Version 1 · Published: 30th Sept 2026

These Terms are a binding agreement between you and Tradecert Limited, 111-113 High Street, Evesham, Worcestershire, WR11 4XP, company number 15542281 ("Tradecert", "we", "us").

They cover the Tradecert application on iOS, iPadOS, macOS, Android and the web at my.tradecert.app (the "App"), our website at tradecert.app (the "Site"), and everything related (together, the "Services").

Business use only. The Services are supplied for use in a trade, business, craft or profession. By using them you confirm you are acting for purposes relating to your trade, business, craft or profession and not as a consumer.

1. The documents, and how you accept them

Our agreement with you consists of these Terms including Schedules A and B, our End User Licence Agreement, and any signed order form. Our Privacy Policy explains how we handle personal data; it is a transparency notice, not a contract.

You accept these Terms by ticking the acceptance box when you create an account, and by pressing accept when we present an updated version in the App. We record each acceptance with the version, the time and the platform. These Terms, the End User Licence Agreement and the Privacy Policy share a single version, shown at the top of each document, and are presented together.

Accepting these Terms is not consent to anything optional. Marketing, advertising, device location and storing a signature are asked for separately, answered separately and recorded separately. Declining any of them does not affect your access or your price.

Nothing binds you simply because it has been posted on the Services. Only documents we present to you for acceptance, or expressly refer to in these Terms, form part of our agreement.

Order of precedence. Where the documents conflict: any signed order form; then Schedule A, on data protection matters; then these Terms; then the End User Licence Agreement. Where the Privacy Policy conflicts with Schedule A, Schedule A prevails.

2. Changes to these terms

We may change these Terms. Where a change is material and adverse to you — for example a change to fees, to how we use or share data, or to your rights — we will give at least 30 days' notice and then present the updated documents in the App for acceptance. If you do not accept, you may cancel before the change takes effect, subject to clause 6 on annual subscriptions.

Minor changes, such as corrections, clarifications and updated contact details, take effect when published.

Our sub-processor list and cookie table are maintained separately and can change without a new acceptance. Changes to the sub-processor list follow clause 6 of Schedule A.

We keep previous versions and will provide a copy on request.

3. The Services

The Services provide software for producing, managing and storing certificates, reports and inspection records across a range of trades. These may include electrical installation work, emergency lighting, fire detection and alarm systems, portable appliance and in-service equipment testing, solar and energy generation, electric vehicle charging equipment, gas and heating work, and other trades and document types we make available from time to time. References to a certificate include any report, record or document produced through the Services.

The Services are not intended for use anywhere that would be contrary to local law. If you access them from outside the United Kingdom you do so on your own initiative and are responsible for local compliance.

4. Your account, and your responsibilities

You must register to use the Services. Keep your password confidential, tell us promptly if you suspect unauthorised use, and give us accurate registration information and keep it current.

You must be 18 or over to create an account, buy a subscription, use the Services or be added to a company workspace. You are responsible for ensuring nobody under 18 uses your workspace.

You must hold and maintain every qualification, registration, scheme membership and authorisation required by law or by any applicable scheme for the work you certify through the Services.

You acknowledge that:

• AI suggestions, calculations and certificate details are assistance only and must be reviewed by a competent person before use;

• AI features organise information and suggest wording; they are not professional, technical, regulatory or safety advice, and are not a substitute for inspection, testing, measurement or professional judgement;

• you are responsible for ensuring your documents comply with every law, regulation, standard, code of practice and scheme requirement applicable to the work;

• the Services include calculation tools and auto-populated values, including values derived from data you enter, and these are provided for convenience — they are not measured results and are not independent verification;

• you remain responsible for taking all required measurements and tests and for exercising your own judgement;

• where the work is subject to a statutory safety regime, you must independently verify every safety-critical value before issuing the document; and

• you must independently verify all results, calculations and entries before issuing, signing, submitting or relying on any document.

5. Payment

All subscriptions are purchased through our website and processed by Stripe, which supports card payment and Direct Debit. There is no in-app purchase. Your payment details go directly to Stripe and are not held by us.

You agree to provide accurate purchase and account information and to keep it current. Prices are in GBP unless stated otherwise, and VAT or other applicable taxes are added where required. You authorise Stripe to charge the amounts properly due under your subscription.

