Terms and Conditions

Revision 2.0 takes effect on 1 September 2026. Order Forms that incorporate the TrustFlight Terms and Conditions by reference are governed by this Revision from that date; Revision 1.2 governs the period before it. Customers who hold a separately signed agreement with TrustFlight continue on the terms of that agreement.

TRUSTFLIGHT MASTER SERVICES AGREEMENT

Revision 2.0, effective 1 September 2026

Formerly the TrustFlight Terms and Conditions, and continuing the same revision sequence. This Revision supersedes Revision 1.2 dated 2024-05-01. Customers who have entered into a separately signed agreement with TrustFlight continue on the terms of that agreement.

SCHEDULE 1: GENERAL TERMS AND CONDITIONS

THIS MASTER SERVICES AGREEMENT (COLLECTIVELY, “AGREEMENT” OR “Agreement”) ENTERED INTO BY AND BETWEEN THE TRUSTFLIGHT LEGAL ENTITY IDENTIFIED IN THE ORDER FORM AS THE CONTRACTING ENTITY AND ITS AFFILIATES (COLLECTIVELY, “SERVICE PROVIDER”, “Service Provider”, “COMPANY”, “Company”, “WE”, “We” OR “US”, “Us”) AND THE INDIVIDUAL OR LEGAL ENTITY USING OR LICENSING THE SERVICES UNDER THIS AGREEMENT AND/OR UNDER AN APPLICABLE ORDER FORM AND SERVICE DESCRIPTION DOCUMENT (COLLECTIVELY “CUSTOMER”, “Customer”, “YOU”, “You”, OR “YOUR”, “Your” AND TOGETHER WITH THE SERVICE PROVIDER, THE “PARTIES”, “Parties”) GOVERNS CUSTOMER’S ACCESS AND USE OF THE SERVICES. FOR THE AVOIDANCE OF DOUBT, THE TERM “CUSTOMER” OR “YOU” SHALL ALSO INCLUDE EMPLOYEES OR OTHER INDIVIDUALS USING THE SERVICES.

BY ACCEPTING THIS AGREEMENT WHILE EXECUTING AN ORDER FORM THAT REFERENCES THIS AGREEMENT, CUSTOMER AGREES TO THE TERMS OF THIS AGREEMENT. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY, YOU WARRANT AND REPRESENT THAT YOU HAVE THE AUTHORITY TO BIND SUCH ENTITY AND ITS AFFILIATES TO THIS AGREEMENT, IN WHICH CASE THE TERMS “CUSTOMER”, “YOU” OR “YOUR” SHALL REFER TO SUCH ENTITY AND ITS AFFILIATES. IF YOU DO NOT HAVE SUCH AUTHORITY, OR IF YOU DO NOT AGREE WITH THIS AGREEMENT, YOU MUST NOT ACCEPT IT AND SHALL NOT BE PERMITTED TO USE THE SERVICES.

BY ACCEPTING THE TERMS OF THIS AGREEMENT YOU REPRESENT AND WARRANT THAT ANY AND ALL INFORMATION YOU PROVIDE US THROUGH THE SERVICES IS TRUE, ACCURATE AND COMPLETE. THE PROVISION OF FALSE OR FRAUDULENT INFORMATION IS STRICTLY PROHIBITED.

WHERE THIS AGREEMENT IS EXECUTED AS A SIGNED MASTER SERVICES AGREEMENT, THE SIGNATURE PAGE AND THIS AGREEMENT TOGETHER GOVERN. SCHEDULES 2 TO 5 APPLY ONLY WHERE THE ORDER FORM STATES THAT THEY APPLY.

1. Definitions and Interpretation

1.1 In this Agreement the following terms have the meanings set out below:

Ad-hoc Services	Has the meaning given in clause 3.12.
Affiliates	In relation to the Service Provider, the Group. In relation to the Customer, any entity that directly or indirectly controls, is controlled by, or is under common control with the Customer.
Agreement	This Master Services Agreement including all Order Forms, Schedules, Exhibits and Rate Schedule Appendices, as amended from time to time.
Authorised User	The Customer’s personnel, and its Affiliates, contractors, auditors and competent authorities, and, where the Order Form counts aircraft managed or operated by the Customer on behalf of third parties as Units, the owners and operators of those aircraft, in each case where authorised by the Customer to access the Services. The Customer is responsible for the acts and omissions of its Authorised Users.
Billing Period	The period covered by each payment of Fees as stated in the Order Form and, where none is stated, twelve (12) calendar months.
Business Day	A day other than a Saturday, Sunday or public holiday in England and Wales on which banks are generally open for business in London (or, where the Order Form specifies a non-UK governing law, a business day in the relevant jurisdiction).
Commencement Date	The date specified in the applicable Order Form on which the Services under that Order Form commence. This may differ from the date on which the Order Form is executed.
Confidential Information	All business, technical, financial or other information disclosed by either Party to the other (before or during the Term) that is designated as confidential or that reasonably should be understood to be confidential given its nature and the circumstances of disclosure.
Contracting Entity	The Group entity of the Service Provider identified in the Order Form as the contracting party. Default: TrustFlight Limited. May be such other Group entity as specified in the Order Form.
Customer Data	All data, content and information (including Personal Data and Regulated Records) owned by or licensed to the Customer that is submitted to, stored in, or processed by the Services.
Delivering Entity	The Group entity responsible for delivery of the Services, as identified in the Order Form. May differ from the Contracting Entity.
DPA Exhibit	The Data Processing Addendum appended to this Agreement, as may be updated from time to time.
Due Date	The date by which a Fees invoice is payable, being the date stated on the invoice or, where not stated, 30 days from the date of the invoice.
Fees	The charges payable by the Customer for the Services as set out in the Order Form.
Force Majeure Event	Any event beyond a Party’s reasonable control including acts of God, war, epidemic or pandemic, terrorism, civil unrest, strikes, failure of utilities, telecommunications outages, compliance with any governmental order, fire, flood, or default of third-party suppliers.
Group	TrustFlight Limited (registered in England and Wales, company number 10989885), together with any holding company of TrustFlight Limited from time to time and any subsidiary from time to time of TrustFlight Limited or of any such holding company, including Baines Simmons Limited, Redline Assured Security Limited and Kenyon International Emergency Services Limited, and their respective successors. “Holding company” and “subsidiary” have the meanings given in section 1159 of the Companies Act 2006.
Information Security Incident	Has the meaning given in clause 6.1.
Initial Term	The initial period specified in the applicable Order Form during which the Order Form is in effect, commencing on the Commencement Date.
Intellectual Property Rights	All patents, inventions, copyright, trade marks, service marks, design rights, database rights, know-how and all other intellectual property rights, whether registered or unregistered, in any jurisdiction.
Minimum Order Quantity	The minimum number of Units stated in the Order Form, below which Fees shall not be reduced.
Order Form	A signed order form incorporating this Agreement by reference, specifying the Services, Fees, Contracting Entity, Delivering Entity, Term, applicable Schedules and other commercial particulars.
Personal Data	Has the meaning given in applicable data protection legislation including (as applicable) the UK GDPR, Data Protection Act 2018, EU GDPR, and any other applicable data protection law.
Rate Schedule Appendix	The rate schedule of the Contracting Entity identified in the Order Form, in the version identified in the Order Form or, where no version is identified, the version current at the date of the Order Form, setting out the rates applicable to services charged on a time, day or unit basis. Each Contracting Entity maintains its own Rate Schedule Appendix, and the Rate Schedule Appendix of one Contracting Entity does not apply to Services provided by another.
Regulated Records	That part of the Customer Data which the Customer relies on in order to determine the airworthiness or serviceability of an aircraft, to make or evidence an operational decision, or to demonstrate compliance to a competent authority, including records of: aircraft technical log entries and certificates of release to service; defects, deferred defects, and minimum equipment list and configuration deviation list items and their expiry; maintenance actions, tasks and due dates; flight times, flight cycles and sector records; continuing airworthiness and airworthiness review records; occurrence, hazard and safety reports and investigations; risk assessments and risk registers; compliance monitoring, audit findings and corrective actions; personnel training, competency and currency records; and controlled manuals, technical publications and other controlled documents, together with their revision, approval, distribution and acknowledgement status.
Renewal Period	Each successive period of twelve (12) calendar months by which an Order Form automatically extends following the Initial Term or any prior Renewal Period, as described in clause 2.2.
Services	The services and/or software to be provided as specified in the Order Form and applicable Schedule(s).
SLA	The service level agreement applicable to an Order Form under Schedule 2 clause 4.2, being the Standard SLA unless the Order Form identifies a different service level agreement.
Standard SLA	The TrustFlight Standard Service Level Agreement published at https://trustflight.com/sla, as may be updated in accordance with Schedule 2 clause 4.3.
Statement of Work	A document executed by both Parties under Schedule 5, defining the scope, deliverables, timeline and fees for a bespoke engagement.
Term	The Initial Term together with any Renewal Periods.
Third-Party Application	Has the meaning given in clause 8.6.
Units	The variable quantities by reference to which Fees are calculated, as stated in the Order Form, being any of: “Aircraft”, meaning any aircraft operated under the Customer’s air operator certificate or equivalent approval together with all aircraft managed or operated by the Customer on behalf of third parties; “Bay”, meaning a single area used by the Customer for conducting maintenance on one aircraft; “Simulator”, meaning one flight simulation training device operated by the Customer; “Line Station”, meaning an airport location at which the Customer provides maintenance support; “Organisation”, “Entity” or “AOC”, each meaning a distinct operation of the Customer holding its own approval, licence or certification; “Passengers”, meaning annual passenger throughput as most recently published or reported by the Customer; and “User” and “Delegate”, as defined in the Order Form.

