ASK4 Compliance Requirements
The following are the legal requirements that we expect all suppliers, contractors and other partners of ASK4 to adhere to.
Notwithstanding any other provision of these Compliance Requirements, You shall comply with all applicable laws (including the Bribery Act 2010, the Control of Asbestos Regulations 2012, the Equality Act 2010, the Employment Rights Act 2025, the Worker Protection (Amendment of Equality Act 2010) Act 2023, the Health and Safety at Work etc. Act 1974, the Housing Act 1988, the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, the Proceeds of Crime Act 2002 and the Immigration Act 2014).
Part 1 – Mandatory Provisions
1. Definitions
This section applies to all supplier types.
“Anti-Bribery and Conduct Provisions” means the provisions contained in clause 3 of these Compliance Requirements.
“Anti-Human Trafficking and Forced Labour Provisions” means the provisions of clause 6 of these Compliance Requirements.
“Compliance Requirements” means these ASK4 Compliance Requirements.
“Economic Sanctions” means any trade, economic or financial sanctions or trade embargoes imposed from time to time by any Sanction Authority, including any sanction applied in respect of a particular type of economic activity, including sectoral sanctions.
“Governmental Authority” means any supranational, national, federal, state, municipal or local government (including any subdivision, court, administrative agency or commission or other authority of the same) or any quasi-governmental, industry or trade or private entity or person exercising regulatory, quasi-regulatory, taxing, importing or other governmental functions (including securities exchanges and competition authorities), together with any entity that is majority controlled by any of them.
“Government Official” means any officer, employee, agent, or representative of any Governmental Authority, any candidate for public office and any official or representative of a political party.
“Personnel” means any individual deployed by You to perform the goods or services including employees, temporary workers and subcontractor staff.
“Provider” means the person or entity providing goods or services to ASK4 and includes its affiliates and any subcontractors engaged in connection with those goods or services. In these Compliance Requirements, “You” and “Your” mean the Provider.
“Representatives” means Your officers, directors, employees, agents, contractors and subcontractors and any person acting on Your behalf.
“Restricted Party” means any person or entity that, at the time of any relevant activity under the agreement between You and ASK4 is:
(A) appearing on, or owned or controlled by a person appearing on, a sanctions list maintained by a Sanction Authority, whether in relation to all economic or trade activities or only a particular type of economic activity, including a sectoral activity;
(B) the government of a Sanctioned Country or a Governmental Authority of a Sanctioned Country; or
(C) a national or resident of or legal entity formed or existing or operating under the laws of a Sanctioned Country.
“Sanction Authority” means any Governmental Authority in any jurisdiction in which You operate or provide services to ASK4, as well as (i) any Governmental Authority in the United Kingdom (including His Majesty's Treasury and the Office of Financial Sanctions Implementation (OFSI)), (ii) any Governmental Authority in the United States (including the US State Department, the US Department of Commerce and the US Department of the Treasury (and in particular, the Office of Foreign Assets Control)), (iii) the United Nations Security Council, and (iv) the European Union.
“Sanction Provisions” means the provisions of clause 4 of these Compliance Requirements.
“Sanctioned Country” means any country or territory subject to country-wide Economic Sanctions imposed by a Sanction Authority, including (without limitation and as at the date of these Compliance Requirements) Cuba, Iran, Libya, North Korea, South Sudan, Sudan, Syria, Crimea and any foreign-occupied regions of Ukraine, and any other country or territory that becomes subject to country-wide Economic Sanctions from time to time.
For the avoidance of doubt, references in these Compliance Requirements to any applicable law include any amendment, re-enactment or replacement of that law and any substantially similar law in any jurisdiction.
2. Onboarding Requirements
This section applies to all supplier types.
2.1 You shall at Your own cost, comply with the ASK4 Compliance Requirements in respect of onboarding, including the following, as applicable:
2.1.1 completing the prequalification forms;
2.1.2 responding to audit questions;
2.1.3 providing health and safety programme documentation;
2.1.4 providing a bank account verification letter;
2.1.5 providing evidence of company and tax registration;
2.1.6 providing modern slavery statements (or other evidence of compliance);
2.1.7 providing ESG statements; and
2.1.8 providing evidence of insurance at the levels and on the terms required by ASK4.
