Terms and Conditions

1.1 Definitions

In this Agreement:

“Agreement” means these Terms and Conditions, together with any Order Form or Purchase Order accepted by Lattice Labs and any Statement of Work.

“Additional Module” means any optional module of the Platform beyond the Base Module, as described in the Order Form or as made available by Lattice Labs from time to time (for example, Psychosocial Health, Document Control, Inductions, Inspections and Checklists, Incident Management, PPE and Asset Management, the Self-Service Portal, Events and Registrations, Governance, Risk and Compliance, Working Groups, and the Provider Directory). The Kiosk and Site Register module is not an Additional Module and is provided under clause 3.5.

“Authorised Users” means the individuals authorised by the Customer to access and use the Platform, as designated by the Customer’s Organisation Administrator.

“Base Module” means the core compliance management functionality of the Platform, including the training matrix, compliance engine, expiry monitoring, employee management, reporting, audit trail, role-based access, notifications, data import, and SSO.

“Business Day” means a day that is not a Saturday, Sunday, or public holiday in Victoria, Australia.

“Commencement Date” means the date on which the Customer’s data is loaded into the Platform and the Customer is provided with access credentials, or the date specified in the Order Form, whichever is earlier, or, where neither applies, the date the Customer’s tenant is activated in the Platform.

“Compliance Tier” means the subscription tier comprising the Base Module, charged under clause 3.1.

“Compliance and Learning Tier” means the subscription tier comprising the Base Module, Lattice Learn, and the Document Control module, charged under clause 3.2.

“Confidential Information” means all information disclosed by one party to the other in connection with this Agreement that is not publicly available, including (without limitation) Customer Data, technical specifications, business strategies, pricing, and any information marked as confidential.

“Customer” means the organisation that subscribes to the Platform under this Agreement, including (without limitation) Victorian local councils, enterprise organisations, and commercial operators.

“Customer Data” means all data, information, documents, and materials uploaded to or generated within the Platform by or on behalf of the Customer, including (without limitation) employee records, worker records, certification records, training matrices, compliance reports, audit trail data, uploaded documents, inspection records, incident records, and psychosocial health data.

“Dormant Record” means a record of an individual that the Customer has archived or deactivated in the Platform. Dormant Records are retained in the Platform, are not counted at any headcount, and never attract Fees.

“External Learner” means a Learner who is not a Tracked Employee, a Tracked Contractor or a Tracked Volunteer, for example a member of the public whom the Customer enrols in its courses. An “Active External Learner” is an External Learner who, in the 12 months before the date on which External Learners are counted under clause 3.16, was enrolled in or completed a course delivered through the Platform. A Dormant Record is not an Active External Learner.

“Fees” means the annual subscription fees calculated in accordance with clause 3, as specified in the Order Form. Charges for Scoped Services under a Statement of Work are not Fees.

“Giving Back Customer” means a Customer that Lattice Labs has accepted into the Giving Back Program.

“Giving Back Program” means the program described in clause 18, under which Lattice Labs provides the Platform free of Fees to Aboriginal and Torres Strait Islander community-controlled not-for-profit organisations.

“GST” has the meaning given in the A New Tax System (Goods and Services Tax) Act 1999 (Cth).

“Intellectual Property Rights” means all intellectual property rights including patents, copyright, trade marks, designs, trade secrets, know-how, and all other rights of a similar nature, whether registered or unregistered.

“Kiosk” means the on-site sign-in terminal functionality of the Platform, including the kiosk web application, badge printing, emergency roll call, and (where deployed) the edge gateway hardware component.

“Learner” means an individual enrolled by the Customer in training delivered through the Platform, whether or not that individual is employed or engaged by the Customer.

“Lattice Labs” means Lattice Labs Pty Ltd (ABN 12 696 385 672, ACN 696 385 672).

“Lattice Learn” means the learning management functionality of the Platform, including course authoring, standards playback, enrolment, the learner portal, pathways, assessment, qualifications and certificates, records and privacy tooling, course commerce, and learning integrations.

“Onboarding” means the process of migrating the Customer’s existing compliance tracking data into the Platform and training the Customer’s staff to use the Platform.

“Order Form” means a document or purchase order issued by the Customer and accepted by Lattice Labs, including an ordering document under a government purchasing arrangement, that specifies the subscription details, including Customer type, tracked headcount, and selected modules. It includes, where the Customer takes up a subscription through the Platform’s self-service sign-up or is admitted to the Giving Back Program, the subscription selections and contact details the Customer submits at sign-up or on application and that Lattice Labs accepts, as recorded in the Platform.

“Organisation” means the Customer’s entity as configured within the Platform, whether operating as a council, enterprise, or commercial tenant.

“Platform” means the Lattice Look compliance management software application, including all updates, enhancements, and modifications made available by Lattice Labs during the Subscription Term. For Victorian council customers, the Platform may be branded as VICCOMP.

“Scoped Services” means the services described in clause 3.9(b), provided only under a Statement of Work.

“Standard Onboarding” means: (a) configuration of the Customer’s tenant and, where applicable, super-tenant; (b) the data migration described in clause 4.1; (c) the training described in clause 4.3; and (d) configuration of one HRIS integration and one identity provider integration, each from the connectors the Platform supports as described in clause 6.3.

“Statement of Work” means a document signed by both parties that describes Scoped Services, including their scope, deliverables, timing and price.

“Subscription Term” means the period of 12 months from the Commencement Date, and each subsequent 12-month renewal period.

“Support” means the technical support services described in clause 8.

