notifications-admin/app/templates/views/terms-of-use.html

{% extends "withoutnav_template.html" %}

{% block page_title %}
Terms of use – GOV.UK Notify
{% endblock %}

{% block maincolumn_content %}

<div class="grid-row">
  <div class="column-two-thirds">

    <h1 class="heading-large">
      Terms of use
    </h1>

    <p>To accept these terms, you must be the service manager for your service. If you’re not the service manager, you’ll need to invite them.</p>

    <section id="summary">
      <h2 class="heading-medium">
        Summary
      </h2>

      <p>If we accept your service onto GOV.UK Notify, we agree to:</p>

      <ul class="list list-bullet">
        <li><a href="#we-agree-to-send-all-the-messages">send all the messages you pass to us</a></li>
        <li><a href="#we-agree-to-keep-your-data-secure">keep your data secure</a></li>
        <li><a href="#we-agree-to-give-you-three-months-notice-if-we-change-these-terms">give you three months’ notice if we change these terms</a></li>
      </ul>

      <p>You agree:</p>

      <ul class="list list-bullet">
        <li><a href="#you-agree-not-to-compromise-our-security">not to compromise the security of GOV.UK Notify</a></li>
        <li><a href="#you-agree-not-to-send-marketing">not to use GOV.UK Notify to send marketing messages</a></li>
        <li><a href="#you-agree-to-send-messages-consistent-with-our-guidelines">to send messages consistent with our design patterns, style guide and information security principles</a></li>
        <li><a href="#you-agree-to-use-delivery-data-to-improve">to use GOV.UK delivery data to continuously improve the quality of your contact data</a></li>
      </ul>

      <p>Before you can send real messages:</p>

      <ul class="list list-bullet">
        <li><a href="#you-must-tell-us-how-many-text-messages-emails-and-letters-you-plan-to-send">you must tell us approximately how many text messages, emails and letters you plan to send</a></li>
        <li><a href="#your-organisation-must-agree-to-pay-any-costs-you-run-up">if you plan to send more than 250,000 text messages per year or any number of letters, your organisation must agree to pay any costs you run up using GOV.UK Notify</a></li>
        <li><a href="#we-will-check-your-templates-before-you-can-go-live">we will check the messages you plan to send to make sure they meet our guidelines</a></li>
      </ul>
    </section>

    <section id="our-side">
      <h2 class="heading-medium">
        Our side of the agreement
      </h2>

      <h3 class="heading-small" id="we-agree-to-send-all-the-messages">
        We agree to send all the messages you pass to us
      </h3>

      <p>We will send all the messages you pass to us, as long as they meet our guidelines.</p>

      <p>We endeavour to provide continuous uptime for both accepting messages and sending them.</p>

      <p>We’ve made sure that GOV.UK Notify can handle large volumes of messages. For email and text messages we have several delivery providers concurrently integrated. This provides GOV.UK Notify with real-time failover capability.</p>

      <p>GOV.UK Notify is supported 24/7 for high-priority issues. We provide a ticketing system and escalation routes for service teams to address incidents.</p>

      <p>You’ll be able to see how our service is performing on our <a href="/_status">status page</a>.</p>

      <h3 class="heading-small" id="we-agree-to-keep-your-data-secure">
        We agree to keep your data secure
      </h3>

      <p>GOV.UK Notify (as a whole, including subcontractors) currently store personal data for up to 1 year, and non-personal data indefinitely.</p>

      <p>GOV.UK Notify has been through an information assurance process to assess information risks, to determine appropriate treatments for those risks and to obtain risk acceptance from the Cabinet Office Senior Information Risk Officer (SIRO). This work includes the completion of a Privacy Impact Assessment to ensure compliance with the Data Protection Act.</p>

      <p>We do not conduct, or enable, analysis of when the same recipient (mobile number, email or postal address) is contacted by multiple Government organisations. We may do so if required by law enforcement.</p>

      <p>We maintain appropriate technical and organisational measures to protect data. We make sure our subcontractors follow the same procedures.</p>

      <p>Cabinet Office act as data processor, as parent organisation of GOV.UK Notify. Your organisation remains the data controller.</p>

      <p>We’ll never transfer or store data on servers outside of the European Economic Area.</p>

      <h3 class="heading-small" id="we-agree-to-give-you-three-months-notice-if-we-change-these-terms">
        We agree to give you three months’ notice if we change these terms
      </h3>

      <p>We’ll email you if you need to change these terms. We’ll tell you clearly what is changing and when the change will come into effect.</p>

      <p>This includes when any of our email, text message or postal providers change.</p>

    </section>

    <section id="your-side">
      <h2 class="heading-medium">
        Your side of the agreement
      </h2>

      <h3 class="heading-small" id="you-agree-not-to-compromise-our-security">
        You agree not to compromise the security of GOV.UK Notify
      </h3>

      <p>You agree to get your service assured through your organisation’s information assurance (security) process. You don’t need to include assurance of GOV.UK Notify or our delivery partners, since we’ve already done that - we can share the work we’ve done.</p>

      <p>You must tell us immediately if you have any security breaches. This is so we can make sure other services are not affected.</p>

      <p>You must follow industry best practices for keeping your API keys secure.</p>

      <p>You must ensure you have obtained correct levels of consent - both to send messages but also for how data is shared in order to do so.</p>

