You will receive our People Protection Services (“Services”) once we’ve agreed a signed Sales Order Form with you or you have given us clear instructions to start work. Each Sales Order Form will include:

• details of the services you’ve chosen
• the number of Devices or licences
• the start date (i.e. the Commencement Date on the Sales Order Form)
• the contract term (duration of the Agreement)
• charges and billing details

If you instruct us to begin before signing a Sales Order Form, the Services will be treated as having started on the date we begin delivering them (“Commencement Date”), and these terms will still apply.

The Sales Order Form forms part of our Agreement with you together with these terms and conditions of business, and any other appendices or schedules that we have agreed in the Sales Order Form are included in the Agreement. If there’s a conflict between documents, the order of priority is (a) the Sales Order Form, these terms and (b) any other schedules or annexes to the Agreement.

Here are some key terms we use throughout this Agreement:

Terms and Definitions

Agreement

• This includes these terms and conditions, your Sales Order Form, and any Schedules or annexes we’ve agreed with you.

Customer / You

• The company named in the Sales Order Form.

Orbis / we / us

• Orbis Protect Ltd or another group company named in the Sales Order Form.

People Protection Services

• People Protection Services detailed in the sales order form – including Lone Worker Services

User

• An individual authorised by you to use the Services (such as a lone worker).

Alarm Receiving Centre (ARC)

• The Orbis monitoring centre that receives alerts and responds to lone worker signals.

Lone Worker Distress Signal

• An alert received by the ARC indicating a User may be in distress.

App

• The software we provide (or approve) for lone workers to trigger alerts.

Equipment/Device

• Any device used to deliver the Services (e.g. a fob or phone).

Escalation

• The process and contacts we use when an alert is triggered.

False Alarm

• An alert that is triggered when no genuine emergency or risk to the User exists.

Charges

• The fees you agree to pay, as set out in the Sales Order Form. Commencement Date The start date for your contract.

Term

• How long your agreement runs for.

Emergency Services

• Police, fire, ambulance or similar responders.

Sales Order Form

• The document signed by both parties that confirms the Services ordered, pricing, contract term, and any other specific terms agreed between us.

Trial

• A period during which the Services are provided free of charge for evaluation purposes, as agreed in writing between the parties.

We may define additional terms later in specific sections or Schedules.

We will provide you with People Protection Services and such other services as agreed between us in writing from time to time (the “Services”). This may include:

• the hire of lone worker Equipment,
• 24/7 monitoring of lone worker alerts triggered through our Equipment, or via our App
• escalation and responding to alerts in line with our protocols,
• access to the Orbis customer portal,
• access to the App

We aim to deliver the Services in line with relevant British Standards, including BS8484 and BS5979 (or any updated standards we tell you about) and in accordance with our own internal procedures and protocols. This includes how we:

• monitor lone worker alerts in line with agreed service requirements
• respond to escalation procedures
• contact the Emergency Services if needed

We are not responsible for the Emergency Services’ actions or failures to respond, or for any external telecoms or network failures however these may arise.

We may make changes to the Services if needed to comply with legal, safety or British Standard requirements — but we’ll ensure those changes don’t materially reduce the Services.

If we receive a Lone Worker Distress Signal, we will follow the escalation procedure that we have agreed in writing with you on the response agreement form. That procedure is based on the contacts and instructions you’ve given us. If we believe the User is in immediate danger, we may also contact

Emergency Services. We do our best to respond quickly, but we can’t guarantee that the Emergency Services will respond in a particular way, or at all. We are not responsible for their response time or actions.

• If a distress signal comes from an expired schedule or turns out to be a False Alarm, we’ll follow the agreed process, inform you, and keep a record.
• If repeated False Alarms make the Services less effective (in our reasonable opinion), we may suspend the Services until the cause is fixed. See clause 5 below for more information on excessive False

You must provide and maintain accurate User information, including names of those people allocated a device and phone numbers, and escalation contact details in our system before using the Service. If these are missing or outdated, the Service may not work properly and Orbis accepts no liability in this

You must make sure each User knows their location will be visible to us in specific circumstances (such as emergencies), and the Device may activate audio monitoring.

You must also:

• Provide working devices/phones to allow the App to run (unless Devices are supplied by us),
• Complete the initial ARC setup test and any additional checks we request,
• Ensure escalation instructions are always up-to-date,
• Prevent the Service from being You must not use the services for covert surveillance,
• Comply with all applicable laws, especially regarding location tracking and data protection,
• Tell us if you expect high volumes of Device or App activity,
• Notify us immediately if you experience any incident, complaint or technical

If we believe you are breaching this Agreement, we may suspend the service or, if the issue isn’t resolved after notice, terminate the contract in accordance with clause If this happens, you will still be responsible for the early termination charges set out in clause 13.

