Terms of Business
For the Provision of Investigative, Surveillance Activities and Litigation Support Services
Effective Date: 28 December 2025
(Updated to reflect the Data (Use and Access) Act 2025)
Recitals
These terms of business set out the basis on which we (the "Company") shall conduct all matters undertaken for you (the "Client") and shall be read in accordance with any covering communication. We confirm having carried out a Conflict of Interest assessment prior to the acceptance of instructions.
1. Definitions and Interpretation
1.1 Definitions
| "Company", "we", "us" | means Palatine. |
| "Client", "you" | means the person or entity who accepts a quotation or offer for the Services. |
| "Data Protection Law" | means the UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025, each as amended or replaced. |
| "Controller", "Processor", "Joint Controller", "Personal Data", "Special Category Data", "Personal Data Breach", "Processing" | shall have the meanings given to them in Data Protection Law. |
| "Senior Responsible Individual" (SRI) | means the individual designated by us under the Data (Use and Access) Act 2025 to be responsible for data protection compliance. |
| "Services" | means the investigative, surveillance, or litigation support services provided. |
1.2 Interpretation
- Reference to a statute includes any amendment or re-enactment (including the DUUA 2025).
- "Writing" includes electronic transmission (email).
2. Communication
2.1 We shall communicate with your authorised officers or advisers. Specific security requirements for communications must be notified to us in advance.
2.2 Instructions should be in writing. Oral instructions must be confirmed in writing by the Client within two Business Days.
3. Provision of Services
3.1 We shall provide the Services with reasonable skill and care, commensurate with prevailing standards in the professional investigation sector.
3.2 We shall act in accordance with all reasonable and lawful instructions.
3.3 We reserve the right to amend these terms by notice in writing, provided such amendments do not reduce your statutory rights.
4. Client's Obligations
4.1 The Client shall provide all pertinent and lawful information necessary for the Services.
4.2 The Client is responsible for obtaining any necessary third-party consents (e.g., from landlords or authorities) required for the performance of the Services.
5. Fees and Payment
5.1 Estimates are indicative; changes in instructions may result in amended quotations.
5.2 Invoices are payable before the end of the month following the month of invoice.
5.3 We reserve the right to charge interest at 8% above the underlying base rate for late payments.
6. Confidentiality
6.1 Each Party shall keep confidential all information disclosed in connection with the Services.
6.2 This obligation does not apply to information required to be disclosed by law or information already in the public domain. This clause survives termination.
7. Data Protection: Determination of Status
Our role under Data Protection Law depends on the nature of the Client and the instruction:
7.1 Business Clients (Processor): Where the Client is a business or legal entity instructing us to process data for their commercial purposes, the Client is the Controller and we are the Processor. We act only on your documented instructions (see Schedule 1).
7.2 Domestic/Private Clients (Independent Controller): Where the Client is a private individual acting in a purely personal or household capacity, and is therefore exempt from most Controller obligations under Data Protection Law, we shall act as an Independent Controller. We determine the professional means and purposes of the investigation to ensure legal and ethical compliance.
7.3 Joint Controllership: Where we and the Client jointly determine the purposes and means of processing, we shall be Joint Controllers. In such cases, the Parties will determine their respective responsibilities for transparency and Data Subject rights by separate agreement.
7.4 Own Business Purposes: We act as an independent Controller for Personal Data processed for our own business administration (e.g., billing, regulatory compliance, and conflict checks).
8. Data Security and Rights
8.1 We implement technical and organisational measures appropriate to the risk, including encryption and secure storage.
8.2 We shall provide reasonable assistance to the Client to respond to Data Subject rights requests (including Subject Access Requests).
8.3 Any Personal Data Breach affecting data processed on the Client's behalf will be notified to the Client without undue delay.
9. Retention and Deletion
9.1 On completion of the Services, we shall return or securely delete Personal Data processed on your behalf within 60 days, unless UK law or our professional indemnity insurance requires longer retention.
9.2 Where legal retention applies, we shall ensure the data remains protected and is not processed for any other purpose.
10. Limitation of Liability
10.1 Neither Party shall be liable for loss of profit, goodwill, or indirect/consequential loss.
10.2 Nothing in this Agreement shall limit or exclude liability for death, personal injury, fraud, or any statutory liability that cannot be excluded by law (including liability under Article 82 of the UK GDPR).
10.3 Subject to Clause 10.2, our total liability shall be limited to the value of the Services provided for the relevant matter.
11. Termination
11.1 Either party may terminate instructions at any time by written notice.
11.2 Upon termination, the Client shall pay all outstanding fees and costs incurred up to the date of termination.
12. Severance
If any provision of this Agreement is found by a court to be invalid, illegal, or unenforceable, that provision shall be deemed modified to the minimum extent necessary to make it valid. If modification is not possible, the provision shall be deleted. The validity of the remainder of the Agreement shall not be affected.
13. Entire Agreement
This Agreement constitutes the entire agreement between the parties and supersedes all previous agreements, promises, or representations relating to its subject matter.
14. No Waiver
No failure or delay by a party to exercise any right or remedy shall constitute a waiver of that right or remedy.
15. Assignment and Sub-Contracting
15.1 We may sub-contract part of the Services to specialist investigators or Sub-processors. We ensure they are bound by written terms no less protective than these.
15.2 The Client may not assign or transfer their rights under this Agreement without our prior written consent.
16. Variation
No variation of this Agreement shall be effective unless it is in writing and signed by both parties.
