Littoralis Ltd — Disc SaaS Terms and Conditions

1. Parties and Interpretation

1.1 These Terms and Conditions are entered into between Littoralis Limited, Suite 70, 26 The Hornet, Chichester, West Sussex PO19 7BB, United Kingdom (Company Number 03806211) (“Littoralis” or “Provider”), and the organisation, agency, or entity to which Disc is licensed (“Customer”).

1.2 In these Terms, the following definitions apply:

• “Disc” or “Service” means the secure information-sharing platform accessible via the Disc App and Disc Desktop, including all modules and associated services provided by Littoralis.
• “Customer Data” means any information, including personal data, uploaded, stored, or processed by Customer within Disc.
• “User” or “Member” means an individual authorised by Customer to access and use Disc.
• “Data Controller” means the organisation that determines the purposes and means of processing personal data (Customer, in this relationship).
• “Data Processor” means the organisation that processes personal data on behalf of the controller (Littoralis, in this relationship).
• “Personal Data” means any information relating to an identified or identifiable natural person.
• “Term” means the initial subscription period and any renewal periods as set out in the Order.
• “Order” means the written agreement, order form, or email confirmation issued by Littoralis setting out, amongst other things, the Service, Fees, and Term.
• “Implementation Fee” means the one-off fee for initial setup, configuration, and administrator training.
• “Licence Fee” or “Subscription Fees” means the recurring periodic fees for access to the Service.
• “Fees” means the Implementation Fee and any Licence or Subscription Fees or other charges to be paid by the Customer.
• “Business Hours” means 09:30 to 17:00 UK time, Monday to Friday, excluding UK public holidays.
• “Data Protection Laws” means all applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2.1 Subject to payment of all Fees and compliance with these Terms, Littoralis grants Customer a non-exclusive, non-transferable, non-sublicensable licence to access and use Disc during the Term for Customer’s internal business purposes only.

2.2 Customer shall not resell, rent, lease, or sublicense access to Disc to any third party. Each User must have an individual login; credential sharing is strictly prohibited.

2.3 Unless otherwise agreed in writing by Littoralis, Customer may not be granted access to Disc until:

• these Terms and Conditions have been accepted by Customer; and
• cleared funds for the Fees have been received by Littoralis,

3. Service Description and Scope

3.1 Littoralis will provide Customer with access to the Disc secure information-sharing platform, deployed over the internet and accessible through the Disc App and Disc Desktop, including all functionality as described in the Disc manuals, storage of Customer Data in a secure environment located in the United Kingdom in full compliance with Data Protection Law, and all relevant upgrades or incremental enhancements that Littoralis considers core components of the Disc system.

3.2 Littoralis will implement Disc for Customer within five working days of confirmation of purchase. The Implementation Fee includes:

• creation of the Disc workspace;
• training of Customer’s administrators (not Users) on how to set up and manage the system;
• consultancy on compliance with data protection law and provision of ‘Must Read Document’ templates where appropriate;
• telephone and email support throughout the implementation and data population process; and
• consultative and advisory reviews at setup, pre-live, and post-live stages.

3.3 Following implementation, Littoralis will provide:

• continuing access to and full use of all Disc functionality;
• telephone and email support to Customer’s designated ‘Single Point of Contact’, available during Business Hours, with emergency-only out-of-hours response capability; and
• quarterly consultative and advisory reviews.

3.4 Training beyond the initial implementation is available as follows:

• online training delivered by Littoralis: £75 per hour; and
• where physical attendance is required: Littoralis will charge travel expenses, travel time at £50 per hour (or part thereof), and accommodation expenses where necessary.

4.1 Littoralis shall use reasonable endeavours to achieve a minimum of 99.5% Service availability per calendar month, not including time for any necessary and pre-notified maintenance.

4.2 Littoralis will use reasonable endeavours to schedule all planned maintenance and emergency downtime to minimise disruption to the Service.

4.3 Notice periods for maintenance are as follows:

• routine maintenance: at least 5 working days’ notice; and
• critical security patches or urgent maintenance: at least 48 hours’ notice where practicable.

5.1 Fees are as set out in the Order and are exclusive of VAT and any other applicable taxes.

5.2 Invoicing is as follows:

• Implementation Fee: invoiced upon Order; and
• Subscription Fees and add-ons: invoiced upfront at the start of each subscription period.

5.3 Payment is due within 14 days of the invoice date, unless otherwise agreed with Customer in writing prior to commencement of Service.

5.4 If payment is not received by the due date, Littoralis reserves the right to charge interest on the outstanding amount at the rate of Bank of England base rate plus 8% per annum, accruing daily from the due date until payment is made in full.

