Terms and Conditions

These Terms of Service (“Terms”) govern your use of Vigil, provided by Vigil Labs Ltd, a company registered in England and Wales under company number [17267620], whose registered office is at [66 Paul Street, London, England, United Kingdom, EC2A 4NA] (“Vigil”, “we”, “us”, “our”).

By creating an account, signing an order form or using the Service, you agree to these Terms on behalf of the business or organisation you represent (“Customer”, “you”). If you do not have authority to bind that organisation, do not use the Service.

Authorised Users: your employees, contractors and agents whom you allow to use the Service under your account.

• Customer Data: all data, including personal data, that you or your Authorised Users enter into, upload to or create in the Service. This includes incident records, refusals, bans, procedures, evacuation plans and images.

• Documentation: the user guides, help content and product descriptions we make available for the Service.

• Order: the plan you choose online or an order form signed by both parties, setting out the plan, number of Venues, fees and term.

• Service: the Vigil software platform, including the web, desktop and mobile applications, APIs, integrations and related support, as described in the Documentation.

• Subscription Term: the period for which you have paid or agreed to pay for the Service.

• Venue: a single premises or qualifying event registered on your account.

2.1 The Service is provided only to businesses, public bodies, charities and other organisations, for use in the course of their operations. It is not offered to consumers.

2.2 You confirm that you are not acting as a consumer when entering into these Terms.

3.1 Vigil is software that helps venues:

• keep contemporaneous incident, refusal and ejection records;

• prepare and maintain procedures, measures and evidence relating to the Terrorism (Protection of Premises) Act 2025 (“Martyn’s Law”);

• manage related safety, licensing, evacuation and data protection tasks.

3.2 Features vary by plan, as described on our pricing page or in your Order. We may improve, change or withdraw features from time to time. We will not materially reduce the core functionality of a paid plan during a Subscription Term you have already paid for.

3.3 Not a compliance guarantee. Vigil helps you prepare, organise and evidence your compliance. It does not do the following:

• give legal advice;

• carry out risk assessments on your behalf;

• guarantee that your venue meets any legal duty.

Your obligations under Martyn’s Law, licensing law, health and safety law, fire safety law, equality law and data protection law remain yours. The Security Industry Authority (“SIA”) and other regulators decide whether those obligations are met. No software is endorsed or approved by the SIA.

4.1 You must provide accurate account information and keep it up to date.

4.2 You are responsible for:

• who you allow to become an Authorised User and the access level you give them;

• keeping log-in details confidential, and making sure each Authorised User has their own log-in;

• everything done under your account;

• removing access promptly when someone leaves or no longer needs it.

4.3 Tell us immediately at founder@vigillabs.co.uk if you suspect unauthorised access to your account.

5.1 You agree to pay the fees for your plan as set out on our pricing page or in your Order. Fees are charged per Venue unless otherwise stated.

5.2 Unless your Order says otherwise, fees are billed monthly in advance by [card / direct debit / invoice]. Invoices are payable within [14] days.

5.3 Fees are exclusive of VAT, which you will pay at the applicable rate.

5.4 Founding Venue discount. If you join under the Founding Venues offer, you receive the discount stated at sign-up (currently 50%) for the first 12 months of your subscription. After that, standard fees apply.

5.5 Late payment. If any amount is overdue by more than [14] days, we may suspend access to the Service after giving you at least 7 days’ written notice. We may also charge interest under the Late Payment of Commercial Debts 11.75% Act 1998.

5.6 Price changes. We may change our fees by giving you at least 30 days’ notice. Changes take effect from your next billing period after the notice period ends. If you do not accept a change, you may cancel before it takes effect.

5.7 Fees already paid are non-refundable, except where these Terms or the law say otherwise.

6.1 Monthly plans renew automatically each month until cancelled. Annual or fixed-term plans renew for the same period unless either party gives at least [30] days’ notice before the end of the current term.

6.2 You can cancel a monthly plan at any time in your account settings or by emailing [email]. Cancellation takes effect at the end of the current billing period.

6.3 Either party may terminate these Terms immediately by written notice if the other party:

• commits a material breach that is not remedied within 30 days of being notified of it; or

• becomes insolvent, enters administration or liquidation, or ceases to trade.

6.4 We may suspend or terminate your access immediately if your use of the Service:

• breaches section 8 (Acceptable use);

• poses a security risk to the Service or other customers; or

• exposes us to legal liability.

Where it is reasonable to do so, we will tell you first and give you a chance to fix the problem.