17. Notices
Any notice shall be in writing and delivered by hand, first-class post, or email. Email notices are deemed received at the time of transmission (or the next Business Day if sent outside 09:00–17:00).
18. Family Reconnection Traces — Special Conditions
18.1 Scope: This Clause applies where the Client instructs us to trace an individual for the purpose of family reconnection (including but not limited to locating estranged relatives, birth parents, siblings, or other family members).
18.2 Legal Framework: Family Reconnection Traces are conducted in strict accordance with the Data (Use and Access) Act 2025 and the UK GDPR. The law requires that personal data be processed fairly and transparently. In family reconnection cases, there is a significant risk that disclosing a person's location without their knowledge could infringe upon their fundamental rights or breach existing legal protections (such as non-molestation orders, restraining orders, or witness protection arrangements).
18.3 Data Controller Status: For Family Reconnection Traces, we act as an independent Data Controller. We determine the purposes and means of processing in order to comply with our legal and ethical obligations, including the protection of the located individual's rights and interests.
18.4 Consent-Led Disclosure Policy: To meet our safeguarding obligations under the Data (Use and Access) Act 2025, we operate a "Consent-Led Disclosure" policy. This means that while we will use our professional expertise to locate the individual, we will not release their current contact details to the Client without their express permission. This fulfils our statutory duty to inform data subjects that their information is being processed.
18.5 Verification of Lawful Purpose: We will only conduct Family Reconnection Traces where there is a clear and lawful basis. If we discover that a court order, injunction, restraining order, non-molestation order, or other legal restriction prohibits the Client from contacting the person, we will terminate the instruction immediately and without refund.
18.6 The Reconnection Process: Where an individual is successfully located, we will contact that person to inform them of the Client's request and to seek their explicit consent before disclosing their personal information (including address and contact details) to the Client. The Client acknowledges and agrees that:
- (a) We will make reasonable efforts to contact the located individual to inform them of the request and to obtain their consent;
- (b) If the located individual declines to give consent, we are legally prohibited from disclosing their address or contact information to the Client;
- (c) If consent is declined, we may, at our sole discretion, offer to pass a letter or message from the Client to the located individual. This is not guaranteed and remains subject to our assessment of the circumstances;
- (d) The Client shall not be entitled to any refund of fees in the event that consent is not obtained or the individual cannot be contacted.
18.7 Mandatory Disclosure to Authorities: If, during the course of a Family Reconnection Trace, evidence emerges of a potential breach of a court order, or it becomes apparent that the Client is subject to any legal prohibition preventing contact with the located individual, we reserve the right to:
- (a) Immediately cease work on the instruction without refund;
- (b) Decline to disclose any information to the Client;
- (c) Notify the located individual of the attempted trace;
- (d) Disclose the Client's details to the Court, law enforcement, or other relevant authorities as may be required or permitted under the Data (Use and Access) Act 2025 or other applicable law.
18.8 Fees: In addition to the standard trace fee, Family Reconnection Traces may incur an additional consent contact fee to cover the safeguarding process of contacting the located individual to seek their consent. The applicable fee will be advised at the time of instruction. The Client acknowledges and agrees that:
- (a) All fees for the trace service and consent contact (where applicable) remain payable regardless of whether the located person consents to the disclosure of their information;
- (b) All fees must be paid in full prior to our making contact with the located individual;
- (c) No refund shall be due in the event that the located individual declines consent, cannot be contacted, or if the instruction is terminated under Clauses 18.5 or 18.7;
- (d) The consent contact fee (if charged) may be waived or varied at our absolute discretion.
18.9 Client Warranties: By instructing us to conduct a Family Reconnection Trace, the Client warrants that:
- (a) They are not subject to any court order, injunction, restraining order, non-molestation order, or any other legal prohibition preventing them from contacting or locating the individual;
- (b) They have a lawful and legitimate reason for wishing to reconnect with the individual;
- (c) They will not use any information provided (or any message-passing service offered) to harass, intimidate, stalk, or cause harm to the located individual;
- (d) All information provided to us regarding the purpose of the trace is true and accurate.
18.10 Indemnity: The Client shall indemnify and hold harmless the Company against any claims, losses, damages, costs, or expenses (including legal fees) arising from any breach of the warranties in Clause 18.9, any misrepresentation regarding the purpose of the trace, or any misuse of information or services provided pursuant to a Family Reconnection Trace.
19. Law and Jurisdiction
This Agreement is governed by the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.
Schedule 1 — Data Processing Schedule
This Schedule applies where we act as a Processor for a Business Client (Controller).
Instructions: We shall process Personal Data only on the documented instructions of the Client.
Confidentiality: We ensure that all persons authorised to process Personal Data have committed themselves to confidentiality.
Sub-processors: The Client grants general authorisation for the appointment of Sub-processors. We will maintain a list of Sub-processors and provide it to the Client upon request.
Assistance: We shall assist the Client in:
- Responding to Data Subject rights requests.
- Conducting Assessments of High Risk Processing (as required by the Data (Use and Access) Act 2025).
- Ensuring compliance with security and breach notification obligations.
Audit: We shall make available the information necessary to demonstrate compliance and allow for audits or inspections.
International Transfers: We will not transfer Personal Data outside the UK unless the Client instructs us to do so and appropriate safeguards (e.g., UK Addendum or Adequacy) are in place.
Agreement to Terms:
The Client agrees to be bound by these Terms by instructing or continuing to instruct the Company.