WeedFairy.Net Security Service Terms, Conditions, And Disclaimer

IT SECURITY TERMS AND CONDITIONS:
Supplier must comply with the IT Security Terms and Conditions set forth in this document and ensure any subcontractor engaged by the supplier, also complies with the IT Security Terms and Conditions.

COMPLIANCE
• For all supplier systems used to host, store, process or transmit Open Text information,
supplier must provide, on an annual basis, an independent audit report (SOC1, SOC2,
SOC3, ISO27001, PCI-DSS) that validates the security controls of those systems.
• In the absence of any independent reports or at the discretion of Open Text, the supplier
must complete an information security questionnaire supplied by Open Text.
In case supplier security and data protection measures do not meet (i) these terms and
conditions; (ii) reasonable good industry standards and / or (iii) regulatory requirements,
supplier and Open Text will mutually agree a remediation plan. In case the remediation
plan cannot address the findings to the satisfaction of Open Text, Open Text at its sole
discretion may terminate the contract between the parties.

ORGANIZATION OF INFORMATION SECURITY
• Supplier must assign a single Information Security point of contact for the duration of the
relationship defined in the contract.
• Supplier must provide the contact information of the Information Security point of contact
upon request.
• The Information Security point of contact must be responsible to liaise with Open Text
Information Security Officer on all matters relating to security.

HUMAN RESOURCE SECURITY
• Supplier must communicate information security policies to all personnel involved in
work on behalf of Open Text or with access to Open Text data and track that personnel
are aware of all security policies.
• Supplier shall regularly train all personnel on information security and privacy matters
relevant to the nature of their function.
• Supplier personnel shall be bound by a binding confidentiality agreement before access
is granted to any Open Text data or assets.

PHYSICAL AND ENVIRONMENTAL SECURITY
• Supplier must ensure that all Open Text data or assets are stored in a secure location
that is protected by industry standard physical protection controls.
IT Security Terms and Conditions

OPERATIONAL PROCEDURES AND RESPONSIBILITIES
• Supplier must document where Open Text’s data and assets are hosted and provide
Open Text with appropriate documentation of the hosting location upon request.
• Supplier must provide to Open Text, documentation about their Information Technology
processes.
• Supplier must not alter, adapt or modify Open Text’s systems without Open Text
approval.
• To the extent applicable to the contract, supplier must adhere to a documented Change
Management process that protects changes to Open Text data or Open Text
environments as applicable.
• Open Text must be the approver of all changes that impact Open Text’s environments,
subject to the Change Management process.
• Supplier must enforce end-point security on assets that connect to Open Text
infrastructure including encrypted connectivity and anti-virus/anti-malware software
• Supplier must establish a vulnerability detection and management process, and software
patch management process on assets accessing Open Text data.
• A network vulnerability scan of the in-scope systems must be performed by a reputable
third-party provider on annual basis. A summary report of the scan results must be
provided to Open Text upon request.
• A formal 3rd party application penetration test must be performed by a reputable thirdparty
provider on annual basis, on any internet facing applications being used in the
supplier’s solution.
• If Open Text terminates the contract, supplier must immediately transfer all data and
Open Text assets to Open Text or, at Open Text’s sole discretion, destroy all data when
no longer required. If data is to be destroyed, an approved methodology must be used
and the supplier must provide Open Text with a certificate of destruction.
• Upon request, supplier must provide Open Text with information on roles and
responsibilities of individuals that have access to Open Text data.
• Upon request, supplier must be able to provide audit logs of systems accessing Open
Text data.
• For all supplier systems used to store, process or transmit Open Text information, Open
Text retains the right to perform a security assessment once a year. Such Assessment
may include examination of supplier’s relevant facilities and records as may be
reasonably required to undertake verification that supplier is complying with its security
obligations. The assessment will be conducted at a mutually agreed time with no less
than 30 days’ advance notification, shall be limited to no more than two (2) business
days and shall not unreasonably disrupt Supplier’s day-to-day business operations
• Supplier must not record any conversation conducted with Open Text personnel.
IT Security Terms and Conditions

ACCESS CONTROL
• Supplier must maintain an up-to-date list of employees and third parties accessing Open
Text data, infrastructure, or information at all times.
• Supplier must ensure that a process for termination of personnel including account
termination is in place.
• Supplier must make available to Open Text the list of employees and/or third parties
accessing Open Text infrastructure and information.
• Supplier must ensure and document that access to Open Text information is granted
according to principle of least privilege.
• Supplier must, on an annual basis or other such frequency requested by Open Text,
ensure and document that logical accesses are reviewed for need and that unused
accounts are removed.