1.2 In this Agreement: (a) references to a person include any individual, company or other legal entity; (b) singular includes plural and vice versa; (c) headings are for convenience only; (d) “includes” and “including” are illustrative and not limiting; (e) references to statutes include amendments and successors; (f) the contracting party on the Service Provider side is the Contracting Entity identified in the Order Form, and in clause 14 (Termination) and clause 19 (Governing Law and Jurisdiction) references to the Service Provider mean the Contracting Entity alone.

1.3 In the event of conflict, the order of precedence is: (i) the Order Form; (ii) any Statement of Work executed under Schedule 5, in respect of the Custom Work it describes; (iii) the applicable service Schedule (Schedules 2 to 5); (iv) the SLA, in respect of maintenance, support and service levels; (v) the DPA Exhibit, in respect of the processing of Personal Data; (vi) the Rate Schedule Appendix, in respect of rates; and (vii) this Schedule 1. This clause states the order of precedence for the whole Agreement, and no Schedule, Exhibit or Appendix varies it. The DPA Exhibit prevails over every other part of this Agreement in respect of the processing of Personal Data.

1.4 Schedule 1 applies to every Order Form. Schedules 2 to 5 apply only to an Order Form which expressly states that the relevant Schedule applies. A Schedule which is not identified in an Order Form has no application to that Order Form, and no obligation, right or charge in that Schedule is incorporated into it. Where an Order Form covers more than one category of Services, each Schedule identified applies only to the Services within its category.

2. Commencement and Duration

2.1 This Agreement commences on the date the first Order Form is executed by both Parties and continues unless terminated in accordance with clause 14. The Services under each Order Form commence on the Commencement Date specified in that Order Form, which may be a later date than the date of execution.

2.2 Each Order Form commences on its Commencement Date and continues for the Initial Term specified. At the end of the Initial Term and each Renewal Period, it automatically extends for a further Renewal Period unless either Party gives written notice of termination not less than the notice period specified in the Order Form before the end of the then-current term. Where no notice period is specified in the Order Form, the notice period is 60 days for Order Forms under Schedule 2, 90 days for Order Forms under Schedule 3, and 60 days for Order Forms under Schedule 4 or Schedule 5 which provide for recurring Services. Order Forms under Schedule 4 or Schedule 5 which do not provide for recurring Services expire on completion of the Services and do not renew.

3. Fees and Payment

3.1 The Customer shall pay the Fees as specified in the Order Form. Where the Order Form is silent, payment is due 30 days from the date of invoice.

3.2 The first invoice is issued on execution of the Order Form and is payable on receipt. The Service Provider is not obliged to commence Services until the first invoice is paid in full.

3.3 Recurring Fees are invoiced in advance and are due on the first day of the Billing Period to which they relate. The Customer shall ensure that the Fees are received by the Service Provider in cleared funds by the first Business Day of the applicable Billing Period. Unless the Customer directs otherwise in writing at the time of payment, payments are allocated chronologically against the oldest outstanding invoice first. This clause prevails over clause 3.1 in respect of recurring Fees.

3.4 All Fees are exclusive of VAT and any applicable sales, withholding or other taxes or duties, which are payable by the Customer in addition at the applicable rate. Where withholding tax applies in the Customer’s jurisdiction, the Customer shall disclose this before execution, and the net amount received by the Service Provider shall equal the Fees stated in the Order Form after withholding.

3.5 Invoice disputes must be notified in writing within 10 days of the invoice date. Only the disputed amount may be withheld; all undisputed sums must be paid on time.

3.6 Without prejudice to any other right, if the Customer fails to pay any invoice by the Due Date the Service Provider may: (a) charge interest on outstanding amounts at 4% above the Bank of England base rate (compounded monthly) from the Due Date; and (b) suspend Services until all outstanding amounts are paid. Suspension does not relieve the obligation to pay accrued Fees. The Service Provider shall not be liable for any consequences of suspension resulting from the Customer’s failure to pay by the Due Date.

3.7 The Service Provider may increase Fees annually on not less than 60 days’ written notice, at the greater of: (a) UK Consumer Prices Index (CPI) as published by the ONS; or (b) 4%, and in any event not more than 8% in any 12-month period. Any fixed-fee period stated in the Order Form overrides this clause for its duration.

3.8 For Managed Services under Schedule 3, where an Order Form so specifies, the annual fee review under clause 3.7 shall instead be at the greater of UK CPI or the percentage stated in the Order Form, with not less than 60 days’ written notice and no increase within the first 12 months of the Commencement Date.

3.9 The Customer shall notify the Service Provider of any change in the number of Units within thirty (30) days of that change taking effect. The Service Provider may at any time independently audit and verify the number of Units, and the Customer shall provide such information as is reasonably required for that purpose.

3.10 A change in the number of Units takes effect for billing purposes on the first day of the Billing Period following the date on which the Service Provider is notified of the change or otherwise identifies it. No pro-rated invoice, credit or adjustment is issued in respect of the Billing Period in which the change occurs, and the Fees for that Billing Period remain payable in full.

3.11 No credit, refund or reduction in Fees is given in respect of any reduction in the number of Units, and the Fees shall not in any event fall below the Minimum Order Quantity.

3.12 Services requested by the Customer which are not included in the Order Form (“Ad-hoc Services”) are chargeable in addition to the Fees. Ad-hoc Services include additional training, additional audit support, configuration changes, additional implementation or data migration activity, activation of additional modules, support outside the hours stated in the SLA, and attendance at Customer meetings, audits or regulatory inspections. The following apply:

a) Ad-hoc Services are charged at the rates in the applicable Rate Schedule Appendix current at the date of the request or, where no Rate Schedule Appendix applies to the Services requested, at the rates set out in the estimate approved under paragraph (b).

b) The Service Provider shall provide the Customer with a written estimate of the charges before any chargeable work commences, and shall not commence chargeable work until the Customer has approved that estimate in writing. Email is sufficient for this purpose.

c) Where Ad-hoc Services are charged on a time basis, time is recorded in minimum increments of one (1) hour and invoiced monthly in arrears with a summary of the time recorded.

d) Where Ad-hoc Services are charged on a day-rate basis, a day means up to eight hours of attendance.

e) Travel, accommodation and subsistence are payable in addition at cost, unless a fixed allowance is agreed in writing.

f) Where the Customer cancels or postpones booked attendance, the charges in Schedule 4 clause 3.1 apply as if the booking were a Defined Service, together with any travel or accommodation costs already incurred and not recoverable.

g) The Service Provider is not obliged to accept any request for Ad-hoc Services and may decline on grounds of resource availability.

3.13 The Rate Schedule Appendix is not published. Where the Order Form identifies a Rate Schedule Appendix as applicable, the Service Provider shall provide it to the Customer on or before execution of that Order Form, and at any time during the Term on written request. Each Rate Schedule Appendix carries a version number and effective date, and the Order Form identifies the version applicable to it. Where no Rate Schedule Appendix is identified in the Order Form, charges for Ad-hoc Services are as agreed in writing under clause 3.12.

