1. Definitions and interpretation
1.1 In this Agreement, the following definitions apply:
"Authorised Users" those employees, agents and independent contractors of the Customer who are authorised by the Customer to use the Services under the Customer's account.
"Business Day" a day other than a Saturday, Sunday or public holiday in England.
"Confidential Information" information that is proprietary or confidential and is either clearly labelled as such or which a reasonable person would consider confidential, disclosed by one party to the other in connection with this Agreement.
"Customer Data" the data (including any personal data) uploaded to, submitted to, or generated within the Services by or on behalf of the Customer or its Authorised Users.
"Data Protection Legislation" the UK GDPR (as amended, including by the Data (Use and Access) Act 2025), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and, to the extent applicable, the EU GDPR (Regulation (EU) 2016/679) and national implementing laws, in each case as amended or replaced from time to time.
"Documentation" the user documentation and help materials for the Services made available by us from time to time.
"Fees" the subscription fees payable by the Customer for the Services, as set out in the applicable Plan.
"Plan" the subscription tier, usage limits, Subscription Term and Fees agreed with the Customer at the point of purchase, or as subsequently upgraded or downgraded.
"Services" the Corganize software-as-a-service platform made available at corganize.com (or such other URL as we notify), together with the Documentation.
"Subscription Term" the Initial Term together with any Renewal Terms (each as defined in clause 12).
1.2 Clause headings do not affect interpretation. Words in the singular include the plural and vice versa. Any words following "including", "in particular" or similar are illustrative only. A reference to legislation is to that legislation as amended, extended or re-enacted from time to time.
2. The Services
2.1 Subject to the Customer paying the Fees and complying with this Agreement, we grant the Customer a non-exclusive, non-transferable right, without the right to grant sublicences, to permit its Authorised Users to use the Services during the Subscription Term solely for the Customer's internal business operations.
2.2 We will provide the Services with reasonable skill and care and materially in accordance with the Documentation.
2.3 We will use commercially reasonable endeavours to make the Services available 24 hours a day, seven days a week, except for: (a) planned maintenance, of which we will give reasonable advance notice where practicable; and (b) unscheduled maintenance performed to address urgent issues.
2.4 We may update, improve or modify the Services from time to time, provided that no update materially reduces the core functionality of the Services during a paid Subscription Term.
2.5 Support is provided by email at support@corganize.com during Business Days. We will use reasonable endeavours to respond to support requests promptly.
3. Accounts and Authorised Users
3.1 The Customer must ensure that registration information is accurate and kept up to date, and that each Authorised User keeps their credentials secure and confidential.
3.2 The Customer is responsible for the acts and omissions of its Authorised Users as if they were the Customer's own, and must notify us promptly at support@corganize.com on becoming aware of any unauthorised access to or use of the Services or any account.
3.3 The number of Authorised Users must not exceed any limit set by the applicable Plan. User subscriptions are for named individuals but may be reassigned to replacement individuals.
4. Acceptable use
4.1 The Customer must not, and must ensure that Authorised Users do not, access, store, distribute or transmit through the Services any material that:
- is unlawful, harmful, threatening, defamatory, obscene, infringing, harassing or racially or ethnically offensive;
- facilitates illegal activity or is otherwise illegal;
- infringes the intellectual property rights or privacy rights of any third party; or
- contains viruses, malware or other harmful code.
4.2 The Customer must not: (a) attempt to copy, modify, decompile, reverse engineer or create derivative works from the Services except as permitted by law; (b) access the Services to build a competing product or service; (c) license, sell, rent, lease or otherwise commercially exploit the Services or make them available to any third party other than Authorised Users; (d) attempt to obtain unauthorised access to the Services or interfere with their integrity or performance (including load testing or penetration testing without our prior written consent); or (e) use the Services in breach of applicable law, including Data Protection Legislation and export control laws.
4.3 We may suspend access to the Services (in whole or in part) where reasonably necessary to address a suspected material breach of this clause 4, a security risk, or a legal requirement. We will, where lawful and practicable, give the Customer prior notice and an opportunity to remedy the issue, and will restore access promptly once the issue is resolved.
5. Customer Data
5.1 The Customer retains all right, title and interest in and to the Customer Data. Nothing in this Agreement transfers ownership of Customer Data to us.
5.2 The Customer grants us a non-exclusive, worldwide, royalty-free licence to host, copy, process, transmit and display Customer Data solely to the extent necessary to provide the Services, provide support, comply with law, and as otherwise permitted by this Agreement.
5.3 The Customer is solely responsible for the accuracy, legality and quality of Customer Data and for ensuring it has all rights, consents and lawful bases required to provide Customer Data to us for processing in accordance with this Agreement.
