Terms and Conditions

1. About these Terms

1.1 APEXi Flow is a trading name of APEXi Digital Limited ("we", "us", "our"), registered in England and Wales, company number 17290313, registered office Ingleby Road, Messingham, North Lincolnshire, DN17 3SS. We are not registered for VAT.

1.2 These Terms are the contract between us and the business, charity or other organisation (the "Organisation", "you", "your") that creates an account to use APEXi Flow (the "Service"). They include Schedule 1 (Data Processing), Schedule 2 (Sub-processors) and Schedule 3 (Online Payments), and refer to our Privacy Policy.

1.3 Business use only. The Service is for organisations that run training courses. You must not use it as a consumer, and by creating an account you confirm that you are acting for the purposes of a business or organisation.

1.4 Who agrees. The person who creates the Organisation's account (the "Owner") confirms that they have authority to bind the Organisation to these Terms. The contract starts when the Owner ticks the box to accept these Terms and the Organisation's account is created. We keep a record of who accepted, which version they accepted and when, and every version stays readable on our website.

1.5 "In writing" includes email.

2. The Service

2.1 APEXi Flow is online software for training providers. It lets an Organisation set up courses, take registrations, run and record courses, record results, issue certificates, and, if it chooses, list courses online and take payments for them.

2.2 What we do not do. We provide software. We are not a training provider, an awarding body or a regulator, and we do not check courses, assessments, trainers' qualifications or the accuracy of anything you enter. Certificates and results pages are produced from the content, templates and decisions you set up. Whether a certificate is valid, accredited or accepted by anyone else is for you and the relevant awarding body or regulator.

2.3 Free to set up. Signing up, setting up and running courses costs nothing. Charges start when you choose a plan and when a register is confirmed, as section 4 explains.

2.4 Changes to the Service. We may improve, change or retire features. Where a change removes something you rely on, or makes a material change to what you pay for, we will tell the Owner by email at least 30 days before it takes effect, unless it is needed urgently for security or to meet the law.

2.5 Support. We provide support by email to support@apexiflow.com and through Report an Issue in the Service, on business days (Monday to Friday, excluding bank holidays in England and Wales). We will reply as soon as we reasonably can. We do not promise a particular reply or fix time. Support is for the Owner and the people the Owner has given a role in the Organisation, not for candidates or bookers, who should contact the Organisation.

3. Accounts and people

3.1 The Owner can invite others to the Organisation's account and give each a role. Each person must be an individual, must use their own sign-in, and must not share it. You are responsible for everything done under your account by the people you invite, as though you had done it yourself.

3.2 Keep sign-in details and passkeys safe. Tell us at once at support@apexiflow.com if you think a sign-in has been misused. We may require a person to sign in again, or reset a sign-in, to protect the Service.

3.3 You must keep the Organisation's details accurate, including the legal name and address that appear on invoices.

3.4 The Owner of an account can be changed only by us, on a written request from the current Owner, or from the Organisation if the Owner is no longer available, after we have checked who is asking. 3.5 A person may belong to more than one Organisation. Their access to each is separate, and ending or locking one does not affect the others.

3.6 Contacting you. We will email the Owner and the Organisation's administrators using the details given when the account was created. Part of the Service is keeping them informed, so we reserve the right to send:

(a) messages needed to run the account: invitations, sign-in and security notices, billing notices, and notices of changes to the Service or these Terms; and

(b) updates about the software: new and changed features, improvements, maintenance, tips on getting the most from the Service, how-to guidance, and a short message offering help if you have set up an account but not yet started using it. These are part of the Service and not advertising. They never promote offers, discounts or upgrades, or sell you anything, and every one of them carries a link to manage or stop them. We do not send marketing (offers, promotions, events or other products) unless you have asked for it. We do not send any of these to candidates, bookers or trainers whose details are in Your Content, which we hold on your behalf only. How we use personal data for these messages is set out in our Privacy Policy.

