for the previous term unless we notify the Customer of a change before the renewal date in accordance with the notice period in the Order Form (or, if the Order Form is silent, on reasonable notice). We may also increase Fees during a Subscription Term to reflect an increase in the number of licensed projects, modules, organisations or Equipment requested by the Customer.

14.6 Fees are non-refundable except as expressly stated in these Terms or an Order Form.

14.7 Where Equipment is sold, hired or loaned, or Connectivity is supplied, the associated charges (including any deposit, hire charges, excess data charges, loss or damage charges and collection charges) are set out in the Order Form and are payable in accordance with this clause 14.

15. Intellectual property

15.1 We and our licensors own all Intellectual Property Rights in the Platform, the App, the Websites, the Documentation, the Equipment firmware we develop, and any modifications, improvements or derivative works, including any that result from feedback or suggestions. Nothing in these Terms transfers those rights.

15.2 If the Customer or an Authorised User provides feedback, ideas or suggestions about the Services, we may use them without restriction or compensation, provided that we do not identify the source without permission.

15.3 We grant the Customer a non-exclusive, non-transferable licence during the Subscription Term to use the Documentation for its internal purposes in connection with the Services.

15.4 Reports, certificates, documents and exports generated by the Customer through the Platform belong to the Customer, subject to our ownership of the underlying templates, layouts, software and Broadsight Labs branding.

15.5 We may identify the Customer as a customer in our marketing materials, using its name and logo, only with the Customer's prior written consent, which may be withdrawn at any time.

16. Confidentiality

16.1 Each party will keep confidential all information of a confidential nature disclosed to it by the other party in connection with these Terms, whether in writing, orally or by inspection, including the terms of any Order Form, Customer Data, our security documentation, and information about the Platform that is not publicly available ("Confidential Information"). Each party will use the other's Confidential Information only for the purposes of these Terms, will protect it with at least the same degree of care it uses for its own confidential information (and no less than reasonable care), and will disclose it only to those of its employees, contractors, professional advisers and (in our case) sub-processors who need to know it and are bound by equivalent obligations.

16.2 Confidential Information does not include information that is or becomes public other than through breach of these Terms, was already lawfully known to the recipient, is independently developed without use of the discloser's information, or is lawfully obtained from a third party without restriction.

16.3 A party may disclose Confidential Information to the extent required by law, court order or a regulator, provided that (where lawful) it gives the other party prompt notice and cooperates with any attempt to limit the disclosure.

16.4 This clause 16 survives termination for five years, and indefinitely for Customer Data and trade secrets.

17. Warranties and disclaimers

17.1 We warrant that (a) the Platform will perform materially in accordance with the Documentation during the Subscription Term; (b) we will provide the Services with reasonable skill and care; and (c) we have the right to grant the licences in these Terms. If the Platform does not conform with warranty (a), the Customer's sole remedy is for us to use reasonable endeavours to correct the non-conformance or, if we cannot do so within a reasonable time, for the Customer to terminate the affected Order Form and receive a pro-rata refund of prepaid Fees for the remainder of the Subscription Term.

17.2 Each party warrants that it has full power and authority to enter into these Terms.

17.3 The Customer warrants that (a) it will use the Services in compliance with all applicable laws; (b) Customer Data, and our processing of it in accordance with these Terms, will not infringe the rights of any third party or breach any law; and (c) it has given all notices and obtained all consents required under Applicable Data Protection Law for the processing of personal data in Customer Data, including in relation to any monitoring of its workers.

17.4 Disclaimers. Except as expressly stated in these Terms, and to the fullest extent permitted by law, the Services are provided "as is" and we exclude all warranties, conditions and other terms implied by statute or common law, including implied terms of satisfactory quality, fitness for a particular purpose and non-infringement. We do not warrant that the Services will be uninterrupted or error-free, that defects will be corrected, that the Services will meet the Customer's requirements, or that readings, calculations, estimates, alerts, maps or documents produced by the Services will be accurate, complete or timely (see clauses 10 and 11). We do not warrant the Services against loss caused by the Customer's own configuration, equipment, networks or identity providers, or by Third-Party Services.

18. Indemnities

18.1 By us. We will defend the Customer against any claim by a third party that the Platform, used in accordance with these Terms, infringes that third party's Intellectual Property Rights in the United Kingdom, and will pay any damages finally awarded or settlement we agree, provided that the Customer notifies us promptly, gives us sole control of the defence and settlement, and gives us reasonable assistance at our cost. If such a claim is made or is likely, we may procure the right for the Customer to continue using the Platform, modify or replace it so that it is non-infringing, or, if neither is commercially reasonable, terminate the affected Order Form and refund prepaid Fees for the remainder of the Subscription Term. We have no obligation for claims arising from Customer Data, Third-Party Services, the Customer's specifications, use in breach of these Terms, or combination with items not supplied by us.

18.2 By the Customer. The Customer will defend and indemnify us and our Affiliates, officers, employees and contractors against all claims, losses, damages, costs and expenses (including reasonable legal fees) arising from (a) Customer Data or its use in accordance with these Terms; (b) any breach of clauses 7, 8, 9.3, 10, 11 or 17.3 or of the Acceptable Use Policy; (c) any electrical installation, inspection, test, design, certificate or operational decision made or carried out by or for the Customer, whether or not the Platform was used in connection with it; (d) any claim by an Authorised User, Recipient or data subject relating to the Customer's use of the Services or its instructions to us; or (e) loss of or damage to Equipment while in the Customer's possession, other than fair wear and tear.

19. Limitation of liability

19.1 Nothing excluded that cannot be. Nothing in these Terms limits or excludes either party's liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, for breach of the terms implied by section 12 of the Sale of Goods Act 1979 or section 2 of the Supply of Goods and Services Act 1982, or for any other liability that cannot lawfully be limited or excluded.

19.2 Cap. Subject to clauses 19.1 and 19.4, our total aggregate liability to the Customer arising out of or in connection with these Terms and the Services, whether in contract, tort (including negligence), breach of statutory duty, misrepresentation or otherwise, in any 12-month period beginning on the start of the Subscription Term or an anniversary of it, will not exceed the amount stated in the Order Form or, if no amount is stated, the Fees paid or payable by the Customer under the relevant Order Form in that 12-month period.