We may correct genuine pricing errors, and may refuse or cancel an order where reasonably necessary, including for pricing errors, suspected fraud or misuse.

6. Subscriptions, renewal and cancellation

Your subscription continues and renews automatically for the plan you have chosen until you cancel. You can cancel through your account.

Cancellation takes effect at the end of your current paid term. At that point your account changes to read-only: you can still sign in and view your certificates, but you cannot create or edit records, and downloading and export are switched off. Export the records you need before then; clause 17 explains how to obtain a copy afterwards.

Annual subscriptions. Where you have paid for an annual term, cancellation takes effect at the end of that term. We do not provide pro-rata or partial refunds for the unused part of a term you have already paid for, except where required by law, where we have agreed otherwise in writing, where you reject a material change under clause 2, or where you object to a sub-processor change under clause 6 of Schedule A.

Price changes. We will not change the fee for a term you have already paid for. We will give at least 30 days' notice by email before a price change takes effect, and it applies from your next renewal after that notice. If you do not accept the new price you may cancel before it takes effect and will not be charged it. Introductory and promotional rates apply only for the period stated at the time, after which the standard rate applies; we will tell you the standard rate before that happens.

7. Acceptable use

Use the Services only for legitimate purposes connected with your trade, business, craft or profession. You must not:

• systematically extract data or content to build a competing database, except through functionality we provide;

• use scraping, robots or automated extraction tools without our permission;

• copy, adapt, decompile or reverse engineer the Services except where the law allows;

• access the Services for competitive analysis, or to copy screens, layouts or workflows, or to build a competing or substantially similar product;

• use our content or outputs to train, fine-tune or evaluate a system designed to replicate the Services;

• circumvent security features, seat limits or subscription arrangements, or share login credentials;

• impersonate another person or use another user's account;

• apply another person's stored signature without their authority, or complete a certificate you are not competent or authorised to complete;

• upload malicious code, or interfere with or overburden the Services;

• use information from the Services to harass or harm anyone, or collect contact details for unsolicited marketing;

• remove proprietary notices, or frame or link to the Services without authorisation; or

• use the Services unlawfully.

Each licence or seat is for a single individual. Material or repeated breach may result in suspension or termination.

8. Your content

You keep all ownership of and rights in the content you create, upload or store. We do not claim ownership.

You grant us a limited, non-exclusive, worldwide, royalty-free licence to host, store, copy for backup and redundancy, process, transmit, adapt so far as technically necessary, and display your content, in order to:

• (a) provide the Services to you and to any company workspace you belong to; and

• (b) operate, secure, test, maintain, improve and develop the Services — including diagnosing faults, reproducing reported problems, building test data, and measuring, improving, training, fine-tuning and evaluating the accuracy of our AI-assisted features and the models used in them.

The licence in (b) is limited to what is necessary for those purposes. It does not permit us to sell your content, to license or disclose it to any third party for that third party's own purposes, or to make it public. Where a purpose in (b) can reasonably be achieved with de-identified or aggregated data, we use that instead.

That licence ends when your content is deleted, except for copies in routine backups until overwritten, and for de-identified or aggregated derivatives that no longer identify you, your clients or any individual.

We do not sell your content. We do not license or disclose it, or anything derived from it, to any third party for that third party's own purposes, in identifiable or anonymised form. We do not use your content or your clients' personal data for advertising. Our use of it to improve the Services is internal and is limited to (b) above. The single exception is the non-identifying technical content described above — an image of an installation, a set of test measurements — which an AI provider may use to improve their own models.

You confirm that you own your content or have the rights to it, that it does not infringe anyone's rights, that it is lawful and free of malicious code, and that where it contains personal data about your clients you have complied with data protection law.

Except as needed to provide the Services, we treat your certificate content, photographs and notes as confidential and do not make them public. We may remove content we reasonably consider unlawful or in material breach, but we have no general obligation to monitor.

Feedback. If you send us a question, suggestion or idea about the Services, we may use it to operate and improve our business. To the extent you own intellectual property rights in it and they can be assigned, you assign them to us with full title guarantee, and you waive any moral rights so far as the law allows. Where a right cannot be assigned, you grant us an irrevocable, perpetual, worldwide, royalty-free, exclusive and sublicensable licence to use it. Feedback does not include your content, which remains yours. In-app feedback is routed to our internal team messaging system together with your name, email address, telephone number, company and the screen you sent it from.