7.1 Ownership. You own all Customer Data. You grant us a licence to host, process, transmit and display Customer Data only as needed to provide, secure and support the Service and to meet our legal obligations.

7.2 Data protection roles. For Customer Data that includes personal data, you are the controller and we are your processor. Our Data Processing Agreement (“DPA”) at [link] forms part of these Terms and meets the requirements of Article 28 of the UK GDPR.

For account, billing and website data, we act as controller under our Privacy Policy at [link].

7.3 Your responsibilities. You are responsible for having a lawful basis for collecting and processing the personal data you put into the Service. This includes:

• data about guests, staff, banned persons and people with evacuation needs;

• providing privacy information to those people;

• carrying out any data protection impact assessment you need;

• responding to data subject requests about records you control. We will help you as set out in the DPA.

7.4 Special and sensitive features. Some features process more sensitive information, for example:

• health or disability information in personal emergency evacuation plans;

• images;

• information about alleged offences in incident records or bans.

Facial recognition and similar features are optional and switched off by default. If you enable or use any of these features, you must make sure your use is lawful, necessary and proportionate. This may include having an appropriate policy document and condition for processing under the Data Protection Act 2018.

7.5 Sharing between venues. Where you choose to share records through a scheme feature, such as Pubwatch, Best Bar None or a group account:

• you are responsible for having a lawful basis and an appropriate data-sharing arrangement with the other members;

• each receiving venue is responsible for its own use of what it receives.

7.6 Location. Customer Data is stored in the United Kingdom and the European Economic Area. We will not transfer it outside those areas except as permitted by the DPA.

7.7 Retention, export and deletion. You can export your records at any time while your account is active. After your account ends:

• we keep Customer Data for [30/60/90] days so you can export it;

• we then delete it, including from backups within a further [number] days;

• the exception is anything we are required by law to keep.

7.8 Aggregated data. We may use anonymised and aggregated data that does not identify you, your Venues or any individual, to operate, secure and improve the Service.

You must not, and must ensure your Authorised Users do not:

• use the Service in breach of any law, including data protection, equality, harassment and licensing law;

• record information about individuals that you have no lawful reason to hold, or that is knowingly false or defamatory;

• use the Service to unlawfully discriminate against, harass or target any person or group;

• upload malicious code, or attempt to gain unauthorised access to the Service or other customers’ data;

• copy, modify, reverse-engineer or create derivative works of the Service, except as permitted by law;

• resell, sublicense or provide the Service to third parties, except under a written agreement with us;

• use the Service to build a competing product;

• interfere with the integrity, security or performance of the Service, including by load-testing or scanning it without our written consent.

9.1 Some features use artificial intelligence or automated analysis, for example:

• answering questions about your records and the law;

• summarising information;

• producing risk or readiness scores.

These features may use third-party AI providers acting as our sub-processors, as listed in the DPA.

9.2 AI and automated outputs can be incomplete or wrong. They are provided to assist your staff, not to replace their judgement or professional advice. You are responsible for reviewing outputs before relying on them.

9.3 We do not use Customer Data to train third-party AI models.

10.1 The Service may connect to third-party products, such as:

• CCTV systems;

• access control systems;

• building management systems;

• payment and communication tools.

Your use of those products is governed by your agreements with their providers.

10.2 We are not responsible for third-party products, their availability, or how their providers handle data. If a third party changes or withdraws its product, we may need to change or stop the related integration.

11.1 We will use reasonable skill and care to provide the Service and to keep it available. We aim for the Service to be available 24 hours a day, but it may be interrupted from time to time by:

• planned maintenance, which we will tell you about in advance where reasonably possible;

• urgent security fixes;

• events outside our control.

11.2 Support is provided through the channels and hours for your plan, as described on our pricing page or in your Order.

11.3 We will keep the Service secure using appropriate technical and organisational measures, including:

• encryption in transit and at rest;

• role-based access;

• logging of access to records;

• tamper-evident record sealing.

We will notify you without undue delay if we become aware of a personal data breach affecting Customer Data.

12.1 We and our licensors own all rights in the Service and Documentation. This includes our software, templates, designs, trade marks and any improvements. Except for the limited right to use the Service under these Terms, no rights are transferred to you.

12.2 During your Subscription Term, we grant you a non-exclusive, non-transferable right for your Authorised Users to use the Service for your internal business purposes.

12.3 Templates. You may adapt the procedure and policy templates we provide for use at your own Venues, and may keep exported copies after your subscription ends.

12.4 Feedback. If you give us suggestions or feedback, we may use them freely without any obligation to you.

13.1 Each party will:

• keep the other’s confidential information confidential;

• use it only to perform these Terms;

• disclose it only to employees, advisers and sub-processors who need to know it and are bound by similar obligations.

