AdvantaISO Limited · Company No. 14929611 · Version 2.0
This Licence Agreement ("Agreement") is made between AdvantaISO Limited, a company registered in England and Wales under company number 14929611, whose registered office is at Lakeview House, 4 Woodbrook Crescent, Billericay, Essex, CM12 0EQ ("AdvantaISO", "we", "us", "our"), and the Customer identified in the Order ("Customer", "you").
This Agreement governs the Customer's access to and use of the AdvantaISO platform, including all modules, features, documentation and associated services (collectively, the "Platform").
By accessing or using the Platform, the Customer agrees to be bound by this Agreement.
"Authorised User" means any employee or authorised personnel of the Customer who is granted access to the Platform.
"Customer Data" means all data, documents and information uploaded to or processed through the Platform by the Customer or its Authorised Users.
"Order" means the order form or agreement specifying the modules, number of Authorised Users and applicable fees.
"Platform" means the AdvantaISO cloud-based compliance management system, including the ISO 27001 module, ISO 9001 module and Security Assessment module, accessible via web browser at advantaiso.com and associated subdomains.
"Subscription Term" means the period specified in the Order, typically twelve (12) months, during which the Customer has access to the Platform.
Subject to the Customer's compliance with this Agreement and payment of applicable fees, AdvantaISO grants the Customer a non-exclusive, non-transferable, limited licence to access and use the Platform solely for the Customer's internal business purposes during the Subscription Term.
Access is limited to the number of Authorised Users specified in the Order. The Customer must ensure each Authorised User:
The Customer must not, and must ensure Authorised Users do not:
AdvantaISO will use commercially reasonable efforts to make the Platform available 24 hours a day, 7 days a week, except for scheduled maintenance and circumstances beyond our reasonable control.
AdvantaISO provides support via email at [email protected], Monday to Friday 9:00am to 5:30pm (excluding UK bank holidays).
AdvantaISO implements and maintains appropriate technical and organisational security measures to protect the Platform and Customer Data, including encrypted connections (TLS), access controls, multi-factor authentication capability and regular security assessments.
The Platform supports multi-factor authentication (MFA) using time-based one-time passwords (TOTP). AdvantaISO strongly recommends that all Authorised Users enable MFA. AdvantaISO may make MFA mandatory at its discretion.
Upon account creation, Authorised Users are issued a secure temporary password and required to change it on first login.
The Customer is responsible for ensuring access is limited to Authorised Users, that credentials are kept confidential, and that any suspected unauthorised access is reported to AdvantaISO promptly.
The Customer retains all right, title and interest in and to its Customer Data. AdvantaISO acquires no ownership rights in Customer Data.
Each Customer's data is logically isolated within the Platform. Authorised Users of one Customer organisation cannot access the data of another Customer organisation.
AdvantaISO will retain Customer Data for a period of two (2) years from the date of last submission. After this period, data will be permanently deleted.
When an Authorised User deletes a record within the Platform, that record is initially placed in a recovery state for up to thirty (30) days, during which it may be restored by AdvantaISO upon written request. After thirty (30) days, deleted records may be permanently removed.
The Platform maintains an activity log recording actions performed by Authorised Users, including logins, logouts, failed login attempts, and data creation, modification and deletion events. The Customer acknowledges and consents to this logging on behalf of its Authorised Users.
The Customer shall pay the fees set out in the Order. Fees are in pounds sterling, exclusive of VAT. Invoices are payable within thirty (30) days. Late payment may result in suspension of access.
Fees are fixed for the initial Subscription Term. Upon each annual renewal, AdvantaISO reserves the right to increase the applicable fees by the greater of (a) 5% or (b) the percentage change in the UK Consumer Price Index (CPI) as published by the Office for National Statistics for the preceding 12-month period. Any such increase will be notified to the Customer in writing no less than 60 days prior to the renewal date. Continued use of the Platform following the renewal date constitutes acceptance of the revised fees.
TO THE MAXIMUM EXTENT PERMITTED BY LAW, ADVANTAISO'S TOTAL AGGREGATE LIABILITY SHALL NOT EXCEED THE TOTAL FEES PAID BY THE CUSTOMER IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM. ADVANTAISO SHALL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL OR CONSEQUENTIAL DAMAGES. NOTHING IN THIS AGREEMENT LIMITS LIABILITY FOR DEATH OR PERSONAL INJURY CAUSED BY NEGLIGENCE OR FRAUD.
This Agreement commences on the start date in the Order and continues for the Subscription Term. Unless the Customer provides written notice of termination at least ninety (90) days before the end of the Subscription Term, this Agreement will automatically renew. On termination, AdvantaISO will provide the Customer with at least thirty (30) days to export Customer Data before permanent deletion.
This Agreement is governed by the laws of England and Wales. The parties submit to the exclusive jurisdiction of the courts of England and Wales.
This Schedule sets out the parties' obligations in respect of personal data processed in connection with the Platform, in accordance with the UK GDPR and the Data Protection Act 2018.
Roles: The Customer is the data controller. AdvantaISO is the data processor.
Personal data processed: Names, email addresses, job titles, login activity records (including IP addresses and timestamps) and other data uploaded by the Customer.
AdvantaISO shall:
Data retention: Customer Data is retained for two (2) years. Soft-deleted records are retained for up to thirty (30) days. Following termination, data is retained for thirty (30) days to allow export, then permanently deleted.
International transfers: All Customer Data is stored within the United Kingdom.