“Tenant” means a discrete organisational unit within the Platform (e.g., a council, a branch, a site, or a customer entity), each with its own data isolation boundary.

“Tracked Employee” means each individual employee whose records are actively maintained in the Platform at the time of the annual headcount. Archived or deactivated records are not counted.

“Tracked Contractor” means each individual contractor or external worker whose records are actively maintained in the Platform at the time of the annual headcount. Archived or deactivated records are not counted.

“Tracked Volunteer” means each individual who volunteers for the Customer, and who is neither an employee nor a contractor of the Customer, whose records are actively maintained in the Platform on the date on which Tracked Volunteers are counted under clause 3.15. Archived or deactivated records are not counted.

“Tracked Person” means a Tracked Employee, a Tracked Contractor, a Tracked Volunteer or an Active External Learner.

1.2 Interpretation

In this Agreement, unless the context otherwise requires: headings are for convenience only; the singular includes the plural and vice versa; a reference to legislation includes any amendment, re-enactment, or replacement; and “including” means including without limitation.

2.1 Grant of Access

Subject to the Customer’s compliance with this Agreement and payment of the Fees, Lattice Labs grants the Customer a non-exclusive, non-transferable right to access and use the Platform during the Subscription Term for the purpose of managing workplace safety, training, and compliance within the Customer’s organisation.

2.2 Authorised Users

The Customer may create an unlimited number of Authorised User accounts at no additional cost. The Customer is responsible for ensuring that each Authorised User complies with this Agreement and for managing Authorised User access through the Platform’s role-based access controls.

2.3 Tenant Configuration

The Platform is configurable to suit different organisational structures. Council customers operate under the VICCOMP configuration with council-specific terminology and Victorian regulatory alignment. Enterprise customers operate under a branch or site hierarchy with industry-specific terminology. The Customer’s tenant configuration is specified in the Order Form. Lattice Labs will configure the Platform accordingly during Onboarding.

2.4 Kiosk and Edge Gateway

Where the Customer’s subscription includes the Kiosk and Site Register module, Lattice Labs will provide the kiosk web application and, where applicable, the edge gateway software for on-premises deployment. The edge gateway operates on the Customer’s hardware and connects to the Platform via encrypted channels. The Customer is responsible for providing and maintaining suitable hardware (tablet, printer, network connection) at each site where the Kiosk is deployed.

2.5 Restrictions

The Customer must not, and must ensure its Authorised Users do not: (a) sublicense, resell, distribute, or make the Platform available to any third party, except that where the Customer subscribes to the Compliance and Learning Tier or is a Giving Back Customer, the Customer may enrol Learners as Authorised Users and give them access to the learner-facing functionality of the Platform, including where the Customer charges those Learners for the training so delivered; (b) attempt to reverse engineer, decompile, disassemble, or otherwise derive the source code of the Platform; (c) use the Platform for any purpose other than the Customer’s internal compliance management and, where permitted by paragraph (a), the delivery of training to Learners; (d) remove or modify any proprietary notices, labels, or marks on the Platform; (e) upload any content that is unlawful, defamatory, or infringes any third party’s rights; (f) attempt to circumvent, disable, or interfere with any security features of the Platform; or (g) use the Platform to store or process data on behalf of any other organisation (each Customer must have its own subscription), subject to paragraph (a) and to clause 18.6.

2.6 Removal of Unlawful Content

Lattice Labs may, without notice and without liability to the Customer, remove, disable access to, or quarantine any content in the Platform that it reasonably believes is unlawful, and may suspend the Customer’s access to the Platform where it reasonably believes that suspension is necessary to prevent or stop a contravention of law or a serious risk to any person.

Lattice Labs will notify the Customer of any action taken under this clause as soon as reasonably practicable, will limit the action to what is reasonably necessary, and will restore access once the grounds for the action have ceased. Lattice Labs may disclose content and associated records to a law enforcement or regulatory authority where required or authorised by law. Nothing in clauses 5.1, 5.2 or 14 prevents Lattice Labs from acting under this clause.

3.1 Compliance Tier Fee

The annual fee for the Compliance tier, being the Base Module, is AUD $50 (exclusive of GST) per Tracked Employee per year. The number of Tracked Employees is determined at the Commencement Date based on the Customer’s initial data load, and recalculated annually at each renewal date based on the active employee count in the Platform at that time. Headcount is fixed at the Commencement Date and trued up annually only if headcount changes exceed 10%.

3.2 Compliance and Learning Tier Fee

The annual fee for the Compliance and Learning tier is AUD $100 (exclusive of GST) per Tracked Employee per year. That tier includes everything in the Compliance tier, the whole of Lattice Learn, and the Document Control module in full, at no additional per-module charge. No part of Lattice Learn is sold separately or carries its own price. Tracked Employees are counted and trued up in the same way as under clause 3.1.

3.3 Contractor Licence Fee

The annual fee for Tracked Contractors is AUD $150 (exclusive of GST) per Tracked Contractor per year. The contractor licence is a separate unit from the per-employee tiers and is never combined with employee seats. It is billed on active contractor profiles only, and no charge is ever made to the contractor. The licence includes the contractor-facing surface of the Platform, being inductions, document control, safe work method statements and risk, inspections and permits, incident management, PPE, the self-service portal, site check-in and check-out, and geofencing.