5.5 If payment is not received within 30 days of the invoice date (being 16 days after the payment due date), Littoralis may immediately suspend Customer’s access to Disc without further notice, including where the outstanding invoice relates to ancillary services or add-ons. Access will be restored upon receipt of cleared payment.

5.6 All Fees are non-refundable. Customer shall not be entitled to any refund or credit in respect of prepaid Fees, whether upon termination for convenience or otherwise.

6. Users and Excess Users

6.1 Each User must have an individual login credential. Sharing of login credentials between Users is strictly prohibited.

6.2 Included Users for Disc Standard are as follows:

• Year 1: unlimited Users included in the Licence Fee; and
• Year 2 onwards: 150 Users included; excess Users charged at £0.30 per User per month.

6.3 Included Users for Disc Segregated Content (Disc SC) are as follows:

• Year 1: unlimited Users included in the Licence Fee; and
• Year 2 onwards: 300 Users included; excess Users charged at £0.30 per User per month.

6.4 Excess Users are calculated on each licence review date and applied as an equal monthly charge across the remaining licence period, irrespective of any subsequent increase or decrease in the number of Users.

7. Pricing and Price Changes

7.1 Fees are fixed throughout the initial Term and any agreed renewal period, unless otherwise agreed in writing.

7.2 Littoralis reserves the right to review and adjust Fees annually. Any Fees increase will apply from Customer’s next invoice date, which incentivises longer-term subscription commitments.

7.3 Littoralis reserves the right to review Fees more frequently in exceptional circumstances, provided that a minimum of 30 days’ notice is given to Customer.

8. Data Protection and Processing

8.1 Customer acts as the Data Controller and Littoralis acts as the Data Processor. Customer is responsible for ensuring it has a lawful basis for processing personal data and for complying with Data Protection Laws.

8.2 Littoralis processes personal data on behalf of Customer to enable Customer to share data (including personal data) with Users and other Data Controllers, store data securely, anonymise data appropriately, and delete data irrevocably. Processing continues for the duration of the Term and the post-termination data export and deletion period as set out in clause 12.

8.3 The personal data processed may include:

• names and contact details of Users and other individuals;
• User classifications as defined by Customer;
• data relating to User certification and access permissions;
• incident reports and associated data;
• biometric data;
• details relating to criminal convictions and offences or related security measures; and
• physical characteristics of individuals associated with incidents (including build, ethnicity, and gender), in accordance with Customer’s rules and protocols.

8.4 The categories of data subjects comprise Users and any other individuals whose data Customer uploads to Disc in accordance with Customer’s documented rules and protocols.

8.5 All Littoralis personnel and sub-contractors processing Customer Data are subject to a duty of confidence. Littoralis ensures that all employees are fully informed of their obligations under this clause and under all applicable data protection law.

8.6 By accepting these Terms, Customer grants Littoralis general written authorisation to engage sub-processors (including sub-contractors) for the purpose of delivering the Service. Current sub-processors include Amazon Web Services (AWS), Just After Midnight (JAM), Codeface, Microsoft, SendGrid, and Cloudflare. Littoralis will notify Customer of any planned change to an existing sub-processor or appointment of a new sub-processor, including the identity of the sub-processor and the purposes of the sub-contract. Littoralis remains fully liable to Customer for the performance of all sub-processor obligations. All sub-processors are bound by written contracts imposing obligations equivalent to those in this clause.

8.7 Littoralis applies robust technical and organisational security measures to protect Customer Data, as detailed in the document ‘Littoralis & Disc Information Security & Protection Provisions’ (available on request). These measures include:

• ISO/IEC 27001:2022 certification;
• Cyber Essentials certification;
• encryption in transit and at rest;
• regular penetration testing and vulnerability assessments; and
• secure by design principles.

8.8 Littoralis will assist Customer in responding to data subject access requests, correction requests, and any other requests for exercise of data subject rights under applicable data protection law, within a reasonable timeframe.

8.9 Littoralis will notify Customer of any personal data breach affecting Customer Data without undue delay and in any event within 72 hours after becoming aware of or suspecting the breach. The notification will include:

• a description of the nature and scope of the breach;
• an assessment of the likely impact on data subjects’ rights and freedoms; and
• details of any measures taken or proposed to mitigate the breach.

8.10 Upon termination or expiry of the Term, and within 30 days of Customer’s written instruction at its request, Littoralis will return all Customer Data to Customer in encrypted CSV and image file format (zipped) and will permanently delete all Customer Data from active systems and schedule deletion from backup systems in accordance with standard retention cycles.