13.2 This does not apply to information that:

• is or becomes public other than through a breach;

• was already lawfully known to the recipient;

• is independently developed; or

• must be disclosed by law or a regulator. Where lawful, the disclosing party will be told first.

13.3 We may disclose Customer Data where required to do so by a court, the police, the SIA or another authority with legal power to require it. Where lawful, we will tell you first.

14.1 Each party confirms it has the authority to enter into these Terms.

14.2 We warrant that the Service will perform materially in line with the Documentation. If it does not, your remedies are:

• we will use reasonable efforts to correct the problem; and

• if we cannot do so within a reasonable time, you may terminate the affected subscription and receive a pro-rata refund of prepaid fees for the unused period.

14.3 Except as expressly set out in these Terms, the Service is provided “as is”. All other warranties, conditions and terms implied by statute or common law are excluded to the fullest extent permitted by law. This includes terms as to satisfactory quality or fitness for a particular purpose.

15.1 Nothing in these Terms limits or excludes liability for:

• death or personal injury caused by negligence;

• fraud or fraudulent misrepresentation;

• any other liability that cannot be limited or excluded by law.

15.2 Subject to 15.1, neither party is liable for any:

• loss of profits, revenue, business or goodwill;

• loss of anticipated savings;

• indirect or consequential loss.

15.3 Subject to 15.1, neither party is liable for:

• the decisions, acts or omissions of the Customer’s staff or third parties, including at or in connection with an incident at a Venue;

• any fines, penalties or enforcement action imposed on the Customer by a regulator, except to the extent caused by our breach of these Terms.

15.4 Subject to 15.1 and 15.5, each party’s total aggregate liability arising out of or in connection with these Terms is limited to the greater of:

• the fees paid and payable by the Customer in the 12 months before the event giving rise to the claim; and

• £[amount].

15.5 Our total liability for breach of our data protection obligations under the DPA is limited to [the greater of £[amount] and [2–3] times the fees paid in the previous 12 months].

15.6 These limits do not apply to the Customer’s obligation to pay fees.

16.1 Our indemnity. We will defend you against any third-party claim that your use of the Service in line with these Terms infringes that party’s UK intellectual property rights. We will pay any damages finally awarded or agreed in settlement. This applies only if you:

• tell us promptly about the claim;

• give us control of the defence; and

• provide reasonable help.

16.2 Your indemnity. You will defend and indemnify us against any third-party claim, including a claim by an individual or regulator, arising from:

• Customer Data;

• your breach of section 7.3, 7.4, 7.5 or 8; or

• your unlawful processing of personal data through the Service.

17.1 We may update these Terms from time to time. We will give you at least 30 days’ notice of any material change by email or in the Service.

17.2 If you do not accept a material change, you may cancel before it takes effect and receive a pro-rata refund of any prepaid fees for the period after it takes effect.

17.3 Continued use of the Service after a change takes effect means you accept it.

18.1 Assignment. You may not assign or transfer your rights under these Terms without our consent, which we will not unreasonably withhold.

We may assign or transfer these Terms, including all Customer Data processed under the DPA, to an affiliate or to a successor in connection with a merger, acquisition, reorganisation or sale of all or substantially all of our business or assets. If we do, we will give you notice, and the successor will be bound by these Terms and the DPA.

18.2 Subcontracting. We may use subcontractors and sub-processors to provide the Service. We remain responsible for them, and the sub-processor rules in the DPA apply.

18.3 Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, such as:

• failure of a hosting provider or the internet;

• power failure;

• industrial action;

• war, terrorism, pandemic or government action.

This does not apply to payment obligations.

18.4 Notices. Notices must be in writing:

• to us at founder@vigillabs.co.uk;

• to you at the email address on your account.

18.5 Entire agreement. These Terms, your Order, the DPA and any documents referred to in them make up the whole agreement between us about the Service. Neither party has relied on any statement not set out in them.

18.6 Order of precedence. If there is a conflict, the following order applies:

1. the DPA, for matters of personal data;

2. your Order;

3. these Terms.

18.7 No waiver. A failure or delay in enforcing a right does not waive it.

18.8 Severance. If any provision is found invalid, the rest of these Terms remain in force.

18.9 Third-party rights. No one other than you and us has any right to enforce these Terms under the Contracts (Rights of Third Parties) Act 1999.

18.10 Governing law and jurisdiction. These Terms and any dispute arising from them, including non-contractual disputes, are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.