DRAFT FOR LEGAL REVIEW — not yet approved for use with customers.

TM WerX — Customer Agreement

Version 2026-11-tm-draft-1.

1. About this agreement

1.1 This agreement is between CAD WerX Limited, a company registered in England and Wales with number 17362101 and registered office at Unit 7 Bridge View Park, Henry Boot Way, Hull, HU4 7DW (“we”, “us”), and the organisation named when the account was opened (the “Customer”, “you”).

1.2 The person who opens the account accepts this agreement on the Customer’s behalf and confirms they are authorised to do so. Each office user also accepts it before using the Service.

1.3 The Service is for businesses only. It is not offered to consumers.

2. The Service

2.1 TM WerX (“the Service”) is web software for traffic management companies. Office users plan jobs and visits, allocate crews, vehicles and drawings, and review site records. Crew members use a web app on their phones to receive jobs, complete checks and sign-offs, take photos and send records from site.

2.2 The crew app is installed from a web link to the phone’s home screen. It keeps jobs, drawings and documents on the phone so it can be used without signal, and sends records and photos when signal is available. Records made without signal are not seen by the office until they are sent.

2.3 The Service can link to a CAD WerX account so that issued CAD WerX drawings can be added to jobs. CAD WerX is a separate service under its own agreement.

3. Your responsibilities

3.1 You remain responsible for your work. You are responsible for planning, designing, installing, maintaining and removing traffic management, for the competence and supervision of your people, for your risk assessments and method statements, and for complying with the Safety at Street Works and Road Works Code of Practice, permits and the law.

3.2 Starter documents. The Service includes example risk assessment, method statement, vehicle check and hazard wording to help you start. It is marked DRAFT until one of your administrators approves your own version. You must review and adapt it to your work and each site before relying on it.

3.3 Not an emergency service. Lone-working check-ins, the panic alarm, notifications and alerts depend on phones, signal, power and third-party notification services, and may be delayed or fail. They support, and do not replace, your own emergency and lone-working arrangements. In an emergency your people must call 999.

3.4 Information from the Service. Details read from job requests, postcode positions, timesheets and cost figures are worked out automatically and may be wrong. Check them before relying on them, for example for pay or invoices.

3.5 Your workers. You must tell your workers how their information is used in the Service, including their position when they sign in, sign out and raise an alarm, their latest position while signed in to a visit, their photos, signatures and working times, and have a lawful basis for that use (see clause 12 and the Schedule).

4. Accounts and users

4.1 Each person must have their own login. Logins must not be shared. You are responsible for all activity under your account.

4.2 Office users are invited by email. Crew logins are made by your office users, who give the crew member their username and password. You must switch off the login of anyone who leaves.

4.3 Keep login details secure and tell us straight away at support@tmwerx.co.uk if you suspect an account has been compromised.

5. Subscription and fees

5.1 The Service is charged per active user (office users and crew logins) per month at the price shown when you subscribe, plus VAT where applicable. Payment is taken in advance through our payment provider, Stripe.

5.2 Adding a user is charged straight away for the rest of the billing period. Switching a user off gives a credit against your next invoice.

5.3 The subscription renews monthly until cancelled. You can cancel at any time from your account page, and cancellation takes effect at the end of the paid period. Fees already paid are not refunded, except as the law requires.

5.4 If a payment fails, we will tell you and retry. If it is still unpaid 14 days after the due date, we may suspend access until it is paid. Records already on crew phones are kept on the phone and sent once access returns.

5.5 We may change our prices by giving at least 30 days’ notice. The change applies from your next billing period after the notice ends.

6. Your content

6.1 You own the content you and your users put into the Service: jobs, drawings, documents, records, signatures and photos (“Your Content”).

6.2 You give us a licence to store and process Your Content only to provide, support and secure the Service.

6.3 Records sent from site are kept as they were sent and cannot be edited. Office users can add notes and corrections, which are kept alongside them.

6.4 Sharing with your clients. An office user can make a link that lets anyone who has it view a job’s record, drawings and photos until it expires or is switched off. You are responsible for who you send links to.

6.5 Keeping records. Completed jobs are deleted, with their photos and drawings, after the period set by your administrator (6 years unless changed). You can download any job, or all your data, at any time. Keep your own copies of anything you need to keep for longer.

6.6 You confirm you have the right to upload Your Content, including drawings and logos, and that it does not infringe anyone else’s rights.

7. Our intellectual property

7.1 We and our licensors own the Service and all rights in it. You may use it only for your own business during your subscription.

7.2 You must not copy, resell, reverse engineer or attempt to obtain the source code of the Service, or use it to build a competing product, except as the law permits.

8. Acceptable use

8.1 You must not: (a) use the Service unlawfully or to monitor people beyond what clause 3.5 describes; (b) try to gain unauthorised access to the Service or interfere with it; (c) use automated means to extract data from it, other than the downloads it provides; or (d) let anyone outside your organisation use your account, other than viewing a share link under clause 6.4.