8.11 Littoralis will cooperate with reasonable audits and inspections to demonstrate compliance with its obligations as a Data Processor. Customer may conduct audits no more than annually on reasonable notice; third-party certifications and security summaries may be provided where feasible.

8.12 Littoralis will inform Customer immediately if Customer requires Littoralis to process personal data in a manner that Littoralis believes would breach applicable data protection law. This provision does not make Littoralis a joint Data Controller and does not relieve Customer of its obligations under data protection law.

8.13 Where Customer uploads special category data or criminal offence data (including in direct crime reporting or PEP contexts), Customer is responsible for establishing a lawful basis for processing under Article 9 or Article 10 of the UK GDPR, meeting any applicable conditions under the Data Protection Act 2018, and maintaining any required appropriate policy document. Littoralis will process such data only on Customer’s documented instructions.

8.14 Nothing in this clause relieves Littoralis of its own direct responsibilities and liabilities as a Data Processor under applicable data protection law.

9. Intellectual Property

9.1 Littoralis is the sole owner of all intellectual property rights in relation to Disc, including all software, code, documentation, and related materials. Customer acquires only a licence to use Disc as set out in clause 2 of this Agreement; no sale or transfer of ownership in any Littoralis intellectual property rights shall occur under this Agreement.

9.2 Customer retains all intellectual property rights in Customer Data.

9.3 Customer grants Littoralis a royalty-free, irrevocable, perpetual licence to use any feedback, suggestions, or ideas provided by Customer for the purpose of improving or enhancing the Service. Littoralis owns all resulting improvements and derivatives.

9.4 Where the Document Writing Service is purchased, Littoralis grants Customer a perpetual, non-exclusive licence to use the delivered policy documents, templates, and configurations internally within Customer’s organisation. Littoralis retains ownership of all background intellectual property and generic know-how.

10. Term and Renewal

10.1 The Service is available on the following subscription terms:

• quarterly (3 months);
• biannual (6 months);
• annual (12 months); and
• multi-year (as agreed in the Order).

10.2 The subscription automatically renews for successive periods of the same duration, subject to clause 7.2, unless either party provides written notice of non-renewal in accordance with clause 10.3.

10.3 To prevent automatic renewal, the party wishing to terminate must provide at least 30 days’ written notice before the end of the then-current Term.

10.4 Where Customer provides notice of termination for convenience, the termination date is the last day of the calendar month following the month in which notice is given. For example: notice given on 15 December results in termination on 31 January.

11. Termination

11.1 Customer may terminate the subscription at any time by providing written notice in accordance with clause 10.4. No refund of prepaid Fees shall be due.

11.2 Littoralis may terminate immediately if Customer materially breaches these Terms and fails to cure the breach within 14 days of written notice from Littoralis, or if the breach is incapable of cure.

11.3 Littoralis may terminate immediately upon Customer’s insolvency, administration, liquidation, or analogous proceedings, or upon Customer ceasing to trade.

11.4 Littoralis may terminate the subscription without cause by providing 90 days’ written notice to Customer.

11.5 Upon termination or expiry: all licences granted to Customer terminate immediately; Customer’s access to Disc is suspended; all outstanding Fees remain payable; and clauses that by their nature survive termination shall continue in force, including those relating to confidentiality, liability, intellectual property, and data protection.

12. Data Export and Deletion

12.1 During the Term, Customer may export Customer Data at any time using the self-service export tools available within Disc at no charge.

12.2 Within 30 days following termination or expiry of the Term, upon written request from Customer, Littoralis will deliver all Customer Data in encrypted CSV and image file format (zipped). Requests for alternative formats or assisted export services may be subject to reasonable additional charges.

12.3 Following receipt of confirmation that Customer has successfully received the exported data (or upon expiry of the 30-day export window if no export is requested), Littoralis will irreversibly delete all Customer Data from active production systems and schedule deletion from backup systems in accordance with standard retention cycles. No further retention of Customer Data shall occur unless required by applicable law or unless otherwise agreed in writing.

13. Acceptable Use and Customer Responsibilities

13.1 Customer and all Users must comply with the following:

• no illegal activity: Disc must not be used for any unlawful purpose, including breach of the Computer Misuse Act 1990 or any other applicable law;
• no unauthorised access: Users must not attempt to gain unauthorised access to Disc or any other system, or probe, scan, or test security vulnerabilities without Littoralis’ prior written consent;
• no credential sharing: each User must use only their own individual login; sharing credentials is strictly prohibited;
• no security circumvention: Users must not attempt to circumvent usage limits, security controls, or access restrictions;
• no malware or interference: Users must not introduce malware, viruses, or harmful code, engage in denial-of-service activity, or interfere with other customers’ use of Disc;
• no scraping or reverse engineering: Users must not scrape data, perform automated extraction, or reverse engineer Disc, except to the extent permitted by applicable law; and
• no unlawful content: Users must not upload unlawful, infringing, defamatory, or harmful content; Customer is responsible for ensuring all Customer Data complies with applicable law.