INFORMATION SECURITY INCIDENT MANAGEMENT
• Supplier must adhere to a formally documented incident management process.
• Supplier must cooperate with Open Text personnel in the diagnosis, investigation and
correction of any security incidents or faults that impact Open Text data.
• Supplier must notify Open Text within 24 hours of suspicion, detection or confirmation of
a breach or unauthorized access to Open Text information that is hosted/transacted or
managed by the supplier.

BUSINESS CONTINUITY and DISASTER RECOVERY MANAGEMENT
• Supplier must have business continuity and disaster recovery plans and processes in
place to ensure the service for Open Text is adequately maintained in the event of
any negative impact on the Supplier´s service.
Supplier will regularly backup Open Text data and retain such Open Text backup data
copies for a minimum of twelve (12) months.

DATA PROTECTION
• Personal information must be processed only for the specified and lawful purposes, and
must not be further processed in any manner incompatible with that purpose or those
purposes.
• Personal information means any information relating to an identified or identifiable
natural person; an identifiable natural person is one who can be identified, directly or
indirectly, in particular by reference to an identifier such as a name, an identification
number, location data, an online identifier or to one or more factors specific to the
physical, physiological, genetic, mental, economic, cultural or social identity of that
natural person. In connection to the contracted services, supplier may process personal
IT Security Terms and Conditions
data of Open Text (i) personnel, (ii) customer personnel and / or (iii) other supplier /
partner personnel.
• Processed or processing means any operation or set of operations which is performed
on personal data or on sets of personal data, whether or not by automated means, such
as collection, recording, organization, structuring, storage, adaptation or alteration,
retrieval, consultation, use, disclosure by transmission, dissemination or otherwise
making available, alignment or combination, restriction, erasure or destruction.
• Use of personal data must be relevant and not excessive in relation to the purpose or
purposes for which they are processed. In connection to the processing of personal data,
supplier will follow Open Text’s written instructions where appropriate.
• The supplier must adhere to all applicable national and international privacy / data
protection legislation including, with effect from it coming into force the EU General Data
Protection Regulation 2016/679 (‘GDPR’) and specifically ensure that personal
information may not be transferred outside the European Economic Area unless
approved by Open Text and on the basis of appropriate safeguards in line with the
provisions of GDPR and the rights of residents specified in GDPR.
• Personal data processed must not be kept for longer than is necessary for that purpose
or those purposes.
• Appropriate technical and organizational measures must be taken against unauthorized
or unlawful processing of personal data and against accidental loss or destruction of, or
damage to, personal data. Upon Open Text request supplier will provide a description of
these measures.
• Supplier agrees that data protection principles apply to the processing of personal data
irrespective of the geographical location chosen by the organization.
• The contract does not give the supplier any rights in any Open Text information or intellectual property.

Additional Terms and Conditions

Part I – Definitions

In these Terms and Conditions the following expressions shall have the following meanings:-

“the Agreement” – these Terms and Conditions, the Installation Notes and the Quotation.

“the Company” – WeedFairy.Net

“the Customer” – the person, firm or company which has accepted the Quotation.

Part 2 – Customer pre-installation obligations

a) The following duties must be carried out by the Customer before installation starts to enable the Company successfully to install the System. The Customer must:-

(i) Obtain and pay for all necessary consents and licences for the installation of the System (such as landlord’s consent);

(ii) Give the Company free access to the premises on the date and time agreed to install the System, and arrange for easy access to all working areas and surfaces for the Company engineers to carry out the necessary work to install the System;

(iii) Supply adjacent to the intruder alarm control unit a non switched fuse 240v spur outlet, unless the Company’s engineer has been requested to fit this device by the Customer and this has been noted on the Quotation;

(iv) Advise the Company of the existence of concealed water, gas, electricity, telephone or other services (if any known about) and point out to the installation engineer their location before work commences.

