Cambition IT Services Limited — Terms and Conditions

Last updated: 22 October 2026

Download: Terms and Conditions (PDF) · Data Protection Terms (PDF)

Cambition IT Services Limited. Registered in England and Wales, company number 08084429. Registered office: 6th Floor, Amp House, Dingwall Road, Croydon CR0 2LX. Trading address: Unit 7, Church Meadows, Haslingfield Road, Barrington, Cambridge CB22 7RG. VAT number 136 186 313. Email: ambitious@cambition.co.uk. Telephone: 01223 656 156.

Agreement

By this Agreement Cambition IT Services Limited (company number 08084429) whose registered office is at 6th Floor, Amp House, Dingwall Road, Croydon CR0 2LX (Cambition) agrees to provide the Services described in the Particulars to the Client named in the Particulars, and the Client agrees to accept those Services, pay the Charges and comply with these Terms and Conditions.

Cambition supplies its Services only to businesses, and not to consumers. The Client confirms that it enters into this Agreement for the purposes of its trade, business or profession. All prices are stated exclusive of VAT.

The Particulars are the separate order, quotation, proposal or other commercial document issued by Cambition that identifies the Client, the Products, the Charges and the term. These Terms and Conditions do not themselves list what a Client is buying.

Related documents: Cambition's Privacy and Cookie Notice (https://cambition.co.uk/privacy/) explains how Cambition handles personal data as a controller; the current list of sub-processors is at https://cambition.co.uk/sub-processors/; and the data protection terms that apply when Cambition processes personal data for the Client are in conditions 11, 11A and 11B and Schedule 3.

If there is a conflict, the following order applies: (a) conditions 11, 11A and 11B and Schedule 3, on data protection matters; (b) the Particulars; (c) Schedule 4 and any other Supplementary Terms; (d) the rest of these Terms and Conditions. Condition 2A.3 governs conflicts with Vendor Terms.

Notices to Cambition should be sent in accordance with condition 15.

1. Interpretation

1.1 Words defined in the Particulars have those meanings. In these Terms and Conditions:

Agreement means the contract formed by the Particulars, these Terms and Conditions (including the Schedules) and any applicable Supplementary Terms.

Approved AI Tools means Grok (xAI's Grok Business, Grok Enterprise or the xAI API) and Grok Bot, as described in condition 11A, including any successor xAI service notified under condition 11.7.

Bribery Act means the Bribery Act 2010.

Business Day means a day other than a Saturday, Sunday or public holiday in England, excluding 24 December to 1 January inclusive.

Business Hour means an hour within Normal Business Hours.

Cambition Portal means Cambition's proprietary CRM, customer portal and ticketing platform at crm.cambition.co.uk (a PSA / ITSM platform).

Charges means the charges in the Particulars.

Client Data means Data, Confidential Information and Personal Data of the Client.

Commencement Date means the date stated in the Particulars or, if none is stated, the date Cambition first provides the Services.

Confidential Information has the meaning in condition 10.

Configuration Services means configuration, onboarding or project work specified in the Particulars or an annexe to them.

Customers means customers of the Client whom the Client authorises to use the Software.

Data means data input into the Software or other Services by the Client, its Personnel or Customers, or by Cambition on the Client's behalf.

Data Protection Legislation means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), in each case as amended by the Data (Use and Access) Act 2025, and any successor UK data-protection law.

Deliverables means documents, scripts, automations, configurations, reports, website content and other materials Cambition creates for the Client under the Particulars.

Device Health Report means a report Cambition produces for the Client summarising the health, patch and security status of devices, using data from the tools in condition 11B.

GDAP means Microsoft's granular delegated admin privileges, which let Cambition administer the Client's Microsoft tenant through Microsoft Partner Center within the roles and duration the Client approves.

Giacom means the relevant Giacom Group company listed at giacom.com/company-details with registered office at 41 Lothbury, London EC2R 7HF.

Grok Bot means the AI assistants operated by Cambition using xAI models and hosted on infrastructure provided by Anysphere, Inc., as described in condition 11A.

Hosting Charges means the Charges for Hosting Services.

Hosting Services means the services that allow authorised users to access the Software or other Products that Cambition itself hosts, including website hosting on Cambition's WHM/cPanel servers.

Intellectual Property Rights means patents, copyright, database rights, rights in software, trade marks, design rights, rights in confidential information and all similar rights anywhere in the world.

Normal Business Hours means 09:00 to 17:30 UK time on Business Days.

Particulars means the order, quotation, proposal or other commercial document issued by Cambition that identifies the Client, the Products, the Charges and the term for that Client.

Personal Data, Personal Data Breach, controller, processor, process, sub-processor, restricted transfer and data subject have the meanings in Data Protection Legislation.

Personnel means officers, employees, consultants, contractors and advisers of the relevant party.

Product means a service or software item named on the Particulars.

Relevant Requirements means all applicable laws on anti-bribery and anti-corruption, including the Bribery Act.

Services means the Products and related work Cambition agrees to provide under the Particulars, including Configuration Services, Hosting Services, maintenance and Technical Support Services as applicable.

Software means the Cambition Portal and any other Cambition software licensed under condition 2.

Software Specification means the description of the Software's functions in the Particulars or in documentation Cambition makes available to the Client.

Supplementary Terms means Schedule 4 and any other Product-specific terms attached to or referred to in the Particulars.

Term means the period from the Commencement Date until this Agreement ends under condition 14.

Third Party Service means a Product supplied by a vendor and resold or provisioned by Cambition.

Third-Party Fees means fees charged by third parties (other than for Third Party Services listed in the Particulars) which the Client approves in advance.

UK GDPR has the meaning given in section 3(10) of the Data Protection Act 2018.

Vendor Terms means the vendor's then-current terms for a Third Party Service, including Giacom Service Specific Terms, the Microsoft Customer Agreement, the N-able Software Services Agreement, SentinelOne's terms, Acronis's, Bitdefender's and Exclaimer's terms and Gladinet's hosted terms.

1.2 Headings do not affect interpretation. A person includes a body corporate. Words in the singular include the plural. A reference to a statute is to that statute as amended or replaced. Including means including without limitation.

