This guide is for buyers, procurement teams and risk assessors. It answers the questions a supplier assessment normally asks, and tells you exactly where in our published terms each answer sits, so you do not have to hunt for it.

Everything referenced here is published and binding. "Framework" means the GEN Framework Agreement, which is the single master agreement covering all goods and services we supply — there is no separate MSA to negotiate. The policies named alongside it are incorporated into that Agreement by reference and form part of it.

This guide is a navigational aid only. It summarises, and where a summary and the underlying document differ, the underlying document governs.

1. Contracting and acceptance

• What are we contracting under? A single Framework Agreement covering all goods and services. No separate master agreement is required. — Framework, preamble
• Is this business-to-business only? Yes. We do not contract with consumers and no consumer protection legislation applies. — Framework, preamble
• How is the Agreement accepted? It is presented and agreed during onboarding, before credentials are issued or work can be requested. — Framework, preamble
• How do the terms change over time? Material changes are notified to your registered contacts and take effect 30 days later, not before. — Framework 12.8
• Can we exit if we reject a change? Yes — at any time before it takes effect, without penalty and without early termination charges. — Framework 12.8
• Which version governs? The version published online, as to content. When a change binds you is governed by the notice provisions. — Framework 12.7, 12.8
• Governing law and jurisdiction? English law, courts of England and Wales. — Framework 12.2
• How are disputes handled? Good faith negotiation, then CEDR mediation, then the courts. Urgent injunctive relief is unaffected. — Framework 10.4
• Who can commit us to work? Any of your employees, unless you notify us in writing of a restriction. HelpDesk requests are always authoritative. — Framework 2.5
• Does our purchase order wording apply? No. Pre-printed terms on either side’s ordering documents do not vary the Agreement. — Framework 11.1

2. Data protection

• Do you provide processor terms? Yes. Full UK GDPR Article 28 terms are in the Agreement itself, not a separate document. — Framework 5.8
• What are the respective roles? You are controller and we are processor for service delivery. We are controller for billing, security, fraud prevention and our own legal obligations. — Framework 5.8.1
• What is the scope of processing? Subject matter, duration, nature, purpose, data types and data subject categories are all specified. — Framework 5.8.2
• Breach notification timescale? Without undue delay and in any event within 48 hours of becoming aware. — Framework 5.8.4
• How are sub-processors handled? General authorisation, current list on request, advance notice of changes, 14 days to object, exit without penalty if unresolved. — Framework 5.8.5
• Do you accept audits? Yes. Information and certifications on request; on-site audit once per 12 months on 30 days’ notice, and without limit where a supervisory authority requires it. — Framework 5.8.6
• Is data processed outside the UK? It may be. Transfers rely on adequacy or an approved mechanism such as the IDTA or the UK Addendum. — Framework 1.3, 5.8.7
• What happens to data at the end? Deleted or returned at your option, elected within 30 days. Backup copies expire on their retention cycle and stay protected until they do. — Framework 5.8.8
• Can we use our own DPA instead? Yes. A signed data processing agreement prevails for the services it covers. — Framework 5.8.10
• Retention periods? Set out in the Privacy Notice. Support tickets are retained for 6 years, with 3 years of self-service access. — Privacy Notice; Framework 1.4
• Lawful bases, data subject rights, complaints? Set out in full, including how to complain to the ICO. — Privacy Notice

3. Information security

• What security measures apply? Appropriate technical and organisational measures under Article 32, proportionate to the nature and risk of the processing. — Framework 5.8.3
• How are credentials protected? Credentials, keys, tokens and certificates are Confidential Information in perpetuity, with no exceptions and no expiry. — Framework 5.1, 5.5, 5.6
• Where are our credentials held? In your Site Record, which is the single repository, and to which your authorised representatives have access. — Framework 2.6
• Are your staff bound to confidentiality? Yes. Everyone authorised to process data is under a binding duty of confidentiality and appropriately trained. — Framework 5.8.3
• Do you monitor or inspect our content? No. We do not review, monitor or moderate hosted content and are under no obligation to do so. We act on notice. — Framework 8.2.2.2
• How are identified risks communicated? By a Site Notice recording the risk and our advice. If remediation is not instructed within 30 days the risk is treated as accepted. — Framework 2.6
• What are the rules on use of your systems? Set out in full, and binding on anyone to whom you give access. — Acceptable Use Policy; Framework 2.4
• Can services be suspended for a security concern? Yes, immediately where there is a security, legal or regulatory risk, with notice as soon as practicable. — Framework 2.4
• How do you handle impersonation and pretexting? Verification requirements and the handling of suspicious requests are published. — Social Engineering Policy