3.4 Additional Module Fees

Each Additional Module subscribed to by the Customer is charged at AUD $25 (exclusive of GST) per Tracked Employee per year, on either base tier. Any fee for Additional Modules in respect of Tracked Volunteers is charged under clause 3.15. No Additional Module fee is charged by reference to a Tracked Contractor: the modules available in respect of Tracked Contractors are those included in the contractor licence under clause 3.3, and no further per-module charge applies to them.

Additional Modules may be added at any time during the Subscription Term, with the fee for the first partial year pro-rated from the date of activation to the next renewal date. The Document Control module is included at no additional charge in the Compliance and Learning Tier.

3.5 Kiosk and Edge Gateway

The Kiosk and Site Register module, including the kiosk web application, badge printing, emergency roll call, and the edge gateway software, is included in the subscription at no additional per-module or per-device charge.

3.6 Minimum Annual Commitment

No minimum annual subscription fee applies to a subscription taken up through the Platform’s self-service sign-up. Where a deployment is scoped by agreement, including for council, multi-site and larger organisations, an Order Form may specify a minimum annual subscription fee, and that minimum applies only if it is stated in that Order Form. This clause does not apply to a Giving Back Customer (see clause 18).

3.7 GST

GST is payable in addition to all Fees and any charges under a Statement of Work, where applicable.

3.8 Unlimited Authorised Users

There is no per-user charge for Platform access. The Customer may create an unlimited number of Authorised User accounts at no additional cost. Fees are based solely on the number of Tracked Persons as provided in clauses 3.1 to 3.4, 3.15 and 3.16, not the number of users who log in. Dormant Records are never counted.

3.9 Implementation and Onboarding

(a) Standard Onboarding is included in the subscription at no additional cost for a subscription taken up through the Platform’s self-service sign-up. For any other Customer, including council, multi-site, government and enterprise Customers, onboarding and implementation, including the items in the definition of Standard Onboarding, are scoped and priced in the Order Form or a Statement of Work.

(b) The following are Scoped Services and are not part of Standard Onboarding: migration of data from another system, such as a legacy learning management system or student management system, other than from a clean, consolidated data file under clause 4.1; cleansing, reconstruction or transformation of historical records; integrations beyond those in paragraph (a), including additional, custom or multi-system integrations; and training beyond that provided under clause 4.3, including additional sessions and rollout training across multiple regions or sites. Lattice Labs provides Scoped Services only under a Statement of Work agreed before the work starts, and charges for Scoped Services only as that Statement of Work sets out. Nothing is charged for Scoped Services without a Statement of Work.

(c) Where an integration requires a licence, credential or service supplied by a third party, the Customer bears that third party’s charges.

(d) For a Giving Back Customer, clause 18.3(c) applies in place of paragraph (b).

3.10 Annual Indexation

Fees are subject to annual indexation. On each renewal date after the first Subscription Term, the per-person rates (the Compliance tier, the Compliance and Learning tier, the contractor licence, and Additional Modules) will be adjusted by the annual percentage change in the Consumer Price Index (CPI) for Melbourne (All Groups), as published by the Australian Bureau of Statistics, for the 12-month period ending in the most recently available quarter prior to the renewal date. In no event will the annual adjustment be less than 0% (i.e., rates will not decrease due to deflation).

In addition to CPI indexation, Lattice Labs may adjust per-person rates beyond CPI on any renewal date by providing the Customer with at least 120 days’ written notice prior to the renewal date. Any such adjustment beyond CPI will not exceed 15% of the prior year’s per-person rates in any single renewal period.

The adjustment beyond CPI in the preceding paragraph applies to subscriptions taken up through the Platform’s self-service sign-up and to any Order Form that does not set its own indexation or price adjustment terms. Enterprise and government agreements ordinarily set indexation in the Order Form. Where an Order Form sets indexation or price adjustment terms, those terms govern under clause 16.9 and this clause applies only to the extent the Order Form is silent. A fee under clause 3.15 or 3.16 is indexed or adjusted only as the Order Form provides.

3.11 Invoicing and Payment

Lattice Labs will issue a tax invoice for the annual Fees within 14 days of the Commencement Date (for the first Subscription Term) or within 14 days of each renewal date (for subsequent terms). Payment is due within 30 days of the invoice date.

Charges under a Statement of Work are invoiced as that Statement of Work provides or, where it is silent, on completion of the Scoped Services. Unless the Statement of Work says otherwise, the payment terms in this clause and clause 3.12 apply to those charges as if they were Fees.

3.12 Late Payment

If payment is not received within 60 days of the invoice date, Lattice Labs may suspend the Customer’s access to the Platform upon 14 days’ written notice. Access will be reinstated promptly upon receipt of payment. Lattice Labs will not delete Customer Data during any suspension period.

3.13 No Refunds

Fees are non-refundable except where the Customer terminates under clause 11.3 (Termination for Cause by Customer).

3.14 [Deleted]

3.15 Volunteer Fee

The fee for Tracked Volunteers, if any, is as set out in the Order Form.

Tracked Volunteers are counted separately from Tracked Employees. The number of Tracked Volunteers is determined at the Commencement Date based on the Customer’s initial data load, and is counted again on each renewal date. The count on a renewal date applies to the Subscription Term that follows it, whatever the size of the change. No charge is ever made to a volunteer.

3.16 External Learner Fee

The fee for Active External Learners, if any, is as set out in the Order Form.

For the first Subscription Term, the number of Active External Learners is the number stated in the Order Form or, if none is stated, the number in the Platform at the Commencement Date. The number is counted again on each renewal date, and the count on a renewal date applies to the Subscription Term that follows it, whatever the size of the change. No fee is charged retrospectively for External Learners enrolled during a Subscription Term.