3.7 Closing your account (section 12) stops all of these messages.

4. Plans, charges and payment

What is charged

4.1 We charge for each candidate on a confirmed register (and for each candidate added to a register after it was confirmed), at the rate for the kind of course. Courses where Flow issues the certificate are "certificated"; courses where an awarding body issues the certificate and Flow records the candidate are "non-certificated". A candidate is charged once, whatever the result, including no result. Nothing is charged for signing up, setting up, taking registrations, finalising a course or issuing certificates as such.

4.2 You must have chosen a plan before a register can be confirmed or a course finalised. Only the Owner can choose a plan, and we never put you on one without your agreement. To choose a plan you must have a working payment card on file; if you have none, choosing a plan takes you to add one first, and the plan starts when the card is accepted. Saving a card does not by itself choose a plan.

4.3 Prices. The current prices, plans and rates are shown on the Current Plan page of your account and are confirmed to the Owner on screen and in the confirmation email when a plan is chosen. Prices are in pounds sterling and exclude VAT. We are not currently registered for VAT; if we become registered, VAT will be added at the rate then in force and shown on your invoices.

4.4 Flexible plans. A Flexible plan is a price for each candidate. Choosing it takes no payment. Each month we work out what you would owe on each of our Flexible plans for the candidates you had, and charge you the lowest total, using the rates you can see under "View Rates" on Current Plan. The rates that apply to you are set by us and cannot be changed by you. Candidates are invoiced on the 1st of the following month (section 4.6). You can cancel a Flexible plan at any time from Current Plan; the card stays on file, and what was used in that month is still invoiced at the end of it. Removing the card also cancels it.

4.5 Fixed plans. A Fixed plan is paid in advance, monthly or yearly as chosen, and gives a number of candidate credits for the period. A candidate uses credits instead of being charged on the monthly bill. A Fixed plan:

• renews automatically at the end of each period unless you switch "Auto renew" off, in which case it ends on the date

shown;

• can be changed to a different size, or changed to a Flexible plan, as the screen allows, with any amount due or

refundable shown to the Owner before they confirm;

• can be cancelled, in which case what was paid, less the months gone at the cost of a month and any credits used over

what those months included, is worked out and shown to the Owner before they confirm. Late in a period there may be no refund;

• may, if you allow it ("Allow extra candidates"), charge extra candidates on the monthly bill once credits run out.

If you do not allow it, a candidate that cannot be covered is held, the plan can go below zero, and only the courses that went past zero wait to be finalised until the shortfall is cleared.

The monthly bill and paying it

4.6 Each month closes on the 1st. On the 1st we create one invoice for the month and email the Owner a link to it, showing the date payment will be taken. Two business days later (excluding weekends and bank holidays in England and Wales) we charge the card you have on file. If a month has no charges there is no invoice. Fixed plan charges are taken when the plan starts or renews.

4.7 By saving a card and choosing a plan you authorise us, through our payment provider Stripe, to take payments from that card for: your plan; candidates charged under section 4.1; extra candidates; any Online payment fee under Schedule 3; and any amount owed on changing or cancelling a plan. We email you before each monthly bill is charged, with the date the payment will be taken, and send a receipt whenever a Fixed plan starts or renews. A change to a plan that costs or refunds money is shown on screen, with the amount, before you confirm it. You can change or remove the card at any time, but a plan cannot be started or kept without a working card.

4.8 Failed payment. If a payment fails we will email the Owner, with a link to update the card, and try again automatically. If an invoice is still unpaid 7 days after the first failed attempt, you will not be able to finalise courses, issue certificates or exports until it is paid (the "first lock"). If it is still unpaid 7 days after the first lock, everything except making the payment is locked (the "second lock"). During a lock: certificates already issued stay verifiable; renewal reminders pause; and public registration shows that registration is unavailable without saying why. Paying lifts the locks as soon as the payment is recognised. We may lift a lock earlier for a fixed time where there is a genuine problem.

4.9 Late payment. If an invoice is not paid by its due date, we may, at our discretion, charge interest on the overdue amount, from the due date until it is paid, at the rate allowed by the Late Payment of Commercial Debts (Interest) Act 1998 (currently 8% a year above the Bank of England base rate), together with the fixed sum and reasonable recovery costs that Act allows. We are not obliged to charge interest, and choosing not to on one occasion does not stop us doing so on another. We will not charge interest on an amount you have disputed in good faith under section 4.10 while the dispute is being looked into, or on an amount we have told you we will not charge.