The Company will use reasonable skill and care in identifying any concealed services not so pointed out. The Company will only be liable for damage to these services or for resulting damage to the extent that it does not take such reasonable care;

(v) Be responsible for the lifting of any floorboards or floor coverings other than carpets. Note that the Company cannot be held responsible for any damage as a result of lifting and re-fitting carpets. Also be responsible for any proposed flush fitting of units and making good thereafter.

b) If the Customer wishes the Company to use any existing equipment as part of the System, it will be assumed to be in full working order. Where the Company on installation discovers this is not the case, any work required to bring such equipment up to an acceptable standard will be charged for on a time and material basis.

c) Where damage could be caused which may not be immediately apparent to our operatives, the Company cannot be held liable where it has not been notified of such a possibility.

Part 3 – Supply of System

a) The Company will install the System at the premises or site specified in the Quotation on the anticipated delivery date quoted by the Company provided that the Company has by that date received payment of 50% of the Installation Charge as referred to in Part 7a. Any provisional fitting date will be held for 5 working days only pending receipt of the above and the signed contract.

b) The Company will use reasonable endeavours to install the System neatly and to conceal cables wherever possible, but where this is impractical the cables will be surface run.

c) The System will be installed in accordance with the recommendations contained in the British Standard Institute’s specification for intruder alarms on buildings current from time to time on the date on which installation starts. Any change made in the Standard for intruder alarms will not be deemed to be retrospective to existing installations.

d) On installation, the Company will give one briefing and demonstration of the System to the Customer or his/her representative. (There will be an additional charge if further instructions are required.) This demonstration, the operating instructions, keys or code number will be supplied to the Customer on payment of the balance of the Installation Charge as set out in Part 7a.

e) Where a deduction from cost has been made by Shield Security for installation of first fix wiring by a third party, Shield Security personnel can only check the position of such wiring against their original specification. We can not check or be held responsible for the integrity of the wiring as inevitably the wire runs are concealed behind plaster, under floors etc. Please be informed that Shield Security will only become aware of any problems with the integrity of the wiring when our fitter attempts to power up and commission the system.

Part 4 – Customer’s post installation Obligations

a) It is the responsibility of the Customer after the installation is completed to refit any floorboards, carpets or other floor coverings lifted before installation and to carry out any building work, cutting away, decoration or making good unless specifically stated in the Specification, other than any required by the failure to exercise reasonable care and skill by the Company its employees or agents.

b) The Customer will (on or immediately after the Installation Date) notify the Company and/or Police in writing of the addresses and telephone numbers of persons who hold keys or codes for the System and the persons responsible for the opening and closing of the premises and upon any change notify the Company and Police immediately in writing. The Company shall not be responsible or liable for any loss or damage caused or resulting from any failure to notify the Company or Police.

c) At all times after the installation is completed the Customer will:-

(i) Operate the System in accordance with the instruction manual;

(ii) Where applicable, pay any line or equipment charges due to third parties (and increases from time to time);

(iii) Pay for all electrical supplies to the System and remain responsible for the upkeep and maintenance of all electrical supplies to the System.

Part 5 – Company’s post installation Obligations

The Company will:-

a) Carry out any repairs or replacement to the System (excluding existing equipment of the Customer incorporated into the system) required by any faulty materials or workmanship within twelve months of the Installation Date.

b) At the request of the Customer and within a reasonable time after such request carry out such further works to the System as are necessary to keep the same in operation or to modify, upgrade or replace the System at a price agreed by the Customer and the Company.

c) Offer to do any modification, alteration or upgrading of the System required to comply with any requirement or regulations of the Police or other authority subject to costs determined by survey and agreement between Customer and Company.