1.3 Writing includes email. Notices are given and deemed received as set out in condition 15.

2. Software licence

2.1 Cambition grants the Client a non-exclusive, non-transferable licence for its Personnel and Customers to access and use the Software (including the Cambition Portal, its ticketing and Device Health Reports) through the Hosting Services solely for the Client's internal business purposes during the Term. The licence ends when this Agreement ends.

2.2 Access is by unique credentials. Credentials must be kept confidential. The Client is responsible for use made with its credentials, except unauthorised use caused by Cambition's Personnel or the Approved AI Tools.

2.3 The Client shall notify Cambition immediately (by raising a ticket and, for urgent matters, by telephone) if it knows or suspects credentials have been compromised.

2.4 The Client shall not: (a) store or transmit unlawful, harmful, defamatory, obscene or infringing material through the Services; (b) abuse, disrupt or attack the Services; (c) copy, modify or distribute the Software; (d) reverse engineer the Software except as a law that cannot be excluded allows; (e) use the Software to provide a bureau service to third parties; (f) transfer its rights; (g) obtain unauthorised access; or (h) use the Software or Cambition's materials (other than the Client's own Data) to train or fine-tune a foundation model or other general-purpose AI model.

2.5 Cambition may enter similar agreements with other clients and independently develop similar services.

2A. Third Party Services

2A.1 Some Products are supplied by a third-party vendor and resold or provisioned by Cambition. Cambition's key suppliers are:

(a) Giacom, through Giacom Cloud Market, including Microsoft 365, Azure, Exchange Online, Exclaimer, Bitdefender and Acronis (including Acronis Microsoft 365 backup), where those Products are on the Particulars;

(b) Microsoft, whose services Cambition administers through Microsoft Partner Center using GDAP and, for Azure (including Azure Plan), Azure Lighthouse where that is on the Particulars;

(c) N-able Technologies Ltd and N-able Solutions ULC, for N-central (N-able hosted cloud) and the SentinelOne EDR bolt-on;

(d) Gladinet, Inc., for CentreStack Online hosted on Amazon Web Services in the United States; and

(e) for VoIP One hosted telephony, the PortSIP software platform and the hosting and telephone-network (carrier) providers Cambition uses for that service.

2A.2 Use of a Third Party Service is also subject to the Vendor Terms identified on the Particulars or accepted when the Product is provisioned. The Client shall accept the Microsoft Customer Agreement before Microsoft services are provisioned.

2A.3 If the Vendor Terms and this Agreement conflict on licence, acceptable use, vendor service levels, data location or cancellation of that Product, the Vendor Terms prevail for that Product only. This Agreement prevails on fees payable to Cambition, Cambition's support, Cambition's liability cap and termination of Cambition's Services.

2A.4 The Client shall not use a Product in a way that puts Cambition in breach of its contract with Giacom or the vendor. Microsoft New Commerce Experience seat terms, mid-term reductions and Azure consumption billed in arrears follow the Vendor Terms. Where a Product has a committed term, Cambition remains liable to Giacom or the vendor for that term even if the Client stops paying, and the Client remains liable to Cambition for the fees for the rest of that committed term.

2A.5 Cambition is not the vendor and does not warrant the vendor's product beyond this Agreement. Vendor downtime is not a breach of Schedule 1 except to the extent Schedule 1 says otherwise.

2A.6 A Product listed in this condition applies only if it is named on the Particulars.

2A.7 Delegated access. Cambition shall request only the GDAP roles (and, for Azure, Azure Lighthouse permissions) reasonably needed for the Services, for a limited duration, and shall renew them only with the Client's approval. The Client may review or remove that access at any time in its Microsoft admin portals, but Cambition is not responsible for any Service it cannot then provide. Cambition shall remove its GDAP relationships and Azure Lighthouse delegations on termination, after any agreed handover under condition 14.5.

3. Maintenance services

3.1 Cambition shall provide release management and change control for the Software and the Hosting Services it operates, and shall implement new releases and patches as it reasonably considers necessary. Code changes to the Cambition Portal are tested before release and are released only with human approval.

3.2 Cambition shall keep service interruptions to a minimum and shall use reasonable efforts to avoid unscheduled downtime.

3.3 Maintenance includes scheduled error corrections and updates to features in the Software Specification. Additional features requested by the Client may be charged separately.

3.4 Maintenance of a Third Party Service is performed by the vendor under the Vendor Terms. Cambition shall pass on vendor maintenance notices that affect the Client where it is reasonably able to do so.

4. Technical support services

4.1 Cambition shall provide the Technical Support Services in Schedule 2 during Normal Business Hours, unless the Particulars specify otherwise.

4.2 All support requests are logged as tickets in the Cambition Portal so that each request has a record and an owner. Tickets may be triaged with the help of the Approved AI Tools under condition 11A.

5. Service levels and service-specific terms

5.1 Schedule 1 applies from the start of the month after the later of: (a) the Commencement Date; and (b) satisfactory completion of any Configuration Services named on the Particulars. Where there are no Configuration Services, Schedule 1 applies from the Commencement Date.

5.2 Schedule 4 contains additional terms for particular Products. Each part of Schedule 4 applies only if the relevant Product is on the Particulars.

6. Client's obligations

6.1 The Client shall give Cambition timely co-operation, access to premises, systems and information reasonably required to provide the Services, and shall ensure that information it supplies is accurate.

6.2 The Client shall prepare its premises and systems at its own cost, appoint a named contact with authority to bind the Client and approve changes, keep contact details current, and comply with applicable law.

6.3 The Client shall obtain any consent it needs from, and give any notice required to, its Personnel and Customers for Cambition to provide the Services, including the tools in condition 11B and the use of the Approved AI Tools in condition 11A.

6.4 The Client shall not, during the Term and for six months after, solicit Cambition's employees or contractors who have worked on the Services, except as a result of a genuine public recruitment campaign. If the Client hires such a person in breach of this condition, it shall pay Cambition a sum equal to 20% of that person's first year's remuneration, which the parties agree is a genuine pre-estimate of Cambition's recruitment and training costs.