9. Signatures in company workspaces

You can store a digital representation of a handwritten signature for use in a company workspace. Stored signatures carry professional and legal significance.

Every user account in a workspace, other than accounts assigned an office or administrative support role without certificate permissions, can select and apply any stored signature in that workspace, including one belonging to another user of any role. Only Administrator and Qualified Supervisor accounts can complete, lock or finalise a certificate; a certificate prepared or signed by anyone else does not become a completed certificate until an Administrator or QS account completes it.

By storing a signature, a user consents to other users of that workspace applying it, and may withdraw at any time by deleting it, asking the customer to remove it, leaving the workspace, or contacting support@tradecert.app. Withdrawal applies going forward.

The customer must ensure everyone who stores a signature has been told how this works and has consented freely, and must not require anyone to store a signature as a condition of using the Services.

The customer is solely responsible for configuring and supervising its users, assigning roles, ensuring Administrator and QS roles are held only by people competent and authorised to complete the documents in question, governing who may apply whose signature, revoking access promptly when someone leaves or their authority changes, and ensuring every signature and declaration applied is accurate and properly authorised. The customer is responsible for the acts and omissions of its users.

We provide the technical functionality. We do not verify identity, authenticate signatures, check authority, or assess whether a user completing a certificate is competent to do so. We may record technical and account activity but do not warrant that any record of a signing event will be complete, retained indefinitely or available for evidential purposes.

To the fullest extent permitted by law and subject to clause 13, we are not liable for the unauthorised or improper application of a stored signature, for a certificate completed by someone not competent or authorised, or for the customer's failure to manage access or signing authority.

10. Intellectual property

We own or license all intellectual property in the Services, including code, databases, functionality, design, text, images and our trademarks. The selection, arrangement and presentation of screens, forms, fields, navigation and overall look and feel may itself be protected.

Subject to these Terms, we grant you a non-exclusive, non-transferable, revocable licence to access the Services and to download or print content you have properly accessed, for your internal business purposes. That does not prevent you from using certificates and documents you generate in the ordinary course of your own business.

No licence is granted, expressly or by implication, to reproduce or emulate the look and feel, layouts or workflows of the Services for any competing product, or to use any part of our interface or design system to develop, test, train, validate or market competing software.

Any other use requires our written permission. We reserve all rights not expressly granted.

11. Third-party sites and links

The Services may link to third-party websites and content we do not control. We are not responsible for their availability, accuracy or privacy practices, and a link is not an endorsement. Some links to suppliers and calibration providers may be affiliate links from which we earn a commission, and we will make that clear where it applies. Purchases from third parties are between you and them.

12. Availability and changes to the Services

We may change, update or discontinue parts of the Services. We do not guarantee that any feature will remain available. Where we intend to discontinue a material feature you rely on, we will give at least 30 days' notice where reasonably practicable.

We may carry out maintenance and security work that interrupts the Services, and will give notice where practicable. The Services may also be affected by matters outside our reasonable control, including internet outages, third-party infrastructure failures and cyber incidents. Subject to clause 13, we are not liable for losses arising solely from temporary interruption or modification.

13. Liability

13.1 Except for the liabilities in 13.4, all our liability arising out of or in connection with these Terms or the Services — in contract, tort including negligence, misrepresentation, breach of statutory duty or otherwise, and whether arising from an act, omission, software defect, calculation error, security failure, service interruption, AI output or any other cause — is subject to this clause.

13.2 The basis of this allocation. The parties acknowledge that these limits reflect: the subscription price, which is set on the basis of this allocation of risk; the fact that you control the professional work the Services document, take the measurements, exercise the judgement and issue the certificate; your obligation to maintain professional insurance appropriate to your business, which is the appropriate place for the risk of professional loss to sit; and the availability of a higher cap under 13.3.

13.3 The cap. Our total aggregate liability for all claims will not exceed the greater of the total amount you paid us in the twelve months before the event giving rise to the claim, or £1,000.

A higher cap is available on request. Contact support@tradecert.app before or at any time during your subscription. We will consider any request in good faith and will offer a higher cap on commercially reasonable terms, which may include an adjusted fee reflecting the increased risk. The cap above applies only where no higher cap has been agreed in writing.