Lattice Labs never charges an External Learner. The Customer may charge External Learners for its own training as permitted by clause 2.5(a).

4.1 Data Migration

Lattice Labs will migrate the Customer’s existing compliance tracking data into the Platform from the Customer’s provided data file (typically Microsoft Excel format). Lattice Labs will complete the data migration and make the Platform available to the Customer within two (2) Business Days of receiving a clean, consolidated data file from the Customer. A data file is clean and consolidated if: (a) it is a single CSV file or Microsoft Excel workbook, laid out in the Platform’s data import format or in another layout Lattice Labs agrees in writing; (b) it has one row per individual and no duplicate individuals; (c) every row gives the individual’s name and a unique identifier; (d) every certification record names the individual, the course and the completion date, with dates in one consistent format; and (e) it can be imported without merging other files and without cleansing, reconstructing or transforming records. Migration from another system, and cleansing, reconstruction or transformation of historical records, are Scoped Services under clause 3.9(b).

4.2 Customer Obligations for Onboarding

The Customer is responsible for: (a) providing a clean, consolidated data file containing employee records, worker records, position titles, organisational structure, training course details, and certification records that meets clause 4.1; (b) verifying the accuracy and completeness of the data provided; and (c) making relevant staff available for training during the onboarding period.

4.3 On-Site Training

Lattice Labs will provide up to two (2) days of on-site or remote training during the initial onboarding period, at no additional cost where Standard Onboarding is included in the subscription under clause 3.9(a). Training covers Platform operation, data management, report generation, and ongoing maintenance. Any further training, including additional sessions and rollout training across multiple regions or sites, is a Scoped Service under clause 3.9(b) and is provided under a Statement of Work.

4.4 Data Accuracy

Lattice Labs is not responsible for the accuracy, completeness, or currency of data provided by the Customer or entered into the Platform by the Customer’s Authorised Users. The Platform processes and reports on data as provided.

4.5 Onboarding Scheduling for Giving Back Customers

(a) This clause applies to a Giving Back Customer. It governs only the timing of Onboarding performed by Lattice Labs under clauses 4.1 and 4.3. It does not affect the Customer’s admission to the Giving Back Program, its access to the Platform, the modules made available to it, the number of its Tracked Persons, the Support provided to it, or the duration of its access free of Fees.

(b) Lattice Labs runs the Platform on infrastructure it owns and operates, and performs Onboarding with its own staff. Both are finite. Onboarding is therefore scheduled in a queue, in the order in which each Customer asked for it. Clause 4.1 does not apply to a Giving Back Customer, and Onboarding is instead provided in queue order.

(c) The Customer’s access to the Platform is provided on acceptance into the Giving Back Program and is not withheld or deferred while the Customer is waiting for Onboarding. The Customer may configure and use the Platform itself at any time, whether or not Lattice Labs has yet performed Onboarding for it.

(d) Lattice Labs will tell the Customer its position in the queue on request, and when that position changes materially. Lattice Labs will not name a date it cannot keep.

(e) A position in the queue, however long, is not a refusal of Onboarding. Neither the length of the queue nor the capacity of Lattice Labs’ infrastructure is a ground on which Lattice Labs may decline an eligible organisation, or decline, delay, reduce or withdraw any other part of the Giving Back Program.

5.1 Ownership

The Customer retains full ownership of all Customer Data at all times. Nothing in this Agreement transfers ownership of Customer Data to Lattice Labs.

5.2 Licence to Process

The Customer grants Lattice Labs a non-exclusive licence to store, process, and display Customer Data solely for the purpose of providing the Platform service to the Customer.

5.3 Data Export

The Customer may export all Customer Data at any time using the Platform’s built-in export functionality, which produces data in standard, non-proprietary formats (CSV and/or JSON). There are no export fees, no restrictions on export frequency, and no requirement to provide a reason for exporting. The data export function is accessible from the Data Imports page within the Platform.

5.4 Data Sovereignty

Subject to the two qualifications below, all Customer Data is stored at rest, and processed, on infrastructure that Lattice Labs owns and operates at sites in Australia, currently its primary site in Melbourne and its disaster recovery site in Wollongong. Lattice Labs does not use a third-party cloud hosting provider for Customer Data, and does not store Customer Data outside Australia.

First, traffic to and from the Platform passes through a content delivery and web application firewall service which terminates TLS in transit and which operates points of presence outside Australia. That service handles data in transit only. It is not used to store Customer Data at rest, other than transient caching and security logging incidental to the operation of that service, and Lattice Labs does not use it as a store of Customer Data.

Second, where the Customer chooses to enable an integration with an external service, including an external artificial intelligence or language model provider, content the Customer sends to that service is handled by that service on its own infrastructure, which may be outside Australia. Lattice Labs records the data residency of each such provider and makes it available to the Customer, and no such integration operates unless the Customer enables it.

5.5 Data Isolation

Each Customer’s data is isolated from all other Customers’ data through database-level Row-Level Security (RLS) enforced at both the tenant level and the super-tenant level. No Customer can access, view, or query another Customer’s data, even in the event of an application-level vulnerability. For enterprise customers with multiple tenants (branches, sites), data isolation is enforced between tenants within the same organisation as well as between organisations.

5.6 Data Deletion on Termination

Upon termination of this Agreement, Lattice Labs will: (a) allow the Customer to export all Customer Data for a period of 90 days following the termination date; (b) permanently delete all Customer Data from primary and disaster recovery infrastructure within 30 days after the 90-day grace period; and (c) provide written confirmation of deletion to the Customer upon request.