6.5 The Client shall comply with condition 13.

6.6 The Client is responsible for: (a) maintaining appropriate licences for its users; (b) the security practices of its own Personnel, including using multi-factor authentication where Cambition recommends it; (c) approving maintenance windows and reboots reasonably requested by Cambition; and (d) keeping its own copies of any data that is outside the scope of the backup Products on the Particulars.

7. Cambition's obligations

7.1 Cambition shall provide the Services with reasonable care and skill and in material accordance with the Particulars.

7.2 Deliverables for Configuration Services shall be provided as set out in the Particulars or the annexe to them.

7.3 Cambition warrants that it has the right to grant the licence in condition 2. If the Software does not materially conform to the Software Specification, Cambition's obligation is to use reasonable efforts to correct the non-conformity. That is the Client's exclusive remedy for breach of this warranty. Cambition does not warrant that use of the Software will be uninterrupted or error-free.

7.4 Cambition does not warrant that security, monitoring or backup Services will prevent every cyber attack, malware infection, outage or data loss. They reduce risk; they do not remove it.

8. Charges and payment

8.1 Charges are as set out in the Particulars. Recurring Charges are invoiced monthly in advance unless the Particulars say otherwise. Azure and other consumption Products are invoiced in arrears when the vendor bills Cambition.

8.2 Time-and-materials work is charged at the rates in the Particulars, based on time recorded against the Client's tickets.

8.3 Third-Party Fees approved in advance are payable in addition to Cambition's Charges. Cambition shall provide supporting documentation.

8.4 Charges are exclusive of VAT, which the Client shall pay at the applicable rate.

8.5 Invoices are payable within 30 days of the invoice date unless the Particulars say otherwise.

8.6 If a sum is overdue, Cambition may claim statutory interest under the Late Payment of Commercial Debts (Interest) Act 1998 (currently 8% a year above the Bank of England base rate) from the due date until payment, together with the fixed-sum compensation and reasonable recovery costs that Act allows.

8.7 On termination, all invoiced sums become due immediately, together with Charges for Services provided but not yet invoiced and any committed Third Party Service fees payable under condition 2A.4.

8.8 The Client shall pay without set-off, counterclaim or deduction, except as required by law.

8.9 Cambition may suspend Services for non-payment after giving not less than 7 days' written notice. Before suspending security monitoring, endpoint protection or backup Services, Cambition shall give the Client a final written warning, not less than 7 days in advance, that those protections will stop.

8.10 Cambition may change Charges for Third Party Services on not less than 30 days' written notice to reflect a change in the vendor's or Giacom's price. Cambition may change its other Charges by giving not less than 90 days' written notice.

8.11 If the Client disputes an invoice in good faith, it shall tell Cambition in writing within 14 days of the invoice date, giving reasons, and shall pay the undisputed part on time.

9. Intellectual property

9.1 Cambition and its licensors own the Intellectual Property Rights in the Software, the Hosting Services and Cambition's materials, tools, templates and know-how. The Client owns the Intellectual Property Rights in Client Data.

9.2 The Client grants Cambition a licence to use Client Data solely to provide and administer the Services, including through the Approved AI Tools under condition 11A.

9.3 Cambition shall indemnify the Client against a claim that the Software infringes a third party's Intellectual Property Rights in the United Kingdom, subject to the Client giving prompt notice, sole conduct of the defence and reasonable co-operation. Cambition may modify the Software, procure a licence, or terminate the affected Service and refund prepaid unused Charges. This indemnity is subject to condition 12.

9.4 The indemnity does not apply to infringement caused by the Client's modification, combination with other software, or use outside this Agreement.

9.5 Conditions 9.3 and 9.4 are the Client's exclusive remedy for infringement of third-party Intellectual Property Rights by the Software.

9.6 Deliverables. Once the Client has paid for them in full, Intellectual Property Rights in Deliverables created specifically for the Client vest in the Client. Cambition keeps the Intellectual Property Rights in its pre-existing and reusable materials, tools and templates, including any incorporated in a Deliverable, and grants the Client a perpetual, non-exclusive, royalty-free licence to use them as part of that Deliverable for its internal business purposes.

9.7 Where the Approved AI Tools help produce a Deliverable, it is reviewed by Cambition's Personnel before delivery and condition 11A.8 applies.

10. Confidentiality

10.1 Each party shall keep the other's Confidential Information confidential and use it only to perform this Agreement.

10.2 Confidential Information includes the Software, Charges, Client Data, and information marked confidential or that ought reasonably to be considered confidential.

10.3 The obligation does not apply to information that is public other than by breach, already lawfully in the recipient's possession, independently developed, or required to be disclosed by law or a competent authority. Where disclosure is required by law, the recipient shall (if lawful) give the other party as much notice as reasonably practicable.

10.4 Cambition may disclose Confidential Information to its Personnel, sub-processors (including the providers of the Approved AI Tools, subject to condition 11A) and professional advisers who need it to perform this Agreement and who are bound by confidentiality.

10.5 This condition survives termination for five years, and indefinitely for trade secrets.

11. Data protection

11.1 Both parties shall comply with Data Protection Legislation. This condition 11 is in addition to, and does not relieve either party of, its obligations under Data Protection Legislation.

11.2 Schedule 3 sets out the subject-matter, duration, nature and purpose of the processing, the types of Personal Data, the categories of data subject, the sub-processors and the international transfers. Cambition's Privacy and Cookie Notice at https://cambition.co.uk/privacy/ explains how Cambition handles personal data where it is a controller (for example website visitors, enquiries and business contacts). The Privacy and Cookie Notice does not form part of this Agreement.

11.3 For Personal Data processed in providing the Services, the Client is the controller and Cambition is the processor. Where the Client is itself a processor for a third party, Cambition acts as the Client's sub-processor and the Client warrants that it has the authority needed for Cambition to do so. Cambition is a controller of Personal Data it processes to run its own business, including account management, invoicing and accounts (kept in Xero), its own staff and payroll records, and business-to-business marketing as described in the Privacy and Cookie Notice. Cambition shall never use Personal Data it processes as the Client's processor for its own marketing.

11.4 Cambition shall process Personal Data only on the Client's documented instructions, including this Agreement, the Particulars and tickets raised by the Client's authorised contacts, unless UK law requires otherwise. In that case Cambition shall tell the Client of that legal requirement before processing, unless the law prohibits this. Cambition shall tell the Client promptly if, in its opinion, an instruction infringes Data Protection Legislation.