Subject to 13.4, we are not liable for loss of profit, revenue, business, anticipated savings, contracts, opportunity, goodwill or reputation; costs of recreating, retesting or re-entering data; costs of substitute products or services; regulatory fines imposed on you; claims made against you by your clients or third parties; or indirect, consequential, special, incidental, exemplary or punitive loss. These apply whether or not we knew the loss was possible.

Liability for loss, deletion, corruption or unavailability of your data, certificates or records is not excluded but is subject to the cap in 13.3. You remain responsible for keeping your own copies of anything important.

13.4 What cannot be limited. Nothing in these Terms excludes or limits our liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, for liability under data protection law that cannot lawfully be limited, or for anything else that cannot lawfully be excluded or limited. All limits apply only so far as the law allows.

13.5 Insurance. You are responsible for maintaining professional indemnity and other insurance appropriate to your trade, your contracts and any scheme you belong to. Our insurance does not extend to you or your work.

14. Indemnity

To the fullest extent permitted by law, you will indemnify us against third-party claims, losses, liabilities and reasonable legal costs arising from: your unlawful content; your material breach of these Terms; your infringement of a third party's intellectual property, privacy or other rights; any certificate or document issued or signed by you through the Services where the claim results from your professional act or omission, inaccurate input, failure to verify, or unauthorised use of a signature; or fraudulent, malicious or unlawful use of the Services by you or your users.

This does not apply to the extent the claim arises from our own breach, our negligence, or our breach of data protection law. We will notify you promptly of any claim, will not settle without your consent (not to be unreasonably withheld), and will give you reasonable assistance at your expense. You are not required to indemnify us for liability that cannot lawfully be transferred.

15. Disclaimer

The Services are provided on an "as is" and "as available" basis. To the fullest extent permitted by law we disclaim warranties, express or implied, except those expressly set out here.

We do not warrant the accuracy, completeness, regulatory compliance or suitability of any certificate, calculation, AI output, observation or document produced using the Services, in any trade. You remain responsible for independently verifying results, calculations, codings, entries, conclusions and compliance before issuing, signing, submitting or relying on any document.

We do not warrant that the Services will be uninterrupted, completely secure or error-free, or that all defects will be corrected. Nothing here limits liability that cannot lawfully be limited.

16. Suspension and termination

These Terms apply while you use the Services. We may suspend, restrict or terminate access where we reasonably consider it necessary, including where: you materially breach these Terms and fail to remedy a remediable breach within a reasonable period after being asked; your use is unlawful, fraudulent, abusive or creates a material security or operational risk; you fail to pay amounts properly due; the law or a regulator requires it; or continued provision is no longer reasonably practicable for legal, technical, security or operational reasons.

Where reasonably practicable we will give notice and, where appropriate, an opportunity to remedy. We may act immediately where necessary to protect the Services, other users, data or security.

If we terminate for breach or misconduct, you must not open another account to circumvent it. We may also take legal action where justified.

17. Your records after your subscription ends

When your paid term ends, your account changes to read-only. You can still sign in and view your certificates, but you cannot create or edit records, and downloading and export are switched off, so you should export what you need while your subscription is active. We do not guarantee that read-only access will remain available indefinitely, and where we suspend or terminate for breach or misconduct we may remove access altogether. Storage of your records continues after that point, as a continuing service described in clause 10 of Schedule A and in our Privacy Policy.

We continue to hold your records as described in our Privacy Policy and in Schedule A. If you need a copy afterwards, contact support@tradecert.app. We will provide it, normally within 30 days, for as long as we still hold it, at no charge for a reasonable request. We may decline or delay where we reasonably suspect fraud or unlawful use, or where the law requires.

Termination or suspension does not by itself authorise deletion of your certificate data. We do not delete certificate records solely because a payment has failed or a subscription has lapsed.

Closing an account, deleting a company workspace or ending your subscription is not by itself a request to erase your personal data. We continue to hold personal data in accordance with our Privacy Policy and Schedule A until you ask us to return or delete it. If you want your personal data erased, tell us at support@tradecert.app and we will act on it as set out in clause 10 of Schedule A.