You must not disclose the financial terms of this Agreement (such as fees or discounts) to others unless legally required or they’ve signed a confidentiality agreement.

You must ensure your personnel are trained and suitable for using the Devices and the Training can be provided by Orbis, online, or by your own team (see clause on training for more information).

You agree to take reasonable steps to avoid generating excessive or avoidable False Alarms. If a supervising operator considers that the number or frequency of False Alarms is affecting our ability to provide a safe and reliable Service, we may:

• suspend or restrict access to the Service until the issue is resolved
• charge you an admin fee for excessive False Alarms, based on the extra time and administrative burden caused by managing them.
• We’ll notify you before taking either of the above steps and give you a chance to resolve the issue

Some of our Services include Devices along with SIM cards provided by Where this applies:

• Devices remain the property of Orbis unless we agree otherwise in
• you are responsible for looking after the Devices and returning them in good condition at the end of the Agreement. We may charge for lost or damaged Devices.
• if you use your own devices to run any Services g. the App, it’s your responsibility to make sure your own device and any SIM card work with our Services.
• if we provide SIM cards, you must only use them for the agreed Misuse may result in disconnection, extra charges, or termination.
• mobile coverage is essential for us to provide the

It is your responsibility to ensure there’s adequate network coverage where the Services will be used and we accept no liability for any loss, disruption, or failure arising from lack of network coverage

We reserve the right to charge for excessive usage if your use of the Service goes beyond typical usage levels (e.g. data, minutes, or texts). Our pricing is calculated based on each Device being used for no more than 15 minutes duration of calls, 7 text messages, and 500 Mega Bytes of data per calendar month. If usage exceeds these limits, we may charge additional fees at our standard rates.

You agree to let us know immediately if any Device or SIM is lost or stolen so we can help secure your account and minimise charges.

If you believe a Device is faulty, let us know and we’ll send a replacement. You must return the suspected faulty Device within 14 If we inspect the returned Device and find signs of misuse or if no fault is found we may charge you the replacement cost.

Mid-Term Returns – If you wish to return any Devices part-way through the contract (e.g. due to reduced staffing), please let us We’ll discuss your options in accordance with clause 13(e)., and your overall service commitment may remain unchanged.

If you believe a Device hasn’t arrived as expected, you must let us know in writing within 7 days of the expected delivery If we don’t hear from you within that time, we’ll assume all Devices have been delivered and charges will apply in full.cific recordings for incident investigation or regulatory purposes, subject to authentication and audit procedures.

Where we supply or manage body-worn cameras (Body-Cams) as part of the Services they are provided for the purpose of promoting the safety of lone workers and/or capturing footage and evidence in connection with incidents where monitoring is required.

For certain services we agree to provide to you, Video and/or audio footage may be transmitted to Orbis’s Alarm Receiving Centre and our authorised sub-processor(s) for the sole purpose of providing monitoring, storage, incident support and escalation.

We will only access or review footage in accordance with pre-agreed protocols or in the event of an incident or alert.

Data Controller and Processor Roles: You are the data controller for all footage captured and Orbis acts as a data processor, and our sub-processors will process personal data only under your instructions and in accordance with the Data Protection terms in this Agreement in the Schedule.

You are responsible for ensuring that:

• any individuals likely to be recorded are made aware of the use of Body Cams (e.g. through visible signage or verbal notice where appropriate).
• use of Body Cams is proportionate and complies with applicable data protection laws and guidance, including BS8593 and the Information Commissioner’s Surveillance Camera Code of Practice .
• you have carried out any required Data Protection Impact Assessments (DPIAs).

Retention and Access: Footage will be stored securely by Orbis or our sub-processors (see our Data Processing Agreement for details) and retained for no longer than is necessary for the purpose of the Service or as required by law. You may request access to spe

If we agree to a Trial, the following will apply:

• the Trial shall be for a maximum of 30 days, and the Services will cease on expiry of the trial period. We may agree a different trial period with you in writing.
• any subsequent use of the service following the Trial will automatically enter into a new agreement for a minimum 12 month term and will be chargeable at the standard rates.

All personal data provided by you to Orbis for the purposes of the Trial will be deleted within 7 days of the Trial ending.

At the end of the Trial, it is your responsibility to return the Devices to Orbis in their original

You agree that if any Devices are not returned or are returned damaged it will incur a fee equal to the standard replacement rate of the The Customer shall pay Orbis any charges incurred under this clause within 30 days of date of invoice

You’re responsible for making sure that every User completes appropriate training before using the Services. This helps ensure their safety and the effectiveness of the Services.

We’ll set out the specific training arrangements in your Sales Order Form or implementation plan. If you’re providing training yourself, you must ensure it covers the basics of how the Service works, including escalation procedures and use of the Equipment.