19.3 Excluded losses. Subject to clause 19.1, neither party will be liable to the other for any (a) loss of profits, revenue, business, contracts or anticipated savings; (b) loss of or damage to goodwill or reputation; (c) loss or corruption of data (except as provided in clause 9.5); (d) loss arising from business interruption; (e) fines or penalties imposed on the Customer by any regulator; or (f) indirect, special or consequential loss, in each case however arising and even if foreseeable.

19.4 Specific exclusions. Subject to clause 19.1, we will not be liable for any loss arising from: (a) any electrical installation, inspection, test, design, certificate, alert, reading, estimate or calculation, or any decision or action taken or not taken in reliance on the Services (clauses 10 and 11); (b) the Customer's or an Authorised User's failure to keep credentials, tokens, devices or Equipment secure; (c) Customer Data or Third-Party Services; (d) the Customer's use of share links, webhooks, email recipients or other Customer-configured integrations; (e) any change to or withdrawal of a Third-Party Service; (f) any suspension or termination exercised in accordance with these Terms; or (g) any event outside our reasonable control (clause 32.4).

19.5 Equipment. Subject to clause 19.1, our liability in respect of any item of Equipment is limited to repair or replacement of the item or a refund of the price paid or hire charges paid for it in the preceding 12 months, and our liability for Connectivity is limited to the Connectivity charges paid in the preceding 12 months.

19.6 The parties agree that the limitations in this clause 19 are reasonable having regard to the Fees, the nature of the Services, the availability of insurance and the Customer's own responsibilities under clauses 7, 10 and 11.

20. Term, suspension and termination

20.1 Term. Each Order Form starts on its start date and continues for the initial Subscription Term stated in it. The Order Form states whether and how the Subscription Term renews and the notice required to prevent renewal.

20.2 Termination for cause. Either party may terminate an Order Form or these Terms immediately by written notice if the other party (a) commits a material breach that is incapable of remedy, or that is capable of remedy but is not remedied within 30 days after written notice requiring it to be remedied; or (b) becomes insolvent, enters administration, liquidation or any similar process, makes an arrangement with its creditors, ceases to trade, or suffers any analogous event in any jurisdiction.

20.3 Termination by us. We may also terminate or suspend immediately if the Customer or an Authorised User seriously or repeatedly breaches the Acceptable Use Policy, if continued provision would breach law or expose us or other customers to material risk, or if Fees remain unpaid after the period specified in a notice given under clause 14.3.

20.4 Suspension. We may suspend access to all or part of the Services, or to particular accounts, tokens, devices or integrations, where reasonably necessary to protect the security, integrity or availability of the Services, to comply with law, to prevent a breach of these Terms, or as permitted by clause 14.3. We will limit suspension to what is necessary, notify the Customer as soon as practicable, and restore access when the cause is resolved.

20.5 Effect of termination. On termination or expiry of an Order Form: (a) the licences granted under it end and the Customer and its Authorised Users must stop using the Platform and the App for the terminated organisation; (b) the Customer must pay all Fees due up to the date of termination and, where we terminate under clause 20.2 or 20.3, all Fees for the remainder of the Subscription Term; (c) Equipment on hire or loan must be returned in accordance with clause 25; (d) Connectivity ends and SIM cards must be returned or destroyed as we direct; and (e) each party will return or destroy the other's Confidential Information, subject to clause 20.7 and any retention required by law.

20.6 Termination by the Customer for our breach. If the Customer terminates under clause 20.2 for our material breach, we will refund any Fees prepaid for the period after termination.

20.7 Customer Data after termination. For 30 days after termination or expiry the Customer may export its Customer Data using the Platform's export features and may ask us for a copy of any data that cannot be exported in that way, which we will provide in a reasonable machine-readable format (we may charge our reasonable costs for extraction beyond the standard features). After that period we will delete Customer Data within 90 days of termination, save for copies in backups (which are overwritten within 14 days) and any data we are required by law to retain. Schedule 1 applies to personal data.

20.8 Survival. Clauses 9.2, 9.7, 14, 15, 16, 17.4, 18, 19, 20.5 to 20.8, 30, 32 and 33 and Schedule 1 survive termination or expiry.

Part D – Authorised User Terms

21. Your obligations as an Authorised User

21.1 Who this Part applies to. This Part applies to you personally if you sign in to the Platform or the App. Your access is granted by, and is subject to the control of, the Customer whose organisation you belong to or that has given you project access (your "Organisation"). If you are one of our staff, your employment or engagement terms also apply.

21.2 Your account. You must keep your credentials confidential, use two-factor authentication where required, not share your account or let anyone else use it, and tell your Organisation's administrator and us ([email protected]) immediately if you think your account, authenticator, device or any token has been compromised. You are responsible for everything done through your account until you tell us otherwise.

21.3 Permitted use. You may use the Platform and the App only for your Organisation's business purposes, only within the roles, projects and modules assigned to you, and in accordance with the Acceptable Use Policy (Schedule 2). You must not attempt to access data belonging to other organisations, other projects, or other users beyond your permissions, even if a technical defect appears to allow it; report any such defect to us instead.

21.4 Accuracy and competence. Where you enter inspection, test, design or safety information, you confirm that you are competent and authorised by your Organisation to do so and that the information is accurate to the best of your knowledge. The Platform does not verify your competence or the accuracy of what you enter (clause 10).

21.5 Electronic signatures. Where you sign a document in the Platform or the App (for example a BS 7909 certificate, danger report or work-order form), you agree that your electronic signature is your signature, that it has the same effect as a handwritten signature, and that you have authority to sign in the role stated. You must not sign on behalf of another person.

21.6 Your Organisation's control. Your Organisation controls your account and the Customer Data you create. Its administrators can see your sign-in history and signed-in devices, change your permissions, and remove your access. When you leave your Organisation or your project access ends, your access will be revoked and any data on your devices must be deleted (clause 23.4).

21.7 Location sharing. If your Organisation enables on-shift positioning in the App, it is your Organisation's decision to use it and your Organisation's responsibility to tell you how it is used. You control the on-shift toggle. See clause 23.5 and the Privacy Policy.