18. Data protection

Our processing of personal data is described in our Privacy Policy. Where we process personal data on your behalf, Schedule A applies and forms part of these Terms. It takes effect automatically when you accept these Terms and needs no separate signature. If you need a countersigned copy for a client's procurement process, contact support@tradecert.app.

Where you upload certificate content about your own clients, you are the controller and we are your processor. Where a company workspace exists, the company is the controller. We are a controller in our own right for your account data, analytics, error monitoring, support, marketing and advertising, as described in our Privacy Policy.

19. Disputes and governing law

If a dispute arises, both parties will first try to resolve it informally for at least 30 days from written notice. If it cannot be resolved, it will be decided by the courts of England and Wales. Nothing prevents either party from seeking urgent injunctive relief, or from issuing proceedings where necessary to protect its position before a limitation period expires.

These Terms and your use of the Services are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

20. General

These Terms and the documents referred to in clause 1 are the whole agreement between us on their subject matter. A failure to enforce a right is not a waiver of it. If any provision is unenforceable it is severed to the minimum extent necessary and the rest continues.

We may assign our rights and obligations as part of a legitimate business transaction, financing, restructuring or sale. You may not assign without our written consent unless the law provides otherwise.

Nothing creates a partnership, joint venture, employment or agency. Except where expressly stated, no person who is not a party has any right under the Contracts (Rights of Third Parties) Act 1999 to enforce these Terms.

We are not responsible for delay or failure caused by matters beyond our reasonable control. Visiting the Services, emailing us and completing forms are electronic communications, and you agree that notices and other communications may be given electronically where the law allows.

There may be typographical errors or omissions in information on the Services, and we may correct them.

21. Contact

Tradecert Limited, 111-113 High Street, Evesham, Worcestershire, WR11 4XP

Company number 15542281 · VAT number 503816901 · support@tradecert.app

Schedule A — Data Processing Agreement

This Schedule forms part of the Terms and Conditions and applies whenever Tradecert processes personal data on your behalf. It sets out our obligations as your processor under UK GDPR and the Data Protection Act 2018. It takes effect when you accept the Terms and continues while we process personal data for you.

In this Schedule, "you" and "Controller" mean the customer — where a company workspace exists, the company that owns it. "Tradecert" and "Processor" mean Tradecert Limited. Personal Data, Processing and Personal Data Breach have the meanings given in UK GDPR.

This Schedule does not apply to personal data for which Tradecert is a controller in its own right. Clause 12 explains that distinction.

1. What we process for you

Subject matter. Operation of the Tradecert certification and inspection platform.

Duration. The term of our agreement with you, and any further period described in the Privacy Policy.

Nature of the processing. Collection, storage, organisation, structuring, retrieval, indexing, use, disclosure by transmission, restriction, erasure and destruction.

Purpose. Enabling you to create, store, manage and issue certificates, reports and inspection records; AI-assisted extraction and suggestion; search; equipment and calibration tracking; providing support and diagnosing faults; securing the Services; and administration of your company workspace and its members.

Categories of personal data. Names, email addresses, telephone numbers, professional credentials, signatures, test instrument details, observations and certificate content, installation addresses including full addresses and postcodes, client names and contact details where you enter them, photographs of installations and equipment, and device and usage data.

Categories of data subjects. Your clients, including property owners and occupiers; your employees, contractors and sub-contractors; and any other individual whose personal data appears in a document you create using the Services.

2. Processing on your instructions

We process personal data only on your documented instructions, except where the law requires otherwise — in which case we will tell you before processing, unless the law prevents us.

These Terms, the End User Licence Agreement and your use of the Services are your complete instructions as at the date of this agreement. You may give further written instructions during the term, and we may charge for work outside the scope of the Services.

Beyond providing the Services, we process your certificate content only for the purposes set out in clause 3 of this Schedule and clause 8 of the Terms — operating, securing, testing, maintaining, improving and developing the Services. We do not create datasets derived from your certificate content for licensing or sale, in identifiable or anonymised form, and we do not disclose it to any third party for that third party's own purposes, other than the non-identifying technical content described in clause 3 of this Schedule.

We will tell you if we believe an instruction infringes data protection law.

3. AI-assisted features

Where you use an AI-assisted feature, the certificate content you submit to that feature — including photographs, test results and free-text notes — is processed on our instructions by the AI providers named on our sub-processor list, which may include Google, Anthropic and OpenAI.