11.5 Cambition shall: (a) ensure that persons authorised to process Personal Data are bound by confidentiality and have access only to the extent they need it; (b) take appropriate technical and organisational measures under Article 32 of the UK GDPR, including those in paragraph 3.15 of Schedule 3; (c) taking into account the nature of the processing and the information available to it, assist the Client by appropriate technical and organisational measures with data-subject requests, and with the Client's obligations on security, personal data breaches, data protection impact assessments and prior consultation with the Information Commission (formerly the Information Commissioner's Office, ICO); (d) delete or return Personal Data on termination in accordance with condition 11.13 and Schedule 3; (e) make available to the Client all information necessary to demonstrate compliance with Article 28 of the UK GDPR and allow for and contribute to audits, including inspections, under condition 11.12; and (f) notify the Client of a Personal Data Breach in accordance with condition 11.11.

11.6 The Client warrants that it has a lawful basis, and has given all notices and obtained all consents needed, for Cambition to process Personal Data as described in this condition 11, conditions 11A and 11B and Schedule 3, including the transfers and sub-processors listed there, and that its instructions comply with Data Protection Legislation.

11.7 The Client gives Cambition general authorisation to appoint the sub-processors listed in Schedule 3 and on the live sub-processor page at https://cambition.co.uk/sub-processors/. Cambition shall give the Client not less than 30 days' written notice (by email to the Client's contact in the Particulars and by updating the sub-processor page) of any intended addition or replacement of a sub-processor, except where an urgent change is needed to keep the Services running or secure, in which case Cambition shall notify the Client as soon as practicable. The Client may object in writing within the notice period on reasonable data-protection grounds. The parties shall then discuss the objection in good faith. If they cannot resolve it within 30 days, the Client may terminate the affected Service by written notice without paying any early-termination charge to Cambition, but the Client remains liable for committed Third Party Service fees under condition 2A.4 (for example annual Microsoft 365 subscriptions) until the end of their commitment period. Cambition shall impose on each sub-processor, by written contract, data protection obligations that give no less protection than this condition 11 (in particular sufficient guarantees of appropriate technical and organisational measures), and remains fully liable to the Client for each sub-processor's performance of those obligations.

11.8 Cambition shall not use Personal Data to make a decision based solely on automated processing that produces legal or similarly significant effects concerning an individual, except where Data Protection Legislation permits it and the safeguards in Articles 22A to 22D of the UK GDPR are applied. The Approved AI Tools are not used to make such decisions; their use is subject to the human oversight in condition 11A.5.

11.9 Cambition may update Schedule 3 (including the sub-processor table) on not less than 30 days' written notice to reflect a change of sub-processor, hosting location or law, provided the update gives the Client no less protection. A sub-processor change is also subject to condition 11.7. Any other change to this condition 11 requires a variation under condition 17.2.

11.10 International transfers. Cambition shall not make, or permit a sub-processor to make, a restricted transfer of Personal Data outside the United Kingdom unless: (a) the transfer is to a country, territory or sector covered by UK adequacy regulations (including, for a recipient in the United States certified under it, the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge)); or (b) the transfer meets the data protection test in UK law and is covered by an appropriate safeguard, namely the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or another mechanism approved under Data Protection Legislation. Cambition shall keep a record of the safeguard used for each transfer and of its assessment of the data protection test, and shall give the Client a summary on request (commercially sensitive terms may be removed). The transfers that Cambition currently makes are listed in paragraphs 3.7 and 3.9 of Schedule 3.

11.11 Personal Data Breach. Cambition shall notify the Client without undue delay after becoming aware of a Personal Data Breach affecting Client Personal Data. The notice shall include, so far as then known: (a) the nature of the breach, including the categories and approximate number of data subjects and records concerned; (b) the likely consequences; (c) the measures taken or proposed to address the breach and mitigate its effects; and (d) a contact point at Cambition. Where not all information is available at once, Cambition shall provide it in phases without undue further delay. Cambition shall co-operate with the Client and take reasonable steps to contain and investigate the breach. Cambition shall not notify the Information Commission or affected data subjects on the Client's behalf unless the Client instructs it to or the law requires it. Notification is not an admission of fault or liability.

11.12 Audit and inspection. In addition to the information made available under condition 11.5(e), the Client (or an independent auditor appointed by the Client who is not a competitor of Cambition and is bound by confidentiality) may audit and inspect Cambition's compliance with this condition 11, including by inspecting relevant premises, systems, records and Personnel, on giving not less than 30 days' written notice. Audits shall take place during Normal Business Hours, no more than once in any 12-month period (except after a Personal Data Breach or where the Information Commission or another competent authority requires it), and in a way that minimises disruption to Cambition's business and protects the confidentiality of other clients' data. Cambition may first offer documents (such as policies, records of processing, certificates it holds and sub-processor audit reports) and the Client shall consider in good faith whether they are sufficient. For sub-processors, Cambition shall make available the audit reports and certifications the sub-processor provides. The Client shall pay for the time Cambition's Personnel spend preparing for and supporting an audit or inspection, at the rates in the Particulars, and each party otherwise bears its own costs.

11.13 Return and deletion. On termination or expiry of the relevant Service, Cambition shall, at the Client's written choice, return Client Personal Data in a commonly used format or delete it, within the period in paragraph 3.12 of Schedule 3, unless UK law requires it to be kept. Copies in routine backups shall be deleted as those backups expire under their normal retention cycle and shall be kept confidential and not actively processed in the meantime.

11.14 Records and co-operation. Cambition shall keep a record of processing activities carried out on the Client's behalf as required by Article 30(2) of the UK GDPR and shall co-operate, on request, with the Information Commission in the performance of its tasks.

11.15 Data protection contact. Cambition's data protection lead is Jamie Stuart, Managing Director, who can be contacted at ambitious@cambition.co.uk or on 01223 656 156. Cambition has not appointed a formal data protection officer because the law does not require it to.