21.8 Recipients. If you are a Recipient, you may use the documents and links sent to you only for the purpose for which they were sent, must not forward share links to people who should not have them, and, where you sign a document electronically, clause 21.5 applies to you. You have no right to use the Platform beyond the document or link you received.

21.9 Our rights. We may suspend or remove your access, or revoke tokens and devices, if we reasonably believe you have breached this Part or the Acceptable Use Policy, if your Organisation asks us to, or if your Organisation's licence ends. We do not owe you any obligation to provide the Services; our obligations are to your Organisation.

21.10 Personal data. Our Privacy Policy explains how we handle your personal data as controller (for example sign-in and security records) and how your Organisation is responsible for Customer Data about you.

Part E – Broadsight Mobile End User Licence

22. Licence to use the App

22.1 Who this Part applies to. This Part is an end user licence agreement between you (the individual who installs and uses the App) and Broadsight Labs. If you use the App on behalf of a Customer, Part D also applies to you and Part C applies to the Customer. Apple Inc. and Google LLC are not parties to this licence except as set out in Schedule 4.

22.2 Licence. We grant you a personal, limited, non-exclusive, non-transferable, revocable licence to download, install and use the App on mobile devices that you own or control, in accordance with the usage rules of the app store from which you obtained it, solely to access the Platform with a valid account for the duration of your Organisation's licence.

22.3 Restrictions. You must not (a) copy, modify, adapt, translate or create derivative works of the App; (b) reverse engineer, decompile or disassemble it, except to the extent permitted by sections 50A to 50C of the Copyright, Designs and Patents Act 1988 or other law that cannot be excluded; (c) rent, lease, lend, sell, redistribute or sublicense it; (d) remove any proprietary notices; (e) use it on a device that has been jailbroken or rooted or that runs an operating system we no longer support; (f) interfere with its security, licence or update mechanisms; or (g) use it in breach of the Acceptable Use Policy.

22.4 Updates and minimum version. We may release updates that add, change or remove features, fix defects or address security issues. Some updates are mandatory: the Platform enforces a minimum supported App version, and an older version may stop working until updated. Keep the App and your device's operating system up to date. We may withdraw support for older devices and operating-system versions at any time.

22.5 Ownership. The App is licensed, not sold. We and our licensors retain all Intellectual Property Rights in it. The App includes open-source components under their own licences, which are listed within the App or available on request; those licences do not restrict your rights under this Part.

22.6 Charges. The App is free to download. Your mobile network operator may charge you for data used by the App, including when synchronising records, photographs and map tiles; you are responsible for those charges.

22.7 Termination. This licence ends automatically if your Organisation's licence ends, if your access is revoked, if you breach this Part, or if you delete the App. We may also end it on notice if we withdraw the App. On termination you must stop using the App and delete it from your devices.

23. Device permissions, offline data and security

23.1 Permissions. The App will ask for your permission before using your camera, photo library, location, biometric authentication and notifications. Each permission is optional, though some features will not work without it. The App asks for "while using the app" location permission only and never requests "always" location access. You can change permissions in your device settings at any time.

23.2 Sign-in tokens. After you sign in, the App stores long-lived access and refresh tokens in your device's secure keychain or keystore. Anyone with access to your unlocked device may be able to use the App as you. You must protect your device with a passcode, enable the App's biometric lock where offered, sign out of devices you no longer use (you and your administrators can revoke devices from the Platform), and tell your administrator and us immediately if a device is lost, stolen or compromised. Tokens are revoked automatically if your password is changed or reset or your account is deactivated; signing out of the web Platform does not sign out the App.

23.3 Offline data. The App stores a local copy of work orders, inspection and test records, photographs, signatures and related Customer Data on your device so that you can work without connectivity, and queues your changes until they can be uploaded. That data is your Organisation's Customer Data. You must (a) keep it confidential; (b) not extract it from the App; (c) synchronise regularly so that records are uploaded; and (d) understand that records captured offline are not visible to your Organisation until they synchronise, and that a change made by someone else while you were offline may need to be reconciled when you reconnect.

23.4 Deletion. Signing out deletes the local copy of Customer Data from the device. When you leave your Organisation, when your access ends, or if your Organisation asks you to, you must sign out of and delete the App.

23.5 Location. The App uses your location only (a) when you tap "use my current position" to pin a work order to where you are, in which case a single position is stored against that work order; and (b) where your Organisation has enabled on-shift positioning and you switch the on-shift toggle on, in which case the App periodically shares your position with your Organisation while the toggle is on, shows a system indicator while it is active, switches itself off after a set period, and lets you view your own history. Your Organisation is the controller of this data and must comply with Applicable Data Protection Law, including carrying out any required impact assessment and informing you. We process it only as your Organisation's processor.

23.6 Photographs and signatures. Photographs you take and signatures you draw in the App are stored on the device until uploaded and become Customer Data. Do not photograph people unless necessary and lawful. Where the App asks you to confirm your identity biometrically before signing, the check is performed by your device and we never receive biometric data.

23.7 Notifications. Push notifications are delivered through Apple and Google services and may be delayed or not delivered. Notifications contain only identifiers and generic titles; details are loaded when you open the App. Do not rely on notifications as your only means of learning about alerts or assignments (clause 10.4).

23.8 Maps. Maps in the App are provided by Google and require connectivity; they are not available offline. Clause 10.7 applies.

23.9 Diagnostics. The App currently records error information on your device only and does not send crash reports to us. If we introduce crash reporting we will update the Privacy Policy and, where required, ask for your permission.

23.10 Compatibility. We do not warrant that the App will work on every device or operating-system version, or with every mobile network, or that it will always be available through the app stores.

24. App store terms

24.1 If you obtained the App from the Apple App Store or Google Play, the additional terms in Schedule 4 apply. Those terms are required by Apple and Google and prevail over this Part to the extent of any conflict.

24.2 You must comply with any applicable third-party terms when using the App, including your mobile operator's terms and the terms of the app store.

24.3 You confirm that you are not located in a country that is subject to a United Kingdom, European Union or United States government embargo or that has been designated as a "terrorist supporting" country, and that you are not listed on any United Kingdom, European Union or United States government list of prohibited or restricted parties.