3.14 Rates are charged in the currency stated in the Order Form. Where a rate in the Rate Schedule Appendix is expressed in a different currency, it is converted into the Order Form currency at the exchange rate prevailing on the date of the Order Form, and that converted rate applies for the remainder of the then-current Billing Period.

3.15 The Service Provider may update the Rate Schedule Appendix no more than once in any twelve (12) month period, on not less than sixty (60) days’ written notice to the Customer. An updated Rate Schedule Appendix takes effect on the date stated in that notice and applies to Services requested on or after that date. No update to the Rate Schedule Appendix requires an amendment to this Agreement or to any Order Form.

3.16 An update to the Rate Schedule Appendix does not affect: (a) any estimate given under clause 3.12 and accepted by the Customer, for the validity period of that estimate; (b) any Statement of Work executed before the update takes effect, for the duration of that Statement of Work; (c) any services already booked and confirmed before the update takes effect; or (d) any rate expressly stated in the Order Form, which prevails over the Rate Schedule Appendix for its stated duration. Where the Order Form states that a rate is fixed for a stated period, that rate is not subject to clause 3.15 for that period.

4. Customer Data

4.1 All Intellectual Property Rights in Customer Data are and remain vested in the Customer (or relevant third party). Nothing in this Agreement transfers any rights in Customer Data to the Service Provider.

4.2 The Customer grants the Service Provider a non-exclusive, royalty-free licence to access, process and use Customer Data solely to the extent necessary to provide the Services.

4.3 The Customer warrants that: (a) it has all necessary rights and consents to provide Customer Data to the Service Provider; and (b) Customer Data does not infringe the rights of any third party or breach any applicable law.

4.4 The Service Provider may use anonymised and aggregated data derived from Customer Data to improve its services, provided such data cannot reasonably be used to identify the Customer or any individual.

5. Data Protection

5.1 Both Parties shall comply with all applicable data protection laws including (as applicable) the UK GDPR, Data Protection Act 2018, EU GDPR (for EU data subjects), and any other applicable regime. Where different laws apply, the stricter obligation prevails.

5.2 To the extent the Service Provider processes Personal Data on the Customer’s behalf, the rights and obligations of each Party as Controller and Processor (or Processor and Sub-Processor, as applicable) are governed by the DPA Exhibit. The terms “Controller”, “Processor” and “Sub-Processor” have the meanings given to them under applicable data protection legislation.

5.3 The Service Provider shall: (a) implement appropriate technical and organisational security measures (at minimum ISO 27001 compliant); (b) notify the Customer without undue delay (and in any event within 72 hours) upon becoming aware of a Personal Data breach; (c) maintain professional liability insurance covering cyber security liabilities; and (d) permit Customer audits of data processing activities (no more than once per 12-month period on reasonable prior written notice).

5.4 Where a service-specific Data Processing Addendum (“Service DPA”) is incorporated into an Order Form as an exhibit or appendix, that Service DPA supplements this clause 5 and the DPA Exhibit in respect of the particular processing activities it describes. In the event of conflict between the Service DPA and this clause 5 or the DPA Exhibit, the Service DPA prevails on data processing matters for that Order Form. The Order Form shall identify the applicable Service DPA by reference.

5.5 To the extent that, in respect of Defined Services under Schedule 4, each Party determines its own purposes for the limited personal data exchanged (principally delegate, attendee and personnel contact data), the Parties act as independent Controllers and each shall comply with data protection laws in respect of its own processing. To the extent the Service Provider processes Personal Data on the Customer’s instructions in the course of Defined Services, clause 5.2 and the DPA Exhibit apply.

6. Information Security Incidents

6.1 In this clause:

a) “Information Security Event” means an identified occurrence in the systems used to provide the Services indicating a possible compromise of Customer Data or a possible failure of information security controls. An Information Security Event does not of itself give rise to any obligation under this clause.

b) “Information Security Incident” means an Information Security Event, or a set of related Information Security Events, which the Service Provider has determined, following triage in accordance with its incident management procedures, has resulted in the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to Customer Data, whether or not any Personal Data is affected. It includes compromise of the systems used to process Customer Data to the extent that such compromise has affected, or is reasonably likely to affect, Customer Data.

c) An Information Security Incident does not include: (i) unsuccessful attempts or activities that do not compromise Customer Data, including unsuccessful log-in attempts, pings, port scans, blocked firewall or web application firewall events, denial-of-service attempts that do not materially degrade the Services, and phishing or social engineering attempts not acted upon; (ii) loss or degradation of availability of the Services, which is addressed by the service levels in the SLA where Schedule 2 applies, except where accompanied by an event falling within paragraph (b); or (iii) any compromise arising from the acts, omissions, configuration choices or credentials of the Customer or its Authorised Users.

6.2 The Service Provider shall notify the Customer of any Information Security Incident affecting the Customer’s Customer Data without undue delay, and in any event within seventy-two (72) hours of determining the Incident. The Service Provider shall carry out triage without undue delay and shall not defer determination in order to postpone notification. Where an Incident affects, or the Service Provider reasonably believes may affect, Regulated Records, the Service Provider shall treat notification as a priority, shall not defer it in order to complete its investigation, and shall provide the Customer with reasonable updates until the Incident is closed. Notifications under this clause are sent to the security contact identified in the Order Form and, where none is identified, to the Customer’s data protection contact. The Service Provider’s contact for this clause is privacy@trustflight.com.

6.3 A notification under clause 6.2 shall state, so far as known at the time: (a) the nature of the Incident and the date and time it was detected; (b) the categories of Customer Data affected and whether any Regulated Records are affected; (c) the likely consequences, including any known or expected effect on the accuracy, completeness or availability of Regulated Records; (d) the measures taken or proposed to contain, remediate and recover from the Incident; and (e) a named point of contact. Where any of that information is not available within the period in clause 6.2, the Service Provider shall notify on the basis of the information then available, provide the remainder as soon as it is established, and provide reasonable updates until the Incident is closed. A notification under this clause is made to enable the Customer to meet its own obligations and shall not constitute an admission of fault, breach or liability by the Service Provider.

6.4 The Service Provider shall provide the Customer with such information and assistance as the Customer reasonably requires in order to meet its own information security reporting obligations to its competent authority, including (where applicable to the Customer) under point IS.I.OR.230 of Annex II to Commission Implementing Regulation (EU) 2023/203, point IS.D.OR.230 of Annex I to Commission Delegated Regulation (EU) 2022/1645, or any equivalent requirement in the Customer’s jurisdiction. Any report required of the Customer by its competent authority remains the Customer’s responsibility, and nothing in this clause requires the Service Provider to report to the Customer’s competent authority on the Customer’s behalf.

6.5 Notwithstanding clause 7 (Confidentiality), the Customer may disclose information relating to an Information Security Incident to its competent authority to the extent required by that authority or by applicable law, provided the Customer limits the disclosure to what is required and, where legally permitted, notifies the Service Provider in advance.

6.6 Assistance under clause 6.4 is subject to the limitations in clause 6.8, and is chargeable at the rates in the applicable Rate Schedule Appendix to the extent the Customer’s request goes materially beyond the information required by clause 6.3.

6.7 The Service Provider maintains an information security management system certified to ISO/IEC 27001 covering the provision of the Services, and shall maintain that certification, or an equivalent certification issued by an accredited certification body, throughout the Term. The Service Provider may change certification body, certificate or certification scheme provided equivalent certification is maintained. The Service Provider shall notify the Customer without undue delay if that certification lapses, is suspended or is withdrawn in respect of the Services. Details of the current certification are available on request. For the avoidance of doubt, this clause relates to the Service Provider’s information security management system certification and does not constitute a warranty in respect of any other certification, registration or approval held by the Service Provider or any member of the Group.

6.8 On reasonable written request giving not less than fourteen (14) days’ notice, and no more than once in any twelve (12) month period (save that one additional request may be made following an Information Security Incident affecting the Customer’s Customer Data), the Service Provider shall: (a) provide information reasonably required for the Customer’s assessment of information security risks arising from its interface with the Service Provider, including a summary of the scope of the Service Provider’s information security management system, its current certification, and the technical and organisational measures applied to the Services; and (b) where the Service Provider performs activities falling within the scope of an information security management system the Customer is required to maintain, cooperate reasonably with the Customer’s monitoring of those activities. Both are subject to clause 7 (Confidentiality) and to the Service Provider’s reasonable security requirements, and neither requires the Service Provider to disclose information relating to any other customer, to provide access to shared infrastructure, or to disclose information where disclosure would itself create a security risk. Where this Agreement or the DPA Exhibit already provides the Customer with equivalent rights, this clause does not create additional or cumulative rights.