Improving and developing the Services. You instruct us, as part of these Terms, to process customer data — including certificate content, photographs, test results and free-text notes — for the purpose of operating, securing, testing, maintaining, improving and developing the Services. That includes diagnosing faults, reproducing reported problems, building test data, and measuring, improving, training, fine-tuning and evaluating the accuracy of our AI-assisted features and the models used in them.

That processing is not limited to content you submit to a feature. It includes analysing the records we hold with AI assistance, whether through our internal analytics warehouse — a copy of customer data from which contact details, signatures, profile pictures and credentials have been removed — or, where we are investigating something specific, the records themselves. Your clients' contact details and signatures are not sent to an AI provider.

This processing is carried out by us, and by sub-processors acting on our instructions, under this Schedule. We do not disclose customer data that identifies any person to a third party for that third party's own purposes, and we do not permit any third party to use it to train or improve their own general-purpose models. For that data we contract with each AI provider on business terms under which submitted content is not used for that provider's own model training and is retained only transiently for abuse monitoring. The one exception is content that identifies nobody — an image of an installation, a set of test measurements — which we may send to a provider on terms that let them use it to improve their own models. We decide what qualifies, and anything naming or picturing a person, your clients' details included, never does.

Where a purpose above can reasonably be achieved with de-identified or aggregated data, we use that instead. Access to identifiable certificate content for these purposes is limited to personnel who need it, as described in Schedule B.

Where an AI provider offers a United Kingdom regional endpoint we use it. Clause 11 describes what happens where it is unavailable, and where a provider offers none.

4. Confidentiality

People authorised to process personal data under this Schedule are subject to appropriate confidentiality obligations.

5. Security

We implement and maintain appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Our current measures are set out in Schedule B. We review them periodically and may change them, provided the level of protection is not reduced.

6. Sub-processors

You give us general authorisation to engage the sub-processors listed on our sub-processor list, available in the Tradecert app under Settings, and referred to in our Privacy Policy.

Before we add or replace a sub-processor that processes personal data on your behalf, we will:

• give you at least 30 days' notice by email or in-app notice, and update the list; and

• allow you to object on reasonable data protection grounds within that period.

Where you object, we will work with you in good faith to find a resolution — which may include a different region, a configuration change, or an exclusion where feasible. If no resolution is found, your remedy is to terminate the affected Services, and we will refund fees paid in advance for the period after termination. An objection does not entitle you to prevent the change for other customers.

We may engage a replacement sub-processor with shorter notice where necessary to maintain the security or continuity of the Services, and will tell you as soon as we can.

We enter into written agreements with sub-processors imposing data protection obligations equivalent to those in this Schedule, and we remain liable to you for their acts and omissions as if they were our own.

7. Data subject rights

Taking into account the nature of the processing and the information available to us, we will give you reasonable assistance to respond to requests from individuals exercising their rights.

Where an individual contacts us directly about personal data we process on your behalf, we will tell you promptly and will not respond substantively except on your instruction or where the law requires.

8. Impact assessments

We will give reasonable assistance with data protection impact assessments and prior consultations with the ICO, where they relate to processing we carry out under this Schedule.

9. Personal data breaches

We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting personal data processed under this Schedule. We will give you the information reasonably available at the time and provide updates as the position becomes clearer.

We will take appropriate steps to investigate, contain and remediate, and will give you reasonable assistance with your own obligations under Articles 33 and 34.

10. Return and deletion

At any time on your written request, and on termination or expiry of the Services, we will at your election return or delete the personal data we process on your behalf, and delete existing copies — except where the law requires us to keep it, in which case we will tell you and will continue to protect it under this Schedule.

Where you make no election, you instruct us to continue storing the data as a continuing service, on the retention approach described in our Privacy Policy, which reflects the fact that certificates and inspection records are frequently needed years after they are created and may be needed for the life of an installation. That instruction stays in force, and the processing continues under this Schedule, until you elect otherwise. You may make an election at any time, and we will act on it within 30 days.

We will act on a return or deletion request within 30 days.

How deletion operates in practice. Where a user deletes an account through the Services, we remove the account record, the authentication credentials and the files that account uploaded, and delete the associated contact from our email system. Certificates created within a company workspace belong to that workspace and are not deleted with an individual account; the workspace controller decides what happens to them. A user who belongs to a company workspace must leave it before the account can be deleted.