Part F – Metering Equipment and Connectivity Terms

25. Supply of Metering Equipment

25.1 Scope. This Part applies where we supply, hire, lend, configure or manage Metering Equipment for a Customer. The Order Form states whether each item is sold, hired or loaned to the Customer, and the applicable charges. Equipment may be manufactured by third parties (for example Shelly and Teltonika) and configured by us for use with the Platform.

25.2 Delivery. Delivery dates are estimates. Risk in Equipment passes to the Customer on delivery to the Customer's nominated address or on collection. The Customer must inspect Equipment on delivery and notify us of any shortage or visible damage within 5 Business Days.

25.3 Sold Equipment. Title to sold Equipment passes to the Customer only when we have received payment in full for it and for all other sums then due. Until then the Customer holds the Equipment as our bailee, must keep it separately identifiable and insured, and must not sell, charge or part with possession of it. We may recover Equipment for which payment is overdue.

25.4 Hired and loaned Equipment. Hired and loaned Equipment remains our property at all times. The Customer must (a) keep it in good condition and not modify, mark, open or tamper with it; (b) keep it at the sites notified to us and not remove it from the United Kingdom without our written consent; (c) insure it for its full replacement value against loss, theft and damage; (d) not sell, charge, lend or part with possession of it; (e) allow us reasonable access to inspect, maintain, update or recover it; and (f) return it to us, or make it available for collection, in good condition (fair wear and tear excepted) promptly after the end of the hire or loan period or of the Subscription Term, whichever is earlier, and in any event within the period stated in the Order Form. The Customer is liable for the replacement cost of Equipment that is lost, stolen, damaged beyond repair or not returned, and for the cost of repairing other damage, at the rates in the Order Form or, if none, our then-current rates.

25.5 Warranties. Sold Equipment is supplied with the benefit of the manufacturer's warranty, which we will pass through to the Customer to the extent we are able. Subject to clause 19.1, we give no other warranty in relation to Equipment except that it will, on delivery, be free from material defects in materials and workmanship for the warranty period stated in the Order Form (or, if none is stated, the manufacturer's warranty period). Our sole obligation for a breach of that warranty is to repair or replace the item or refund its price. The warranty does not cover damage caused by improper installation, use, environmental conditions, power surges, accident, neglect, modification or repair by anyone other than us.

25.6 Firmware and remote management. We may update the firmware and configuration of Equipment remotely to maintain security, compatibility and performance, and may require the Customer to permit such updates as a condition of continued service. The Customer must not alter Equipment configuration except as directed in the Documentation.

25.7 Security of Equipment. Equipment credentials, tokens and SIM cards must be kept secure. The Customer must tell us immediately if any Equipment is lost, stolen or tampered with so that we can revoke its access to the Platform.

25.8 End of life and recycling. We will accept the return of Equipment we have supplied for recycling in accordance with the Waste Electrical and Electronic Equipment Regulations 2013, at the Customer's cost of delivery unless otherwise agreed. Equipment must not be disposed of in general waste.

26. Installation, use and safety

26.1 Unless an Order Form states that we will install Equipment, the Customer is responsible for installation. All installation, connection, commissioning, relocation and removal of Equipment must be carried out by competent persons in accordance with the manufacturer's instructions, the Documentation, BS 7671, BS 7909 where applicable, the Electricity at Work Regulations 1989 and all other applicable law, with the supply isolated where required.

26.2 Equipment must be used only for monitoring electrical parameters as described in the Documentation, within its rated voltage, current, temperature and environmental limits, and with correctly sized and oriented current transformers. Equipment is not a protective, safety, metering-for-billing or control device and must not be relied on to protect persons, property or installations from electrical danger.

26.3 The Customer is responsible for the siting and physical security of Equipment, for providing a suitable power supply, for ensuring adequate mobile-network coverage at each site (or an alternative connection we have agreed), and for any damage or injury arising from the way it is installed or used.

26.4 We do not warrant that Equipment will be suitable for any particular generator, distribution board or installation unless we have confirmed suitability in writing after reviewing the Customer's specification.

27. Connectivity

27.1 Where we supply Connectivity, we do so using one or more third-party mobile network operators and connectivity providers. SIM cards and network subscriptions remain our property (or that of our provider) and are licensed to the Customer solely for transmitting data between the Equipment and the Platform during the Subscription Term.

27.2 The Customer must not remove a SIM from the Equipment it was supplied with, use it in any other device, use Connectivity for any other purpose (including internet access, tethering or voice), or exceed any fair-use or data allowance in the Order Form. We may charge for excess usage at the rates in the Order Form and may suspend Connectivity that is misused.

27.3 Mobile network coverage, speed and availability vary by location, environment and network operator and are outside our control. Metering data may be delayed or lost during coverage gaps; where Equipment buffers readings, they will be uploaded when coverage returns, but we do not guarantee this. We are not liable for any loss caused by network outages, coverage gaps or roaming restrictions.

27.4 Connectivity ends when the Subscription Term ends or the relevant Equipment is returned. SIM cards must then be returned to us or destroyed as we direct.

Part G – Support System and Status Page

28. Support portal, knowledge base and status page

28.1 We provide customer support through our support portal at https://broadsightlabs.atlassian.net/servicedesk/customer/portal/35 and documentation through our knowledge base at https://broadsightlabs.atlassian.net/wiki/spaces/BEKH, both of which are hosted by Atlassian using Jira Service Management and Confluence (the "Support System"). Our service status page at https://broadsightlabs.statuspage.io is hosted by Atlassian Statuspage.

28.2 Support Services are provided to Customers and their Authorised Users in accordance with Schedule 3. Anyone may raise a request through the portal without an account, but we may decline or deprioritise requests from people who are not Customers or Authorised Users.

28.3 When using the Support System you must (a) provide accurate information and keep your contact details up to date; (b) not include passwords, authentication codes, private keys, tokens or other secrets in requests, screenshots or attachments; (c) not upload Viruses, unlawful material or personal data beyond what is needed to resolve your request; (d) not use the Support System to send marketing, abuse or spam; and (e) comply with Atlassian's terms and policies that apply to the pages it hosts.

28.4 Knowledge-base content is provided for information to help you use the Services. It is part of the Documentation and is licensed for your internal use only. It may not reflect the very latest version of the Services, and clauses 10 and 17.4 apply to it.