6.9 This clause applies in addition to clause 5 (Data Protection) and the DPA Exhibit. Where an Information Security Incident also constitutes a Personal Data breach, the Service Provider shall comply with both this clause and clause 5.3(b), and a single notification satisfying the requirements of both is sufficient. Where the requirements of this clause and the DPA Exhibit differ in respect of the same event, this clause governs the timing and content of notification to the Customer, and the DPA Exhibit governs all other aspects of the Parties’ data protection obligations.

7. Confidentiality

7.1 Each Party shall not at any time during this Agreement, and for five years after termination or expiry, disclose to any third party any Confidential Information of the other Party, except as permitted by clause 7.3, and shall not use any Confidential Information of the other Party for any purpose other than the performance of its obligations under this Agreement. In this clause, the Party disclosing Confidential Information is the “Disclosing Party” and the Party receiving it is the “Receiving Party”.

7.2 Customer Data is the Confidential Information of the Customer. The obligations in this clause continue without limit of time in respect of Customer Data and in respect of any trade secret of either Party.

7.3 Disclosure is permitted: (a) to employees, contractors and advisers who need to know for the purposes of this Agreement and are subject to equivalent confidentiality obligations; or (b) as required by law or regulatory authority.

7.4 Obligations do not apply to information that: (a) is already publicly available through no fault of the Receiving Party; (b) was already known before receipt; (c) is independently developed; or (d) is received from a third party free to disclose it.

7.5 Each Party acknowledges that breach of this clause may cause irreparable harm for which damages alone would be insufficient, and that injunctive or other equitable relief may be sought without proof of special damage. Obligations survive termination.

8. Intellectual Property

8.1 All Intellectual Property Rights in the Services, the Service Provider’s software, systems, platforms, methodologies, training content, emergency response materials and other proprietary materials are and remain the exclusive property of the Service Provider (or its licensors). Nothing in this Agreement transfers any such rights to the Customer.

8.2 The Service Provider grants the Customer a non-exclusive, non-transferable licence to use the Services during the Term for the internal business purposes of the Customer and its Authorised Users. This licence terminates automatically on expiry or termination of the Order Form.

8.3 All Intellectual Property Rights in Customer Data remain vested in the Customer (clause 4.1).

8.4 Intellectual property arising from bespoke, custom or SoW-based work is governed by Schedule 5 (Custom Work / SoW Terms).

8.5 The Service Provider shall indemnify the Customer against losses arising from any third-party claim that the Services infringe that party’s Intellectual Property Rights, provided the Customer: (a) promptly notifies the Service Provider; (b) grants the Service Provider sole control of the defence; and (c) makes no admission of liability.

8.6 Where the Services include or are delivered by means of a third-party application, platform or service (a “Third-Party Application”), the Customer is granted a non-exclusive, non-transferable right to use that Third-Party Application solely in conjunction with the Services and in accordance with the terms imposed by its provider. The Customer shall comply with all terms, conditions and policies of the provider, including usage restrictions, acceptable use policies and any applicable licence. The Service Provider is not liable for any breach of those terms by the Customer, for any misuse or unauthorised use of a Third-Party Application by the Customer, or for the acts or omissions of the provider of a Third-Party Application. Where a Third-Party Application is withdrawn, materially changed or ceases to be available to the Service Provider, the Service Provider shall notify the Customer and may substitute a functionally equivalent alternative.

9. Warranties

9.1 The Service Provider warrants that: (a) the Services will substantially conform to the specifications in the applicable Order Form and, where Schedule 2 applies, the applicable Service Description Document; (b) the Services, including any support and implementation services, will be provided with reasonable care and skill by suitably qualified personnel; and (c) the Services will not infringe the Intellectual Property Rights of any third party.

9.2 The Customer warrants that: (a) it has authority to enter into and perform this Agreement; (b) execution does not conflict with any other agreement; and (c) it will use the Services in compliance with all applicable laws and regulations.

9.3 Save as expressly set out in this Agreement, all other warranties, representations and conditions implied by statute, common law or otherwise are excluded to the fullest extent permitted by applicable law.

9.4 The Customer acknowledges that the Services are provided as a tool to support the Customer’s own processes and are not a substitute for them. The Customer shall use the Services only in accordance with applicable regulations and with appropriate back-ups, safeguards, contingency arrangements and procedures in place, including arrangements enabling the Customer to continue operating in the event that the Services are unavailable. The Customer is responsible for verifying the accuracy and correctness of any information produced by or obtained through the Services, for satisfying itself that the Services meet its specific operational and regulatory requirements, and for its own regulatory compliance, which remains the Customer’s sole responsibility.

10. Limitation of Liability

10.1 Nothing in this Agreement limits or excludes either Party’s liability for: (a) death or personal injury caused by its negligence; (b) fraud or fraudulent misrepresentation; or (c) any liability that cannot be excluded by applicable law.

10.2 This clause sets out the entire financial liability of the Service Provider, including any liability for the acts or omissions of its employees, agents and sub-contractors, whether arising in contract, tort (including negligence or breach of statutory duty), misrepresentation (whether innocent or negligent), restitution or otherwise.

10.3 Subject to clause 10.1, the Service Provider shall not be liable, whether such loss is direct or indirect, for any: (a) loss of profits; (b) loss of business or revenue; (c) loss of anticipated savings; (d) loss of goodwill; (e) loss or corruption of data, except to the extent arising from the Service Provider’s failure to comply with clause 5.3(a) or Schedule 2 clause 3 (Customer Data and Back-Ups), for which liability is subject to the cap in clause 10.4; or (f) special, indirect or consequential loss, however arising.

10.4 Subject to clauses 10.1 and 10.3, the Service Provider’s total aggregate liability shall not exceed the total Fees paid or payable in the 12 months preceding the event giving rise to the claim. Any Service Credits paid or credited under the SLA count towards that limit.

10.5 The Customer is solely responsible for results obtained from using the Services and for conclusions drawn from such use.

11. Indemnity

11.1 The Customer shall indemnify the Service Provider against all costs, expenses, liabilities and damages arising from: (a) the Customer’s misuse of the Services; or (b) any third-party claim arising from Customer Data. The Customer’s liability under this clause is subject to the cap in clause 10.4.

11.2 An indemnity under this Agreement is conditional on the indemnified Party: (a) notifying the other promptly of any claim; (b) giving the other sole control of the defence and settlement; (c) making no admission of liability; and (d) taking reasonable steps to mitigate its loss.

12. Anti-Bribery, Compliance and Sanctions

12.1 Each Party shall comply with all applicable anti-bribery and anti-corruption laws including the Bribery Act 2010 and all applicable anti-money laundering legislation.

12.2 Neither Party shall make or receive any payment or benefit in connection with this Agreement that amounts to bribery or the offering, giving, receiving or soliciting of an improper advantage.

12.3 Each Party shall comply with all applicable sanctions, export control and trade laws including those of the UK, EU and USA. Each Party represents that it is not, and that no person owning or controlling it is, named on any UK, EU or US government denied-party, restricted-party or sanctions list. Neither Party shall permit the Services to be used in connection with any sanctioned person or territory, or in violation of any applicable export control law.

12.4 Breach of this clause is a material breach and entitles the non-defaulting Party to terminate immediately in accordance with clause 14.1(c).

13. Force Majeure

13.1 Neither Party shall be in breach of this Agreement or liable for delay or failure in performance to the extent caused by a Force Majeure Event, provided the affected Party: (a) promptly notifies the other; (b) uses reasonable endeavours to mitigate; and (c) the obligation to pay accrued Fees is not affected.

13.2 If a Force Majeure Event continues for more than 90 days, either Party may terminate the affected Order Form(s) on 30 days’ written notice without liability (save for accrued Fees).

14. Termination

14.1 Either Party may terminate this Agreement or any Order Form immediately if: (a) the other Party commits a material breach and, where remediable, fails to remedy within 30 days of written notice; (b) the other Party becomes insolvent, enters administration, is wound up or ceases to trade; or (c) the other Party commits a breach of clause 12.