Where you make a request to us under this clause, we additionally remove or de-identify personal data held by the sub-processors that support the Services, including analytics, support-diagnostic, search and error-monitoring providers, within 30 days of the request. We act on request rather than automatically because those systems hold the diagnostic and support records we rely on to support other users of your workspace, to investigate issues arising before deletion, and to maintain the security of the Services.

We may retain, for a limited period and only for so long as necessary, records required to: provide continued support to you or to another user of your workspace, including investigating an issue that arose before the request; maintain the security and integrity of the Services and prevent fraud or abuse; comply with a legal or regulatory obligation; or establish, exercise or defend a legal claim. Records retained under this paragraph are limited to what is necessary for the stated purpose, are not used for any other purpose, and are deleted or de-identified once that purpose has been met.

Backup copies are not edited. They are overwritten or expire on the ordinary backup cycle described in Schedule B. Where a restore is performed from a backup predating a deletion request, the deletion is re-applied to the restored data.

De-identified or aggregated data created under clause 3 that no longer identifies you, your clients or any individual is not affected by a deletion request, because it is no longer personal data. It is never sold, licensed or disclosed to a third party.

11. International transfers

Customer Data is stored and processed in the United Kingdom, other than as set out below. Processing outside the United Kingdom and the EEA includes the following:

• AI features. Where a United Kingdom regional AI endpoint is unavailable or capacity-limited, requests fail over to that provider's global endpoint, which may process the request in any of its regions. Where a provider offers no United Kingdom endpoint, requests to it are processed outside the United Kingdom. Such requests contain the certificate content submitted to that feature. Except for the non-identifying technical content described in clause 3, no provider uses this data to train its models, and each retains it only transiently for abuse monitoring under the business terms we contract on.

• Google-managed global services. Firebase Authentication and Google Analytics for Firebase operate on Google's global infrastructure and are not region-configurable.

• Error monitoring. Error events are processed in the United States.

• Billing and, where consented, conversion measurement. Stripe and the advertising platforms named in our Privacy Policy operate on global infrastructure.

• Ancillary provider services. Our search provider's dashboard and monitoring, and our marketing-website session recording provider's support access, may involve processing in the European Union and the United States.

• Transactional email. Our provider is a United States entity. Hosting is in the European Union, in Belgium, but its terms permit processing in the United States and elsewhere its group companies and sub-processors operate.

Search indexing is performed in the United Kingdom; ancillary services such as the provider's dashboard and monitoring may involve processing in the European Union and the United States. Search analytics are processed in the European Union (Germany). Product analytics is processed in the European Union. Transactional email is hosted in the European Union, in Belgium, but our provider is a United States entity whose terms permit processing in the United States and elsewhere its group companies and sub-processors operate.

Session recording on our marketing website is processed in the European Union, in Ireland, with limited international access by the provider's personnel for service and support. That processing does not involve Customer Data.

All such transfers are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, incorporated into each sub-processor's data processing agreement, or under a UK adequacy decision where one applies. The position for each sub-processor is shown on our sub-processor list, available in the Tradecert app under Settings and on request, and copies of applicable transfer mechanisms are available from support@tradecert.app.

12. Where we act as controller

This Schedule governs personal data we process on your behalf — principally the content of the certificates and documents you create, including personal data about your own clients.

Separately, we act as a controller in our own right for your account data: your name, email address, telephone number, company details, professional credentials, subscription and billing information, how you use the Services, your support enquiries, your marketing and advertising choices, and the records of those choices. We process that for our own purposes, including account administration, service communications, product analytics, error monitoring, support, security, marketing where you have asked for it, and advertising measurement and audience management where you have given permission.

That activity is not carried out on your instructions and is not governed by this Schedule. It is described in our Privacy Policy, which sets out the lawful bases, the recipients and the controls available to you.

For the avoidance of doubt, we do not disclose certificate content, client details, installation records or job data to advertising platforms.

13. Audit

We will make available the information reasonably necessary to demonstrate compliance with this Schedule and with Article 28, and will allow for and contribute to audits, including inspections, by you or an auditor you appoint.