28.5 The status page shows the current and historical status of the components of the Services as monitored by us. It is provided for information, does not form part of any service level commitment, and is not a warranty of past or future availability. You may subscribe to updates by email, Slack or Microsoft Teams; subscriptions are handled by Atlassian, and the subscription form uses Google reCAPTCHA. You can unsubscribe at any time.

28.6 Atlassian's cookies and tracking notice applies to the pages it hosts. Our Privacy Policy describes how we use the personal data you provide through the Support System.

Part H – General

29. Changes to the Services and to these Terms

29.1 We may change these Terms from time to time. We will publish the updated Terms on our websites with a new effective date and, for changes that materially reduce a Customer's rights or increase its obligations, give Customers at least 30 days' notice by email or through the Platform before they take effect. A Customer that objects to such a change may terminate the affected Order Form by written notice before the change takes effect and will receive a pro-rata refund of prepaid Fees; continued use after the effective date is acceptance of the change. Changes required by law, or that do not materially reduce a Customer's rights, take effect on publication.

29.2 Authorised Users and Recipients are bound by the version of these Terms current at the time they use the Services. We may ask Authorised Users to accept updated Terms when they sign in.

29.3 We may change, improve or discontinue features of the Services in accordance with clauses 13.4 and 22.4.

30. Electronic communications, signatures and records

30.1 The parties agree to conduct business electronically. Notices, Order Forms, records, reports, certificates and other documents created, signed, sent or stored through the Services are valid and enforceable to the same extent as paper documents, and each party waives any right to contest their validity solely on the ground that they are electronic.

30.2 Electronic signatures captured through the Platform or the App (including signatures drawn on a signature pad and any biometric or password step-up preceding them) are electronic signatures for the purposes of section 7 of the Electronic Communications Act 2000 and the UK eIDAS Regulation, and each party agrees that they satisfy any requirement for a signature and are admissible as evidence. The Platform records the signatory's name, stated role, the time of signing and the account (where any) used.

30.3 Records generated by the Platform, including audit trails, activity logs and timestamps, are evidence of the matters they record. Timestamps are recorded by our servers in Coordinated Universal Time and displayed in the configured time zone; records captured offline in the App carry the time captured on the device, adjusted using the App's clock-skew estimate, and the time they were received by the Platform.

30.4 We may communicate with Customers and Authorised Users about the Services (including service, security, legal and billing notices) by email to the addresses on the account, by notices in the Platform or the App, or through the status page. Those communications are part of the Services and are not marketing.

31. Notices

31.1 Formal notices under these Terms must be in writing and sent (a) to us by email to [email protected] (with a copy to [email protected] for data-protection notices) or by post to our registered office; and (b) to a Customer by email to the contact address in the Order Form or the Customer's primary administrator, or by post to the Customer's registered office or the address in the Order Form.

31.2 Notices sent by email are deemed received when sent, unless the sender receives a bounce or error message, and if sent outside 09:00 to 17:30 on a Business Day, at 09:00 on the next Business Day. Notices sent by first-class post or recorded delivery are deemed received two Business Days after posting. This clause does not apply to the service of proceedings.

32. General legal terms

32.1 Entire agreement. These Terms, together with any Order Form, the Privacy Policy and the documents referred to in them, constitute the entire agreement between the parties in relation to their subject matter and supersede all previous agreements, representations and understandings. Each party acknowledges that it has not relied on any statement, representation or warranty not set out in these Terms. Nothing in this clause limits liability for fraud.

32.2 Assignment. The Customer may not assign, novate or transfer any of its rights or obligations without our prior written consent (not to be unreasonably withheld). We may assign or novate these Terms to an Affiliate or to a successor to all or substantially all of our business or assets on notice to the Customer, and may subcontract our obligations provided that we remain responsible for the performance of our subcontractors.

32.3 Anti-bribery. Each party will comply with the Bribery Act 2010 and will not offer, give, solicit or accept any bribe or improper inducement in connection with these Terms.

32.4 Events outside our control. Neither party will be in breach of these Terms or liable for delay or failure to perform (other than payment obligations) caused by events beyond its reasonable control, including acts of God, flood, fire, storm, epidemic, war, terrorism, riot, civil commotion, industrial action (other than by the affected party's own workforce), failure of public or private telecommunications networks or mobile network operators, failure or unavailability of third-party cloud, hosting, DNS or content-delivery services, cyber-attacks that could not reasonably have been prevented by the security measures required by these Terms, changes in law, or action by any government or regulator. The affected party will notify the other and use reasonable endeavours to mitigate the effect. If such an event continues for more than 60 days, either party may terminate the affected Order Form on written notice.

32.5 Severance. If any provision of these Terms is or becomes invalid, illegal or unenforceable, it will be deemed modified to the minimum extent necessary to make it valid, legal and enforceable, and the remaining provisions will not be affected.

32.6 Waiver. No failure or delay in exercising any right or remedy is a waiver of it, and no single or partial exercise of any right or remedy precludes any further exercise of it or of any other right or remedy.

32.7 No partnership. Nothing in these Terms creates a partnership, joint venture or agency between the parties, and neither party has authority to bind the other.

32.8 Third-party rights. Except as expressly provided in Schedule 4 for Apple and Google, and for our Affiliates, officers, employees and contractors under clause 18.2, no one other than the parties has any right under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of these Terms. The parties may vary or rescind these Terms without the consent of any third party.

32.9 Counterparts and electronic execution. An Order Form may be executed in counterparts and by electronic signature, each of which is an original and which together constitute one agreement.

32.10 Complaints about our service. If you have a complaint about the Services (other than a data-protection complaint, which is dealt with in our Privacy Policy), please raise it through the support portal or by email to [email protected]. We will acknowledge it within 5 Business Days, investigate it and respond within 20 Business Days. Nothing in this clause affects your right to bring legal proceedings.

32.11 Language. These Terms and all communications under them are in English.

33. Governing law and jurisdiction

33.1 These Terms, any Order Form and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with them or their subject matter or formation are governed by and construed in accordance with the law of England and Wales.

33.2 Each party irrevocably agrees that the courts of England and Wales have exclusive jurisdiction to settle any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with these Terms, any Order Form or their subject matter or formation, except that we may seek interim or injunctive relief to protect our Intellectual Property Rights or Confidential Information in any court of competent jurisdiction.