14.2 The right to terminate under clause 14.1(b) is subject to any restrictions imposed by the Corporate Insolvency and Governance Act 2020 (“CIGA 2020”). Where a counterparty has entered a formal insolvency or restructuring process to which CIGA 2020 applies (including administration, a moratorium, a restructuring plan or a company voluntary arrangement), clause 14.1(b) may not be exercisable as a standalone termination right by reason of the insolvency event alone. In such circumstances, the Service Provider’s primary termination right is clause 14.1(a), including for non-payment of Fees that accrued before or during the insolvency process. This clause does not limit any right to terminate for reasons other than the insolvency event itself.

14.3 On termination or expiry of the Term under any Order Form: (a) all licences granted under that Order Form terminate immediately; (b) all outstanding Fees become immediately due and payable; (c) each Party shall return or certify destruction of the other’s Confidential Information; (d) Customer Data shall be dealt with in accordance with the DPA Exhibit and Schedule 2 clause 3.3 (where applicable); and (e) accrued rights and provisions expressed to survive termination or expiry continue in full force.

14.4 Termination or expiry of an Order Form does not terminate this Agreement or any other Order Form, and a breach of or affecting one Order Form does not entitle either Party to terminate any other Order Form. Termination of this Agreement terminates every Order Form then in effect, unless the notice of termination states otherwise. No act or omission of one Group entity is attributable to another except as provided in clause 16.5.

14.5 The following survive termination or expiry: clause 1 (Definitions and Interpretation), clause 4 (Customer Data), clause 5 (Data Protection), clause 6 (Information Security Incidents), clause 7 (Confidentiality), clause 8 (Intellectual Property), clause 10 (Limitation of Liability), clause 11 (Indemnity), clause 15 (Non-Solicitation), this clause 14, clause 16 (General), clause 17 (Dispute Escalation), clause 19 (Governing Law and Jurisdiction), Schedule 2 clause 3 (Customer Data and Back-Ups), Schedule 3 clause 7 (Liability) and Schedule 5 clause 5 (Intellectual Property in Created Works), together with the DPA Exhibit and any accrued right or remedy of either Party.

15. Non-Solicitation

15.1 Each Party agrees that during the Term and for six (6) months after termination or expiry of the relevant Order Form, it shall not directly solicit or entice away any employee or contractor of the other Party with whom it has had material contact in connection with the Services. This period applies to Services delivered under every Schedule. This clause does not prevent either Party from hiring individuals who respond to a general public advertisement of employment not targeted at the other Party’s staff, nor does it apply to any individual who has had no material contact with the other Party in connection with the Services for a period exceeding six months.

15.2 Where a Party breaches clause 15.1 and the individual concerned enters employment or engagement with that Party, that Party shall pay to the other a sum equal to thirty per cent (30%) of the individual’s first-year remuneration, which the Parties agree is a genuine pre-estimate of the cost of recruiting a replacement.

15.3 This clause is the only non-solicitation provision in this Agreement and applies to all Services under every Schedule.

16. General

16.1 NOTICES. All notices under this Agreement shall be in writing. For all routine notices, email is sufficient: to the Customer at the address specified in the Order Form, and to the Service Provider at notices@trustflight.com. An email notice is deemed received at the time of transmission, unless the sender receives an automated notification that delivery has failed, in which case the sender shall promptly re-send by an alternative method or to an alternative address notified by the recipient. Recorded post (or equivalent signed-for postal service) is required only for: (a) formal notices of termination under clause 14; and (b) notices triggering the dispute escalation process under clause 17. Notices sent by recorded post shall be addressed to the Customer at the address specified in the Order Form, and to the Service Provider at the registered office of the Contracting Entity, marked for the attention of the Company Secretary, with a copy by email to notices@trustflight.com. The registered office of each United Kingdom Contracting Entity is The National Safety & Security Academy, First Avenue, Finningley, Doncaster, DN9 3RH, United Kingdom. Where the Contracting Entity is not incorporated in the United Kingdom, notices by recorded post shall be sent to its registered office. A notice sent by recorded post is deemed received on the second Business Day after the date of posting. Either Party may change its notice details on written notice to the other.

16.2 RELATIONSHIP. Nothing in this Agreement creates a partnership, joint venture, agency or employment relationship.

16.3 ASSIGNMENT. The Customer may not assign, sub-contract or transfer any rights or obligations without prior written consent. The Service Provider may assign to any Group company on prior written notice, provided there is no material change to the Services.

16.4 SUB-CONTRACTING. The Service Provider may sub-contract the performance of any of its obligations, and remains responsible to the Customer for the acts and omissions of its sub-contractors as if they were its own. Engagement of sub-processors of Personal Data is governed by the DPA Exhibit.

16.5 DELIVERING ENTITY. Where the Order Form identifies a Delivering Entity which is not the Contracting Entity, the Services are delivered by that Delivering Entity and the Contracting Entity is responsible to the Customer for the acts and omissions of the Delivering Entity in connection with this Agreement as if they were its own. A reference in any Schedule to an obligation of the Delivering Entity is enforceable by the Customer against the Contracting Entity.

16.6 ENTIRE AGREEMENT. This Agreement (with all Order Forms, Schedules, Exhibits and Appendices) is the entire agreement between the Parties and supersedes all prior agreements relating to its subject matter. Neither Party is entitled to rely on any agreement, understanding, statement or representation not expressly set out in this Agreement, save for any statement or representation made fraudulently. This clause does not supersede any confidentiality or non-disclosure agreement between the Parties, or any prior agreement which the Order Form states continues in force.

16.7 MODIFICATIONS. The Service Provider may amend Schedule 1 and Schedules 2 to 5 on not less than 30 days’ written notice, where the amendment is required by law or regulation or does not materially prejudice the Customer. This power does not extend to any Order Form, to the Fees, to clause 10 (Limitation of Liability), to clause 19 (Governing Law and Jurisdiction) or to the DPA Exhibit, each of which may be varied only by written agreement between the Parties. If a material change adversely affects the Customer, the Customer may terminate the affected Order Form(s) before the change takes effect, and the Service Provider shall refund any Fees prepaid in respect of the period after termination.

16.8 SEVERANCE. If any provision is found unlawful, invalid or unenforceable, it shall be severed; the remainder continues in full force.

16.9 NO WAIVER. No failure to exercise any right or remedy constitutes a waiver of that right or remedy.

16.10 THIRD PARTY RIGHTS. Except as set out in this clause, this Agreement does not confer rights on any third party pursuant to the Contracts (Rights of Third Parties) Act 1999. A Delivering Entity may enforce, and rely on, any provision of this Agreement expressed to be for its benefit, including the limitations and exclusions of liability in clause 10 and in Schedule 3 clause 7. The Parties may vary or rescind this Agreement without the consent of any such third party.

16.11 MARKETING RIGHTS. Unless otherwise notified, the Service Provider may cite the Customer as a user of the Services in promotional materials. This right ceases for materials created after the end of the Term.

16.12 INSURANCE. The Service Provider shall maintain insurance appropriate to the Services, including professional indemnity, public liability and cyber liability cover, with limits not less than any stated in the Order Form, and shall provide evidence of cover on reasonable written request. The existence, scope or limits of any insurance do not increase or otherwise affect the limits of liability in clause 10.

16.13 LANGUAGE. This Agreement is executed in the English language. In the event of any translation, the English version prevails.

17. Dispute Escalation

17.1 The Parties shall attempt in good faith to resolve any dispute arising out of or in connection with this Agreement promptly and informally. Either Party may give written notice of a dispute (“Dispute Notice”), following which the dispute escalation process in this clause applies.

17.2 Within 10 Business Days of a Dispute Notice, the relevant project leads or account managers of each Party shall meet (in person or by video conference) to attempt to resolve the dispute.

17.3 If the dispute remains unresolved 20 Business Days after the Dispute Notice, either Party may escalate to senior executives (at director level or above). The executives shall meet within 10 Business Days of escalation.

17.4 If the dispute remains unresolved 20 Business Days after executive escalation, either Party may refer the matter to mediation administered by the Centre for Effective Dispute Resolution (CEDR) or such other mediator as the Parties agree. The costs of mediation shall be shared equally. Mediation shall not prevent either Party from seeking urgent injunctive or interim relief from the courts.