4.10 Disputes about a bill. Tell us within 30 days of the invoice date at billing@apexiflow.com. We will look into it and correct any mistake. You must still pay any amount that is not in dispute.

4.11 Credits and goodwill. We may, at our discretion, credit a charge to a later bill. You have no right to a credit unless we confirm one in writing.

4.12 Changes to prices. We may change prices or plans. We will email the Owner at least 30 days before the change affects you. A change does not affect a Fixed plan period already paid for; it takes effect at the next renewal. If you do not accept a change you may close your account under section 12 before it takes effect.

4.13 No refunds are due for charges for candidates on a confirmed register, or for a part-used billing period, except as these Terms say or the law requires.

5. Online payments

5.1 Online Listing and Online Bookings are optional. Online Listing lists courses on a public page and works without payment. Online Bookings lets visitors book and pay online, through your own Stripe account. It is turned on by the Owner, who agrees the Online payment fee as part of setting it up, and is governed by Schedule 3, which forms part of these Terms.

6. Your data and your candidates' data

6.1 You own the content you put into the Service, including candidate records, templates and documents ("Your Content"). We do not claim ownership of it.

6.2 You give us a licence to host, copy, process and display Your Content only as needed to provide and secure the Service for you, and as these Terms and Schedule 1 allow.

6.3 For the personal data of candidates, trainers and bookers in Your Content, you decide what is collected and why, so you are the controller and we are your processor, as Schedule 1 sets out. You are responsible for: having a lawful basis for collecting and using that data; giving candidates the information the law requires (section 6.7 explains the privacy notice the Service shows them); keeping the data accurate; and not asking us to do anything that would breach the law. If you collect special category data (such as health information) through forms you build, you are responsible for having a valid condition for doing so.

6.4 We are the controller of the data about people who hold accounts, as our Privacy Policy explains.

6.5 We may produce statistics and measure how the Service is used, from information that does not identify you, your candidates or anyone else, to run and improve the Service. 6.6 Exporting your data. You can export your data during the term and during any closing period under section 12 using the tools in the Service.

6.7 The candidate privacy notice. Under the send button of every form your candidates fill in, the Service links a privacy notice in your name. Unless you link your own notice in your Company Profile, it is our default notice, filled in from your details and from how you use the Service, and it is on from the start so that your candidates always have one. The default is a general template provided for your convenience. It is not legal advice, and we give no promise that it meets your legal obligations or suits your organisation. You must read it, take your own legal advice before relying on it, and keep what it says accurate (for example, how long you keep records). You can approve it or link your own notice instead at any time. To the extent the law allows, we accept no responsibility and no liability for any loss arising from your use of the default notice, and you remain responsible, as controller, for the information you give your candidates.

7. Certificates, records and verification

7.1 You are responsible for the courses, assessments, results, templates, and certificates you create, including that they meet any requirement of an awarding body, regulator, or client. Check each certificate before you issue it.

7.2 Where Flow issues a certificate it adds a verification link and code. Anyone who has them can open the verification page, which shows whether the certificate is valid, expired or withdrawn, the candidate's name, the certificate number and the date it was issued, together with your name, logo and contact details. It never shows the outcome of a course or any other details. We keep that page working for as long as the certificate is valid, even after your account closes (section 12.7), unless we stop providing the Service altogether, in which case section 12.11 applies.

7.3 If you need to correct or reissue a certificate, you can do so in the Service. We do not alter your records ourselves except to put right a fault in the Service or at your written request.

8. Acceptable use

8.1 You, and the people you invite, must not: break the law or use the Service to harm others; enter data you have no right to use; send unlawful, misleading or abusive messages through the Service; issue a certificate you know to be false; try to access another Organisation's data or any part of the Service you are not permitted to use; probe or test the Service's security without our written permission; overload, interfere with or disrupt the Service, or bypass its limits (including the limits on public forms and emails); copy, resell, reverse engineer or build a competing service from it; or use automated tools to harvest data from it.