5.7 Aggregated and Anonymised Data

Where the Customer is provided access to the cross-organisation benchmarking feature, the Customer is included by default and the Customer’s compliance data may be included in aggregated, anonymised benchmarking datasets visible to other participating customers. No individual employee data, Customer-identifiable data, or raw records are shared. The Customer may opt out of benchmarking participation at any time via Platform settings.

6.1 Platform Purpose

The Platform is a compliance management and record-keeping tool. It is designed to help organisations track, monitor, and report on workforce training certification compliance, manage documents and inspections, monitor psychosocial health obligations, manage site access, and maintain audit-ready compliance records.

6.2 The Platform Is Not a Safety System

The Platform does not prevent workplace accidents. It does not monitor workplace conditions in real time. It does not replace workplace risk assessments, safe work method statements, site safety inspections, or any other operational safety measures. It does not provide safety advice.

The Platform is a record-keeping and monitoring system that assists the Customer in maintaining an auditable record of workforce training compliance. The Customer remains solely responsible for all workplace health and safety obligations, including ensuring that workers are appropriately trained, competent, and supervised before performing regulated work.

6.3 Manual Data Entry

Unless an HRIS integration has been configured, the Platform relies on data entered by the Customer’s Authorised Users. The Platform may offer optional integrations with external systems including HRIS platforms (such as Chris21, TechnologyOne, Civica, and SAP), identity providers (Azure AD, Okta), and other third-party services. Where such integrations are enabled by the Customer, data accuracy and availability is subject to the external system’s performance and the Customer’s configuration. Lattice Labs is not responsible for data quality issues originating from connected external systems. The accuracy and currency of compliance status displayed by the Platform is dependent on the accuracy and timeliness of data entered by the Customer’s staff and any connected external systems.

6.4 Not Legal or Compliance Advice

Nothing in the Platform, including compliance reports, gap analyses, expiry alerts, psychosocial health assessments, or any other output, constitutes legal advice, compliance advice, or a guarantee of regulatory compliance. The Customer should obtain independent legal and compliance advice as appropriate.

7.1 Tamper-Evident Audit Trail

The Platform maintains a tamper-evident, append-only audit trail that records every action taken by every Authorised User, including data creation, modification, deletion, login/logout events, report generation, configuration changes, and data exports. Each audit trail entry is timestamped using server-side clock functions, attributed to the identity of the user who performed the action, and written to an append-only log.

7.2 Cryptographic Verification

Audit trail records are sealed into a cryptographically verifiable structure: an Ed25519-signed Merkle tree (using RFC 6962-style Signed Tree Heads) over the append-only log, which is continuously re-verified. As a result, any alteration, deletion, or reordering of audit records is cryptographically detectable. Signed roots are anchored to independent, off-database storage so that tampering can be detected even where it is attempted by a person with elevated database privileges. The audit trail is designed to provide a legally defensible record of the Customer’s compliance management activities.

7.3 Retention and Records Management

Audit trail records are retained in accordance with ISO 9001:2015 records-management requirements and are aligned to the logging controls of ISO/IEC 27001 (Annex A control 8.15). Signed roots may be delivered to the Customer to enable independent verification of audit-trail integrity.

7.4 Access and Export

Organisation Administrators and Auditors may view, filter, search, and export the complete audit trail for their organisation at any time. The Customer may request verification or export of the audit trail, including the signed cryptographic roots that evidence its integrity.

8.1 Support Services

Lattice Labs will provide technical support to the Customer via email during Business Hours (9:00 AM to 5:00 PM AEST/AEDT, Monday to Friday). Support covers Platform functionality, data migration queries, report generation, module configuration, and troubleshooting.

8.2 Response Times

Lattice Labs will use reasonable endeavours to respond to support requests within the following timeframes: Critical (Platform unavailable or data integrity issue): First response within 4 hours during Business Hours. High (major feature unavailable, workaround exists): First response within 8 Business Hours. Medium (minor feature issue, no operational impact): First response within 2 Business Days. Low (general enquiry, enhancement request): First response within 5 Business Days.

8.3 Platform Availability

Lattice Labs will use reasonable endeavours to maintain Platform availability of 99.5% measured on a monthly basis, excluding scheduled maintenance windows. Scheduled maintenance will be communicated to the Customer at least 48 hours in advance and will be conducted outside Business Hours where practicable.

8.4 Updates and Enhancements

Lattice Labs may update, enhance, or modify the Platform from time to time. Updates that materially alter existing functionality will be communicated to the Customer at least 14 days in advance. All updates are included in the subscription Fee at no additional cost.

8.5 Feature Requests

The Customer may submit feature requests to Lattice Labs at any time. Lattice Labs will consider all feature requests in good faith and will endeavour to incorporate requests that align with the Platform’s purpose and benefit the broader customer base. Feature requests do not create an obligation on Lattice Labs to implement any specific functionality.

9.1 Security Measures

Lattice Labs implements and maintains security measures appropriate to the nature and sensitivity of the personal information processed by the Platform, including: (a) encryption of data at rest (AES-256) and in transit (TLS 1.2 or higher); (b) Argon2id password hashing for all user credentials; (c) mandatory multi-factor authentication for administrative roles; (d) WebAuthn passkey and OIDC SSO authentication support; (e) role-based access controls enforced at both application and database levels; (f) database-level multi-tenant isolation using Row-Level Security at both tenant and super-tenant levels; (g) daily automated external attack-surface scanning of the production environment, nightly automated dependency vulnerability scanning, and periodic adversarial security testing conducted against a full production-equivalent environment; (h) geographic disaster recovery with live replication to a separate Australian location; and (i) physical access controls restricting server access to authorised personnel.