17.5 If mediation does not resolve the dispute within 30 days of the mediator’s appointment (or such longer period as the Parties agree), either Party may commence legal proceedings or arbitration in accordance with clause 19. Completion of this process is a condition precedent to commencing proceedings, save that either Party may at any time bring a claim for payment of sums which are not disputed in good faith under clause 3.5, apply for interim or injunctive relief, or issue any claim necessary to protect a limitation period.

18. Compliance

18.1 MODERN SLAVERY. Each Party warrants that it complies with all applicable laws relating to modern slavery and human trafficking, including (where applicable) the Modern Slavery Act 2015. Each Party shall maintain reasonable due diligence procedures to ensure that slavery and human trafficking do not occur in its supply chain or business.

18.2 ESG AND SUSTAINABILITY. Each Party shall maintain and comply with its own policies relating to environmental responsibility, ethical business conduct, diversity and inclusion, and human rights (collectively, “ESG Policies”). On reasonable request (no more than once per calendar year), a Party shall provide a written summary of its ESG Policies and material compliance activities.

18.3 AUDIT RIGHTS. Without prejudice to clause 5.3(d) and clause 6.8, either Party may, on not less than 20 Business Days’ prior written notice, audit the other Party’s records and processes relating to compliance with clauses 18.1 and 18.2. Audit rights may be exercised no more than once per 12-month period unless the auditing Party has reasonable grounds to suspect material non-compliance. The costs of any such audit are borne by the auditing Party unless material non-compliance is found.

18.4 Any liability arising from breach of this clause is subject to the aggregate liability cap in clause 10.4 and is limited to direct losses only.

19. Governing Law and Jurisdiction

19.1 This Agreement and any dispute (including non-contractual disputes) arising from it shall be governed by the law applicable to the Contracting Entity as set out in the table below, or as otherwise specified in the Order Form.

Contracting Entity	Governing law is	Courts with exclusive jurisdiction
TrustFlight Limited (co. 10989885)	England and Wales	London, England
Total AOC Solutions Limited (co. 07800710)	England and Wales	London, England
TrustFlight (Canada) Inc	British Columbia	Vancouver, British Columbia
Kenyon International Emergency Services Limited (co. 09056220)	England and Wales	London, England
Baines Simmons Limited (co. 04295495)	England and Wales	London, England
Redline Assured Security Limited (co. 05915087)	England and Wales	London, England

19.2 INTERNATIONAL ARBITRATION. For cross-border enterprise engagements, the Parties may elect in the Order Form to resolve disputes by international arbitration in lieu of court proceedings. Where elected: arbitration shall be conducted under the ICC Rules or LCIA Rules (as selected in the Order Form); the seat shall be London, England; the language shall be English; and the arbitral award shall be final and binding on both Parties.

19.3 Where the Contracting Entity is not listed in the table above, this Agreement is governed by the law of England and Wales and the courts of England and Wales have exclusive jurisdiction.

19.4 Each Party irrevocably submits to the exclusive jurisdiction specified in this clause (or to arbitration if elected under clause 19.2) for the resolution of all disputes under this Agreement.

SCHEDULE 2: SAAS SOFTWARE TERMS

This Schedule applies only where the Order Form states that SaaS Software is provided. See Schedule 1, clause 1.4.

1. The Service

1.1 Each SaaS service is described in a Service Description Document (“SDD”) which specifies: (a) the modules available and core functionality; (b) implementation approach; and (c) supported hardware and software. The Order Form identifies the SDD(s) applicable.

1.2 The Service Provider shall provide the Service on a non-exclusive basis for the Term from the Commencement Date in accordance with this Agreement and the applicable SDD.

1.3 The Commencement Date is followed by an implementation phase as specified in the SDD. The Customer shall cooperate with the Service Provider during implementation and provide reasonable access to its systems and facilities. Implementation activity beyond that described in the SDD is an Ad-hoc Service under Schedule 1 clause 3.12.

1.4 The Customer may submit requests for altered, enhanced or extended functionality (“Change Request”). Change Requests are reviewed at the Service Provider’s discretion and may be included in future releases. The Customer grants the Service Provider a fully paid-up, perpetual, irrevocable, worldwide, royalty-free licence to use the content of any Change Request.

2. Implementation, Training and Audit Support

2.1 The Customer shall ensure that all authorised users are appropriately trained and shall bear costs associated with training beyond the implementation phase described in the SDD.

2.2 Additional training outside the implementation phase is charged at the rates set out in the Order Form or, where the Order Form does not state a rate, at the rates in the applicable Rate Schedule Appendix, in each case subject to Schedule 1 clause 3.12.

2.3 The Service Provider will provide standard, non-Customer-specific documentation to support Customer audit activities at no additional charge. Additional audit support, including Customer-specific documentation, is subject to availability of Service Provider personnel and is charged at the rates in the applicable Rate Schedule Appendix, subject to Schedule 1 clause 3.12.

3. Customer Data and Back-Ups

3.1 The Service Provider shall make regular backups of all Customer Data at least once daily, stored at a location separate from the primary data centre.

3.2 In the event of loss or damage to Customer Data, the Service Provider shall use reasonable endeavours to restore from the latest back-up. The Service Provider is not responsible for loss caused by third parties (other than those sub-contracted by the Service Provider).

3.3 On the effective date of termination or expiry of the Term, the Service Provider shall make all Customer Data stored in the Services accessible for download in a commonly used, machine-readable format. Customer Data will be accessible for download for 30 days from that date, and for any longer period agreed in writing, which may be subject to a charge at the rates in the applicable Rate Schedule Appendix. After that period the Service Provider may destroy or otherwise dispose of the Customer Data, and shall confirm such destruction to the Customer in writing on request.

4. Maintenance, Support and Service Levels

4.1 Maintenance, support and service levels, including response and containment times, Service Credits and uptime commitments, are governed by the SLA. The SLA is incorporated into this Agreement by reference and binds both Parties as if set out in full in this Schedule.

4.2 The Standard SLA applies unless the Order Form identifies a different service level agreement, in which case that agreement applies in place of the Standard SLA for that Order Form.

4.3 The Service Provider may update the Standard SLA on not less than 30 days’ written notice to the Customer. If a material adverse change is made, the Customer may, before the change takes effect, terminate the Agreement in respect of the affected Order Form(s) without liability for early termination, save for accrued Fees.

4.4 The Service Provider shall keep the current version of the Standard SLA, and each superseded version, published at https://trustflight.com/sla with its revision number and the date from which it took effect. The version in force at the time of the event in question governs that event.

4.5 Service Credits are the Customer’s sole and exclusive remedy for any failure to meet the uptime commitment in the SLA, and count towards the liability cap in Schedule 1 clause 10.4.

5. Software Licences and Acceptable Use

5.1 The Customer shall use the Service under a non-exclusive, non-transferable licence for the internal business purposes of the Customer and its Authorised Users during the Term.

5.2 The Customer shall not: (a) copy, modify or create derivative works; (b) store or transmit malware or harmful code; (c) store or transmit unlawful material; (d) reverse engineer or disassemble; (e) use the Service to build a competing product; (f) resell the Service or make it available as a standalone service to any third party who is not an Authorised User; or (g) attempt to obtain unauthorised access.

5.3 The Service Provider warrants that it has the authority to licence the Service to the Customer. Nothing transfers Intellectual Property Rights in the Service to the Customer.

5.4 User access is controlled by credentials which the Customer is responsible for maintaining, including adding, removing and managing user permissions.

5.5 The Service Provider may monitor the Customer’s use of the Service from time to time to verify compliance with this Agreement.

6. AI and Analytics Features

6.1 Where the Services include optional AI or analytics features, those features are not enabled unless the Customer requests activation in writing. The following apply to any such feature once activated.

a) Customer Data submitted to an AI feature is not used to train, fine-tune or otherwise improve any generative artificial intelligence model, whether the Service Provider’s or a third party’s.

b) Output generated by an AI feature from Customer Data is Customer Data, and Schedule 1 clause 4.1 applies to it.

c) AI output is assistive only. The Customer remains responsible for reviewing it and for any decision taken on the basis of it, and Schedule 1 clause 9.4 applies to it.

d) Sub-processors supporting AI features, and any transfer of Personal Data to them, are governed by the DPA Exhibit and are engaged only where the Customer has approved them in writing.

7. Feature Commitments and Custom Development

7.1 Where agreed in the Order Form, the Service Provider may commit to specific platform feature developments or enhancements (“Feature Commitments”). Feature Commitments shall be documented in the Order Form with scope, target delivery timeline, and acceptance criteria.