We will invoice you monthly in Our preferred method of payment is direct debit. You agree to pay each invoice within 30 days of the invoice date. All charges are subject to VAT (or any similar tax) at the applicable rate.

You must pay the charges in full, without deduction or set-off. If you do not pay on time, we may charge interest at the statutory rate, plus our reasonable admin costs in collecting the overdue amount. If you think there’s an error in your invoice, you must raise it with us within 14 days of the invoice We’ll work with you to resolve it, but unless otherwise agreed, this won’t delay your obligation to pay.

If a Device is returned early or not used, this will not automatically cancel your payment obligations for the full agreed term.

Any outstanding balance due will automatically accrue interest at the rate of 8% over the Bank of England base We may suspend the Services if payments are seriously overdue. If we do this, it does not affect your obligation to continue paying.

Our charges are based on the agreed Commencement Date for the Services, even if you activate the Device or start using the Services later.

Our Charges will increase each year on the anniversary of the Commencement Date by the higher of 5% or the percentage change in the CPI over the previous 12 We reserve the right to make additional price adjustments in exceptional circumstances that significantly affect our costs. We will give you 30 days’ notice of any such change.

Your contract starts on the Commencement Date set out in the Sales Order Form and runs for the agreed Term.

Either of us can end the contract early if the other:

• commits a serious breach of this Agreement and the other does not fix it within 30 days of being asked to, in writing
• becomes insolvent or unable to pay debts when due

You may also cancel at the end of the agreed Term by giving us at least 90 days’ written notice (such notice to expire on the end date of the agreed Term).

If you do not give notice to cancel at least 90 days prior to the expiry date, the contract will automatically renew for another 12-month term, and the same terms will continue to

If you end the contract early, you’ll need to pay all remaining charges plus an early termination fee (see your Sales Order Form or speak to us for details). Please note that returning Devices early does not cancel your payment obligations for the agreed Term. This does not apply if you terminate the Agreement because we have breached it and you are exercising your right to terminate under 13(b) above).

Once the contract ends, you must stop using the Services and return any Devices to We may charge you for any missing or damaged Devices. We’re not responsible for cancelling any mobile service arrangements you’ve made directly.

After the contract ends, you must:

• stop using the Services
• return all Orbis Devices and materials (or pay for them if not returned or damaged)
• pay any unpaid invoices

If you’ve agreed to store Devices or data with us and don’t tell us what to do with them, we may

securely delete or dispose of them 28 days after the contract ends. We’ll try to contact you first before doing this.

Certain terms will continue after the Agreement ends—these include anything that relates to confidentiality, payment, liability, and anything else that should reasonably survive.

Both you and Orbis agree to keep each other’s confidential information safe and not share it with anyone else unless the law requires it, or the other party gives written permission

You can share confidential information with your own employees, agents or subcontractors—but only if they need to know it and are under duties to keep it confidential too.

The obligations in this clause continue for a period of five (5) years from the date of termination or expiry of the Agreement.

We (or our licensors) own all intellectual property rights in the Services, including any applications, materials, or technology we provide.

We give you a limited, non-transferable licence to use any Orbis software or portal that forms part of the Service—but only:

• for the number of Users listed in your Sales Order Form
• for the purposes of receiving the Services

You must not copy, share, or sublicense any of our software or IP to anyone If you allow someone to misuse our IP or Services, or breach this section, you agree to cover any resulting loss or damage we suffer.

Depending on the nature of the Services, Orbis may act either as a Data Controller or a Data Where Orbis determines the purpose and means of processing, we act as a Data Controller. Examples of this include where we collect personal data of your employees to maintain our business relationship with you. Our privacy policy at www.orbisprotect.com/privacy-policy-lone-worker-data applies in these situations. Where we process personal data on your behalf in providing the Services, for example where our Services include the collection of security footage on your instructions, you are the Data Controller, and we act as your Data Processor. The terms of Data Processing Schedule will apply where we act as your processor

In all cases, we will comply with applicable UK data protection laws, including the UK GDPR and the Data Protection Act 2018.

We’ll act with reasonable care and skill in delivering the Services, but no service can be guaranteed to be 100% reliable at all times. We’re not liable for:

• events outside our control (e.g. telecom failures, poor mobile signal, GPS issues)
• third-party services or products (e.g. mobile networks, your own devices)
• any loss of profits, revenue, business, or indirect or consequential loss

We do not promise that the Services will prevent harm to any They are a safety aid and not a guarantee of protection. Nothing in this Agreement limits either party’s liability for:

• death or personal injury caused by negligence
• fraud or fraudulent misrepresentation
• anything else we can’t legally exclude

Our total liability under this Agreement in respect of one claim or any series of claims is capped at the lower of £10,000 or 100% of the total Charges you’ve paid in the previous 12 months.

19. Neither of us will be liable for delay or failure to meet our obligations if it’s caused by something outside our reasonable This includes things like natural disasters, government actions, power failures, or major network outages.