9.2 Data Breach Notification

In the event of a data breach (as defined in the Privacy Act 1988) involving Customer Data, Lattice Labs will: (a) notify the Customer within 72 hours of becoming aware of the breach; (b) provide available details of the nature of the breach, the data affected, and the measures being taken to contain and remediate the breach; (c) cooperate with the Customer in meeting any notification obligations under the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act) or applicable state privacy legislation; and (d) take all reasonable steps to contain, investigate, and remediate the breach.

10.1 Lattice Labs IP

All Intellectual Property Rights in the Platform, including source code, architecture, design, documentation, algorithms, and data structures, are and remain the sole property of Lattice Labs. Nothing in this Agreement grants the Customer any rights in the Platform other than the right of access described in clause 2.1.

10.2 Customer IP

All Intellectual Property Rights in Customer Data are and remain the sole property of the Customer. Nothing in this Agreement grants Lattice Labs any rights in Customer Data other than the processing licence described in clause 5.2.

10.3 Feedback

If the Customer provides feedback, suggestions, or ideas for Platform improvements, Lattice Labs may use that feedback to improve the Platform without obligation or compensation to the Customer. Such feedback does not transfer any Intellectual Property Rights from the Customer to Lattice Labs.

10.4 Publicity

(a) Except as provided in clause 10.4(b), the Customer grants Lattice Labs a non-exclusive licence to use the Customer’s name and logo to identify the Customer as a customer of the Platform, including on the Lattice Look website and in marketing materials. This licence is revocable at any time by the Customer on written notice to Lattice Labs, and Lattice Labs will cease new uses promptly on receipt of that notice. Any use beyond identifying the Customer as a customer, including any statement attributed to the Customer, requires the Customer’s separate prior written consent.

(b) Clause 10.4(a) does not apply where the Customer is a Giving Back Customer. For such a Customer, this Agreement grants Lattice Labs no licence to use the Customer’s name or logo, and imposes on the Customer no obligation to act as a reference for Lattice Labs. Lattice Labs may use the Customer’s name or logo only under an express written permission given separately from this Agreement, and the Customer may withhold that permission, give it in part, or withdraw it at any time on written notice. On receipt of a withdrawal notice, Lattice Labs will cease all use of the Customer’s name and logo promptly, and will remove them from the Lattice Look website and from any marketing material still within its control.

(c) The giving, withholding, or withdrawal of a permission under clause 10.4(b) has no effect on the Customer’s rights under this Agreement. The Customer’s access to the Platform, the modules made available to the Customer, the Onboarding and support provided to the Customer, and the duration of the Customer’s access free of Fees are in no case conditional on any publicity permission or on the Customer acting as a reference, and Lattice Labs will provide each of them on identical terms whether or not a permission is given.

11.1 Initial Term and Renewal

This Agreement commences on the Commencement Date and continues for an initial Subscription Term of 12 months. The Agreement will automatically renew for successive 12-month Subscription Terms unless either party provides written notice of non-renewal at least 60 days before the end of the current Subscription Term.

11.2 Termination for Convenience

Either party may terminate this Agreement at the end of any Subscription Term by providing at least 60 days’ written notice before the end of the current term. The Customer is not required to provide a reason for non-renewal.

11.3 Termination for Cause by Customer

The Customer may terminate this Agreement immediately by written notice if: (a) Lattice Labs commits a material breach of this Agreement and fails to remedy the breach within 30 days of receiving written notice of the breach; (b) the Platform is unavailable for more than 5 consecutive Business Days (other than due to scheduled maintenance or circumstances beyond Lattice Labs’ reasonable control); (c) Lattice Labs enters into administration, receivership, liquidation, or any form of insolvency; or (d) Lattice Labs breaches any data sovereignty commitment under clause 5.4.

In the event of termination under this clause, the Customer is entitled to a pro-rata refund of any prepaid Fees for the unexpired portion of the current Subscription Term.

11.4 Termination for Cause by Lattice Labs

Lattice Labs may terminate this Agreement immediately by written notice if: (a) the Customer commits a material breach of this Agreement and fails to remedy the breach within 30 days of receiving written notice; or (b) the Customer fails to pay Fees within 90 days of the invoice date.

11.5 Effect of Termination

Upon termination of this Agreement for any reason: (a) the Customer’s access to the Platform will cease at the end of the current Subscription Term (or immediately in the case of termination for cause); (b) the data export and deletion provisions in clause 5.6 will apply; (c) clauses 2.6 (Removal of Unlawful Content), 5 (Customer Data), 6.2 (Not a Safety System), 7 (Audit Trail), 10 (Intellectual Property), 12 (Liability), 13 (Indemnity), 14 (Confidentiality), 16 (Governing Law), and 18.1(c) and 18.2 (no Fees under the Giving Back Program, and no retrospective Fee liability) survive termination.

12.1 Platform Is a Management Tool

The Customer acknowledges that the Platform is a compliance record-keeping and monitoring tool, not a workplace safety system. The Platform does not and cannot prevent workplace accidents, injuries, or fatalities. The Customer remains solely responsible for all workplace health and safety obligations under the Occupational Health and Safety Act 2004 (Vic) and all other applicable legislation.