8.2 We may remove content or restrict features that break this section. Where we reasonably can, we will tell you first.

9. Our intellectual property

9.1 We and our licensors own all rights in the Service: the software, design, text, trademarks and logos. These Terms do not transfer any of them to you. You may use the Service only as these Terms allow.

9.2 You keep the rights in your own name, logo and branding. You allow us to display them on the Service as you set it up, including on certificates, results pages, emails, public listing pages and Stripe pages you choose.

10. Availability, support and security

10.1 We will provide the Service with reasonable skill and care. We do not promise that it will be uninterrupted or free of faults. We will tell the Owner when we can about planned maintenance, and will work to restore the Service quickly after any outage.

10.2 We use the security measures described in Schedule 1, Annex B, and review them regularly. You must also keep your own devices and sign-ins secure.

10.3 Your own copies. We keep backups of the Service so that we can restore it after a serious failure. They are for running the Service, not a substitute for your own copies. You are responsible for regularly exporting and keeping your own copy of your data, including candidate records, course records, results, and certificates, using the export tools in the Service, and for keeping any records the law or an awarding body requires you to hold. We do not promise to restore an individual record, file or version that you have deleted, changed or lost, or to restore it by a particular time. We will use reasonable efforts to help where we can, and may charge reasonable costs for restoring a particular record at your request.

11. Suspension

11.1 We may suspend or restrict part or all of the Service, with a notice where we reasonably can, if: payment is overdue (section 4.8); you or anyone you invite materially breach these Terms; we reasonably believe it is needed to protect the Service, other customers or people's data; or the law requires it.

11.2 We will restore the Service once the reason has been put right. Suspension does not stop charges for a plan paid in advance.

11.3 During any suspension, certificates already issued stay verifiable.

12. Ending the contract and closing an account

12.1 The Owner closes the account from the Billing section of the Service. We can also start closure for an account on written request from the Owner, or under 12.9.

12.2 Read-only period. On closure the account becomes read-only for 60 days. During this period nothing new can be created or finalised, but the Owner can sign in, export data, and download certificates and invoices. For the first 30 days the account can only be reopened. After that the Owner can confirm closure for good, or it becomes ready to close when the period ends.

12.3 Money owed. An account cannot close while money is owed. The last invoice is raised and charged as normal and an unpaid invoice stops the account closing until it is paid. A closed account that still owes money keeps the debt.

12.4 A Fixed plan on closing. A yearly plan with time still paid for is settled on the day closing is requested, using the cancellation calculation in section 4.5, and the amount is shown to the Owner before they confirm. If a remainder is owed and cannot be taken, the account does not start closing. A monthly plan is not cancelled, nothing is refunded for the month in progress, and it ends on the day its paid time is up. When the account closes any plan still running ends that day.

12.5 Online payments on closing. Schedule 3 section 7 applies.

12.6 What we delete. When an account is finally closed we delete Your Content, including candidate records, course records, uploaded documents, templates, forms, emails, clients, venues, quizzes, reminders and logs, and staff access to the Organisation. A person keeps their own login and any other Organisations they belong to.

12.7 What we keep, and why. So that certificates already issued stay verifiable for the people who earned them, we keep, for each certificate that is valid on the day the account closes: the certificate record (the candidate's name, the course, dates, number and expiry, and the issuing Organisation's name), the certificate file and the verification page, which keeps showing your name, logo and contact details. We keep each until the certificate expires, or for three years after closure if it has no expiry date. Replaced and withdrawn certificates are deleted. We also keep our own billing records, including invoices, for six years, as the law requires, the details of the Stripe customer record, and the record of who agreed to these Terms for the Organisation and when, for six years after closure. You instruct us to keep the certificate records on your behalf for this purpose; if you no longer exist or cannot be contacted, we will hold them as controller for that limited purpose.

12.8 After closure. The Owner keeps their login and can start a new Organisation straight away. The closed one then belongs to nobody.

