Client Services Terms

These terms apply to services supplied by Client Culture under an engagement letter or proposal that refers to them, for engagements commencing or renewing on or after the effective date.

1. The agreement

1.1 These Client Services Terms (“Terms”) apply to services supplied by Client Culture Pty Ltd, ABN 88 619 177 132 (“Client Culture”, “we”, “us”) to a client firm (“the Client”, “you”) under a proposal, engagement letter or order that refers to them (“Engagement Letter”).

1.2 The agreement between us consists of, in descending order of precedence: (a) the Engagement Letter; (b) any Schedule to these Terms that the Engagement Letter applies; (c) these Terms; (d) our Privacy Policy and Security Policy as published at clientculture.com (the Security Policy page at clientculture.com/security, including its sub-processor table, is the current statement of our security measures and sub-processors).

1.3 An Engagement Letter is accepted when it is signed by the Client, or when the Client instructs us to commence or pays the first invoice, whichever is first.

1.4 Credentials, certification and marks issued by Trusted Firms Global (TFG Certification Pty Ltd) are also governed by the Trusted Firms Credential and Mark Use Terms. Where those terms and these Terms deal with the same matter, the Trusted Firms terms apply to the credential.

1.5 Contact means a person whose details the Client has supplied on a list loaded to the platform – a client, referrer or staff member of the Client, as the list specifies – for surveying or, where Schedule 1 applies, for matching email. A person not on a loaded list is not a Contact.

2. Services

2.1 We supply the services described in the Engagement Letter: client experience surveys, staff experience surveys where engaged, the Client Culture platform, reports, and any additional tools or services listed.

2.2 Platform access is included for all of the Client’s enrolled team members at every service tier, without a per-user cap. The Client manages joiners and leavers through its nominated administrator on the platform.

2.3 We supply the services with due care and skill, in accordance with the Engagement Letter and our published survey methodology. Survey timing depends on the Client meeting its obligations in clause 3.

2.4 We may improve, add to or change platform features from time to time, provided the change does not materially reduce the services described in the Engagement Letter.

3. Client obligations

3.1 Client lists. The Client supplies client contact lists in the agreed format, by the agreed date, from a nominated contact. We are not responsible for survey delays caused by late or non-conforming lists. Rework of lists supplied outside the agreed process may be charged at the rate stated in the Engagement Letter.

3.2 Lawful basis. The Client warrants that it is entitled to provide the details of its Contacts and that surveying them on its behalf complies with applicable privacy, data protection and electronic marketing law – including the Privacy Act 1988 (Cth) and the Spam Act 2003 (Cth) in Australia; the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations in the United Kingdom; and the GDPR and the ePrivacy rules of the relevant member state in the European Union – and that its own privacy notices cover the collection of feedback by a service provider. We send surveys as the Client’s service provider and processor. Unsubscribe requests are honoured and returned to the Client.

3.3 Accuracy. The Client is responsible for the accuracy of the data it provides, including team member enrolments, client attributes and invoice or engagement data used as a survey basis.

3.4 Program contact. The Client nominates a program contact authorised to give instructions and receive notices under the agreement.

3.5 Users. The Client ensures its users keep their access secure and do not allow anyone else to use it, use the platform for the Client’s internal purposes and comply with clause 10.

4. Fees and payment

4.1 Fees are as stated in the Engagement Letter, exclusive of GST, and are invoiced quarterly in advance unless the Engagement Letter states otherwise.

4.2 Invoices are payable within 30 days of the invoice date.

4.3 Fees increase on each anniversary of the Commencement Date by the percentage stated in the Engagement Letter or, if none is stated, by 3.5%.

4.4 If an invoice is more than 30 days overdue we may, on 14 days’ written notice, suspend platform access and survey activity until payment is received. Fees continue to accrue during suspension, and the Client is liable for our reasonable costs of recovery.

4.5 Additional services are quoted and agreed in writing before work begins. Expenses are charged only where agreed in advance.

4.6 Fee basis. Fees are set on the size band stated in the Engagement Letter – the number of partners and principals unless the letter specifies another measure. If at an anniversary of the Commencement Date the Client has grown beyond that band, fees for the following year move to the band that applies, at our then-current rates for that band, in addition to the increase in clause 4.3. We give the Client 60 days’ notice of the change before the anniversary. A Client that has reduced in size may ask for the lower band on the same basis.

5. Term and termination

5.1 The agreement commences on the Commencement Date and continues until terminated under this clause. If the Engagement Letter states a minimum term, neither party may terminate for convenience before it ends.

