Master Services Agreement (MSA)

1. Definitions

• "TSA" means The Safeguarding Alliance Limited.
• "Affiliate" means any entity that controls, is controlled by, or is under common control with a party.
• "Authorized Users" means Customer's employees and contractors authorized to use the Services.
• "Agreement" means this MSA, the DPA, and any applicable service terms.
• "Confidential Information" means all non-public, proprietary, or confidential information disclosed by either party.
• "Customer Data" means all data, content, and information submitted by Customer to the Services.
• "Documentation" means our user guides, API documentation, and other materials.
• "DPA" means the Data Processing Addendum incorporated by reference.
• "Effective Date" means the date Customer first accepts this Agreement or first accesses the Services under a paid subscription, whichever is earlier.
• "Service Terms" means the specific terms and conditions for the Services as agreed between the parties.
• "Services" means The Safeguarding Alliance Limited's Safer Recruitment Suite (SafeRecord, SafeApply, and/or SafeVerify) as described in the Documentation.
• "Subscription Term" means the period during which Customer is authorized to use the Services.

1A. Order of Precedence

In case of conflict: (1) the Data Processing Addendum ("DPA") controls with respect to personal data processing; (2) this MSA; (3) any executed Order Form or Service Terms.

2. Services and Access

2.1 Provision of Services

Subject to the terms of this Agreement, TSA will make the Services available to Customer during the Subscription Term. Customer may access and use the Services solely for its internal business operations in accordance with the Documentation.

2.2 Service Levels

Service availability target: 99.9% per calendar month, excluding Scheduled Maintenance (minimum 24 hours' notice) and force majeure.

Business Hours means 09:30 to 22:00 UTC, Monday to Friday, excluding public holidays in England and Wales and federal public holidays in the United States (equivalent to 10:30 AM – 6:00 PM GMT / 09:30 AM – 5:00 PM CDT).

Incident response targets:

• P1 – Service Unavailable: response within 1 Business Hour; workaround within 4 Business Hours; target restoration within 2 Business Days.
• P2 – Major Degradation: response within 4 Business Hours; workaround within 2 Business Days.

Service credits (applied to the next invoice): 99.5–99.89% = 5%; 99.0–99.49% = 10%; <99.0% = 25%. Service credits are Customer's sole and exclusive remedy for availability shortfalls.

2.3 Support Services

TSA will respond to support requests submitted via the Support page or by email to wg@thesafeguardingalliance.org.uk within 24 Business Hours. For service incidents (P1 and P2), the response times in section 2.2 apply.

2.4 Updates and Enhancements

TSA may modify the Services to add new features, improve existing functionality, or address security issues. Material changes will be communicated with reasonable advance notice.

3. Customer Responsibilities

3.1 Authorized Users

Customer may designate Authorized Users who may access the Services. Customer is responsible for all activities of Authorized Users and ensuring compliance with this Agreement.

3.2 Restrictions and Acceptable Use

Customer will comply with Schedule 1 (Acceptable Use Policy) and will not: (a) reverse engineer, decompile, or disassemble the Services; (b) rent, lease, or sublicense the Services; (c) use the Services for any unlawful purpose; (d) attempt to gain unauthorized access to the Services; (e) interfere with or disrupt the Services; or (f) exceed the usage limits specified in this Agreement.

3.3 Customer Data and Backups

Customer represents and warrants that it has all necessary rights to submit Customer Data to the Services and that such submission does not violate any applicable law or third-party rights. Customer must maintain independent backups of Customer Data.

3.4 Customer Data Accuracy

Customer is responsible for the accuracy of the personal data it submits to, or configures the Services to collect, and for keeping it up to date. This includes: (a) the details of the organisation user accounts Customer creates and administers, which individual users cannot amend themselves; (b) the organisation profile; and (c) applicant, referee and staff records Customer creates, uploads, or edits within the Services. Where a data subject asks Customer to correct data that Customer controls, Customer is responsible for making that correction using the tools available in the Services. TSA does not independently verify the accuracy of Customer Data.

Where an applicant maintains their own SafeApply account and profile, the applicant is responsible for the accuracy of that profile, as set out in the Terms & Conditions. An application already submitted to Customer is a record of what the applicant provided at the time; any amendment to it is a matter for Customer as Controller.