Audits are subject to reasonable notice, appropriate confidentiality obligations, and your cost. They may be carried out no more than once in any twelve months, unless following a Personal Data Breach affecting your data or where a regulator requires it, and must be conducted in a way that does not unreasonably disrupt our operations.

Where our written security information reasonably answers your questions, we may satisfy an audit request by providing it.

14. Your obligations

As controller you are responsible for:

• having a lawful basis for the personal data you instruct us to process;

• ensuring the personal data you upload has been collected lawfully and that the individuals have been given the privacy information required by Articles 13 and 14;

• the accuracy, completeness and content of the documents you create;

• maintaining the professional credentials and registrations required to use the Services;

• ensuring people you invite to a company workspace are authorised to access it and the personal data visible within it, and removing access promptly when that changes; and

• telling us promptly if you believe an instruction would infringe the law.

15. Liability and general

Nothing in this Schedule limits the rights of data subjects under Article 82 UK GDPR, or any liability which cannot lawfully be limited. As between us and you, our liability under this Schedule is subject to clause 13 of the Terms and Conditions to the fullest extent permitted by law.

Where this Schedule conflicts with the Terms and Conditions on a data protection matter, this Schedule prevails.

We may update this Schedule to reflect changes in law or in our processing. Material changes are presented for acceptance with the other documents, as described in clause 2 of the Terms.

This Schedule is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Schedule B — Technical and organisational security measures

These are the measures we currently apply. We review them periodically and may change them, provided the level of protection is not reduced. This Schedule describes our measures at a level appropriate for publication; further detail is available to customers under a confidentiality agreement.

Encryption

Personal data is encrypted in transit and at rest.

Access control

Access to systems containing personal data is limited to Tradecert personnel who require it for support, troubleshooting and service operation. Multi-factor authentication is required for administrative accounts, hosting accounts and application back-end systems. Access rights are removed promptly when a person's role changes or they stop working with Tradecert. We do not use external contractors for access to customer data.

User authentication

Users authenticate with an email address and password. We enforce minimum password complexity requirements.

Hosting and infrastructure

We host the Services on Google Cloud Platform and Firebase. Production, staging and development run as three separate Google Cloud projects with no shared data.

All application compute, and Customer Data at rest in the core Tradecert application — database, realtime database and file storage — are located in Google Cloud's London region in the United Kingdom. Firebase Authentication is a Google-managed global service and is not region-configurable. Search indexing, product analytics, error monitoring and transactional email involve processing in other locations, as set out in clause 11 of Schedule A and on our sub-processor list.

The web application is served as static assets through a global content delivery network; no Customer Data is stored on or served from that network. DNS is provided by Cloudflare, Inc., which does not proxy application traffic and holds no Customer Data; it processes DNS query and technical metadata only.

Payment details, including card and bank details for Direct Debit, are captured and processed entirely within Stripe-hosted checkout and billing pages. We neither receive nor store them.

Backups and disaster recovery

Method and frequency. Three layers of protection operate on the production database. Point-in-time recovery runs continuously, so the database may be read as at any timestamp within the retention window and there is no period during which a change is unprotected. Scheduled backups are taken every 24 hours, and a full backup is taken every Sunday.

Retention. Point-in-time recovery is retained for 7 days, being the maximum the service offers. Daily backups are retained for 30 days and weekly backups for 98 days. The furthest recovery point is therefore approximately 14 weeks.

Location. All backups are held in Google Cloud's London region in the United Kingdom, the same region as the source database. Backups are not transferred outside the United Kingdom.

Recovery. Point-in-time recovery supports record-level restoration into the live database. Scheduled backups support full-database restoration to a new database instance. Restores are carried out by our authorised personnel, or at the request of an administrator of the company owning the affected records, and are logged.

Monitoring

We operate application error monitoring and monitor for unusual access and login activity.

Incident response

We maintain a written cyber incident response plan setting out immediate actions, responsibilities and escalation. Where we become aware of a Personal Data Breach affecting data we process on a customer's behalf, we notify the affected customer without undue delay and in any event within 72 hours, as set out in clause 9 of Schedule A.

Personnel

Tradecert personnel are subject to confidentiality obligations and receive security awareness guidance.

Vendor management

We assess the security posture of service providers before adopting them and maintain a record of those we use, available as our sub-processor list in the Tradecert app under Settings, and on request.

TERMS & CONDITIONS