12.9 Ending by us. We may close an account: on 30 days' written notice for any reason; or at once if you materially breach these Terms and do not put it right within 14 days of our asking, or you become insolvent, or we are required to by law. We will give the Owner the same read-only period to export data unless the law or a serious breach prevents it.

12.10 Ending or closure does not affect rights that have already arisen, or any clause meant to continue.

12.11 If we close the Service. If we decide to stop providing the Service altogether, or the part of it you use, we will give the Owner of every account at least 90 days' written notice, by email and in the Service, before it stops. Unless the law, a court or a serious security risk makes that impossible, in which case we will give as much notice as we can. During the notice period:

(a) the Service continues to work as normal, and you can export your data, certificates and invoices;

(b) we will not start new plans or take new Online Bookings after the date given in the notice, but existing plans and bookings continue to be honoured to the end of the period;

(c) we will refund the part of any plan you have paid for in advance that covers time after the Service stops, calculated by the cancellation method in section 4.5 but without deducting months you did not receive;

(d) we will not charge the Online payment fee on payments for courses that run after the Service stops, and will help you refund any such payments still held;

(e) where certificates have been issued through the Service, we will tell you before the end date what will happen to their verification pages and how to keep a record of the certificates and their verification codes. We will either keep the verification pages working until each certificate expires, or hand them to a person you agree to, or give you the means to publish your own, and we will say which in the notice; and

(f) after the end date we will delete your data under section 12.6 and Schedule 1, clause 9, and keep only what the law requires. If we close the Service because we are insolvent, the arrangements that apply will be those of the person dealing with the insolvency, and we will tell you what we can.

12.12 Not affected by notice. Giving notice under 12.11 is not a breach of these Terms, and you are not charged for ending your account because of it.

13. Liability

13.1 Nothing in these Terms limits or excludes liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or anything else that cannot be limited or excluded by law.

13.2 We are not liable, in contract, tort (including negligence) or otherwise, for: loss of profit, revenue, business, contracts, goodwill or anticipated savings; loss or corruption of data caused by something outside our control or caused by you, or loss that you could have avoided by keeping your own copies as section 10.3 requires; or any indirect or consequential loss.

13.3 Our total liability to you for all claims arising out of or in connection with one event, or a series of connected events, is limited to the charges you paid us for the billing period or periods in which that event, or the first of those events, took place and during which it continued, but never more than the charges you paid us in the 12 months before the event. The charges we count are the plan charges, candidate charges and any Online payment fee for those periods.

13.4 You are responsible, and we are not, for claims by candidates, bookers or others about courses, certificates, results or any content you create or collect, including claims arising from your use of data in breach of the law, and for VAT and any other tax on your sales, as Schedule 3, clause 3.3A says.

13.5 We are not responsible for delay or failure caused by events outside our reasonable control, including failure of power or telecommunications, third-party service failure (including Stripe or our hosting providers), cyber-attack that we have taken reasonable steps to prevent, industrial action, fire, flood, epidemic, war or government action. If such an event lasts more than 30 days, either of us may end the contract on notice.

14. Changes to these Terms

14.1 We may change these Terms, for example to reflect a change in the law or the Service. The current version, with its number and date, is always on this page. For a material change we will email the Owner at least 30 days before it takes effect. If you do not agree, you may close your account before the date, and the old Terms apply until then.

14.2 If a change affects the data processing terms (Schedule 1) or the sub-processors (Schedule 2), section 4 of Schedule 1 applies.

15. Complaints and feedback

15.1 We welcome feedback. If you are unhappy about the Service or these Terms, write to support@apexiflow.com. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days, and tell you what we have done. Data protection complaints are also covered by our Privacy Policy.

15.2 Complaints do not affect your right to bring legal proceedings.

16. General

16.1 Who is bound. These Terms are between you and us. No one else can enforce them.

16.2 Assignment. We may transfer our rights and duties under these Terms to another company (for example, on a sale of our business) and will tell you. You may not transfer yours without our written consent.

16.3 Entire agreement. These Terms, with the Privacy Policy, are the whole agreement and replace any earlier discussions about the Service. Each of us confirms that we have not relied on anything not written in them.