11A. Artificial intelligence tools

11A.1 Which tools. The only generative artificial intelligence tools Cambition uses with Client Data are the Approved AI Tools: Grok (xAI's Grok Business, Grok Enterprise or the xAI API, provided by X.AI LLC) and Grok Bot (AI assistants operated by Cambition using xAI models and running on infrastructure provided by Anysphere, Inc.). Cambition shall not use any other generative AI system with Client Data without the Client's prior written consent. This does not apply to machine-learning or AI features built into a Third Party Service the Client has ordered (for example SentinelOne threat detection), which are governed by the Vendor Terms and condition 11B.

11A.2 What the Approved AI Tools do. Grok Bot assistants act on Cambition's behalf and may, within the limits in conditions 11A.3 to 11A.5: (a) triage, categorise and summarise tickets, and suggest responses; (b) read and update records in the Cambition Portal; (c) carry out administrative tasks in the Client's Microsoft 365 tenant through the GDAP roles the Client has approved, and in Azure through Azure Lighthouse where that is on the Particulars; (d) carry out monitoring, patching and security actions in N-central and SentinelOne; (e) draft (but not send) emails and other messages to the Client; (f) prepare Device Health Reports; (g) carry out bookkeeping in Cambition's own Xero accounts, which include the Client's billing details; (h) make changes to Cambition's website; and (i) prepare code changes to the Cambition Portal, which are reviewed by a separate testing Grok Bot and released only with human approval.

11A.3 What data they may access. The Approved AI Tools may access Client Data only to the extent necessary to perform the Services and administer the Client's account, and for the same purposes as Cambition's Personnel. That may include: ticket content (including emails the Client sends to Cambition's ticket address) and attachments; Cambition Portal records; Microsoft 365 and Azure tenant, directory, user, licence, configuration and audit-log data available through GDAP or Azure Lighthouse; device, patch and security data from N-central and SentinelOne; and billing data. Cambition does not allow the Approved AI Tools, or any other AI application, to read the content of the Client's mailboxes. The only application Cambition authorises to access mailbox content is Acronis Cloud Backup, which uses the Microsoft Graph Mail.ReadWrite permission solely to back up and restore mailboxes where Microsoft 365 backup is on the Particulars. Cambition shall not store Client credentials in Grok Bot except where reasonably necessary to perform the Services, and then only with access control, least-privilege permissions and logging.

11A.4 No training on Client Data. Cambition shall: (a) use only a business, enterprise or API tier of the Approved AI Tools whose provider terms prohibit training on customer content, and shall not use a consumer or personal account (including Grok on X or a personal SuperGrok account) with Client Data; (b) enable Privacy Mode, or the equivalent no-training setting, on Grok Bot and keep it enabled; (c) not accept provider credits or any other benefit in exchange for permitting training on Client Data; and (d) not itself, and contractually require the providers of the Approved AI Tools not to, use Client Data to train, fine-tune or otherwise improve any foundation model or general-purpose AI model, use Client Data to develop or improve products or services offered to third parties, or retain Client Data for any purpose other than providing the Services and related administration, security, abuse-monitoring and support, except where the law requires retention.

11A.5 Human oversight. Cambition's Personnel supervise the Approved AI Tools. A named member of Cambition's Personnel (the Managing Director or an authorised engineer) must review and approve, before it takes effect: (a) any action that is irreversible or cannot readily be undone, including deleting users, mailboxes, data, devices or backups; (b) any action with legal effect, including agreeing or varying contract terms; (c) any financial action, including placing or cancelling orders, changing licence quantities, issuing credits or making payments; and (d) the release of code changes to the Cambition Portal. Emails and other messages to the Client or third parties are sent by Cambition's Personnel, not by the Approved AI Tools. On reasonable request, Cambition shall give the Client information about actions taken by the Approved AI Tools in the Client's systems.

11A.6 Retention. The providers' retention periods are in paragraph 3.13 of Schedule 3. Grok Bot may keep files, session state and memory relating to the Client in its hosted environment for the life of the Agreement, only for the purpose of performing the Services, and shall delete them within 90 days after the Agreement ends, unless the law requires them to be kept.

11A.7 International transfers. X.AI LLC and Anysphere, Inc. process Personal Data in the United States. Each transfer is a restricted transfer under condition 11.10 and is made under the UK IDTA or the UK Addendum to the EU Standard Contractual Clauses incorporated into that provider's data processing terms, after Cambition has assessed the data protection test.

11A.8 Responsibility. Outputs of the Approved AI Tools are assistive. Cambition remains responsible to the Client for acts and omissions of the Approved AI Tools as if they were carried out by its own Personnel, and the limits in condition 12 apply in the same way.

11A.9 X.AI LLC and Anysphere, Inc. are sub-processors under condition 11.7 and are listed in Schedule 3.

11A.10 Transparency. On request, Cambition shall tell the Client which Approved AI Tools are used on its account and for what. The Client may, by written notice at any time and at no extra cost, ask Cambition not to use the Approved AI Tools on its account, or not to give Grok Bot access to its Microsoft 365 tenant or other systems. Cambition's Personnel shall then carry out that work manually. Manual handling may mean that some requests take longer to respond to or complete, and the targets in Schedule 2 continue to apply.

11A.11 Client use of AI. The Client shall not enter Cambition's Confidential Information, or credentials Cambition provides, into a publicly available or consumer-tier AI service. The Client's own choice of AI tools for its own business is the Client's decision as controller. AI and automation projects that Cambition delivers for the Client are governed by the Particulars and paragraph 4.8 of Schedule 4.

11A.12 This condition 11A does not limit conditions 10 or 11.

11B. Monitoring, security, backup and file-access tools

11B.1 To provide the Services, Cambition may install and operate monitoring, security, backup and file-access software on devices, tenants and systems covered by the Particulars. This includes N-able N-central (hosted by N-able, not on Cambition's own servers), the SentinelOne endpoint agent that forms part of Cambition's EDR service, Bitdefender, Acronis (including Microsoft 365 backup), Exclaimer and Gladinet CentreStack, where those Products are on the Particulars.

11B.2 The Client authorises that installation and operation. Those tools may collect the device, security, backup, directory and file data described in Schedule 3. Cambition uses that data for the same administrative and protective purposes as access by its Personnel, and to produce Device Health Reports.