2.2 You shall comply with all genuine onboarding requirements notified by ASK4 before Your appointment or entry into any agreement between You and ASK4. Compliance after appointment or entry into an agreement shall be permitted only to the extent, and by the deadline, expressly agreed by ASK4 in writing.
2.3 You shall maintain compliance throughout the term of any agreement between You and ASK4 and shall complete any renewal to remain an approved Provider of ASK4.
2.4 You shall ensure that the services comply with all applicable laws, regulations, regulatory guidance, licences, consents and applicable industry standards, these Compliance Requirements and any ASK4 policies notified to You; are performed by suitably qualified, competent, trained and supervised Personnel with reasonable skill, care and diligence; and do not expose ASK4, its workers, customers or clients to any material legal, regulatory, operational, health and safety or reputational risk. Any material failure to comply with this clause 2.4 shall constitute a material breach and entitle ASK4 to exercise its rights under clause 8.
3. Anti-bribery and Conduct Provisions
This section applies to all supplier types.
3.1 You warrant and undertake that:
3.1.1 neither You nor any of Your Representatives has breached or will breach any applicable anti-bribery laws and regulations, including the United Nations Convention against Corruption, the OECD Convention on Combating Bribery of Foreign Public Officials in International Business Transactions, the Foreign Corrupt Practices Act 1977 and the UK Bribery Act 2010 (the “Anti-Bribery Laws”); and
3.1.2 You and Your Representatives will comply with the Anti-Bribery Laws in carrying on the business and activities contemplated by any agreement between You and ASK4.
3.2 You warrant and undertake that neither You nor any of Your Representatives has or will, directly or indirectly, offer, give, request or receive anything of value to:
3.2.1 influence any acts, decisions, or omissions made by any Government Official or any other person or entity to obtain or retain business or secure an improper business advantage;
3.2.2 induce any person or entity to act improperly in violation of such person’s or entity’s duty;
3.2.3 induce any Government Official or any other person or entity to use influence with a Governmental Authority or any other person or entity to commit an improper act or to obtain or retain business; or
3.2.4 have the purpose or effect of public or commercial bribery, acceptance or acquiescence in extortion, kickbacks or any other unlawful or improper means of obtaining or retaining business.
3.3 You warrant and undertake that:
3.3.1 no ownership interest, direct or indirect, in the Provider is held or controlled by or for the benefit of any Governmental Authority, Government Official or any close family members of a Government Official; and
3.3.2 none of Your Representatives is a Governmental Authority or Government Official.
3.4 You will notify ASK4 promptly if this changes or is likely to change.
4. Sanctions Provisions
This section applies to all supplier types.
4.1 You warrant and undertake that You have not:
4.1.1 provided or received goods, services or technology, including credit and financial services or products, to or from any Sanctioned Country or Restricted Party in breach of an Economic Sanction;
4.1.2 imported, exported or facilitated the import or export of any product, service or technology, including credit and financial services and products, from or to any Sanctioned Country or Restricted Party in breach of an Economic Sanction; or
4.1.3 otherwise engaged in any financial or other business transaction with any Sanctioned Country or Restricted Party in breach of an Economic Sanction.
4.2 You undertake that You will not engage in or assist any of the actions listed in this clause 4.
5. Criminal Finances Act 2017
This section applies to all supplier types.
5.1 ASK4 does not tolerate tax evasion and is committed to ensuring that none of its employees, agents or third party representatives engage in tax evasion.
5.2 You warrant and undertake that You have implemented reasonable procedures to prevent tax evasion by Your employees, agents or other third parties.
5.3 You further acknowledge that You understand Your responsibilities under Part 3 of the Criminal Finances Act 2017 (“Part 3”) and that You have put in place reasonable prevention procedures (as referred to in Part 3) to ensure that neither Your Representatives nor Your relevant third parties will commit the criminal offences referred to in Part 3.
5.4 On reasonable notice given to You by ASK4, You will provide ASK4 such information and assistance as it may reasonably require enabling it to satisfy itself of Your compliance with Part 3.
6. Anti-Human Trafficking and Forced Labour Provisions
This section applies to all supplier types.