16.4 If part is invalid. If a court finds part of these Terms unlawful, the rest stays in force.

16.5 No waiver. A delay in enforcing a right does not mean we have given it up.

16.6 Notices. We may give notice by email to the Owner and through the Service. You may give notice by email to support@apexiflow.com, or by post to our registered office.

16.7 Our relationship. Nothing in these Terms makes us partners, or either of us the other's agent.

17. Governing law

17.1 These Terms, and any dispute about them or the Service, are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. This applies wherever the Organisation is based, because these Terms are for businesses only.

Schedule 1 — Data Processing Terms

Part A — Details of the processing

Part B — The terms

1. Instructions. We will process the personal data only on your documented instructions, which are these Terms, your use of the Service and settings, and any written instruction you give that is consistent with them. We will tell you if we think an instruction breaks the law. We may also process it where the law requires, and will tell you beforehand unless the law prevents us.

2. Confidentiality. Everyone we allow to process the data is under a duty of confidentiality and has access only if they need it to provide the Service.

3. Security. We take appropriate technical and organisational measures to protect the data, as Annex B describes.

4. Sub-processors. 4.1 You give us general authority to use the sub-processors in Schedule 2. 4.2 We will tell the Owner by email at least 30 days before adding or replacing one, so you can object. If you object on reasonable data protection grounds and we cannot resolve it, you may close the account without penalty and we will refund any amount paid in advance for the period you will not use. 4.3 Each sub-processor is bound by a written contract with data protection duties no less protective than these. We stay responsible to you for their performance.

5. International transfers. We will transfer personal data outside the UK only as the UK GDPR allows, with the safeguards in Schedule 2.

6. People's rights. We will help you to answer requests from people exercising their rights, by the tools in the Service and on request. If a request about your data reaches us, we will pass it to the Owner within 5 business days and will not answer it ourselves unless you ask.

7. Our help with your duties. We will give you reasonable help with your duties on security, breach notification, data protection impact assessments and consulting the ICO, taking into account the information we have. We may charge reasonable costs for help that goes beyond what is normal.

8. Personal data breach. We will tell the Owner without undue delay, and in any case within 48 hours, after we become aware of a breach affecting your data. We will say what we know: what happened, what data and how many people are affected, the likely effects, what we have done and what we recommend. We will keep you updated. You decide whether to notify the ICO and the people affected.

9. Return and deletion. During the term and any closing period you can export your data. When the account is finally closed we delete your data as section 12.6 of the Terms says, except: the certificate records and billing records section 12.7 of the Terms describes, which we keep on your instruction and as the law requires; and any copy we must keep by law. Data in routine backups is deleted when the backup is overwritten, within 7 days.

10. Audit. We will give you the information you reasonably need to check that we comply with this Schedule. You may, no more than once a year (or at once after a breach), and on 30 days' notice, audit our compliance, in a way that does not disrupt our business or other customers or reveal other customers' data. We may meet this by giving you a recent independent report.

11. Our own use. We are a controller of the data about account holders and billing, as our Privacy Policy explains. This Schedule does not apply to that data.

12. Liability and law. Section 13 of the Terms applies. These terms are governed by the law of England and Wales. If this Schedule conflicts with the rest of the Terms on a data protection matter, this Schedule applies.

Annex A — Roles for access

What the Service lets you configure so that each person sees only what they should.

• Each Organisation's data is separated from every other Organisation's.
• Roles: the Owner and administrators can see an Organisation's records and settings; trainers see their own courses

and only those, together with what those courses use. A person sees only the records their role allows.

• Candidates and visitors never see other people's records.

Annex B — Security measures

• Encryption in transit. Connections to the Service use HTTPS, and the Service refuses plain HTTP.
• Separate organisations. The database applies row-level rules and every request is checked on the server for the

Organisation and the person's role, so one Organisation cannot reach another's data. The browser cannot write to the database directly: every save goes through the server, which checks who is asking.

• Sign-in. Passwords are stored hashed, passkeys are supported, sessions expire after inactivity and after a

maximum time, and the long-lived session token is held in a cookie that scripts cannot read. The accounts we use to run the Service (hosting, database, code, payments and email) are protected by two-factor sign-in.