11B.3 The Client shall not remove, disable or interfere with those tools while the relevant Services are live, and shall obtain any consent it needs from, and give any notice required to, its own Personnel. Cambition is not responsible for incidents or failures that result from a tool being removed, disabled or blocked by the Client.

11B.4 SentinelOne uses endpoint telemetry to detect attacks and to improve detection. That is part of how the EDR Product works under SentinelOne's terms and is not limited by condition 11A.

11B.5 CentreStack Online is hosted by Gladinet, Inc. on Amazon Web Services in the United States. Files the Client stores on that platform are processed in the United States under condition 11.10 and Schedule 3.

11B.6 Acronis Microsoft 365 backup uses the Microsoft Graph Mail.ReadWrite permission solely to back up and restore mailbox content. It does not use AI to read mailbox content on Cambition's behalf.

11B.7 N-able, SentinelOne, Bitdefender, Acronis, Exclaimer and Gladinet are sub-processors under condition 11.7 where the relevant Product is on the Particulars.

11B.8 This condition 11B does not limit conditions 10 or 11.

12. Limitation of liability

12.1 This condition 12 sets out each party's entire financial liability arising under or in connection with this Agreement, including liability in contract, tort (including negligence), misrepresentation or otherwise.

12.2 Nothing in this Agreement limits or excludes liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot be limited or excluded by English law.

12.3 Subject to condition 12.2, neither party is liable for loss of profits, loss of business, loss of goodwill, loss of anticipated savings, loss or corruption of data (except to the extent the Services expressly include backup and the loss is caused by Cambition's negligence in performing that backup), or any special, indirect or consequential loss.

12.4 Subject to conditions 12.2 and 12.4A, each party's total liability arising under or in connection with this Agreement shall not exceed the Charges paid by the Client in the 12 months before the event giving rise to the claim. This cap does not apply to the Client's obligation to pay the Charges.

12.4A Subject to condition 12.2, each party's total liability for breach of conditions 10, 11, 11A and 11B (confidentiality and data protection) shall not exceed £1,500,000 in aggregate. This cap is separate from, and not counted towards, the cap in condition 12.4.

12.5 Schedule 1 states the Client's exclusive remedy for unavailability of the Hosting Services, except for any right to terminate this Agreement expressly gives.

12.6 Cambition is not liable for failure or delay to the extent caused by the Client's breach, by the Client removing or restricting tools or delegated access under conditions 2A.7 or 11B.3, or by a Third Party Service outside Cambition's control.

12.7 This condition 12 survives termination.

13. Anti-bribery

13.1 Each party shall comply with the Relevant Requirements, maintain adequate procedures to prevent bribery, not engage in any activity that would be an offence under sections 1, 2 or 6 of the Bribery Act, and promptly report to the other any request for an undue financial or other advantage in connection with this Agreement.

14. Term and termination

14.1 This Agreement starts on the Commencement Date and continues on a rolling monthly basis until either party ends it, or ends an individual Service, by giving the other not less than 30 days' written notice. Ending the Agreement or a Service does not end the Client's liability for committed Third Party Service fees under condition 2A.4 (for example annual Microsoft 365 subscriptions), which remain payable until the end of their commitment period.

14.2 Either party may terminate immediately by written notice if the other: (a) fails to pay any sum within 14 days after written notice that it is overdue; (b) commits a material breach that is irremediable, or fails to remedy a remediable material breach within 30 days after written notice; or (c) repeatedly breaches in a way that reasonably justifies the opinion that its conduct is inconsistent with it intending to give effect to this Agreement.

14.3 Cambition may terminate on written notice if the Client undergoes a change of control within the meaning of section 1124 of the Corporation Tax Act 2010, other than an internal reorganisation that does not change the ultimate beneficial ownership.

14.4 Either party may terminate immediately if the other is unable to pay its debts, enters insolvency, administration, liquidation or an arrangement with creditors, or any equivalent event occurs.

14.5 On termination: (a) all licences end; (b) the Client shall stop using the Software and Third Party Services provisioned by Cambition, except Microsoft services the Client transfers to another partner or continues directly with Microsoft; (c) each party shall return or destroy the other's Confidential Information on request, except copies required by law or held in routine backups; (d) Personal Data is returned or deleted under condition 11.13; (e) Cambition shall, on request and at the rates in the Particulars, give reasonable exit assistance, which may include exporting Client Data from the Cambition Portal, handing over administrator credentials and documentation, transferring Microsoft subscriptions (subject to the Vendor Terms), removing GDAP and Azure Lighthouse access, removing its monitoring and security agents (after which those devices are no longer protected by Cambition), migrating hosted websites and porting telephone numbers where the carrier allows it; (f) accrued rights and remedies are not affected; and (g) conditions which by their nature should survive shall survive, including conditions 2A.4, 6.4, 8, 9, 10, 11, 11A, 11B, 12, 14.5 and 17.

14.6 Cambition may suspend all or part of the Services if a termination event has occurred, in an emergency, or in the event of an actual or suspected security breach, to the extent reasonably necessary. Cambition shall tell the Client promptly and lift the suspension when the reason for it has ended.

14.7 If an event under condition 17.3 prevents a party from performing a material part of its obligations for more than 60 days, the other party may terminate the affected Services by written notice.

15. Notices

15.1 Notices under this Agreement shall be in writing and delivered by hand, pre-paid first-class post or email to the addresses in the Particulars. Notices to Cambition must also be sent to ambitious@cambition.co.uk and, for notices of breach or termination, by post to the trading address, with a copy to the registered office. Support requests are not notices and should be raised as tickets.

15.2 A notice is deemed received: (a) if delivered by hand, on delivery; (b) if sent by pre-paid first-class post, on the second Business Day after posting; (c) if sent by email, at the time of transmission, unless the sender receives an automated delivery-failure report. A notice deemed received outside Normal Business Hours is deemed received at the start of the next Business Day.

16. Assignment and subcontracting

16.1 The Client shall not assign or subcontract this Agreement without Cambition's prior written consent, not to be unreasonably withheld.

16.2 Cambition may subcontract performance of the Services, remaining responsible for its subcontractors, and may use sub-processors as provided in condition 11. Cambition may assign or transfer this Agreement, without the Client's consent, to a purchaser of all or substantially all of its business, and shall notify the Client in writing when it does so.