7.2 Custom development is excluded from this Schedule. Any bespoke custom development, including custom integrations, bespoke modules, one-off modifications and any development work beyond documented Feature Commitments, is governed exclusively by Schedule 5 and requires a separate executed Statement of Work.

7.3 All Intellectual Property in Feature Commitments vests in the Service Provider. The Service Provider grants the Customer a non-exclusive licence to use such developments for the Term, provided all applicable fees are paid.

SCHEDULE 3: MANAGED SERVICE TERMS

This Schedule applies only where the Order Form states that Managed Services are provided. See Schedule 1, clause 1.4.

1. Service Delivery Model

1.1 Managed Services are ongoing, retained services delivered by the Delivering Entity as specified in the Order Form. The Order Form shall describe: (a) the nature and scope of the managed services; (b) the service delivery model (embedded personnel, remote management, on-call response or other); (c) any Key Performance Indicators (“KPIs”) or service standards; and (d) the mobilisation timeline.

1.2 For Emergency Response Services provided by Kenyon International, the Order Form shall additionally specify: (a) the retainer fee and annual payment dates; (b) the activation trigger and notification protocol; (c) geographic scope and response time commitments; and (d) the applicable Rate Schedule Appendix for activation and deployment costs or, where no Rate Schedule Appendix applies, the basis on which activation and deployment costs are to be charged.

1.3 The Delivering Entity shall provide the managed services in a professional and workmanlike manner by appropriately qualified personnel.

1.4 Where the Delivering Entity is not itself certified or authorised by an external body to carry out a managed service and the Customer holds a relevant approval, the Delivering Entity shall act as a sub-contractor working under the approval of the Customer. Regulatory compliance remains the responsibility of the Customer, and the Service Provider gives no warranty as to the regulatory compliance of the managed services.

1.5 Where the Delivering Entity processes Personal Data on the Customer’s behalf in the course of providing Managed Services, it acts as Processor and not as Controller, and Schedule 1 clause 5 and the DPA Exhibit apply to that processing.

2. Mobilisation and Activation

2.1 For retainer-based managed services, the Delivering Entity shall maintain readiness to provide the Services throughout the Term. Mobilisation shall commence within the timeframe specified in the Order Form following the Customer’s written activation instruction.

2.2 For Emergency Response Services, activation is triggered by the Customer’s emergency notification to the Delivering Entity using the contact details specified in the Order Form. The Delivering Entity shall acknowledge receipt and confirm deployment within the response time specified in the Order Form.

2.3 The Customer shall provide the Delivering Entity with timely access, information and cooperation reasonably required for service delivery including (where applicable) access to premises, systems and relevant third parties.

3. Personnel

3.1 The Delivering Entity shall ensure that all personnel delivering managed services are suitably qualified and experienced for the role. The Delivering Entity remains the employer (or engager) of all such personnel.

3.2 The Customer may reasonably request that the Delivering Entity replaces any individual providing the services if the Customer has reasonable grounds (including performance concerns). The Delivering Entity shall use reasonable endeavours to comply with any such request.

3.3 The Customer shall comply with all relevant health and safety, security and site rules and shall ensure the Delivering Entity’s personnel are made aware of any applicable requirements.

4. Reporting and KPIs

4.1 Where KPIs are specified in the Order Form, the Delivering Entity shall report performance against those KPIs at the frequency specified. Reporting shall be provided in a format agreed between the Parties.

4.2 The Parties shall meet at the frequency specified in the Order Form to review service performance, agree any changes and address any issues.

5. Variation and Change Control

5.1 Either Party may request a variation to the scope of managed services by written notice. Variations are subject to agreement on revised Fees and terms before implementation.

5.2 For Emergency Response Services, activating services beyond the scope specified in the Order Form may result in additional charges at the rates set out in the Rate Schedule Appendix or, where none applies, as agreed in writing under Schedule 1 clause 3.12. The Delivering Entity shall notify the Customer of any anticipated additional costs as soon as reasonably practicable.

6. Exit and Transition

6.1 On termination or expiry, the Delivering Entity shall provide reasonable transition assistance to the Customer for a period of up to 90 days (or as agreed in the Order Form) at the rates set out in the Rate Schedule Appendix or, where none applies, as agreed in writing under Schedule 1 clause 3.12.

6.2 The Parties shall agree an exit plan setting out: (a) the handover of any materials, data or ongoing matters; (b) any run-off obligations; and (c) the treatment of any Customer-specific work in progress.

7. Liability — High-Consequence Managed Services

7.1 This clause applies to Order Forms for Emergency Response Services and other high-consequence managed services where the Order Form designates the engagement as a “High-Consequence Managed Service” (“HCMS”). In all other respects, the liability provisions of Schedule 1 clause 10 apply.

7.2 As a condition precedent to the Delivering Entity’s obligation to mobilise, deploy or otherwise perform under an HCMS Order Form, the Customer shall provide evidence satisfactory to the Delivering Entity of: (a) public liability insurance with a limit of not less than the amount specified in the Order Form (or, if not specified, £5,000,000 per occurrence); and (b) any other insurance cover specified in the Order Form as a prerequisite for the relevant service category. The Delivering Entity may decline to mobilise or deploy until that evidence is provided.

7.3 For HCMS engagements, the Delivering Entity’s total aggregate liability to the Customer (subject to Schedule 1 clause 10.1) shall not exceed the limit of the Delivering Entity’s own professional indemnity and public liability insurance in force at the time of the event giving rise to the claim, as evidenced by an insurance certificate provided on request. No fixed monetary cap is stated in this clause; the applicable insurance limit is confirmed per Order Form on execution.

7.4 The Customer shall indemnify the Delivering Entity and the Contracting Entity against all claims, costs, expenses, liabilities and damages brought by or on behalf of any third party, including any passenger, employee, next of kin or personal representative, arising out of the incident or event in respect of which Emergency Response Services are activated, save to the extent the claim arises from the negligence or wilful misconduct of the Delivering Entity. The Customer’s liability under this clause is not subject to the cap in Schedule 1 clause 10.4, and Schedule 1 clause 11.2 (conduct of claims) applies to it.

7.5 The Delivering Entity provides Emergency Response Services in support of the Customer’s own arrangements. It does not assume, and the Customer remains solely responsible for, the Customer’s obligations to passengers, family members and next of kin under ICAO Annex 9, Regulation (EU) No 996/2010 and any equivalent requirement applicable to the Customer, including any obligation to publish or operate a family assistance plan.

7.6 The exclusion of consequential loss in Schedule 1 clause 10.3 applies to HCMS engagements. For the avoidance of doubt, nothing in this clause limits or excludes the liability of the Delivering Entity or the Contracting Entity for death or personal injury caused by negligence, which is unlimited in accordance with Schedule 1 clause 10.1, and the cap in clause 7.3 does not apply to any such liability.

SCHEDULE 4: DEFINED SERVICES TERMS

This Schedule applies only where the Order Form states that Defined Services (training, consulting or auditing) are provided. See Schedule 1, clause 1.4.

1. Booking and Confirmation

1.1 Defined Services are confirmed when the Customer executes an Order Form specifying the service or programme, delivery format, dates and fees. The Service Provider shall issue confirmation within 5 Business Days.

1.2 A booking is confirmed on execution of the Order Form, and the cancellation charges in clause 3.1 apply from that date. Where payment is required in advance, joining instructions, pre-course materials and access credentials will not be issued until the relevant fee is paid.

1.3 The Customer warrants that delegate information provided is accurate. The Service Provider is not liable for any delay or failure caused by inaccurate or incomplete delegate information.

2. Delivery Obligations

2.1 The Service Provider shall: (a) deliver the Service using qualified and experienced instructors or consultants; (b) provide the materials specified in the Order Form; and (c) use reasonable endeavours to deliver on the confirmed dates.

2.2 The Service Provider reserves the right to substitute individual instructors or consultants, provided the replacement is appropriately qualified.

2.3 The Service Provider holds the approvals identified in the Order Form and shall maintain them for the duration of the Services, and shall on request provide a copy of any such approval. Save as stated in the Order Form, the Service Provider gives no warranty as to the regulatory compliance of the Services, and regulatory compliance remains the Customer’s responsibility. Responsibility for ensuring delegates meet any pre-requisite qualifications remains with the Customer.

