Chapter 12

Templates

Copy, fill the brackets, send. Keep every filled-in version; the second one is always faster.

Order form (one page)

TEAMTALK ORDER FORM Customer: [Legal name], [company number], [address] Supplier: TeamTalk Ltd, [company number], [registered office] Plan: [Site £180/site/month · Company £550/£950/£1,600/£2,600 by enrolled-worker band · Enterprise] Scope: [N] sites, up to [N] enrolled workers (band), unlimited managers Term: 12 months from [go-live date], then renewing annually unless either party gives 60 days' notice before the renewal date. Any price change is notified at least 90 days before renewal. Fee: £[x] per year, exclusive of VAT, invoiced annually in advance by Bacs, payable within 30 days (monthly billing available at +15%) Pilot (if applicable): £2,500 + VAT for 60 days from launch, up to 3 sites and 250 enrolled workers, 100% credited against year one if signed within 30 days of pilot end; refunded only if success criteria 1 and 2 are both missed (exclusions per the Pilot Agreement) Included: onboarding of the first [N] sites, join cards, admin training (2 × 45 min), email support within one working day, a critical-SMS allowance of 2 posts per enrolled worker per month Excluded: SMS delivery above the allowance, at 8p per message, capped by agreement Customer obligations: an accurate worker list (name, mobile, language, leaving date) kept current; a named administrator per site; the Customer's own privacy notice to its workers (template supplied); at least two posts per site per week during onboarding Data: processed under the attached Data Processing Agreement; sub-processor list at [url]; all data exportable by the Customer at any time and on termination for any reason Terms: this order form incorporates the TeamTalk Terms of Service at [url], version [x], dated [date]. Liability: each party's total liability under this order is capped at the fees paid or payable in the 12 months before the claim, except for death or personal injury caused by negligence, fraud, and the separate data-protection cap in the DPA; neither party is liable for indirect or consequential loss. Governing law: England and Wales Signed for Customer: ____________ Name/Title: ________ Date: ______ Signed for Supplier: ____________ Name/Title: ________ Date: ______

Pilot agreement wording (add to the order form for pilots)

Pilot success criteria, agreed by both parties before launch: 1. At least 70% of enrolled workers have logged in within 14 days of launch. 2. At least 85% confirmed receipt on mandatory posts within 72 hours. 3. At least 2 posts per site per week, sustained. 4. A compliance export accepted by the Customer's HSEQ lead as an evidential briefing record. Day-14 activation review; day-30 formal review; day-60 decision meeting. If criteria 1 and 2 are both missed, the pilot fee is refunded; if either is met it is not (exclusions per the Pilot Agreement: undeliverable numbers above 10%, sites without two posts a week or incomplete launch actions, workers added in the final 14 days). If met, the Customer will take the [Company £x band] plan from [date], with the pilot fee credited against year one.

Data processing agreement: what yours must contain

Start from the ICO's contract guidance and a reputable template; have a solicitor read it once. Then never change it per customer unless they pay for the change.

Security summary (one page)

Tick only what is true today; write "not yet" for the rest. "Not yet" costs you nothing with a security reviewer; a control you assert and do not operate costs you the account. The full version, with the same rule, is in the legal pack (security-summary.pdf).

TEAMTALK SECURITY SUMMARY — [date] [ ] = true today [not yet] = planned, with date Hosting: AWS London (eu-west-2), United Kingdom, managed via Laravel Forge. Logical tenant isolation enforced at the data layer (every query scoped by tenant id); automated cross-tenant tests [ ] / [not yet: date]. Encryption: TLS 1.2+ in transit [ ]; AES-256 at rest on EBS and S3 [ ]. Authentication, workers: phone-number one-time codes over SMS (Twilio Verify), single-factor possession: no password to phish, per-device, short-lived. Device-bound sessions with re-verification only on a new device [ ] / [not yet: date]. Leaver lockout on leaving date [ ]. Authentication, admins: email + password with MFA [ ] / [not yet]. Backups: daily, encrypted, retained [30] days [ ]; restore last tested on [date] / [not yet]. Sub-processors: AWS (UK region), Twilio (UK Extension to DPF, checked [date]), OpenAI (message text only, no identifiers; IDTA + TRA on file [ ] / [not yet]), Mux (DPF, re-certification status checked [date]), [SES / Mailgun: confirm]. Full list with entity, country and transfer basis: [url]. Monitoring: uptime and error monitoring, alerts to the founder's phone [ ]. There is no on-call rota: one director, no employees, stated plainly. Vulnerability management: dependencies reviewed [monthly] [ ]; critical patches within [72] hours [ ]. Incident response: named contact [name, phone]; customer notification within 72 hours of a confirmed breach [ ]. Certifications: Cyber Essentials: not currently held. Assessment booked with [body], target [date]. Cyber Essentials Plus / ISO 27001: not held; offered only if a contract requires it. Insurance: PI £[1m], PL £[1m], cyber £[amount], certificates on request [ ] / [not yet: date]. What the record is: the Service records that a person confirmed a notice. That is evidence of an act, not of comprehension, and does not by itself discharge any legal duty. Contact: [[email protected]]

Onboarding checklist (first 30 days of a customer)

  1. Day 0: tenant created with logo and colours; admin accounts; languages set; first group structure agreed.
  2. Day 1–3: user import (spreadsheet: name, phone, language, group) or join cards printed per site.
  3. Day 3–7: on site with the manager for the first join session; first must-read published with them; first chase.
  4. Day 7: 45-minute admin training. Leave a one-page "how to post" sheet.
  5. Day 14: activation check; call any site under 40%.
  6. Day 30: reach review with the buyer; agree the next sites; ask for the reference quote.

Reference request

"You said last week that the chase list saved you an afternoon. Could I quote that, with your name and title, on one page I send to other builders? I'll send you the exact words first."

Renewal: three messages, never one

The customer's 60-day cancellation window closes at day 305, so a single notice at day 300 gives them five days, and a price rise inside it reads as an increase slipped through on silence, which is the pattern plc procurement teams are trained to escalate. Split it.

Day 240: health review (email, then a 20-minute call)

Subject: TeamTalk at [company]: the year so far [Name], eight months in: you have published [N] notices to [N] workers in [N] languages, with an average confirmed reach of [N]%. [One specific thing they did well.] Two things I'd like to look at with you before renewal: [site X's reach has dropped since [month]] and [languages you added]. 20 minutes on [date]?

Day 270: price notice, only if the price is changing (its own message, 90 days out)

Subject: TeamTalk pricing from [renewal date] [Name], from your renewal on [date] the [band] plan will be £[x] a year, up [N]% from £[y], in line with our published price list. The reason is [what changed]. Nothing changes before then, and your renewal is not automatic on this: reply if you would like to talk it through and I will call you.

Day 300: renewal notice

Subject: TeamTalk renewal — [date] [Name], your TeamTalk plan renews on [date] at £[x] for the year [as notified on [date]]. Over the year you published [N] notices to [N] workers in [N] languages with an average confirmed reach of [N]%. Reply if you'd like to add sites before then, or if anything has changed.