4. Service levels and support

• What service levels are available? A published range, from daytime cover with a response measured in working days to 24/7 cover with a response measured in minutes. — Framework 6; Service Level Policy
• Are bespoke service levels available? No. Coverage windows and response times outside the published range are not offered. — Framework 6
• How is response time measured? From the Start Time Metric, within the coverage window for that level only. — Service Level Policy
• What is the remedy if a response window is missed? That ticket and its directly related sub-tickets are handled without charge. This replaces service credits entirely. — Service Level Policy
• Can we escalate mid-engagement? Yes. You can move between published levels or escalate an individual ticket, at the rates for the level chosen. — Framework 6; Service Level Policy
• How is support accessed? Through the GEN HelpDesk as the primary channel, with full ticket history available to you. — Framework 1.4; Technical Support Policy
• Who manages a managed environment? Under Exclusive Management, only us — which is what carries the warranty and the service level. Shared arrangements are available and are best-efforts. — Framework 8.2.2.3

5. Liability, indemnities and insurance

• What is the liability cap? The greater of 12 months’ fees under the relevant Statement of Work or £50,000, with a separate cap applying to each Statement of Work. — Framework 9.6
• What is excluded? Indirect, incidental, special, consequential and punitive losses, on both sides. — Framework 9.6
• What is never capped or excluded? Death or personal injury caused by negligence, fraud, breach of the implied terms as to title, and anything else that cannot lawfully be limited. — Framework 9.6
• Is confidentiality liability capped? Yes, separately, at £250,000. It does not consume the general cap. — Framework 9.6
• Is there an IP indemnity? Yes, mutual, with defined procedures and remedies. — Framework 9.1 to 9.5
• What insurance is expected of us? Cover protecting GEN personnel while working on your premises, including public liability, with certificates on request. — Framework 2.2
• Is the risk allocation negotiable? The caps reflect the pricing and are stated to be an essential basis of the bargain. — Framework 9.7

6. Intellectual property

• Who owns what we commission? Where a Statement of Work records that we are engaged to create a specified work and you are charged for creating it, that work and its IP transfer to you on payment in full. — Framework 4.3
• Who owns everything else? We do. Pre-existing material, anything we build at our own initiative, and anything created as a means of delivering a service remains ours. — Framework 4.2
• How do we secure ownership of a deliverable? Have it recorded as commissioned in the Statement of Work. Where a Statement of Work is silent, ownership stays with GEN. — Framework 4.3
• What licence do we get? Software and deliverables are licensed, not sold, under the licence identified in the Statement of Work, with a default internal-use licence where none is named. — Framework 4.4; Software Licence Agreement
• Who owns our own material? You do, at all times, including anything you provide to us. — Framework 4.1
• Who owns equipment on our site? GEN equipment remains ours unless expressly sold, and sold equipment transfers on payment in full. — Framework 4.5

7. Confidentiality

• Is confidentiality mutual? Yes, in all respects. — Framework 5.1
• How long does it last? Five years generally; perpetual for credentials, personnel information, the existence of the relationship, and anything that remains commercially sensitive. — Framework 5.5
• Will you name us as a client? No. Neither party may identify the other in marketing, case studies, client lists or public communications without written consent. — Framework 5.3
• Who else may learn of the relationship? Only those who need to know to deliver or support the services — suppliers, carriers, subcontractors, advisers, insurers — under equivalent confidentiality obligations. — Framework 5.3
• What about lawful disclosure requests? Permitted where legally required, with prior notice to you where lawful, and limited to the minimum necessary. — Framework 5.6
• Are our staff protected from approach? Yes, mutually, excluding untargeted recruitment advertising. — Framework 5.4