Part 6 – Monitoring & Maintenance (or maintenance only where relevant)

a) The Company will carry out Monitoring and Maintenance services as set out in the Installation Notes and as agreed in writing between the Customer and the Company.

b) Monitoring and Maintenance are on a one year fixed term basis, running in the first year from the Installation Date. If the Company wishes to provide Monitoring and Maintenance for further periods it will send the Customer an invoice for the following year’s charges, at least four weeks before expiry of the annual term. If the Company does not wish to continue to provide Monitoring and Maintenance, it will send written notice of this fact to the Customer at least four weeks before the expiry of the annual term.

c) At any time after the expiry of the first year of Monitoring and Maintenance the Customer may terminate Monitoring and Maintenance by giving at least four weeks’ written notice.

d) At any time after the expiry of one year from the Installation Date the Company shall have the right to increase the Monitoring and Maintenance Inspection Charges. Any increases will be notified to the customer at the time of invoice.

e) Monitoring and Maintenance Inspection Charges are reviewed on 1 January each year.

f) The Company will carry out routine maintenance inspection during the hours of 08:30 to 17:30 Monday to Friday (excluding Bank Holidays) on a date previously agreed with the Customer and in accordance with the relevant Standard if applicable.

g) Monitoring and Maintenance of the System may be withdrawn immediately without advice or notice of withdrawal should any agreed payment fail to be made within 30 days of invoice or direct debit payment date.

Part 7 – Payment

a) The Customer will pay 50% of the Installation Charge as a deposit to the Company before installation begins, and the balance together with the Maintenance Inspection Charge for the first year on the Installation Date. For the avoidance of doubt all monies to be paid within 14 days of the final invoice.

b) The Customer will pay the Monitoring Charge for the first year on receipt of an invoice issued by the Company once connection has been made to the Alarm Receiving Centre.

c) Where the attendance of the Company’s employees is requested for any reason whatsoever (apart from normal maintenance inspections or under the guarantee by the Company in Part 5a) the Company reserves the right to charge the Customer for labour at its standard rates (including travelling time) and for materials.

Part 7.1 – Refund/Cancellation Policy (Domestic sales only)

1. The company will refund any item ordered online if the goods are returned in the same condition that they were sent and within seven days of receipt. This means that all the packaging must be returned and the items must not be used or damaged in any. Once we have received the goods back and inspected their condition we will organise a refund within 7 working days. This does not affect any statutory rights.

2. If an order is cancelled and the goods have not been dispatched we will refund monies within 7 working days. We must have received written notification of the cancellation and you must have received an acknowledgement (we also advise that you call our sales team 01482 300833 which would help speed up processing and prevent any delays). If the goods have been dispatched please return as per 7.1a

Part 8 – General Conditions

a) Ownership of the Customer Equipment will pass to the Customer on payment of the balance of monies as set out in Part 7a.

b) The Customer will not assign, sell, charge, mortgage, pledge or attempt to part with possession of any part of the Company Equipment nor any interest in it nor encourage or allow any person to adjust, tamper, alter or interfere in any way whatsoever with the Company Equipment.

c) The Company is entitled to transfer or assign all or any of its rights in this Agreement and to perform any of its obligations through nominated subcontractors although the Company will still be responsible to the Customer for its obligations.

d) Any variation or modification of any of the terms and conditions of this Agreement must be evidenced in writing and signed by a duly authorised representative of the Company.

Part 8.1

Delivery of Goods/Policy (were appropriate)

Save as otherwise agreed in writing by the Company delivery shall be made by the Company making the goods available for collection from its premises and so informing the Purchaser or, if some other place for delivery is stated in any acknowledgement of order (AO), by the Company or its nominated carrier tendering the Goods for delivery to the stated place. If the Purchaser fails to take delivery or to give adequate delivery instructions, the Company may (without prejudice to its other rights) store or dispose of the Goods, in which case the Purchaser shall pay to the Company upon request the amount of any reasonable storage or disposal charges. If the Purchaser does not take delivery or give adequate delivery instructions within 14 days of the Company’s notification that the Goods are ready for despatch the Company may without prejudice to any other rights terminate the Contract in accordance with clause Whilst the Company will seek to meet the stated delivery time, it is approximate and the Company shall not incur liability in relation to late delivery. If no time for delivery is agreed the Purchaser shall accept the Goods when ready for delivery.