33.3 If you are a consumer resident in Scotland or Northern Ireland, you may also bring proceedings in the courts of your home nation, and you benefit from any mandatory provisions of the law of the country in which you are resident.

Schedule 1 – Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms between Broadsight Labs Ltd. ("Processor", "we") and each Customer ("Controller", "you") and applies to the processing of personal data in Customer Data. Terms defined in the UK GDPR have the same meaning here.

1. Roles and scope

1.1 You are the controller (or, where you act for your own clients, a processor, in which case you warrant that your instructions are authorised by the relevant controller) and we are your processor in respect of personal data in Customer Data ("Customer Personal Data"). Annex 1 describes the processing.

1.2 This DPA does not apply to personal data we process as a controller, which is described in our Privacy Policy.

1.3 Where you make the Services available to freelancers, contractors or other organisations, you remain responsible to us for their processing as if it were your own.

2. Your obligations

2.1 You will comply with Applicable Data Protection Law, and in particular will (a) ensure that you have a lawful basis for the processing of Customer Personal Data and for your instructions to us; (b) provide all notices and obtain all consents required, including notices to your workers about any location monitoring, sign-in auditing or other monitoring that you enable; (c) carry out any data protection impact assessment required for your use of the Services, including before enabling technician location sharing in the App; (d) not upload special category data or criminal-offence data; and (e) ensure that your instructions comply with law. We may refuse to follow, and will inform you if in our opinion an instruction infringes, Applicable Data Protection Law.

2.2 You acknowledge that you configure the Services (including users, roles, share links, email recipients, webhooks, retention of records and Equipment) and that you are responsible for those choices.

3. Our obligations

3.1 We will process Customer Personal Data only on your documented instructions, including with regard to transfers to a third country, unless required to do so by UK law, in which case we will inform you of that legal requirement before processing unless the law prohibits it. These Terms, the Order Form, your configuration of the Services and your use of their features constitute your documented instructions.

3.2 We will ensure that persons authorised to process Customer Personal Data are bound by obligations of confidentiality.

3.3 We will implement the technical and organisational measures described in Annex 2 and such further measures as are appropriate to the risk under Article 32 UK GDPR, and will not materially reduce the overall level of protection during the Subscription Term.

3.4 We will assist you, by appropriate technical and organisational measures and insofar as possible, in responding to requests from data subjects exercising their rights under Chapter III UK GDPR. If we receive such a request directly we will notify you within 3 Business Days and will not respond to it except on your instructions or as required by law. The Platform's user-management, export, deletion and audit features are provided to help you respond to requests yourself.

3.5 We will assist you in ensuring compliance with Articles 32 to 36 UK GDPR (security, breach notification and impact assessments), taking into account the nature of the processing and the information available to us. We may charge reasonable costs for assistance beyond what is available through the standard features and Support Services.

3.6 We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, providing the information required by Article 33(3) UK GDPR as it becomes available, and will cooperate with you and take reasonable steps to mitigate the effects of the breach. Our notification is not an admission of fault.

3.7 We will make available to you all information necessary to demonstrate compliance with Article 28 UK GDPR and will allow for and contribute to audits, including inspections, conducted by you or an auditor mandated by you, in accordance with paragraph 6.

3.8 We will maintain records of our processing activities as required by Article 30(2) UK GDPR.

4. Sub-processors

4.1 You give general written authorisation for us to engage the sub-processors listed in Annex B of our Privacy Policy (the "Sub-processor List") and to engage additional or replacement sub-processors subject to this paragraph 4.

4.2 We will give you at least 30 days' notice of any intended addition or replacement of a sub-processor, by email to your administrators or by notice in the Platform, and will update the Sub-processor List. If you reasonably object on data-protection grounds within that period and we cannot resolve the objection, you may terminate the affected Order Form on written notice and receive a pro-rata refund of prepaid Fees for the remainder of the Subscription Term.

4.3 We will impose on each sub-processor, by written contract, data-protection obligations that provide at least the same level of protection as this DPA, and we remain fully liable to you for the performance of each sub-processor's obligations.

5. International transfers

5.1 We will not transfer Customer Personal Data outside the United Kingdom, or permit a sub-processor to do so, unless the transfer is (a) to a country or organisation covered by adequacy regulations made under section 17A of the Data Protection Act 2018 (including the United Kingdom Extension to the EU-US Data Privacy Framework, for certified US organisations); or (b) subject to appropriate safeguards under Article 46 UK GDPR, such as the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. The Sub-processor List identifies the location and safeguard for each sub-processor.

6. Audit

6.1 We will, on request no more than once in any 12-month period (or more often following a personal data breach or where required by a supervisory authority), provide you with our Cyber Essentials certificate, a summary of our Information Security Policy (POL-IT-002), a summary of the results of our most recent independent penetration test, and written responses to reasonable security questionnaires. You agree that these will normally be sufficient to satisfy paragraph 3.7.

6.2 Where you reasonably consider that further verification is required, you may carry out an on-site or remote audit, on at least 30 days' written notice, during Business Days and business hours, no more than once in any 12-month period, subject to reasonable confidentiality and security requirements, without disrupting our operations or accessing other customers' data, and at your own cost. We may charge our reasonable costs of supporting an audit that exceeds one Business Day.

7. Deletion and return

7.1 On termination or expiry of the Order Form, we will, at your choice, delete or return all Customer Personal Data in accordance with clause 20.7 of the Terms and delete existing copies, unless UK law requires storage of the personal data. Data in backups will be deleted through our normal backup rotation (14 days). On request we will certify deletion in writing.

7.2 You may delete Customer Personal Data at any time during the Subscription Term using the Platform's features, and may instruct us to delete specific data.

8. Liability and term

8.1 Each party's liability under this DPA is subject to the exclusions and limitations in clause 19 of the Terms. Nothing in this DPA relieves either party of its direct obligations and liabilities under Applicable Data Protection Law.

8.2 This DPA takes effect on the start of the Subscription Term and continues until we have deleted or returned all Customer Personal Data. In the event of conflict between this DPA and the rest of the Terms, this DPA prevails in relation to the processing of Customer Personal Data.