5.2 After any minimum term, either party may terminate for convenience by giving the notice stated in the Engagement Letter or, if none is stated, three months’ written notice.

5.3 Either party may terminate immediately by written notice if the other commits a material breach not remedied within 30 days of notice, or becomes insolvent.

5.4 On termination: (a) fees for the current invoicing period remain payable and issued invoices are due; (b) platform access ends at the end of the notice period; (c) on request made within 30 days, we supply an export of the Client’s Client Data (contacts, team members, survey responses with scores and comments, follow-up records and consent records) in CSV or JSON; (d) we delete or de-identify Client Data within 90 days after the export period, except as required by law and except de-identified aggregated data under clause 6.2, and confirm to the Client in writing when done.

5.5 On termination, credentials lapse in accordance with the Trusted Firms terms; we disable the Client’s widgets and licensed domains and withdraw consented comments from Client Culture and Trusted Firms surfaces at the end of the notice period. The Client removes any static copies of marks or comments within 14 days.

6. Data, privacy and security

6.1 Client Data means the data the Client provides or that the services collect for it: Contact and team member details and attributes, survey responses, scores, comments, follow-up records, kudos and integration records. Client Data remains the property of the Client and is confidential information of the Client.

6.2 The Client grants us a licence to host, process, analyse and display Client Data to supply the services, and to create de-identified aggregated data for benchmarking, research and product development. De-identified data does not identify the Client, its clients or its staff, and we may retain and use it after termination.

6.3 We do not disclose Client Data to third parties other than the sub-processors we use to supply the services – hosting, database, email delivery, single sign-on, AI-assisted report commentary, document generation, backup and rate limiting – as listed with their locations in the Security Policy, or where required by law. Some sub-processors process data outside Australia, as the list states.

6.4 Privacy. We handle personal information in accordance with the Privacy Act 1988 (Cth) and our Privacy Policy and, where the Client or its Contacts are in the United Kingdom or the European Union, the UK GDPR and Data Protection Act 2018 or the GDPR as applicable. In those terms the Client is the controller of the personal data of its Contacts and we are its processor, acting on its documented instructions for the purposes of the services; the Data Processing Schedule (Schedule 2) applies and forms part of the agreement. Where personal data is transferred from the UK or the EU to Australia for hosting, the transfer is made under the standard contractual clauses or the UK international data transfer addendum incorporated in Schedule 2. Each party is responsible for its own compliance with privacy and data protection law.

6.5 We maintain the security controls described in our Security Policy, including encryption in transit and at rest, role-based access, logging and backups. The platform and its database are hosted in Sydney, Australia; sub-processors and their locations are listed in the Security Policy.

6.6 We notify the Client without undue delay of any eligible data breach affecting Client Data and cooperate with the Client in responding to it.

6.7 Where the Client connects a Microsoft 365 tenancy or another system to the platform, Schedule 1 applies.

6.8 Staff surveys. Staff survey responses are reported to the Client in aggregate only, with scores suppressed below a minimum group size and comments shown only where enough people have commented, as described in the survey invitation. We do not disclose individual staff responses or the identity of a respondent to the Client. The link between an invitation and its response is removed on a fixed schedule after the survey closes.

6.9 Comment retention. The Client controls how long free-text survey comments are retained on the platform through the retention setting available to its administrator, from immediate deletion to three years; the default is shown in the setting. When the period expires, the comments are deleted automatically; scores, categories and drivers are retained so that results and trends are unaffected. We are not liable for the loss of comments deleted under the Client’s setting, and the Client should export any comments it needs before a period expires. Contact and team member records are retained for the term of the agreement and deleted or de-identified under clause 5.4.

7. Confidentiality

7.1 Each party keeps the other’s confidential information confidential, uses it only for the purposes of the agreement, and discloses it only to personnel and advisers who need it and are bound to keep it confidential, or where required by law. Client Data, pricing and the contents of reports are confidential. This clause survives termination.

8. Results, credentials and marks

8.1 The Client may use survey results, scores and reports internally without restriction.

8.2 A score or result quoted publicly must carry its date and refer to its verification page on trustedfirms.global. Marks and scores must be reproduced as issued – not altered, cropped or re-coloured.

8.3 A credential mark may be displayed only while the credential is active and must link to its verification page. Expired or withdrawn marks are removed from websites, email signatures and materials within 14 days; marks and scores served through the platform’s widgets and badge service are updated automatically – a widget shows no mark or score once the credential is not active, and continues to show consented comments while the Client’s domains remain licensed. Prior-year credentials may be referred to only as history, clearly dated, never as current.