3. Cancellation, Postponement and Transfer

3.1 In the event the Customer cancels or postpones a confirmed booking, the following charges apply unless the Order Form specifies otherwise:

Notice period	Cancellation charge
More than 4 weeks prior to commencement	No charge
2 to 4 weeks prior to commencement	50% of the relevant fee
Less than 2 weeks prior to commencement	100% of the relevant fee

3.2 All cancellation instructions must be received in writing by the Service Provider. In the event of a cancellation, the Service Provider reserves the right to reclaim any discounts previously awarded.

3.3 A booked delegate place may be transferred to a later date for the same course, on one occasion only and within 12 months of the original date, subject to: more than 4 weeks’ notice, no charge; 2 to 4 weeks, 30% of the course fee; less than 2 weeks, 60% of the course fee. A transferred booking that is subsequently cancelled or not attended remains payable in full, and the revised date must be specified at the time of transfer.

3.4 The Customer may substitute a delegate on a booking at any time free of charge on written notice to the Service Provider.

3.5 The Service Provider reserves the right to cancel or reschedule a course. In such cases, the Customer will be notified and a new delivery date agreed, or all monies paid will be refunded in full.

4. Customer Obligations

4.1 The Customer shall: (a) provide delegates who meet any pre-requisite requirements; (b) co-operate with the Service Provider and supply required input materials in sufficient time; (c) ensure accuracy of all input materials; and (d) provide the Service Provider with timely access to premises and relevant systems where necessary.

4.2 The Customer shall inform the Service Provider of all relevant health and safety requirements, security rules and any reasonable requirements that apply at its premises.

5. Intellectual Property — Training Materials

5.1 The Intellectual Property Rights in the course materials, training content, methodology and other materials developed by or on behalf of the Service Provider (“Service Provider Materials”) remain the exclusive property of the Service Provider. The Customer is granted a non-exclusive, non-transferable licence to use Service Provider Materials for the Customer’s internal training purposes only.

5.2 Service Provider Materials may not be copied, reproduced, redistributed, sub-licensed, published externally or exploited commercially without the Service Provider’s prior written consent. The Service Provider shall be credited as the author of its materials in all cases.

5.3 The Intellectual Property Rights in any input materials or data provided by the Customer (“Customer Input Materials”) remain the property of the Customer. The Service Provider is granted a non-exclusive, royalty-free licence to use Customer Input Materials to deliver the Services.

5.4 Where the Service Provider creates bespoke materials specifically for the Customer as a defined scope item (for example a custom training programme or policy document), the position on Intellectual Property Rights shall be as agreed in the Order Form and governed by Schedule 5.

6. PartnerPlus Programme

6.1 Where the Customer subscribes to the PartnerPlus pre-payment programme, the Order Form shall specify: (a) the pre-payment amount and the corresponding band; (b) the applicable discount; (c) the Activation Date, being the date of invoice; and (d) the validity period. The bands, the discount applicable to each band and the minimum top-up increment are set out in the applicable Rate Schedule Appendix current at the date of the Order Form.

6.2 PartnerPlus credit may be topped up within the first 12 months of the Activation Date. Top-ups do not change the Activation Date or the discount band.

6.3 Any unused credit at expiry of the validity period will be forfeited unless otherwise agreed in writing. The cancellation terms in clause 3.1 apply to bookings made under a PartnerPlus programme.

7. International Delivery

7.1 For services delivered outside the United Kingdom, any applicable withholding taxes shall be charged on the final invoice. International travel costs (flights, accommodation, subsistence) are payable by the Customer in addition to the fees, at the rates specified in the Rate Schedule Appendix, or as agreed in the Order Form or in writing under Schedule 1 clause 3.12.

7.2 The Service Provider accepts confirmed business class travel bookings only. Staff sub-load or standby ticketing is not accepted.

7.3 The Customer shall inform the Service Provider of all applicable local regulatory, legal and cultural requirements for delivery in the relevant jurisdiction, and shall ensure compliance with any local laws affecting the delivery of training or consulting services.

SCHEDULE 5: CUSTOM WORK / STATEMENT OF WORK TERMS

This Schedule applies only where the Order Form states that Custom Work is provided, or where a Statement of Work is executed. See Schedule 1, clause 1.4.

1. Statement of Work

1.1 All Custom Work engagements require a Statement of Work (“SoW”) executed by both Parties before commencement. The SoW shall specify at minimum: (a) a description of the work and objectives; (b) deliverables and acceptance criteria; (c) timeline and milestones; (d) fees and billing schedule (fixed price or time and materials); (e) the Delivering Entity; and (f) any key assumptions.

1.2 Each SoW incorporates this Agreement and the applicable Order Form by reference. The order of precedence is as set out in Schedule 1 clause 1.3.

1.3 The Service Provider reserves the right to decline any Custom Work request without providing reasons.

2. Commencement and Delivery

2.1 Work commences on the date specified in the SoW, subject to payment of any advance fees required.

2.2 The Service Provider shall use reasonable commercial endeavours to complete deliverables within the timelines specified, subject to the Customer providing timely cooperation, access and approvals.

2.3 Time is not of the essence for delivery unless expressly stated in the SoW.

3. Change Control

3.1 Either Party may request changes to an executed SoW by written notice. Changes are subject to agreement on revised scope, fees, timeline and terms before implementation. No change is effective until a written change order is signed by both Parties.

3.2 The Service Provider shall notify the Customer as soon as reasonably practicable if it identifies any circumstance likely to cause a material delay or cost increase.

4. Acceptance

4.1 On completion of each deliverable, the Customer shall review and notify the Service Provider whether the deliverable is accepted or rejected (with reasons) within 10 Business Days. Failure to notify within this period shall constitute acceptance.

4.2 The Service Provider shall use reasonable endeavours to remedy any properly notified rejection within a reasonable time. If, after two rounds of revision, the deliverable has not been accepted, either Party may escalate to the dispute resolution mechanism in Schedule 1 clause 17.

5. Intellectual Property in Created Works

5.1 Unless otherwise agreed in the SoW, all Intellectual Property Rights in materials, works and deliverables created specifically for the Customer (“Created Works”) vest in the Service Provider on creation. The Service Provider grants the Customer a perpetual, non-exclusive, royalty-free licence to use the Created Works for the Customer’s internal purposes, subject to payment of all fees.

5.2 Where the SoW expressly provides for assignment of Intellectual Property Rights to the Customer, such assignment shall take effect on receipt of all fees due under the SoW. No such assignment is effective unless the SoW has been approved in writing by an authorised signatory of the Service Provider.

5.3 The Customer grants the Service Provider a non-exclusive, royalty-free licence to use any Customer Input Materials incorporated in the Created Works. The Service Provider may retain and use anonymised methodologies, know-how and experience gained in performing the Custom Work.

5.4 Pre-existing Intellectual Property of each Party (“Background IP”) remains the property of the originating Party. Each Party grants the other a non-exclusive licence to use its Background IP to the extent necessary to perform the SoW.

6. Costing and Billing

6.1 For fixed-price SoWs, fees are payable at the milestones specified. For time-and-materials SoWs, fees are payable monthly in arrears based on time recorded at the rates in the Rate Schedule Appendix or, where none applies, at the rates set out in the SoW, with supporting timesheet records.

6.2 Expenses (travel, accommodation, subsistence) are payable in addition at cost, unless a fixed expense allowance is agreed in the SoW.

6.3 The Service Provider may require advance payment of up to 50% of the estimated fees before commencement of time-and-materials work.

6.4 Custom Work is estimated and priced as follows:

a) The Service Provider shall provide a written estimate setting out the estimated effort in days, the applicable day rate (from the Rate Schedule Appendix where one applies), any third-party or licence costs, and whether the engagement is offered on a fixed-price or time-and-materials basis.

b) Estimates are valid for thirty (30) days and are given on the assumptions recorded in the estimate. Where an assumption proves incorrect, clause 3.1 applies.

c) For time-and-materials engagements the estimate is an estimate and not a cap. The Service Provider shall notify the Customer once recorded time reaches 80% of the estimate and shall not exceed the estimate without the Customer’s written approval.

d) For fixed-price engagements the price covers only the deliverables and acceptance criteria stated in the SoW.

Previous revisions: Revision 1.2, in force from 1 May 2024 until 31 August 2026. The Schedule of Amendments maps every provision of Revision 1.2 to its place in Revision 2.0.

Revision 2.0, effective 1 September 2026.