5.4 We will maintain appropriate technical and organisational measures to protect Customer Data as described in the Data Processing Schedule, and will perform regular backups of Customer Data. In the event of loss or damage to Customer Data caused by us, the Customer's sole and exclusive remedy is for us to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest backup.
5.5 We may compile and use data that is aggregated and/or anonymised such that it does not identify the Customer or any individual, for the purposes of operating, analysing and improving the Services.
6. Data protection
6.1 Each party will comply with its obligations under Data Protection Legislation. To the extent we process personal data contained in Customer Data on the Customer's behalf, the Customer is the controller and we are the processor, and the Data Processing Schedule (Schedule 1) applies and is incorporated into this Agreement.
6.2 Where we process personal data relating to the Customer's personnel for our own purposes (for example account administration, billing and service communications), we do so as a controller in accordance with our Privacy Policy.
7. Fees and payment
7.1 The Customer will pay the Fees for the selected Plan in advance, monthly or annually as agreed. Fees are currently invoiced by us and payable by bank transfer within 14 days of the invoice date, unless otherwise agreed in writing. If we introduce card or direct debit payment through a payment provider, the Customer may be required to accept that provider's terms; we will give notice before any such change applies to the Customer's subscription.
7.2 We are not currently registered for VAT, and Fees are therefore invoiced without VAT. If we become VAT registered, Fees are stated exclusive of VAT and any other applicable taxes, which the Customer will then pay in addition at the applicable rate.
7.3 If any sum payable is not paid when due (other than a sum genuinely disputed in good faith), we may, without limiting our other rights: (a) charge interest on the overdue sum at 4% a year above the Bank of England base rate from time to time, accruing daily; and/or (b) on at least 14 days' written notice, suspend access to the Services until payment is made in full.
7.4 We may increase the Fees with effect from the start of the next Renewal Term by giving at least 30 days' prior written notice. If the Customer does not wish to accept the increase, it may cancel the subscription with effect from the end of the then-current Subscription Term.
7.5 Except as expressly set out in this Agreement or required by law, Fees are non-refundable, and no refunds or credits are given for partial subscription periods or unused capacity. Upgrades take effect immediately (with a pro-rata charge); downgrades take effect from the next billing date.
7.6 Any free trial is provided "as is" for evaluation purposes, may be modified or withdrawn at any time, and is limited to the trial period stated at sign-up. Clause 11 caps do not increase for trial use.
8. Intellectual property
8.1 We and/or our licensors own all intellectual property rights in and to the Services and the Documentation. Except for the rights expressly granted in this Agreement, no rights in the Services are granted to the Customer.
8.2 The Customer grants us a non-exclusive, perpetual, irrevocable, royalty-free licence to use any feedback or suggestions about the Services for any purpose, provided we do not identify the Customer without consent.
8.3 We will defend the Customer against any claim that the Customer's use of the Services in accordance with this Agreement infringes a third party's intellectual property rights, and will indemnify the Customer for amounts awarded against it (or agreed in settlement by us) in respect of such claim, provided the Customer: (a) notifies us promptly; (b) gives us sole control of the defence and settlement; and (c) provides reasonable cooperation. This clause states the Customer's exclusive remedy for intellectual property infringement.
8.4 Clause 8.3 does not apply to the extent a claim arises from Customer Data, use of the Services in breach of this Agreement, combination of the Services with anything not supplied by us, or use of other than the latest available version where use of that version would have avoided the claim.
9. Confidentiality
9.1 Each party will keep the other's Confidential Information confidential, use it only to perform its obligations or exercise its rights under this Agreement, and disclose it only to those of its personnel and professional advisers who need to know it and are bound by obligations of confidentiality.
9.2 Clause 9.1 does not apply to information that: is or becomes public other than through breach; was lawfully known to the recipient before disclosure; is lawfully received from a third party without restriction; or is independently developed. A party may disclose Confidential Information to the extent required by law, a court or a regulator, giving the other party as much notice as lawfully possible.
9.3 This clause 9 survives termination of this Agreement for five years.
10. Warranties and disclaimers
10.1 Each party warrants that it has full power and authority to enter into this Agreement.
10.2 We do not warrant that the Services will be uninterrupted or error-free, or that they will meet the Customer's requirements. The Customer assumes sole responsibility for results obtained from its use of the Services and for conclusions drawn from such use. The Services are not intended to constitute professional advice of any kind.
10.3 The Customer acknowledges that the Services may be subject to limitations, delays and other problems inherent in the use of the internet and electronic communications, and we are not responsible for delays or failures caused by such matters.
10.4 Where the Services include features that generate or summarise content using artificial intelligence, the Customer acknowledges that such output may be inaccurate or incomplete, is provided for assistance only, and should be reviewed by a person before being relied on. We do not warrant the accuracy of AI-generated output.