      <p>You must not perform any load testing on GOV.UK Notify, since we’ve already done it.</p>

      <h3 class="heading-small" id="you-agree-not-to-send-marketing">
        You agree not to use GOV.UK Notify to send marketing messages
      </h3>

      <p>GOV.UK Notify is for sending transactional messages.</p>

      <p>Transactional messages relate directly to something the user did. For example:</p>

      <ul class="list list-bullet">
        <li>The user completed a transaction, you send them a confirmation email</li>
        <li>The user got an MOT a year ago, you remind them that it’s about to expire</li>
        <li>The user signed up for email alerts, you send them email alerts</li>
      </ul>

      <p>You don’t need to ask permission to send messages that directly relate to a transaction. By using a transaction, a user is implicitly agreeing to receive messages about that transaction.</p>

      <p>Marketing messages don’t relate directly to something the user did. For example:</p>

      <ul class="list list-bullet">
        <li>Telling users about your webinar</li>
        <li>Sending users government advice</li>
        <li>Continuing to update someone about a service they no longer use</li>
      </ul>

      <p>You must agree not to use GOV.UK Notify to send marketing messages.</p>

      <p>If you do use GOV.UK Notify to send marketing messages, we may refuse to accept further messages for delivery.</p>

      <h3 class="heading-small" id="you-agree-to-send-messages-consistent-with-our-guidelines">
        You agree to send messages consistent with our design patterns, style guide and information security guidelines
      </h3>

      <p>Your messages must follow our <a href="https://designpatterns.hackpad.com/Notifications-5vuitmNqIjZ" rel="external">design patterns</a>, <a href="https://www.gov.uk/topic/government-digital-guidance/content-publishing" rel="external">style guide</a> and <a href="https://docs.google.com/document/d/15-OjaEqDBy31uDU7nLZCpYIQOnzSCJR63-cp3cQI9G8" rel="external">information security guidelines</a>.</p>

      <p>Your messages must not contain any personal, or otherwise sensitive, information.</p>

      <h3 class="heading-small" id="you-agree-to-use-delivery-data-to-improve">
        You agree to use GOV.UK Notify delivery data to continuously improve the quality of your contact data
      </h3>

      <p>When you send messages through GOV.UK Notify, we provide feedback on the status of every text message, email and letter.</p>

      <p>You agree to use our delivery data to check (and potentially remove) bounced email addresses, mobile numbers and postal addresses from your database.</p>
      
      <p>You agree to ensure your user’s personal data is kept accurate and up to date, in line with Data Protection Act principles.</p>

      <p>If you have consistently high bounce rates, we will investigate and may refuse to accept further messages for delivery. This is to protect delivery rates for other services using GOV.UK Notify.</p>

    </section>

    <section id="requesting-to-go-live">
      <h2 class="heading-medium">
        Requesting to go live
      </h2>

      <p>Before you can send real messages:</p>

      <ul class="list list-bullet">
        <li>you must tell us approximately how many text messages, emails and letters you plan to send</li>
        <li>you must ensure you have obtained consent to both send messages themselves, but also share data in order to do so</li>
        <li>if you plan to send more than 250,000 text messages per year or any number of letters, your organisation must agree to pay any costs you run up using GOV.UK Notify</li>
        <li>we will check the messages you plan to send to make sure they meet our guidelines</li>
      </ul>

      <h3 class="heading-small" id="you-must-tell-us-how-many-text-messages-emails-and-letters-you-plan-to-send">
        You must tell us how many text messages, emails and letters you plan to send
      </h3>

      <p>You must estimate how many text messages, emails and letters you plan to send each year, including any spikes or seasonal variation.</p>

      <p>We will make sure GOV.UK Notify is easily able to handle your estimated sending volume.</p>

      <h3 class="heading-small" id="your-organisation-must-agree-to-pay-any-costs-you-run-up">
        Your organisation must agree to pay any costs you run up using GOV.UK Notify
      </h3>

      <p>If you plan to send more than 250,000 text messages per year or any number of letters, your organisation must agree to pay these costs by signing a memorandum of understanding.</p>

      <p>If you plan to send fewer than 250,000 text messages per year or you only plan to send email, you don’t need a memorandum of understanding.</p>

      <h3 class="heading-small" id="we-will-check-your-templates-before-you-can-go-live">
        We’ll check your templates before you can go live
      </h3>

      <p>We’ll check your templates to make sure they are transactional, not marketing, and follow our <a href="https://designpatterns.hackpad.com/Notifications-5vuitmNqIjZ" rel="external">design patterns</a>, <a href="https://www.gov.uk/topic/government-digital-guidance/content-publishing" rel="external">style guide</a> and <a href="https://docs.google.com/document/d/15-OjaEqDBy31uDU7nLZCpYIQOnzSCJR63-cp3cQI9G8" rel="external">information security guidelines</a>.</p>
    </section>

    <section id="leaving-gov-uk-notify">
      <h2 class="heading-medium">
        Leaving GOV.UK Notify
      </h2>

      <p>You can remove your service from GOV.UK Notify at any time. <a href="{{ url_for('main.feedback') }}">Contact us</a> and we’ll delete your account.</p>
      
      <p>Any data that you have processed through GOV.UK Notify will be deleted as part of the existing data deletion processes.</p>

    </section>

  </div>
</div>

{% endblock %}