9. Availability and changes

9.1 We will use reasonable care and skill to provide the Service and aim to keep it available. We do not promise it will be uninterrupted or error-free.

9.2 We may carry out maintenance and improve or change features. We will not materially reduce the core functionality during a paid period without notice.

10. Third-party services

10.1 Postcode positions come from postcodes.io, which uses Ordnance Survey, Royal Mail and Office for National Statistics open data. Notifications to phones are delivered by the phone maker’s push service (for example Apple or Google). We are not responsible for those services.

11. Confidentiality

11.1 Each party will keep the other’s confidential information confidential and use it only for this agreement, except where disclosure is required by law.

12. Data protection

12.1 Each party will comply with UK data protection law, including the UK GDPR and the Data Protection Act 2018.

12.2 You are the controller of the personal data in Your Content, including your workers’ information. We process it for you as processor under the Data Processing Schedule below.

12.3 We are controller for account, billing and security data, as our privacy policy describes.

13. Liability

13.1 Nothing in this agreement limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot be limited or excluded by law.

13.2 To the extent the law allows, all terms implied by statute or common law are excluded.

13.3 Subject to clause 13.1, we are not liable for any: (a) loss of profit, revenue, business, contracts or goodwill; (b) indirect or consequential loss; or (c) loss arising from a record, alert, notification or alarm that was delayed or not delivered because of a phone, signal, power or third-party service.

13.4 Subject to clause 13.1, our total liability under or in connection with this agreement is limited to the greater of: (a) the fees you paid in the 12 months before the event giving rise to the claim; and (b) £[X].

14. Indemnity

14.1 You will indemnify us against claims, losses and costs arising from: (a) your misuse of the Service; (b) Your Content; and (c) your failure to meet clause 3.5.

15. Suspension and termination

15.1 Either party may end this agreement by cancelling the subscription. Cancellation takes effect at the end of the paid period.

15.2 Either party may end this agreement immediately by notice if the other: (a) materially breaches it and does not put the breach right within 14 days of being asked to; or (b) becomes insolvent.

15.3 We may suspend access for non-payment or misuse.

15.4 You can download your data during the term and for 30 days after it ends.

15.5 We will delete Your Content 90 days after the agreement ends. We keep records we must keep, such as acceptances of this agreement and invoices, for 6 years.

16. Force majeure

16.1 Neither party is liable for delay or failure caused by events beyond its reasonable control, including the failure of a hosting, payment, email or push notification provider, or of mobile networks.

17. Changes to this agreement

17.1 We may change this agreement by giving at least 30 days’ notice by email to your account administrator. If you do not accept a change, you may cancel before it takes effect, and we will refund any fees paid for the period after the change. Changes required by law may take effect sooner.

18. Notices

18.1 We will send notices to your account administrator’s email address. You can send notices to support@tmwerx.co.uk.

19. General

19.1 This agreement is the whole agreement between us about the Service. Neither party may transfer it without the other’s consent, except that we may transfer it to a successor of our business. No one else has rights under it.

19.2 This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Schedule: Data Processing

S1 Instructions. We process personal data for you only on your documented instructions, which are to provide the Service under this agreement.

S2 What is processed. About your office users and crew: names, work email addresses (office users), usernames, mobile numbers, day costs, qualifications and card expiry dates, signatures, sign-in and sign-out times and positions, position when a panic alarm is raised, the latest position while signed in to a visit (not a history), lone-working check-ins, photos they take, vehicle checks, near-miss reports and notes. About others: names and contact details in jobs and job requests, and people or vehicles that appear in site photos. Processing lasts while this agreement runs and then as clause 15 sets out.

S3 Confidentiality. We ensure everyone who processes the data is bound by confidentiality.

S4 Security. We keep appropriate technical and organisational measures in place, including encryption in transit, hashed passwords, per-company separation of data, end-to-end encrypted notification messages, fingerprints (SHA-256) on stored files, and encrypted backups.

S5 Sub-processors. You authorise the sub-processors below. We will give you at least 30 days’ notice of any new sub-processor, and you may object.

Sub-processor	Purpose
Cloudflare, Inc.	Hosting, database, file storage and email receiving
Stripe Payments Europe Ltd / Stripe, Inc.	Payments (account contact details only)
Resend, Inc.	Emails to office users
Apple, Google and Mozilla push services	Delivering notifications to phones (the message content is encrypted so they cannot read it)
postcodes.io	Postcode lookup (postcode text only)

S6 Transfers. Where data is processed outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Addendum.

S7 Assistance. We will help you respond to data subject requests and meet your security, breach notification and impact assessment obligations, as far as reasonable.

S8 Breaches. We will tell you without undue delay after becoming aware of a personal data breach affecting your data.

S9 End of processing. At the end of the agreement we will delete or return the data, as clause 15 sets out.

S10 Audit. We will make available the information reasonably needed to show compliance with this Schedule.