12.2 No Guarantee of Regulatory Compliance

Lattice Labs does not warrant or guarantee that use of the Platform will ensure the Customer’s compliance with any law, regulation, or standard, including (without limitation) the OHS Act 2004, OHS Regulations 2017, OHS (Psychological Health) Regulations 2025, ISO 9001, ISO 45001, or any other regulatory framework. Compliance depends on the accuracy of data entered, the timeliness of data updates, and the Customer’s operational practices.

12.3 Exclusion of Consequential Loss

To the maximum extent permitted by law, Lattice Labs excludes all liability for indirect, consequential, special, or incidental loss or damage, including (without limitation): (a) loss of revenue, profit, or anticipated savings; (b) loss of data, except that this exclusion does not apply to loss of Customer Data caused by Lattice Labs, for which Lattice Labs remains liable subject to clause 12.4 and in addition to its obligation to restore from backups; (c) loss arising from regulatory action, prosecution, fines, or penalties imposed on the Customer; (d) loss arising from workplace incidents, injuries, or fatalities; (e) reputational loss; and (f) loss of opportunity.

12.4 Cap on Liability

To the maximum extent permitted by law, Lattice Labs’ total aggregate liability under or in connection with this Agreement, whether in contract, tort (including negligence), statute, or otherwise, is limited to the greatest of (a) the total Fees paid by the Customer in the 12-month period immediately preceding the event giving rise to the liability, (b) AUD $50,000, and (c) in respect of any claim covered by Lattice Labs’ professional indemnity or public liability insurance, the amount actually recoverable by Lattice Labs under that policy in respect of that claim, net of any deductible.

Paragraphs (b) and (c) apply whether or not any Fees have been paid, including where the Customer is a Giving Back Customer and where no invoice has yet fallen due.

12.5 Consumer Law

Nothing in this Agreement excludes or limits any rights or guarantees that cannot be excluded or limited under the Australian Consumer Law (Schedule 2 of the Competition and Consumer Act 2010 (Cth)) or any equivalent state or territory legislation.

13.1 Customer Indemnity

The Customer indemnifies Lattice Labs against all claims, losses, damages, costs (including reasonable legal costs), and expenses to the extent arising from or in connection with: (a) the Customer’s breach of this Agreement; (b) any claim by an Authorised User or third party arising from use of the Platform by the Customer or its Authorised Users in breach of clause 2.5; (c) inaccurate, incomplete, or misleading data uploaded to the Platform by the Customer or its Authorised Users; and (d) any claim that content uploaded by the Customer infringes a third party’s rights.

This indemnity does not extend to any claim, loss, damage, cost or expense to the extent it is caused by Lattice Labs’ own breach of this Agreement, negligence, or wilful misconduct.

13.2 Lattice Labs Indemnity

Lattice Labs indemnifies the Customer against all claims, losses, damages, costs (including reasonable legal costs), and expenses arising from any third-party claim that the Platform infringes that third party’s Intellectual Property Rights in Australia, provided that: (a) the Customer promptly notifies Lattice Labs of the claim; (b) Lattice Labs has sole control of the defence and settlement; and (c) the Customer provides reasonable cooperation.

14.1 Obligations

Each party agrees to keep the other party’s Confidential Information confidential and not to disclose it to any third party, except: (a) to employees, contractors, or professional advisors who need to know and are bound by confidentiality obligations; (b) as required by law or regulation; or (c) with the prior written consent of the disclosing party.

14.2 Customer Data

For the avoidance of doubt, all Customer Data is the Customer’s Confidential Information. Lattice Labs’ obligations under this clause are in addition to its obligations under the Privacy Policy as published at privacy.latticelook.au.

16.1 Governing Law

This Agreement is governed by the laws of the State of Victoria, Australia. Each party submits to the non-exclusive jurisdiction of the courts of Victoria.

16.2 Entire Agreement

This Agreement constitutes the entire agreement between the parties in relation to its subject matter and supersedes all prior discussions, negotiations, representations, and agreements.

16.3 Amendments

This Agreement may only be amended in writing signed by both parties.

16.4 Assignment

The Customer may not assign this Agreement without Lattice Labs’ prior written consent. Lattice Labs may not assign this Agreement without the Customer’s prior written consent, except to a successor entity in the event of a corporate restructure that does not materially change the ownership or control of Lattice Labs.

16.5 Notices

All notices under this Agreement must be in writing and sent by email to the addresses specified in the Order Form or to such other address as a party may notify in writing.

16.6 Severability

If any provision of this Agreement is found to be invalid or unenforceable, the remaining provisions continue in full force and effect.

16.7 Waiver

A failure to exercise or delay in exercising any right under this Agreement does not constitute a waiver of that right.

16.8 Force Majeure

Neither party is liable for any delay or failure to perform its obligations under this Agreement to the extent caused by circumstances beyond its reasonable control, including (without limitation) natural disasters, pandemics, government actions, power failures, or internet outages. The affected party must notify the other party promptly and use reasonable endeavours to mitigate the impact.

16.9 Order of Precedence

If there is any inconsistency between an Order Form accepted by Lattice Labs and these Terms and Conditions, the Order Form prevails to the extent of the inconsistency. A Statement of Work prevails over these Terms and Conditions only in respect of the Scoped Services it covers. A government head agreement, panel deed, standing offer or ordering document under which the Customer acquires its subscription is treated as an Order Form for the purposes of this clause. However, neither an Order Form nor a Statement of Work varies clause 5.4, clause 12.5, clause 16.1 or clause 18 unless it expressly identifies the clause it varies and is signed by both parties. Clause 18.7 prevails over this clause.