8.4 Certification outcomes are determined solely by the measured results and process standards; fees have no bearing on them. Credentials may be withdrawn where results are found to have been manipulated or misrepresented.

8.5 Survey integrity. The Client must not select or exclude respondents to influence results, coach, pressure or incentivise responses, or submit responses on a client’s behalf. Where credentials apply, the survey basis is as defined in the Trusted Firms terms.

8.6 Trusted Firms. The Client authorises Client Culture to provide TFG Certification Pty Ltd with the results, response counts and consented comments needed to assess, issue and display credentials, and authorises TFG Certification Pty Ltd to publish them on trustedfirms.global while the credential is active. Figures shown on trustedfirms.global are computed from the same verified response record as the platform, never from a separately maintained copy; a correction is made in place and remains visible as a correction.

9. Client comments, testimonials and reviews

9.1 A client comment is published outside the platform only with the consent of the individual who wrote it, obtained through the platform’s consent workflow, and only in the form and with the attribution consented to.

9.2 Consent may be withdrawn at any time by the author, through the Client or by contacting us. On withdrawal the comment is removed from every Client Culture and Trusted Firms surface promptly, normally within minutes; the Client removes any static copies within 14 days.

9.3 Comments are published exactly as written. A correction of a factual error, such as the spelling of a name, is made only with the author’s agreement and is recorded.

9.4 Widgets and badges render only on domains the Client has licensed through us. The widget script and badge images must not be copied, modified, self-hosted or proxied. Which comments appear on each page is controlled through the platform, not by editing the Client’s pages.

10. Intellectual property and acceptable use

10.1 We own the platform, its software, methodology, report formats, survey instruments, loyalty driver framework, marks and brands, and all improvements to them. Nothing in the agreement transfers those rights. Net Promoter, NPS and Net Promoter Score are trademarks of Bain & Company, Inc., Satmetrix Systems, Inc. and Fred Reichheld.

10.2 The Client owns Client Data and the content of its own comments and materials. We grant the Client a non-exclusive licence to use reports and platform outputs for its internal purposes, and to use consented comments, scores and marks externally in accordance with clauses 8 and 9.

10.3 The Client must not, and must ensure its users do not: allow others to use their access; access another firm’s data; copy, scrape, reverse engineer or interfere with the platform or its security; introduce malicious code; or use the platform for any unlawful purpose or for any purpose other than the Client’s client and staff experience program.

11. Availability and support

11.1 We aim for platform availability of 99.5% in each calendar month, excluding scheduled maintenance notified in advance and outages of third-party services such as email delivery, single sign-on providers and Microsoft services.

11.2 Support is available by email during business hours in Melbourne, Australia, with a response within one business day.

12. Liability

12.1 Our services come with guarantees under the Australian Consumer Law and, where they apply, the UK Consumer Rights Act 2015 or the consumer law of the relevant EU member state, that cannot be excluded. Nothing in these Terms excludes or limits those guarantees. Where the law permits, our liability for breach of a guarantee is limited to supplying the services again or paying the cost of having them supplied again.

12.2 Subject to clause 12.1, each party’s total liability arising out of or in connection with the agreement, in contract, tort or otherwise, is limited to the fees paid by the Client in the twelve months before the event giving rise to the claim.

12.3 Subject to clause 12.1, neither party is liable for indirect or consequential loss, loss of profit, revenue, goodwill or business, or loss of data beyond restoration from our backups.

12.4 The limits in 12.2 and 12.3 do not apply to a breach of clause 7, to wilful misconduct, or to the Client’s obligation to pay fees.

12.5 Survey results record respondents’ opinions. We do not warrant that results or reports are free of error, and the Client is responsible for decisions it makes in reliance on them.

13. General

13.1 Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, provided it notifies the other and uses reasonable efforts to resume.

13.2 Variation. We may update these Terms by publishing the new version at clientculture.com/terms and giving the Client’s program contact 30 days’ notice by email. A change does not reduce the services or increase the fees in an Engagement Letter during its minimum term without the Client’s agreement.

13.3 Assignment. Neither party may assign the agreement without the other’s consent, not to be unreasonably withheld, except that we may assign to a related entity or a purchaser of our business on notice, and the credentials component may be transferred to TFG Certification Pty Ltd as described in the Engagement Letter.