3.5 Customer Notices to Applicants

Customer is responsible for providing appropriate privacy and safeguarding information to applicants, referees, and other individuals whose data Customer collects through the Services. Customer must provide a privacy notice to applicants, referees, and other individuals whose data it processes through the Services, meeting the requirements of UK GDPR Article 13 where Customer collects the personal data directly from that individual, and Article 14 where Customer obtains it from another source. Article 14 applies, for example, where Customer uploads an applicant's details or documents itself rather than the applicant submitting them, where Customer bulk-onboards staff records, and where Customer or an applicant supplies a referee's contact details before that referee is approached. In those cases Customer must also tell the individual the source of the data and the categories of personal data held, and must do so within one month of obtaining the data or, if earlier, at the point of first communication with them or first disclosure of the data. The Services allow Customer to upload a safeguarding statement (PDF) for display to applicants and referees. TSA provides a template organisation privacy notice accessible via the platform settings; Customer is responsible for reviewing, completing, and keeping that notice accurate and up to date. Customer warrants that any safeguarding materials and privacy notices are accurate, lawful, and kept up to date.

4. Subscription Terms and Renewal

4.1 Initial Term

The initial Subscription Term begins on the Effective Date and continues for the period specified in this Agreement or as otherwise agreed by the parties.

4.2 Renewal and Cancellation

Unless either party provides written notice of non-renewal at least 30 days before the end of the current term, the Agreement will automatically renew for successive periods equal to the initial term. Customer may cancel their subscription at any time through their root account settings, with such cancellation taking effect at the end of the current billing period.

5. Fees and Payment

5.1 Fees

Customer will pay all fees as specified in this Agreement or as otherwise agreed by the parties. All fees are non-refundable except as expressly set forth in this Agreement.

5.2 Payment Terms

Online payments are processed by Paddle.com Market Ltd as merchant of record at the time of purchase. Where the parties agree to invoicing, invoices are due net-30 days from the invoice date. Late amounts may accrue interest at 1.5% per month (or the maximum permitted by law, if lower).

5.3 Payment Processing

Online subscription payments are collected by Paddle.com Market Ltd as merchant of record. Customer authorizes recurring subscription charges through Paddle's checkout and billing systems. TSA does not store card or bank details. In its merchant-of-record capacity Paddle acts as an independent controller in its own right, and as TSA's processor for the billing details TSA sends it in order to raise an invoice; both roles are described in section 6.3 of the Data Processing Addendum. Where invoicing is agreed separately under section 5.2, the invoice is issued through Paddle as merchant of record on the payment terms stated in that section, and payment is made in accordance with the payment instructions set out on the invoice.

5.4 Taxes

Customer is responsible for all taxes, duties, and government charges arising from this Agreement, excluding taxes based on TSA's income.

5.5 Fee Changes

TSA may increase fees with 60 days' written notice. Customer may terminate within 30 days of such notice if it disagrees with the increase.

6. Data Protection and Security

6.1 Data Processing

The DPA governs the processing of personal data. TSA will implement and maintain appropriate technical and organisational measures to protect Customer Data against unauthorized access, alteration, disclosure, or destruction.

6.2 Security Measures

TSA maintains industry-standard security measures including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Virtual Private Cloud (VPC) and network isolation
• Comprehensive audit logging and monitoring
• Regular vulnerability assessments according to the industry standard
• Secure backup and disaster recovery procedures
• Personnel security and confidentiality obligations

6.3 Compliance and Sub-processors

TSA will maintain compliance with applicable data protection laws and industry standards as required by the DPA.

TSA may use sub-processors to provide the Services, including Waxley Graham LLC for software development and platform operation. Customer's notice, objection, and termination rights regarding sub-processors are set out in the DPA. A current list is maintained at Sub-Processors. TSA will provide advance written notice of material sub-processor changes to Customer administrators.

6.4 Security Incident Response

In the event of a security incident affecting Customer Data, TSA will notify Customer without undue delay and provide reasonable assistance in investigating and remediating the incident in accordance with the DPA.

7. Data Export and Deletion

7.1 Data Export

Upon Customer's request, TSA will make available to Customer all Customer Data in machine-readable format (JSON exports and document bundles) within 60 days. Data export is not automatically provided upon termination and must be specifically requested by Customer.

7.2 Data Deletion

After providing data export, TSA will delete Customer Data from active systems within 30 days and from backup systems within 90 days, except where retention is required by applicable law.

7.3 Transition Assistance

Upon Customer's request and payment of applicable fees, TSA will provide reasonable transition assistance for up to 60 days following termination.

8. Intellectual Property Rights

8.1 TSA's Intellectual Property

TSA retains all right, title, and interest in and to the Services, Documentation, and all related intellectual property. Customer receives only the limited rights expressly granted in this Agreement.

8.2 Customer's Intellectual Property

Customer retains all right, title, and interest in and to Customer Data and any intellectual property provided by Customer.