16.10 Versions and Transition

(a) This version of these Terms and Conditions (version 3.6) applies to Agreements made on or after the date it is first published at tos.latticelook.au.

(b) A Customer whose Agreement was made under an earlier version continues under the version it accepted, including on renewal, until it agrees in writing to a later version.

(c) Where a Customer agrees to move to a later version that introduces a new per-person charge, that charge does not apply before the first renewal date that falls at least 120 days after Lattice Labs gives the Customer written notice of it.

17.1 Escrow Arrangement

Upon written request by the Customer, Lattice Labs will enter into a source code escrow arrangement with a reputable independent escrow agent (such as NCC Group or Iron Mountain). The escrow arrangement will provide for release of the Platform source code to the Customer in the event that: (a) Lattice Labs enters into administration, receivership, liquidation, or ceases to carry on business; (b) Lattice Labs fails to maintain or support the Platform for a continuous period exceeding 90 days; or (c) any other release event agreed between the parties and the escrow agent.

17.2 Escrow Costs

The costs of establishing and maintaining the escrow arrangement will be shared equally between Lattice Labs and the requesting Customer, unless otherwise agreed.

17.3 Licence on Release

In the event of a source code release, the Customer is granted a non-exclusive, non-transferable licence to use the source code solely for the purpose of maintaining and operating the Platform for the Customer’s own internal use. This licence does not include the right to sublicense, distribute, or commercially exploit the source code.

18.1 Purpose and Eligibility

(a) The Giving Back Program is the program under which Lattice Labs provides the Platform free of Fees to Aboriginal and/or Torres Strait Islander community-controlled not-for-profit organisations that employ staff.

(b) The eligibility criteria are those published at latticelook.au/givingback as at the date the Customer applies. Lattice Labs assesses eligibility once, when it accepts the Customer into the Program. Where the application of those criteria to an organisation is genuinely unclear, Lattice Labs resolves the question in favour of eligibility. Lattice Labs retains a copy of the published criteria as at each application date and provides it to the Customer on request.

(c) If a Giving Back Customer ceases to meet the eligibility criteria after it has been accepted, that does not give Lattice Labs any right to charge Fees for any period, to recover the value of access already provided, or to terminate this Agreement.

18.2 No Fees

(a) No Fees are payable by a Giving Back Customer, for the initial Subscription Term or for any renewal Subscription Term.

(b) Clauses 3.1, 3.2, 3.3, 3.4, 3.6, 3.9(b), 3.10, 3.11, 3.12, 3.13, 3.15 and 3.16 do not apply to a Giving Back Customer, and the grant of access in clause 2.1 is not conditional on payment of any amount.

(c) Clause 11.4(b) does not apply to a Giving Back Customer.

18.3 What Is Included

(a) Every module of the Platform is made available to a Giving Back Customer at no charge, including every Additional Module and the whole of Lattice Learn.

(b) There is no limit on the number of Tracked Persons a Giving Back Customer may record, and no charge is made by reference to that number.

(c) Onboarding under clause 4, any work that would otherwise be a Scoped Service under clause 3.9(b), and Support under clause 8 are provided to a Giving Back Customer at no charge, whatever their size, and otherwise on the same terms as to a Customer that pays Fees, subject only to clause 4.5.

(d) Where on-site training under clause 4.3 requires travel, Lattice Labs bears its own travel costs and does not charge them to the Customer.

18.4 Duration

(a) Lattice Labs will not give a notice of non-renewal under clause 11.1, and will not terminate under clause 11.2, in respect of a Giving Back Customer, except where it discontinues the Platform for all customers.

(b) The Customer may end its participation in the Program at any time, on written notice. If the Customer does so and does not enter into a subscription on paying terms, that notice operates as a notice of termination of this Agreement and clause 5.6 applies. If the Customer enters into a subscription on paying terms, this Agreement continues, clause 5.6 does not apply, and clause 3 applies from the date agreed between the parties.

(c) The AUD $50,000 floor and the insurance limb in clause 12.4 apply to a Giving Back Customer, so the cap on Lattice Labs’ liability is not nil.

18.5 Nothing Is Asked in Return

(a) Clauses 10.4(b) and 10.4(c) apply, so this Agreement grants Lattice Labs no licence to use the Customer’s name or logo, and imposes on the Customer no obligation to act as a reference.

(b) Cross-organisation benchmarking under clause 5.7 is switched off by default for a Giving Back Customer. Participation is a choice the Customer makes in Platform settings and may be reversed at any time.

(c) Lattice Labs bears the whole cost of any escrow arrangement established under clause 17 at the request of a Giving Back Customer, and clause 17.2 does not apply. Lattice Labs may satisfy this paragraph by adding the Customer as a beneficiary to an existing escrow arrangement covering the Platform.

(d) No minimum level of use of the Platform is required of a Giving Back Customer, and no reporting to Lattice Labs on its use of the Platform is required of it.

18.6 Auspiced and Member Organisations

Clause 2.5(g) does not prevent a Giving Back Customer from storing or processing data on behalf of an organisation that it auspices, or that is a member of it, where that organisation would itself meet the eligibility criteria for the Program.

18.7 The Published Description of the Program

If there is any inconsistency between the description of the Giving Back Program published at latticelook.au/givingback as at the date the Customer applies and this Agreement, the provision more favourable to the Customer prevails. Clause 16.2 does not operate to exclude that published description.