The Company may deliver in instalments constituting separate contracts and delay in delivery of any instalment will not entitle the Purchaser to terminate the Contract, nor permit the set off of any payments in respect of one delivery against any claim in respect of any other delivery. Where Goods are delivered by instalments the Company may issue separate invoices.

Part 9 – Termination

a) If the Customer commits any breach of its obligations under the Agreement and fails to remedy the same within 30 days of notice by the Company requesting the breach to be remedied, or if any payment due under this Agreement is more than 30 days in arrears the Company may terminate the Agreement by giving the Customer 14 days notice in writing of the termination.

b) The Company may terminate this Agreement immediately by notice in writing to the Customer if the Customer goes into liquidation, becomes bankrupt, makes a voluntary arrangement with his creditors or has a receiver or administrator appointed.

c) The Company reserves the right to terminate the Agreement immediately if the System or the premises are destroyed or so substantially damaged that the Company is unable to reasonably continue its obligations hereunder and also charge to the Customer the value of Company Equipment destroyed. Any monies paid for Monitoring and Maintenance will be refunded on a pro rata basis for that period when the Customer is without the System.

d) On termination of Maintenance and Monitoring by either the Customer or the Company or on expiry of the Maintenance and Monitoring services:-

(i) The Customer will give the Company free access to remove the Company Equipment;

(ii) It shall be the absolute responsibility of the Customer to ensure the safety of any remaining electrical installation following removal of the Company Equipment.

e) If the Company is not paid the balance of the Installation Charge as set out in Part 7a, it may remove the System from the Customer’s premises. In this event, the Customer will be responsible for any breakage or other damage, in particular for the refitting of any floor boards, carpets or other floor coverings and to carry out any building work, decoration or making good, arising from the removal of the Company Equipment unless the same is caused by the failure to exercise reasonable care and skill by the Company, its employees or agents.

Part 10 – Limitation of Company’s Liability

PLEASE READ THIS SECTION CAREFULLY. IT CONTAINS RESTRICTIONS ON THE COMPANY’S LIABILITY IN THE EVENT OF A CLAIM BY THE CUSTOMER

a) The System is intended only to reduce the risk of loss or damage to the property and injury to persons on the premises to the extent that is reasonably practicable by use of such equipment. The Company gives no undertaking to the Customer that the System may not be compromised or circumvented or that the System will prevent any loss by burglary, theft or otherwise. The Company does not guarantee that particular loss, damage or injury can and will be prevented by use of the System.

b) The Company accepts responsibility for ensuring that the System complies with the Specification and will be reasonably capable of meeting the purpose but does not accept any larger responsibility than that, whether in negligence or otherwise save as set out in this Part 10.

c) The Company accepts liability without limit for (i) death or personal injury caused by its or its employees failing to take proper care whilst acting in the course of their employment; and

(ii) any fraudulent statements of fact made by it which caused the Customer to enter into this Agreement.

d) The Company shall not be liable for any loss or damage suffered by the Customer however caused, whether as a result of any failure to exercise reasonable care and skill, breach of these terms, false statement or otherwise or resulting from any unauthorised entry or burglary, theft, robbery, damage, disturbance or any other cause, subject to Part 10c.

e) The Customer shall be liable for the cost of any key holding charges regardless of the nature of the call including any alarm equipment failure.

f) The Company will have no liability for any loss suffered by the Customer as a result of a call not being received at the Alarm Receiving Centre, if this is due to the fault of BT, Kingston Communications or other communications provider, a failure in the electricity supply to the System or the Alarm Receiving Centre or as a result of the Company’s premises being evacuated, due to causes such as fire, bomb alerts or gas leaks.

g) Where the Company accepts liability for loss suffered by the Customer if a call is not received at the Alarm Receiving Centre, as a result of a failure in the communication system at the Alarm Receiving Centre or a breakdown in the equipment, which in either case is due to the fault of the Company, claims shall be limited to the amount specified in the installer’s insurance schedule covering electronic security systems, a copy of which can be seen on request.
h) The Company or its insurers shall not be liable or investigate any claim for loss unless the Customer has given written notice as soon as is reasonably practicable (14 days) after its occurrence