8.3 Feedback

Customer grants TSA a perpetual, worldwide, royalty-free license to use suggestions, enhancement requests, or recommendations provided regarding the Services ("Feedback"). Feedback does not include Customer Data or either party's Confidential Information.

9. Confidentiality

9.1 Confidential Information

Each party will protect the other's Confidential Information using the same degree of care it uses to protect its own confidential information, but not less than reasonable care.

9.2 Exceptions

The confidentiality obligations do not apply to information that: (a) is publicly available; (b) was known to the receiving party prior to disclosure; (c) is independently developed; or (d) is required to be disclosed by law.

9.3 Duration

Confidentiality obligations survive termination of this Agreement for a period of five years.

10. Warranties and Disclaimers

10.1 TSA Warranties

TSA warrants that: (a) the Services will perform substantially in accordance with the Documentation; (b) TSA has the right to grant the rights granted herein; and (c) TSA will not knowingly introduce malicious code into the Services.

LIMITATION: These warranties are Customer's sole and exclusive remedies for breach of warranty and do not extend to third-party components, integrations, or Customer's specific use cases.

10.2 Customer Warranties

Customer warrants that: (a) it has the authority to enter into this Agreement; (b) Customer Data does not violate any applicable law or third-party rights; (c) it will use the Services in compliance with applicable laws; (d) it has obtained all necessary consents for data processing; (e) it will not use the Services for unlawful purposes; and (f) it will maintain appropriate security measures for its systems and networks.

10.3 Disclaimers

EXCEPT AS EXPRESSLY SET FORTH HEREIN, THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, UNINTERRUPTED SERVICE, OR ERROR-FREE OPERATION.

10.4 Additional Disclaimers

TSA makes no warranties regarding: (a) the accuracy, completeness, or reliability of third-party data or services; (b) the suitability of the Services for Customer's specific business requirements; (c) the availability of specific features or functionality; (d) the security of Customer's network or systems; or (e) compliance with Customer's internal policies or industry-specific regulations.

10.5 AI and Automation Disclaimers

Any AI-assisted features are provided for convenience only and do not replace human judgment or professional decision-making. TSA disclaims all liability for decisions made based on AI-generated content, summaries, or recommendations.

11. Indemnification

11.1 TSA Indemnification

TSA will defend and indemnify Customer against third-party claims alleging that the Services, as provided by TSA and used in accordance with this Agreement, infringe UK intellectual property rights, provided Customer promptly notifies TSA in writing, reasonably cooperates, and allows TSA sole control of the defense and settlement.

11.2 Customer Indemnification

Customer will indemnify TSA against claims arising from: (a) Customer's use of the Services in violation of this Agreement or Schedule 1; (b) unlawful Customer Data; (c) Customer Data; or (d) Customer's violation of applicable law.

11.3 Remedies

If the Services become subject to a claim of infringement, TSA may: (a) obtain the right for Customer to continue using the Services; (b) modify the Services to be non-infringing; or (c) terminate this Agreement and refund prepaid fees.

12. Limitation of Liability

12.1 General Limitation

EXCEPT FOR LIABILITY THAT CANNOT BE LIMITED BY LAW, EACH PARTY'S AGGREGATE LIABILITY FOR DIRECT DAMAGES UNDER THIS AGREEMENT SHALL NOT EXCEED THE TOTAL AMOUNTS PAID OR PAYABLE BY CUSTOMER TO TSA IN THE 12 MONTHS PRECEDING THE CLAIM. This cap applies to all direct damages arising under or in connection with this Agreement, whether in contract, tort (including negligence), breach of statutory duty, or otherwise.

12.2 Data Incident Liability

For data protection incidents, TSA's liability for direct damages is subject to the same cap in section 12.1, unless the incident results from TSA's gross negligence or wilful misconduct.

12.3 Excluded Damages

IN NO EVENT SHALL EITHER PARTY BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOST PROFITS, DATA LOSS, BUSINESS INTERRUPTION, OR LOST OPPORTUNITIES, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. The cap in section 12.1 applies only to direct damages and does not apply to excluded damages under this section 12.3.

Carve-outs. The limitations in this Section 12 do not apply to: (i) death or personal injury caused by negligence; (ii) fraud or fraudulent misrepresentation; (iii) wilful misconduct; (iv) breach of confidentiality; (v) Customer's payment obligations; (vi) TSA's indemnity under Section 11; and (vii) any liability that cannot be limited as a matter of law.