10.5 All other warranties, conditions and terms implied by statute or common law are, to the fullest extent permitted by law, excluded from this Agreement.
11. Limitation of liability
11.1 Nothing in this Agreement excludes or limits either party's liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; or (c) any other liability which cannot lawfully be excluded or limited.
11.2 Subject to clause 11.1, neither party will be liable under or in connection with this Agreement (whether in contract, tort (including negligence), breach of statutory duty or otherwise) for any: loss of profits; loss of business or revenue; loss of anticipated savings; loss of or damage to goodwill; loss or corruption of data (except as set out in clause 5.4); or any indirect or consequential loss.
11.3 Subject to clauses 11.1 and 11.2, each party's total aggregate liability under or in connection with this Agreement in any 12-month period is limited to the total Fees paid or payable by the Customer in that 12-month period (or £100, if greater).
11.4 The Customer's payment obligations, and liability arising under the Customer's indemnity in clause 11.5 or breach of clause 4 (Acceptable use), are not limited by clause 11.3.
11.5 The Customer will indemnify us against claims, losses and expenses arising from Customer Data or from use of the Services by the Customer or its Authorised Users in breach of this Agreement or applicable law.
12. Term and termination
12.1 This Agreement starts on the date the Customer first accepts it and continues for the initial subscription period selected at purchase (the "Initial Term"). It then automatically renews for successive periods equal in length to the Initial Term (each a "Renewal Term") unless either party cancels in accordance with clause 12.2.
12.2 The Customer may cancel at any time via the account settings or by written notice, with effect from the end of the then-current Subscription Term. We may cancel with effect from the end of the then-current Subscription Term by giving at least 30 days' written notice.
12.3 Either party may terminate this Agreement immediately by written notice if the other party: (a) commits a material breach which is irremediable or, if remediable, is not remedied within 30 days of written notice; or (b) becomes insolvent, enters administration or liquidation, or suffers any analogous event in any jurisdiction.
12.4 On termination or expiry: (a) all rights granted under this Agreement cease and the Customer must stop using the Services; (b) accrued rights and remedies are unaffected; and (c) clauses intended to survive (including clauses 5.5, 8, 9, 11, 12.4, 12.5 and 14) continue in force.
12.5 For 30 days after termination or expiry, the Customer may export Customer Data using the tools provided in the Services or may request a copy of Customer Data in a commonly used machine-readable format. After that period we will delete Customer Data in accordance with the Data Processing Schedule, save that we may retain copies to the extent required by law.
13. Force majeure
13.1 Neither party is in breach of this Agreement or liable for delay or failure to perform (other than payment obligations) resulting from events beyond its reasonable control, including acts of God, epidemic, war, terrorism, civil unrest, governmental action, power or internet failure, or failure of third-party hosting or telecommunications providers. If such an event continues for more than 60 days, either party may terminate this Agreement on 14 days' written notice.
14. General
14.1 Variation. We may update these terms from time to time. Material changes will be notified to the Customer by email or in-app notice at least 30 days before they take effect. If a material change is detrimental to the Customer, the Customer may cancel with effect from the end of the current billing period before the change takes effect; continued use after the effective date constitutes acceptance.
14.2 Assignment. The Customer may not assign or transfer this Agreement without our prior written consent (not to be unreasonably withheld). We may assign this Agreement to an affiliate or in connection with a merger, acquisition or sale of assets.
14.3 Entire agreement. This Agreement (including the Schedules and the applicable Plan) constitutes the entire agreement between the parties relating to its subject matter and supersedes all prior agreements and understandings. Each party acknowledges it has not relied on any statement not set out in this Agreement. Nothing in this clause limits liability for fraudulent misrepresentation.
14.4 Notices. Notices must be in writing and sent: to us, at support@corganize.com or our registered office; to the Customer, at the email address registered on the account. Email notices are deemed received at the time of transmission (or, if outside Business Hours, at 9am on the next Business Day).
14.5 Waiver; severance. No failure or delay in exercising a right is a waiver of it. If any provision of this Agreement is held invalid or unenforceable, it will be modified to the minimum extent necessary or, if not possible, deemed deleted, and the remaining provisions continue in force.
14.6 Third party rights. This Agreement does not give rise to any rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of this Agreement.
14.7 No partnership. Nothing in this Agreement creates a partnership, agency or employment relationship between the parties.
14.8 Governing law and jurisdiction. This Agreement and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, save that we may seek injunctive relief in any court of competent jurisdiction to protect our intellectual property or Confidential Information.