13.4 Notices are given by email to the program contact and to contact@clientculture.com.

13.5 The agreement is the entire agreement about its subject matter. If a provision is invalid or unenforceable the remainder continues. No agency, partnership or employment relationship is created. Unless the Engagement Letter specifies another governing law and jurisdiction, the agreement is governed by the law of Victoria, Australia, and the parties submit to the courts of Victoria.

Schedule 1 – Connected systems: the 24-Hour Email Tool (Microsoft 365)

S1.1 Purpose. The 24-Hour Email Tool measures the time taken by enrolled team members to reply to client email against a 24-hour standard and reports it on the platform.

S1.2 Permission. The tool connects to the Client’s Microsoft 365 tenancy through Microsoft Graph using the Mail.ReadBasic application permission, which cannot return message bodies or attachments. Of the properties that permission exposes, the tool requests only the sender, the recipients, the received and reply timestamps and a conversation identifier used to match replies to the Contact’s email. Only email between enrolled team members and Contacts is matched; email with anyone else is not matched and its metadata is not retained. The subject line is excluded from every request and is never stored.

S1.3 Data stored. The platform records the matched Contact and team member, the timestamps and a one-way hash of the conversation identifier. It does not store email addresses of correspondents, subjects or content. Records are retained for the term of the agreement and handled as Client Data, and deleted under clause 5.4.

S1.4 Scope. Access is limited to the mailboxes of enrolled team members. We recommend the Client enforce that boundary itself using Exchange role-based access control for applications, scoping the permission to an administrative unit containing only enrolled users. The Client may revoke the permission in Microsoft Entra at any time. Revocation ends our access to the mailboxes; we deactivate the connection and confirm to the Client within one business day of detecting it, and no data is retrieved after revocation.

S1.5 Client responsibilities. The Client obtains any internal approvals it requires, including its IT security review, and is responsible for notifying its team members of the measurement as required by applicable workplace surveillance law and its own policies.

S1.6 Commencement of the tool is subject to completion of the Client’s IT security review. We supply our Information Security Policy, the permission scope, the data-handling description and, on request, a review of the retrieval code to support that review.

Schedule 2 – Data Processing Schedule

Applies where the UK GDPR or the GDPR applies to personal data processed under the agreement.

S2.1 Roles. The Client is controller; Client Culture is processor. Subject matter: the client and staff experience services in the Engagement Letter. Duration: the term of the agreement plus the deletion period in clause 5.4. Nature and purpose: sending surveys, collecting and analysing responses, reporting, follow-up workflows, and the tools in the Engagement Letter. Data subjects: the Client’s Contacts and team members. Data categories: name, email address, organisation, role and attributes supplied by the Client; survey scores and comments; follow-up notes; and, where Schedule 1 applies, email metadata as described there.

S2.2 Instructions. We process personal data only on the Client’s documented instructions, which are the agreement and the Client’s use of the platform, unless required by law, in which case we tell the Client first where permitted.

S2.3 Confidentiality and security. Our personnel with access are bound by confidentiality. We maintain the technical and organisational measures in the Security Policy and notify the Client of a personal data breach without undue delay and in any case within 72 hours of becoming aware of it, with the information the Client needs to meet its own obligations.

S2.4 Sub-processors. The Client authorises the sub-processors listed, with their locations, in the Security Policy (hosting, database, email delivery, single sign-on, AI-assisted commentary, document generation, backup and rate limiting). We give 30 days’ notice of a change; the Client may object on reasonable grounds, in which case the parties work in good faith to resolve the objection, failing which the Client may terminate the affected service. We remain responsible for our sub-processors.

S2.5 Transfers. Personal data is hosted in Sydney, Australia, and certain sub-processors process it outside Australia as the Security Policy lists. Transfers from the UK are made under the UK International Data Transfer Addendum to the EU standard contractual clauses; transfers from the EU under the standard contractual clauses (Module 2, controller to processor), each incorporated by reference with the Client as data exporter and Client Culture as data importer and the annexes completed by this Schedule.

S2.6 Assistance. We assist the Client, at reasonable cost where the request is substantial, with data subject requests, impact assessments and consultations with supervisory authorities, taking into account the nature of the processing.

S2.7 Deletion and return. At the end of the services we return or delete personal data as clause 5.4 provides, and delete existing copies unless law requires retention. De-identified data under clause 6.2 is not personal data.

S2.8 Audit. We make available the information necessary to demonstrate compliance, including our Security Policy, current certifications or assessments, and answers to reasonable written questions. An on-site audit may be requested once a year on 30 days’ notice, at the Client’s cost, during business hours and without disruption to other clients.