12.4 Customer-Specific Limitations

TSA is not liable for: (a) Customer's use of the Services in violation of applicable law; (b) Customer's failure to implement appropriate security measures; (c) unauthorized access using Customer's credentials; (d) Customer's reliance on the Services for critical business decisions; (e) third-party actions or failures; or (f) Customer's failure to maintain adequate backups of Customer Data.

12.5 Service Interruption Liability

Customer acknowledges that service interruptions may occur and agrees that TSA's sole obligation for service unavailability is to use reasonable efforts to restore service. TSA is not liable for business losses resulting from temporary service interruptions.

13. Force Majeure

Neither party will be liable for any failure or delay in performance due to circumstances beyond its reasonable control, including acts of God, natural disasters, war, terrorism, labor disputes, government actions, or outages or failures of cloud infrastructure or third-party hosting providers on which the Services depend. The affected party must notify the other party promptly and use reasonable efforts to minimize the impact.

For the avoidance of doubt, a full outage of cloud infrastructure or third-party hosting services on which the Services depend constitutes a force majeure event. In such circumstances, TSA's obligation to provide a workaround within the timeframes specified in Section 2.2 is suspended for the duration of the outage. TSA will use reasonable endeavours to communicate the situation to affected Customers promptly.

14. Regulatory Access

Customer may permit regulators, inspectors, or accreditation bodies access to information relating to safeguarding compliance through the Services. TSA shall provide reasonable cooperation.

15. International Use

The Services may be accessed and used by Customer and its Authorised Users from locations outside the United Kingdom. Customer is responsible for ensuring that its use of the Services, and its collection and processing of personal data through the Services, complies with all laws applicable in the territories where Customer and its users operate. This Agreement is governed by the laws of England and Wales as set out in section 16; however, nothing in this Agreement excludes or limits any rights or remedies that cannot be excluded or limited as a matter of the mandatory laws of Customer's jurisdiction.

16. Governing Law and Dispute Resolution

16.1 Governing Law

This Agreement is governed by the laws of England and Wales, without regard to conflict of law principles.

16.2 Jurisdiction

The courts of England and Wales have exclusive jurisdiction over any disputes arising from this Agreement.

16.3 Dispute Resolution

Before commencing proceedings, the parties will attempt in good faith to resolve disputes through senior-level negotiations.

17. General Provisions

17.1 Entire Agreement

This Agreement, including the DPA and any applicable service terms, constitutes the entire agreement between the parties and supersedes all prior agreements.

17.2 Amendments

This Agreement may only be amended by a written instrument signed by both parties.

17.3 Assignment

TSA may assign this Agreement to an Affiliate without Customer's consent. Customer may not assign this Agreement without TSA's prior written consent, except in connection with a merger, acquisition, or sale of substantially all assets with TSA's prior written consent.

17.4 Severability

If any provision of this Agreement is held to be invalid or unenforceable, the remaining provisions will remain in full force and effect.

17.5 Waiver

No waiver of any provision will be effective unless in writing and signed by the waiving party.

17.6 Survival

Provisions relating to confidentiality, intellectual property, indemnification, limitation of liability, and governing law will survive termination.

17.7 Notices

Notices to TSA must be sent to wg@thesafeguardingalliance.org.uk or the contacts specified in the admin console. TSA has appointed a Data Protection Officer; data protection matters, including data subject requests and matters arising under the Data Processing Addendum, should instead be directed to the Data Protection Officer at dpo@thesafeguardingalliance.org.uk. Notices to Customer must be sent to the contacts specified by Customer (or updated in the admin console). Notices are deemed received on business days when sent, unless the sender receives a bounce-back or error.

17.8 Third-Party Beneficiaries

This Agreement does not create any rights for third parties.

Schedule 1 – Acceptable Use Policy

1. Services Description

Cloud platform (hosted on AWS infrastructure) providing:

• Candidate workflows and reference checks
• Staff record management
• Configurable forms and basic reporting
• Web browser access (no integrations guaranteed)

2. Prohibited Activities

Customer shall not:

• (a) Upload unlawful or prohibited content;
• (b) Conduct security testing without consent;
• (c) Use for high-risk activities;
• (d) Exceed fair usage limits;
• (e) Upload criminal record certificates (DBS, CRB, etc.) or equivalent certificate documents where the Services require metadata only; upload medical or psychological reports or assessments except through the dedicated medical vetting workflow in SafeVerify or SafeRecord; or upload biometric, genetic, or other special category data except as permitted by the Services' configured workflows and the Controller's lawful basis.

3. Suspension Rights

TSA may suspend access where reasonably required to protect service integrity or where Customer breaches this Schedule.