8. Subcontracting and supply chain

• Do you subcontract? We may. We remain fully responsible for subcontractors and impose confidentiality obligations at least as strict as our own. — Framework 12.4
• Who provides the physical network? Connectivity runs over third-party infrastructure. We are responsible for the networking; the physical circuits are the carrier’s. — Framework 8.2.2.4
• How are third-party charges handled? Passed through where they arise from your use, actions or circumstances, with notice where practicable. — Framework 3.2
• Anti-bribery and corruption? Published and incorporated. — Anti-Bribery and Corruption Policy
• Modern slavery? A statement is published. — Modern Slavery Statement
• Environmental and social value? Published commitments covering our supply chain and our customers. — Ecology Policy; Social Value Commitment

9. Artificial intelligence

• Do you use AI in service delivery? Yes — ticket classification and routing, solution generation, response augmentation and system optimisation. — Framework 11.6
• Does our data leave your infrastructure? No. All such processing runs on GEN’s own infrastructure. Nothing is sent to any third-party AI provider, hosted model service or external API. — Framework 11.6
• Is our data retained or used for training? No. Inputs, contexts and outputs are not logged or retained, so they cannot be disclosed, reused or produced. Only aggregate operational counters are kept. No customer data trains any third-party model. — Framework 11.6
• Are decisions automated? No decision producing legal or similarly significant effects is automated. Output affecting you is reviewed by our people first. — Framework 11.6
• What is your wider AI position? Published, including our position on AI-generated code in production. — AI Use Policy

10. Commercial terms

• Payment terms? 30 days from receipt of invoice, by bank transfer, in the currency stated. — Framework 3.6
• Can prices rise during a term? Yes, on 30 days’ notice, capped at the greater of 5% or CPI plus 3%. If that applies during a minimum term you may exit without early termination charges. Third-party and regulatory increases pass through without cap. — Framework 3.8
• How is time recorded? Emergency support has a one hour minimum; everything else rounds to 15 minute increments. — Framework 3.1
• What if we cancel booked work? Two full working days’ notice, or it is chargeable in full with committed costs. Training bookings have their own notice period. — Framework 3.7; Technical Training Policy
• Is there a free trial of support? The first hour of qualifying support is free. — First Hour Free Policy

11. Change, exit and continuity

• What is the term? A rolling agreement running until terminated. — Framework 10.1
• Can we terminate for convenience? Yes, either party on 90 days’ notice. Live Statements of Work continue under their own terms. — Framework 10.2
• Termination for breach? 30 days to cure a remediable breach, immediate where it cannot be remedied. — Framework 10.2
• Termination on insolvency? Immediate, either way. — Framework 10.2
• Do services renew automatically? Yes, where a minimum term applies, for an equal period, unless either party gives 90 days’ notice. — Framework 10.8
• Early termination charges? The lesser of third-party costs plus lost profit, or 80% of the remaining term. — Framework 10.5
• Will you help us move to another provider? Yes, unless termination is for your breach or non-payment; reasonable transition costs are chargeable. — Framework 10.7
• Do we get our data and materials back? Yes. Your property is returned, and neither it nor any personal data is withheld over unpaid charges. — Framework 10.3
• What if GEN disappears? You are never locked out. Credentials are held in your Site Record with access for your authorised representatives, independent of the Agreement continuing. — Framework 2.6
• Force majeure? Performance excused while it lasts, charges suspended for any service not being provided, and either party may exit after 90 days. — Framework 11.4

12. Documents referenced

The Framework Agreement lists every incorporated policy at Section 12.6, and each is published at a stable URL. The online version of each document is the authoritative one; printed and saved copies are for convenience only.

If your assessment asks something this guide does not answer, raise a ticket through the HelpDesk or speak to your Account Manager and we will point you at the relevant provision, or tell you plainly that we do not cover it.