• Public forms and email. Public booking, registration and feedback forms and the emails they send have rate

limits and abuse checks, and sign-in, sign-up, forgotten-password and paid-booking pages use a bot check (Cloudflare Turnstile).

• Files. Uploaded files are stored privately, in the EU, and opened only through time-limited links after a check of

who is asking.

• Monitoring. Errors are sent to a monitoring service with personal details removed where we can, and sign-in and

security events are logged.

• Staff access. Access to customers' data is limited to staff who need it for support and operations, and is

protected by two-factor sign-in on the accounts that can reach it.

• Backups and recovery. The database is backed up automatically every day by our database provider, and each backup

is kept for 7 days. Backups are for restoring the Service after a serious failure; they are not a substitute for your own exports (section 10.3 of the Terms).

• Testing. We have had an independent security review and carried out its fixes, and we repeat it at least every 12 months and after any major change.
• Incidents. We have a breach procedure, described in clause 8.

Schedule 2 — Sub-processors

This is the list at 24 October 2026. The same list is in section 8 of our Privacy Policy.

Stripe is an independent controller of payment details for its own legal duties, such as fraud prevention.

Schedule 3 — Online Payments

1. What it is and when it applies

1.1 Online Bookings lets visitors book listed course dates and, where a course has an Amount, pay for them online. It needs a plan, a working card on file, booking terms (3.3B) and your own Stripe account connected to Flow. It is turned on only by the Owner, who agrees the Online payment fee as part of setting it up. Until then nothing can be booked online.

1.2 This Schedule applies as well as the rest of the Terms. If they conflict about Online Bookings, this Schedule applies.

2. Stripe and the money

2.1 You will have your own Stripe account, made or connected through Flow. Your contract for it is with Stripe and Stripe's terms apply to it. We are not a party to that contract, and Stripe's fees (card fees, invoice fees and dispute fees) are paid by you to Stripe.

2.2 A booker's payment goes from the booker to you, on Stripe's own payment page, in your name. It goes into your Stripe balance and then to your bank on your own payout schedule. The money never passes through us. We are not a bank, payment institution or payment service provider and we never hold your funds.

2.3 You allow us to use your Stripe account to: start a payment; see whether it was paid; refund it, when you ask; read the invoice; and keep our own copy of the invoice and any credit note. We cannot take your money into our own account.

3. You are the seller

3.1 Every booking is a contract between you and the booker. We are not a party to it and we do not sell your courses.

3.2 You are responsible for: your prices, availability and course information; the VAT treatment of your sales; your booking and cancellation terms; refunds and disputes (chargebacks) with bookers, which come out of your Stripe balance, Stripe keeps its card fee on a refund; and for meeting the law that applies to your sales to bookers, including the information you must give consumers before they buy and their cancellation rights.

3.3 Prices and VAT. The Service shows prices as you have entered them. A price shown "+ VAT" is charged with VAT at 20% added and shown as its own line; "including VAT" and no-VAT prices are charged as the plain amount. The booker is charged the price and VAT wording as they stood when they went to the payment page.

3.3A VAT and other taxes are your responsibility. You are solely responsible for deciding whether VAT or any other tax applies to your courses and bookings; for being registered where the law requires; for choosing the right price wording and rate; for what your invoices, receipts and records say; and for accounting for, reporting and paying any tax to HMRC or any other authority. The Service does not give tax advice and does not decide whether VAT is due, and we do not use Stripe Tax. The Service only does the arithmetic your price wording promises. We are not liable for any VAT, tax, penalty, interest or other loss that arises from your decisions about tax, from the prices and wording you enter, from an error in the tax treatment you choose, or from your failure to keep or file records. If you think a price, receipt or invoice shows the wrong tax, you must tell us and correct it yourself; we will help where we can. If a calculation error in the Service itself causes a loss, our liability for it is limited as section 13 of the Terms says.