Schedule 1 — Data Processing Schedule
This Schedule applies where Corganize processes personal data contained in Customer Data on behalf of the Customer, and is intended to satisfy Article 28(3) of the UK GDPR and, where applicable, the EU GDPR. In this Schedule, "controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have the meanings given in Data Protection Legislation.
S1.1 Roles. The Customer is the controller (or, where the Customer is itself a processor for a third-party controller, the Customer warrants it has authority to appoint us as sub-processor) and Corganize is the processor of personal data within Customer Data.
S1.2 Details of processing. Subject matter and duration: provision of the Services during the Subscription Term and the post-termination period in clause 12.5. Nature and purpose: hosting, storage, organisation, retrieval, display, transmission, backup and deletion of Customer Data as necessary to provide the Services. Categories of data subjects: the Customer's personnel (including administrators, instructors and learners) and any other individuals whose personal data the Customer chooses to include in Customer Data. Categories of personal data: names, business email addresses, profile images, role and permission assignments, authentication data, learning progress and activity records, assessment results, submitted work and messages, uploaded files and any other personal data the Customer chooses to upload. Special category data is not intended to be processed, and the Services are not designed for it; the Customer must not upload special category data without first agreeing appropriate additional measures with us in writing.
S1.3 Instructions. We will process personal data only on the Customer's documented instructions (which are, as at the date of this Agreement, to process personal data as necessary to provide the Services in accordance with this Agreement), unless required to do otherwise by law, in which case we will inform the Customer of that legal requirement before processing unless the law prohibits this. We will inform the Customer if, in our opinion, an instruction infringes Data Protection Legislation.
S1.4 Confidentiality. We will ensure that persons authorised to process the personal data are subject to appropriate obligations of confidentiality.
S1.5 Security. We will implement and maintain appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art and the nature of the data. Our current measures include:
- Encryption in transit. All traffic to the Services is served over HTTPS/TLS with HTTP Strict Transport Security.
- Tenant isolation. Each customer's data is separated at the database level using row-level security, enforced by the database rather than by application code alone, under a database role that holds no privileges to bypass it.
- Authentication. Passwords are stored only as salted hashes. Short-lived access tokens are held in memory; refresh tokens are issued as HttpOnly, SameSite cookies. Optional single sign-on is supported, and administrative access to our platform console requires two-factor authentication.
- Access control and support access. Our staff do not have standing access to Customer Data. Support access to a customer account requires that customer to grant scoped permission in their own settings, is time-limited, and every action taken under it is recorded in that customer's audit log.
- Backups. Encrypted daily backups are retained for 30 days and replicated to two independent off-site locations. Backups are encrypted before they leave the server.
- Logging and monitoring. Security-relevant events (including sign-ins, failed sign-ins and administrative actions) are logged, and service availability is monitored automatically.
S1.6 Sub-processors. The Customer gives general written authorisation for us to engage sub-processors to provide the Services. Our current sub-processors are listed in the Sub-processors section of our Privacy Policy. We will give at least 30 days' notice of the addition or replacement of a sub-processor (via that page or by email), during which the Customer may object on reasonable data protection grounds; if the objection cannot be resolved, the Customer may terminate the affected Services and receive a pro-rata refund of prepaid Fees. We will impose data protection obligations on sub-processors materially equivalent to those in this Schedule and remain liable for their performance.
S1.7 Assistance. Taking into account the nature of the processing, we will assist the Customer by appropriate technical and organisational measures, insofar as reasonably possible, in responding to requests from data subjects exercising their rights, and in the Customer's compliance with its obligations regarding security, breach notification, data protection impact assessments and prior consultation. We may charge a reasonable fee for assistance that is materially disproportionate or arises from the Customer's breach.
S1.8 Personal data breach. We will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, and will provide information reasonably required for the Customer to meet its own notification obligations, and reasonable cooperation in remediation.
S1.9 International transfers. We will not transfer personal data outside the UK or the EEA unless appropriate safeguards are in place under Data Protection Legislation, such as an adequacy decision/regulations, the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses (with any required supplementary measures). Details of where Customer Data is stored, and of the sub-processors that may process it outside the UK and EEA, are set out in our Privacy Policy.
S1.10 Deletion and return. On expiry of the period in clause 12.5, we will delete personal data within Customer Data from our live systems. Copies held in encrypted backups are overwritten in the ordinary backup cycle and are deleted within 30 days of deletion from the live systems, unless retention is required by law.
S1.11 Audit. We will make available to the Customer information reasonably necessary to demonstrate compliance with this Schedule, and will allow for and contribute to audits (including inspections) conducted by the Customer or its mandated auditor, no more than once in any 12-month period, on at least 30 days' notice, during Business Hours, subject to reasonable confidentiality and security requirements, and at the Customer's cost. We may first satisfy an audit request by providing recent third-party audit reports or certifications where available.