13.2 Customer is responsible for ensuring that all Users comply with this clause and all other terms of this agreement. Littoralis may suspend or terminate access for any User or Customer if Littoralis becomes aware of a breach of this clause.

14. Liability and Limitation

14.1 Littoralis’ aggregate liability to Customer in any 12-month period arising from or in connection with these Terms, the Service, or any related matter shall not exceed the total Fees paid by Customer to Littoralis in the 12 months preceding the event giving rise to the claim.

14.2 Littoralis shall not be liable for:

• indirect or consequential loss;
• loss of profits, revenue, business, or goodwill;
• loss of data (subject to Customer’s right to export data as set out in clause 12); or
• any other loss or damage that does not directly result from Littoralis’ breach.

14.3 Nothing in this clause limits Littoralis’ liability for:

• death or personal injury caused by negligence;
• fraud or fraudulent misrepresentation; or
• any liability that cannot lawfully be limited or excluded under applicable law.

15. Indemnity

15.1 Customer shall indemnify, defend, and hold harmless Littoralis from and against all losses, costs, damages, and expenses (including reasonable legal costs) arising from:

• Customer’s or any User’s misuse of Disc;
• Customer’s breach of these Terms or applicable law;
• any claim arising from Customer Data, including claims of infringement, unlawfulness, or breach of third-party rights; or
• Customer’s violation of the Acceptable Use Policy in clause 13.

16. Confidentiality

16.1 Each party shall keep the other’s confidential information confidential and shall not disclose it to third parties except to employees and contractors who need to know it for the purpose of performing the contract and who are bound by confidentiality obligations no less protective than this clause.

16.2 Confidential information may be disclosed if required by law, court order, or regulatory authority, provided that the disclosing party gives prompt notice to the other party to allow it to seek protective measures where permitted by law.

17. Force Majeure

17.1 Neither party shall be liable for any failure or delay in performance caused by events or circumstances beyond its reasonable control, including acts of God, war, terrorism, natural disaster, pandemic, or government action. The affected party shall use reasonable efforts to mitigate the impact and resume performance as soon as reasonably practicable.

18. Governing Law and Jurisdiction

18.1 These Terms and Conditions are governed by and construed in accordance with the laws of England and Wales.

18.2 The parties irrevocably submit to the exclusive jurisdiction of the courts of England and Wales.

19. Notices

19.1 Any notice required under these Terms must be in writing and delivered by email to the contact address designated by the receiving party, or by post to the address set out in clause 19.2.

19.2 The address for notices to Littoralis is: Littoralis Limited, Suite 70, 26 The Hornet, Chichester, West Sussex PO19 7BB, United Kingdom.

19.3 Notices are deemed received on the next Business Day following dispatch, unless the sending party receives a delivery failure notification.

20. General Provisions

20.1 These Terms and Conditions, together with the Order and any referenced documents, constitute the entire agreement between the parties and supersede all prior negotiations, understandings, and agreements, whether written or oral.

20.2 In the event of conflict between documents, the following order of precedence applies: (1) the Order (including any bespoke terms); (2) these Terms and Conditions; (3) any referenced schedules or attachments; except that data protection obligations under applicable law and clause 8 shall prevail in respect of the processing of personal data.

20.3 Littoralis may amend these Terms and Conditions at any time by providing 30 days’ written notice to Customer. Continued use of Disc following the notice period constitutes acceptance of the amended terms. If Customer does not accept the amendment, Customer may terminate the subscription in accordance with clause 10.

20.4 If any provision of these Terms is found to be invalid or unenforceable, that provision shall be severed and the remaining provisions shall continue in full force and effect.

20.5 No waiver of any provision or right under these Terms shall be effective unless in writing and signed by the waiving party. Waiver of any breach shall not constitute waiver of any subsequent breach.

20.6 Customer shall not assign, transfer, or delegate any rights or obligations under these Terms without Littoralis’ prior written consent. Littoralis may assign these Terms to any successor or affiliate without consent.

20.7 These Terms do not confer any rights on any third party, and no third party may enforce any provision under the Contracts (Rights of Third Parties) Act 1999.

Last updated: 8^th May 2026

---