3.3B Booking terms. Every booking made through your Online Listing, free or paid, is made on your booking terms. The booker ticks a box above the send button of the booking form to agree to them, and the Service keeps a record of that agreement for you (who agreed, for which date, to which version, and when). Unless you link your own terms in your Company Profile, they are our default booking terms, filled in from your details. The default is a general template provided for your convenience. It is not legal advice, and we give no promise that it meets your legal obligations or suits your business. You must read it and take your own legal advice before approving it or relying on it. Online Bookings cannot be turned on until the Owner has approved the default or linked your own terms. If the default changes after that (for example because your details change), bookings carry on and the Owner is asked to approve it again. You can link your own terms instead at any time. To the extent the law allows, we accept no responsibility and no liability for any loss arising from your use of the default booking terms, and you remain responsible for your booking terms and for honouring them, including bookers' legal rights.

3.4 The booker's receipt and invoice come from Stripe in your name. We keep our own copy of each invoice and credit note on the payment record for you to download.

4. The Online payment fee

4.1 We charge you a flat Online payment fee for each candidate paid for online, one fee for each paid place, ever. It is never a percentage of the price. The fee is not taken from the booker's payment or from your Stripe account: it is a line on your ordinary monthly bill and is paid with it, by card, under section 4 of the Terms. It is never charged booking by booking, and it does not use a Fixed plan's credits.

4.2 The rates are shown on Current Plan and are confirmed to the Owner when they turn Online Bookings on. They are priced in levels, for each month, as the rates page shows.

4.3 When the fee is owed. Nothing is owed on the day a booking is taken.

• If the paid candidate is on a register when it is confirmed, the fee is owed then.
• If the candidate is added after the register was confirmed, the fee is owed at that moment.
• If the payment is kept but the candidate never reached a confirmed register (for example a no-show, an incomplete

booking, or a register never confirmed), the fee is owed 7 days after the course's first day.

• In any case the fee is owed no later than 30 days after the first day the course had when the booker paid.

4.4 Refunds and the fee. A full refund of the booker's payment before the fee is owed means it is never owed. A payment taken back in a dispute counts as a full refund. If any part of the money for that place is kept, the fee is owed. A refund or lost dispute after the fee is owed does not bring the fee back.

4.5 We may, at our discretion, credit a fee. You have no right to ask for a credit.

4.6 We may change the rates under section 4.12 of the Terms.

5. Pausing and stopping

5.1 Online Bookings pauses automatically, and every course listing keeps showing but the booking button shows a contact message, if: Stripe restricts or pauses your Stripe account or it is no longer in good standing; your Flow account is locked for non-payment (section 4.8 of the Terms) or is closing; or we pause it under section 11 of the Terms. A pause pauses everything: free courses cannot be booked online either. Bookings never go through unpaid by accident. We email the Owner and raise a task when a pause starts.

5.2 You may switch Online Bookings off at any time. You may also disconnect Stripe, which only stops Flow using the account. Nothing is done to the account at Stripe. Payments already taken remain yours to refund, and fees already owed stay owed.

5.3 A cancelled or moved date. Cancelling a date that holds payments changes nothing about the payments: refunds are done by hand, and a task reminds you. Moving a paid candidate to another date moves their payment record with them, and no money moves.

6. Bookers' personal data

6.1 You are the controller of the personal data of bookers and candidates collected through Online Bookings, and we are your processor under Schedule 1. Stripe is responsible for its own use of payment details as its privacy notice says.

6.2 You are responsible for telling bookers how you use their data, for example through the privacy notice described in section 6.7 of the Terms, on the terms set out there.

7. Closing the account

7.1 Online payment stops the moment closing starts. The close screen shows the Owner how many payments are still held. A payment refunded in full within 7 days of starting to close costs no fee. The fee is charged, on a bill, for any payment kept after that, and the account cannot finish closing until that bill is paid.

7.2 When the account is finally closed, we delete the payment records and our copies of invoices and credit notes along with the rest of the Organisation's data, and remove Flow's connection to your Stripe account. We keep only our own bills, whose Online payment fee line is a count and an amount with no booker's name. Your own Stripe account still holds all of its own records: keep the records you need for tax and accounting.