17. General

17.1 This Agreement is the entire agreement and supersedes previous agreements relating to its subject-matter. Each party acknowledges it has not relied on any representation not set out in this Agreement. Nothing in this condition limits liability for fraud.

17.2 A variation must be in writing and signed by both parties, except that: (a) Cambition may update Schedule 3 as provided in condition 11.9; and (b) Cambition may update these Terms and Conditions by giving the Client not less than 30 days' written notice, with the update applying at the end of that notice period (or earlier if the change is required by law). If the Client does not accept an update, it may end this Agreement under condition 14.1. The version of these Terms and Conditions that applies to the Client is the one in force on the date of the Particulars, as changed under this condition. Previous versions are available on request.

17.3 Neither party is in breach, or liable for delay, to the extent the breach or delay is caused by circumstances beyond its reasonable control, provided it gives notice and uses reasonable efforts to mitigate. This does not excuse payment obligations.

17.4 A waiver must be in writing. Failure or delay in enforcing a right is not a waiver.

17.5 If a provision is invalid, it shall be modified to the minimum extent necessary to make it valid. The rest of the Agreement remains in force.

17.6 Nothing in this Agreement creates a partnership or agency.

17.7 A person who is not a party has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce this Agreement.

17.8 This Agreement is governed by English law. The courts of England and Wales have exclusive jurisdiction. The parties shall first attempt to resolve a dispute through CEDR mediation if either party requests it, without prejudice to either party's right to seek interim relief.

17.9 The Particulars may be accepted and signed electronically.

Schedule 1 — Service level arrangements

1. Availability target. Cambition shall use reasonable efforts to make the Hosting Services it operates (including the Cambition Portal and website hosting on Cambition's WHM/cPanel servers) available for 99.5% of each calendar month, excluding Excused Downtime.

2. Availability is calculated as: ((Total minutes in the month − Excused Downtime minutes − Unexcused Downtime minutes) / (Total minutes in the month − Excused Downtime minutes)) × 100. Unexcused Downtime means minutes in which the relevant Hosting Service is unavailable, other than Excused Downtime.

3. Excused Downtime means scheduled maintenance notified at least 24 hours in advance, Client-caused outages, third-party vendor outages, and events beyond Cambition's reasonable control under condition 17.3.

4. Measurements are taken at five-minute intervals at Cambition's network boundary, not at the Client's premises.

5. If monthly availability falls below 99.5%, the Client may claim a service credit of 5% of that month's Hosting Charges for each full 1% below the target, capped at 25% of that month's Hosting Charges. The Client must claim the credit by ticket within 30 days after the end of the month. Credits are the exclusive remedy for unavailability, except the termination rights in this Agreement.

6. Credits do not apply to Third Party Services except to the extent the vendor issues an equivalent credit that Cambition actually receives, which Cambition shall pass on.

Schedule 2 — Technical support

1. The Client shall log incidents through the Cambition Portal (crm.cambition.co.uk) or by email to Cambition's support ticket address given in the Particulars and the Cambition Portal. Every request is ticketed. P1 incidents should also be telephoned to Cambition on 01223 656 156.

2. Priority and response targets during Normal Business Hours:

3. Response is the time until a technician acknowledges the ticket and begins diagnosis, not the time to resolve. Automated acknowledgements and AI triage do not count as a response.

4. Cambition may reclassify priority on reasonable grounds and shall tell the Client when it does.

5. Support for a Third Party Service is provided by Cambition as first line where the Particulars include managed support for that Product. Second-line support is provided by the vendor under the Vendor Terms.

6. Support outside Normal Business Hours is available only where stated in the Particulars.

Schedule 3 — Data protection statement

A. Roles

3.1 For Personal Data processed in providing the Services, the Client is the controller, Cambition is the processor, and the persons listed in paragraph E are sub-processors.

3.2 Where Cambition processes Personal Data to run its own business (account management, invoicing and accounts in Xero, its own staff and payroll, and business-to-business marketing), Cambition is the controller and its Privacy and Cookie Notice at https://cambition.co.uk/privacy/ applies. Xero is Cambition's own supplier for that purpose and not a sub-processor of Client Personal Data.

B. Purpose

3.3 Cambition processes Personal Data only to: (a) provide, administer, support, secure and bill the Services; (b) operate the tools in condition 11B and produce Device Health Reports; (c) provision and manage Third Party Services, including through Microsoft Partner Center and GDAP; (d) operate the Approved AI Tools under condition 11A; (e) host the Client's websites and telephony where those Products are on the Particulars; (f) comply with UK law; and (g) exercise or defend legal claims. Cambition shall not sell Personal Data or use it for its own marketing.

C. Types of Personal Data

3.4 Depending on the Products on the Particulars, Personal Data may include: identity and contact data; billing data; tickets (including emails sent to Cambition's ticket address), attachments and diagnostic logs held in the Cambition Portal; Microsoft 365 and Azure identity, user, licence, group, configuration, sign-in and audit-log data accessed through GDAP or Azure Lighthouse; Microsoft mailbox and file content held in the Client's tenant; N-central device inventory, health, patch status, remote-session metadata and device usernames; SentinelOne process names, file hashes, command lines, network metadata, detections and rollback events; Bitdefender endpoint and threat telemetry; Acronis backup content and metadata, including Microsoft 365 mailbox content where Microsoft 365 backup is on the Particulars; CentreStack files, folders, permissions and access logs; Exclaimer directory attributes and email in transit where signatures are applied server-side; website files, databases, form submissions and server logs on Cambition's hosting servers; VoIP One extension and user details, phone numbers, call detail records, voicemail and, where enabled, call recordings; Device Health Report data; and, for the Approved AI Tools, the data described in condition 11A.3.

3.5 Cambition does not seek special category or criminal-offence data. If the Client stores such data in a mailbox, file, backup, website, call recording or ticket, the decision to do so is the Client's as controller, and the Client should tell Cambition if it requires additional safeguards.