Annex 1 – Description of processing

Annex 2 – Technical and organisational security measures

Our security programme is governed by our Information Security Policy (POL-IT-002), an internal document that defines our information security management system and cyber governance, and is externally validated by our Cyber Essentials certification. Measures include:

• Governance: defined security roles and responsibilities; risk assessment; policy review at least annually; staff confidentiality obligations and security awareness training; joiner, mover and leaver processes; supplier and sub-processor due diligence.
• Access control: unique accounts; mandatory two-factor authentication for password-based accounts; single sign-on options (SAML 2.0, Microsoft Entra ID, Microsoft Entra External ID); role-based access control and per-organisation tenancy isolation enforced in application logic; per-project access grants; licence-based feature control; least-privilege administrative access with logging; automatic session expiry (idle and absolute); immediate server-side revocation of sessions and mobile tokens on password change, role change or deactivation.
• Cryptography: TLS 1.2 or higher for all connections including to the database; HSTS; passwords hashed with Argon2id; authenticator secrets and integration secrets encrypted with AES-256-GCM using purpose-specific keys derived by HKDF; mobile, ingest and password-reset tokens stored only as keyed one-way hashes; encryption at rest for storage and backups.
• Application security: secure development practices; input validation; parameterised database queries; CSRF protection; content security policy with per-request nonces and restrictive security headers; sanitisation of uploaded files and images; egress protection for customer-configured webhooks; rate limiting; dependency management and software bill of materials; independent penetration testing; coordinated vulnerability disclosure.
• Infrastructure: origin servers not directly exposed to the internet (Cloudflare Tunnel); web application firewall, DDoS protection and bot management; hardened, non-root containers; segregated environments for development and production; secrets held in environment configuration, never in source control; infrastructure hosted in the United Kingdom, with backups and redundant copies held in the United Kingdom or the European Union.
• Monitoring and logging: authentication, administrative-change, email and error events forwarded to a security information and event management platform; database-backed audit trail available to global administrators; alerting on anomalous activity; log integrity controls.
• Resilience: load-balanced, multi-node deployment; twice-daily database backups with 14-day retention stored off-site; restoration testing; public status page and incident communications; documented incident response and personal data breach procedures.
• Mobile app: OAuth 2.0 Authorization Code with PKCE via the system browser; tokens stored in the device keychain or keystore; optional biometric lock; local data removed on sign-out; push payloads limited to identifiers; minimum supported version enforcement.
• Metering Equipment: per-device revocable ingest tokens over HTTPS; TLS for MQTT where supported; device data validated on receipt; remote revocation of lost or compromised devices.

Schedule 2 – Acceptable Use Policy

This Acceptable Use Policy applies to everyone who uses any of the Services. Breach of it is a material breach of the Terms.

1. Prohibited uses

You must not use the Services:

1.1 in any way that breaches applicable law or regulation, or that infringes the rights of any person;

1.2 to upload, store, send or transmit material that is defamatory, obscene, offensive, discriminatory, harassing, threatening, or that promotes violence or illegal activity;

1.3 to upload, store or transmit special category personal data, criminal-offence data, payment card data, or personal data you do not have the right to process;

1.4 to send unsolicited or unauthorised advertising, promotional material or other spam, including through project invitations, report sharing, danger reports, work-order emails or alert channels;

1.5 to transmit any Virus or malicious code, or any material designed to interfere with the operation of any software, hardware or network;

1.6 to attempt to gain unauthorised access to the Services, other customers' organisations or data, other users' accounts, the servers or networks connected to the Services, or the Metering Equipment of others, or to test the vulnerability of any of them without our written authorisation (see clause 9.6 of the Terms and the Computer Misuse Act 1990);

1.7 to circumvent or interfere with authentication, tenancy, licensing, rate-limiting, content-security or other controls, or to use the Services other than through the interfaces we provide;

1.8 to scrape, crawl, harvest or bulk-extract data from the Services by automated means other than the export features we provide;

1.9 to share accounts, credentials, tokens, SIM cards or Equipment access with anyone who is not authorised;

1.10 to impersonate any person or organisation, to sign a document electronically as someone else, or to misrepresent your authority, competence or role;

1.11 to interfere with or disrupt the integrity or performance of the Services, including by sending excessive traffic, malformed telemetry, or excessive alert, webhook or email volumes;

1.12 to reverse engineer, copy, resell or build a competing product using the Services, except as expressly permitted by law;

1.13 to use the Services as a safety, protective, life-safety or billing system, or to rely on them in breach of clauses 10 and 11 of the Terms; or

1.14 to use the Services in breach of sanctions or export-control laws.

2. Content standards

2.1 Content you upload (including photographs, notes, form entries, attachments, branding and custom map images) must be accurate where it states facts, genuinely held where it states opinions, and must not contain personal data beyond what is necessary for the purpose. Photographs should focus on equipment and site conditions and avoid capturing people unnecessarily.

2.2 You are responsible for ensuring that you have the right to upload any content, including any Intellectual Property Rights and any consents needed for images of people or private property.

3. Communications features

3.1 Emails, notifications, share links and documents generated by the Services may be sent only to people who have a legitimate connection with the relevant project, site, customer or work and who would reasonably expect to receive them.

3.2 Share links must be given appropriate expiry dates and revoked when no longer needed. You must not post share links publicly.

3.3 Webhook endpoints and notification channels must be under your control or that of a party who has agreed to receive the data.

4. Resource limits

4.1 We may set and enforce reasonable limits on storage, upload sizes and types, telemetry rates, API and ingest requests, email and notification volumes, report generation and other resource use, as described in the Documentation or notified to you. We may throttle or block usage that exceeds those limits or that we reasonably consider abusive.

5. Enforcement

5.1 We decide in our reasonable discretion whether this policy has been breached. We may remove or disable content, suspend or terminate access, revoke tokens and devices, notify the Customer and the authorities, and take legal action. We will act proportionately and, where practicable, notify the Customer first.

5.2 Report breaches of this policy, and security vulnerabilities, to [email protected].

Schedule 3 – Support Services

1. Support channels

1.1 Requests for support should be raised through the support portal at https://broadsightlabs.atlassian.net/servicedesk/customer/portal/35, which provides request types for technical support, bug reports, feature suggestions, improvement suggestions, product trial questions, licensing and billing questions, and other questions. Requests may also be made by email to [email protected] or by telephone on +44 (0)204 538 5011 during Support Hours; we may ask you to log a telephone request in the portal so that it can be tracked.