If the issue continues for more than 30 days, either of us can end the Agreement by giving written notice.

20. You can’t transfer this Agreement to someone else without our written consent, which we will not unreasonably withhold. We can transfer this Agreement to another company in the Orbis group without your consent.

21. For legal notice under this Agreement (like notice of termination), you must send it by recorded delivery or courier to the registered address in the Sales Order Form. Notices are deemed delivered:

• on the day of delivery if sent by hand
• two working days after posting (UK)
• immediately if confirmed as received by email

Routine communications may be by email; formal notices must follow the method above.

22. This Agreement constitutes the complete and entire understanding between the It supersedes all prior discussions, emails, or preliminary drafts pertaining to the Services. If we want to change any terms of our Agreement after the Commencement Date, it must be in writing and signed by both of us.

23. No one else has any right to enforce any part of this Agreement, under the Contracts (Rights of Third Parties) Act 1999 or otherwise.

24. This Agreement is governed by English If there’s a dispute, we both agree to resolve it in the courts of England and Wales.

This Schedule sets out how we will process personal data on your behalf in line with UK and EU data protection law, including the UK and EU GDPR. You are the controller, deciding the purpose and manner in which the data is processed. These terms apply when you decide why personal data is collected (the purposes), and we process it only to help you deliver those purposes. For example, when we provide services like lone worker alarms, CCTV, and body-worn cameras.

1. Our Responsibilities as your processor

We will only process personal data in line with your documented instructions. We will also: –

• tell you promptly if we believe an instruction breaks the law
• keep data confidential and only share it with people who need to know
• only appoint sub-processors under written contracts imposing obligations equivalent to those in this Schedule
• provide reasonable assistance to enable you to respond to data subject rights requests within statutory deadlines
• implement appropriate technical and organisational security measures (see our website at [ https://www.orbisprotect.com/about-us/technical-and-organisational-measures
• help you respond to security incidents and complete Data Protection Impact Assessments
• delete or return data securely when instructed or when the contract ends
• keep records to show our compliance
• let you audit us on reasonable notice (see section auditing below) Details of the data processing is set out at Annex 1.

2. Your Responsibilities as Controller

You are responsible for ensuring you have a lawful basis to collect and use the personal data in the way you have asked us to process it. You must provide clear and sufficient privacy information to data subjects (e.g., privacy notices) explaining the purposes, lawful basis, and your identity as the

controller. You have the responsibility to respond to data subject requests and regulatory obligations in relation to the processing we undertake for you

3. Our Sub-Processors

We use other companies to help deliver our services (e.g. cloud hosting). See our privacy notice https://www.orbisprotect.com/privacy-policy/for a current list.

We will inform you before adding or changing sub-processors – we will give you at least [30] days written notice and allow you to object on reasonable grounds. If we cannot accommodate your objection, you may terminate the relevant service by providing us with written notice. We will ensure that our sub-processors agree to equivalent obligations as those set out in this Schedule.

4. Security Measures

We apply appropriate technical and organisational measures to protect personal data. These are described at [https://www.orbisprotect.com/about-us/technical-and-organisational-measures] and include the following measures:

• Access controls and user authentication
• Encryption of data at rest and in transit
• Secure storage and disposal
• Regular security testing and staff training

5. Data Breach Notification

If we become aware of a personal data breach affecting the Services we are providing to you, we will notify you without undue delay, and within 24 hours where feasible, providing available details and proposed mitigation measures.

6. Assisting with Data Subject Rights

We will notify you promptly (within 2 working days) of any Data Subject rights requests we receive and not respond directly unless specifically instructed by you in writing. We will provide reasonable assistance to help you respond within statutory deadlines.

7. International Data Transfers

We will not transfer personal data outside the UK or EEA unless expressly authorised by you in writing and appropriate safeguards (such as Standard Contractual Clauses, UK International Data Transfer Agreement or equivalent) are in place.

8. End of Contract

When the contract ends, or if you ask us to stop processing, we will delete or return the personal data (at your choice) and confirm this to you in writing. We may keep data if required by law or if the individual gives us separate consent.

9. Audits and Compliance

You or an independent third-party auditor may audit our data processing activities, subject to reasonable confidentiality obligations, in order to verify our compliance. Audits must take place during normal business hours, on at least 14 days’ written notice. You may do this once per year (unless required more often by law or a serious incident occurs).

Annex 1    Data Processing Overview

• Categories of data subjects: Employees, visitors, lone workers
• Types of personal data may include: Video footage, GPS location, contact details and such other data as agreed with you in the Agreement or Order Form.
• Processing purposes: Security monitoring, safety alerts, incident response
• Retention periods: As agreed in your service contract
• Transfers: Limited to UK/EEA unless otherwise approved