D. Data subjects

3.6 Personnel and users of the Client; the Client's Customers who use the Software; contacts in the Client's directories, mailboxes, files and tickets; individuals who use a monitored or backed-up device; visitors to websites Cambition hosts for the Client; and callers to and from the Client's VoIP One service.

E. Sub-processors

3.7 Cambition may use the sub-processors below, but only where the relevant Product is on the Particulars, except X.AI LLC and Anysphere, Inc., which Cambition uses to administer the Services for all Clients. The live list is published at https://cambition.co.uk/sub-processors/ and is kept consistent with this table. Changes are made under conditions 11.7 and 11.9. If the live list and this table differ, the live list as updated under condition 11.7 prevails.

3.8 Cambition shall impose written terms on each sub-processor that give no less protection than this Schedule and remains responsible to the Client for that processing.

F. International transfers

3.9 Personal Data processed by Gladinet, Inc., X.AI LLC and Anysphere, Inc. is processed in the United States. These are restricted transfers. They take place only where necessary for CentreStack Online or the Approved AI Tools, where the data protection test is met and under the UK IDTA or the UK Addendum to the EU Standard Contractual Clauses (or UK adequacy regulations where the recipient is certified under the UK-US data bridge), as set out in condition 11.10. Microsoft and other vendors may make transfers under their own data processing terms where the Client's configuration or the vendor's support model requires it.

3.10 Personal Data processed by SentinelOne for Cambition's EDR service is hosted at rest in the European Union (EU Central 1). A transfer from the United Kingdom to the EEA is not a restricted transfer while UK adequacy regulations for the EEA remain in force. SentinelOne is a US company and group support may involve affiliates outside the EU under SentinelOne's own transfer safeguards.

3.11 Cambition does not represent that Personal Data processed by CentreStack Online or by the Approved AI Tools remains in the United Kingdom.

G. Duration

3.12 Cambition processes Personal Data for the Term and then, at the Client's choice, deletes or returns it within 90 days after termination, except where UK law requires retention or a copy must be kept to establish or defend a legal claim.

3.13 Vendor retention follows that vendor's terms. Under xAI's enterprise and API terms, inputs and outputs are currently deleted within 30 days unless Zero Data Retention is enabled. Grok Bot retains files and session state only as set out in condition 11A.6. CentreStack files remain until the Client or Cambition deletes them or the tenant is closed. Backup data is kept for the retention period set for the Client's backup plan.

H. Instructions and security

3.14 This Schedule, conditions 11, 11A and 11B, the Particulars and tickets raised by the Client's authorised contacts are documented instructions.

3.15 Cambition shall maintain technical and organisational measures appropriate to the Services, including: encryption in transit, and at rest where the platform supports it; multi-factor authentication for all administrative access, including GDAP and Azure Lighthouse access; least-privilege, role-based and time-limited delegated access; logging of administrative actions; timely patching of systems Cambition operates; separation of duties for code changes (a separate testing Grok Bot and human approval before release); and and human approval of the actions listed in condition 11A.5.

3.16 Personal Data Breaches are notified under condition 11.11. Audits and inspections take place under condition 11.12.

Schedule 4 — Service-specific terms

Each part of this Schedule applies only if the relevant Product is on the Particulars.

4.1 Microsoft 365 licensing. Microsoft licences are supplied through Giacom Cloud Market and administered through Microsoft Partner Center. Annual and multi-year New Commerce Experience subscriptions cannot usually be reduced or cancelled mid-term outside Microsoft's short cancellation window, and the Client remains liable for them under condition 2A.4. Cambition administers the tenant through GDAP under condition 2A.7.

4.2 Azure. Azure consumption is billed in arrears at the vendor's rates. Unless the Particulars include cost management, the Client is responsible for the resources it asks Cambition to deploy and for setting budgets and spending alerts. Where Azure Lighthouse is used, Cambition's delegated access is limited as described in condition 2A.7.

4.3 Monitoring, patching and EDR. N-central and SentinelOne are operated as described in condition 11B. Patching may require reboots, which Cambition shall schedule in agreed windows where possible. Automated security responses (for example isolating a device) may interrupt the Client's work; this is part of how the Service protects the Client. Condition 7.4 applies.

4.4 Backup. The scope, frequency and retention of backups are as stated in the Particulars. Data outside that scope is not backed up. Acronis Microsoft 365 backup uses the Microsoft Graph Mail.ReadWrite permission solely to back up and restore mailboxes. Cambition monitors backup jobs and acts on failed or missed jobs. Test restores are carried out at the Client's request and are chargeable at the rates in the Particulars. Cambition does not guarantee that every item can be restored, because restores depend on the backup data, the vendor's platform and the condition of the systems being restored to.

4.5 Website hosting. Websites are hosted on Cambition-managed WHM/cPanel servers running on a Microsoft Azure virtual machine in a UK datacentre. The Client is responsible for the lawfulness of its website content and for any personal data its website collects (including its own privacy and cookie notices). Cambition may suspend a website that is compromised, is attacking other systems or breaches condition 2.4. Website backup frequency and retention, and the registrant of any domain names Cambition manages for the Client, are as stated in the Particulars.

4.6 VoIP One telephony. VoIP One is a hosted telephony service using PortSIP software. Calls to the emergency services (999 and 112) may not work during a power cut or loss of internet connection, and location information may be limited; the Client shall tell its users and keep registered addresses up to date. Number porting depends on the losing and gaining providers. Call charges are as stated in the Particulars.

4.7 Cyber Essentials. Cambition helps the Client prepare for Cyber Essentials (and Cyber Essentials Plus where on the Particulars). Certification is decided by the certification body, not by Cambition, and Cambition does not guarantee that the Client will pass. The Client is responsible for the accuracy of its self-assessment and for the declaration signed on its behalf.

4.8 AI and automation projects. Scope, acceptance criteria and Charges are set out in the Particulars. The Client shall review and test automations before relying on them in live operations, and decides how their outputs are used. Where the project involves an AI service chosen by the Client, that service is the Client's choice as controller and is not an Approved AI Tool; Cambition's own use of AI on the project remains subject to condition 11A.

4.9 Device Health Reports. Device Health Reports and health scores are prepared from the data available to Cambition's tools at the time. They are for information, are not an audit or certification, and do not guarantee the security of any device.