1.2 Self-service documentation is available at https://broadsightlabs.atlassian.net/wiki/spaces/BEKH and through the help button in the Platform.

1.3 "Support Hours", the priority definitions, target response times, maintenance windows and any availability commitment that apply to a Customer are those set out in its Order Form or, where the Order Form is silent, in the support plan we publish or notify to Customers from time to time (the "Support Plan"). Where neither document specifies a matter, we will provide Support Services during our normal business hours on Business Days using reasonable endeavours.

2. How requests are handled

2.1 We will assign each request a priority in good faith based on its impact on the Customer's use of the Services and the information provided, and may reassign it as the investigation proceeds. Requests reporting that the Platform or the ingest service is unavailable to all of the Customer's users, or a confirmed security incident affecting Customer Data, are treated as the highest priority.

2.2 Any target response times in the Order Form or Support Plan are targets, not guarantees, and measure the time to our first substantive response, not the time to resolution. Resolution may consist of a fix, a workaround, or a decision not to change the Services.

2.3 Support Services exclude: issues caused by the Customer's own systems, networks, browsers, devices, identity providers, third-party equipment or configuration; Third-Party Services; issues arising from use in breach of the Terms; training, consultancy, custom development, data migration and on-site work; and support for versions of the App that are no longer supported.

3. Maintenance and service status

3.1 We aim to carry out planned maintenance at times that minimise disruption to Customers and to give reasonable advance notice on the status page. Emergency maintenance (for example to address a security vulnerability) may be carried out at any time with as much notice as is practicable.

3.2 Incidents and maintenance are communicated on the status page at https://broadsightlabs.statuspage.io. Customers should subscribe to updates.

3.3 Any availability target or service level applies only where it is set out in an Order Form (clause 13.1 of the Terms).

4. Security incidents

4.1 Suspected security incidents and vulnerabilities should be reported immediately to [email protected] (24 hours a day) rather than through the general support portal. Personal data breaches are handled in accordance with Schedule 1.

Schedule 4 – Additional terms for app store distribution

Part 1 – Apple App Store

The following terms apply to any use of the App obtained from the Apple App Store, as required by Apple's minimum terms for a developer's end user licence agreement. "Apple" means Apple Inc. and its subsidiaries.

1. Acknowledgement. This licence is between you and Broadsight Labs only, not Apple. Broadsight Labs, not Apple, is solely responsible for the App and its content. This licence may not provide for usage rules that conflict with the Apple Media Services Terms and Conditions.

2. Scope of licence. The licence granted to you for the App is limited to a non-transferable licence to use the App on Apple-branded products that you own or control and as permitted by the Usage Rules set out in the Apple Media Services Terms and Conditions, except that the App may be accessed and used by other accounts associated with you via Family Sharing or volume purchasing.

3. Maintenance and support. Broadsight Labs is solely responsible for providing any maintenance and support services for the App, as specified in these Terms or as required by applicable law. Apple has no obligation whatsoever to furnish any maintenance and support services with respect to the App.

4. Warranty. Broadsight Labs is solely responsible for any product warranties, whether express or implied by law, to the extent not effectively disclaimed. In the event of any failure of the App to conform to any applicable warranty, you may notify Apple, and Apple will refund the purchase price (if any) for the App to you. To the maximum extent permitted by applicable law, Apple will have no other warranty obligation whatsoever with respect to the App, and any other claims, losses, liabilities, damages, costs or expenses attributable to any failure to conform to any warranty will be Broadsight Labs' sole responsibility.

5. Product claims. Broadsight Labs, not Apple, is responsible for addressing any claims by you or any third party relating to the App or your possession and/or use of the App, including (i) product liability claims; (ii) any claim that the App fails to conform to any applicable legal or regulatory requirement; and (iii) claims arising under consumer protection, privacy or similar legislation.

6. Intellectual property claims. In the event of any third-party claim that the App or your possession and use of the App infringes that third party's intellectual property rights, Broadsight Labs, not Apple, will be solely responsible for the investigation, defence, settlement and discharge of any such claim.

7. Legal compliance. You represent and warrant that (i) you are not located in a country that is subject to a US Government embargo, or that has been designated by the US Government as a "terrorist supporting" country; and (ii) you are not listed on any US Government list of prohibited or restricted parties.

8. Developer name and address. Broadsight Labs Ltd., 1 Tower House, Tower Centre, Hoddesdon, Hertfordshire, EN11 8UR, United Kingdom; [email protected]; +44 (0)204 538 5011. Direct any questions, complaints or claims with respect to the App to these contact details.

9. Third-party terms. You must comply with applicable third-party terms of agreement when using the App, for example your wireless data service agreement.

10. Third-party beneficiary. Broadsight Labs and you acknowledge and agree that Apple, and Apple's subsidiaries, are third-party beneficiaries of this licence, and that, upon your acceptance of the terms and conditions of this licence, Apple will have the right (and will be deemed to have accepted the right) to enforce this licence against you as a third-party beneficiary thereof.

Part 2 – Google Play

The following terms apply to any use of the App obtained from Google Play. "Google" means Google LLC and its affiliates.

1. This licence is between you and Broadsight Labs only, not Google. Google is not responsible for the App or its content and has no obligation to provide maintenance or support for it.

2. Your download and use of the App from Google Play is also subject to the Google Play Terms of Service. In the event of a conflict between this licence and the Google Play Terms of Service regarding your use of Google Play, the Google Play Terms of Service prevail.

3. Broadsight Labs, not Google, is responsible for addressing any claims relating to the App, including product liability, legal or regulatory compliance, consumer protection and intellectual property claims.

4. Google is a third-party beneficiary of this licence to the extent necessary to enforce the terms of the Google Play Terms of Service and the Google Play Developer Distribution Agreement.

Broadsight Labs Ltd. · Registered in England and Wales, company number 17126211 · Registered office: 1 Tower House, Tower Centre, Hoddesdon, Hertfordshire, EN11 8UR, United Kingdom · [email protected] · +44 (0)204 538 5011