6.1 You warrant and undertake that neither You, nor any of Your Representatives, has violated or will violate any domestic or international anti-human trafficking or forced labour laws (the “Modern Slavery and ESG Laws”) including, without limitation: (i) the UK Modern Slavery Act 2015; (ii) the California Transparency in Supply Chains Act; (iii) the U.S. Government’s Federal Acquisition Regulation on Ending Trafficking in Persons; (iv) the Forced Labour Convention, 1930 (No. 29); (v) the Abolition of Forced Labour Convention, 1957 (No. 105); (vi) the Uyghur Forced Labor Prevention Act, or (vii) any applicable anti-human trafficking or labour laws in any jurisdiction in which You conduct business.
6.2 If You become aware of or reasonably suspect a violation of domestic and/or international anti-human trafficking or forced labour laws in any jurisdiction, You shall provide notice to ASK4 without undue delay (and in any event within five (5) business days (being any day other than a Saturday, Sunday or public holiday in England)) after becoming aware of or reasonably suspecting the violation. You shall also notify ASK4 promptly upon any investigation, formal complaint or claim relating to any actual or potential violation of law, and in any event within thirty (30) days of such investigation, formal complaint, or claim.
6.2.1 As part of our commitments under the Modern Slavery and ESG Laws, ASK4 may require You to: sign up to Supplier Ethical Data Exchange (“SEDEX”) as a member, complete Your profile to provide a risk assessment score, maintain an active registration, and connect with ASK4 on the SEDEX platform;
6.2.2 ensure that any ethical or social audits undertaken by You, by third parties on Your behalf, or by third parties on Your operations are recorded on the SEDEX platform and made available to ASK4 (each an "Audit"); and
6.2.3 at Your own cost, perform appropriate remedial actions to address any issues or failures identified through an Audit.
7. Equality, Dignity at Work and Workplace Conduct
This section applies to all supplier types
7.1 You shall comply with ASK4 policies (as notified to You from time to time) relating to equality, dignity at work, workplace conduct and the fair and professional treatment of all residents, prospective residents, and their guests, ASK4 workers and any other person with whom Your Personnel interact in connection with the services without regard to age, disability, race, nationality, ethnic or national origin, religion, belief or lack of religion/belief, sex, sexual orientation, being pregnant or having a child, gender reassignment, marriage and civil partnership, and in accordance with all jurisdictional guidelines, and furthermore, You accept the responsibility to train Your Representatives to comply with those policies.
7.2 You shall take all reasonable steps to ensure that Your Personnel do not engage in unlawful discrimination, harassment (including sexual harassment), victimisation or any other inappropriate workplace conduct in connection with the services, in accordance with the Equality Act 2010, the Worker Protection (Amendment of Equality Act 2010) Act 2023 and all other applicable equality and employment laws. Such steps shall include maintaining appropriate policies and procedures, providing appropriate training to relevant Personnel and maintaining records of that training (which You shall provide to ASK4 upon reasonable request), and taking appropriate action where any breach is identified.
7.3 You shall maintain appropriate policies and procedures relating to equality, dignity at work, harassment, grievance handling and standards of professional conduct appropriate to the nature of the services. Upon reasonable request, You shall provide ASK4 with copies of those policies or evidence that they have been implemented.[1]
7.4 Any material breach of this clause 7 shall constitute a material breach of these Compliance Requirements and ASK4 may exercise its rights under clause 8, including requiring the removal of Personnel from the services or terminating any agreement between You and ASK4 where appropriate.
7.5 You shall impose obligations equivalent to those set out in this clause 7 on any subcontractor whose personnel perform the services or attend any location where the services are performed, and You shall remain responsible for such subcontractors’ compliance with this clause 7.
8. Additional Provisions
This section applies to all supplier types.
8.1 You warrant and undertake that at all relevant times, there are no allegations, charges, proceedings, investigations or requests for information from You or any of Your Representatives by any Governmental Authority regarding any actual or potential violation of these Compliance Requirements. You will immediately inform ASK4 if this changes or is likely to change.
8.2 You warrant and undertake that all payments made in connection with the performance of any agreement between You and ASK4 shall be:
8.2.1 properly and accurately recorded in Your books and records, including the amount, purpose and recipient;
8.2.2 maintained in accordance with Your internal procedures along with supporting documentation; and
8.2.3 maintained in accordance with all other applicable laws relating to the preparation and maintenance of books, records or accounts, in each case in a manner that provides sufficient assurance that all Your transactions are recorded in a form that permits compliance with these Compliance Requirements.
8.3 You warrant and undertake that neither You, nor any of Your Representatives, has:
8.3.1 circumvented any internal accounting controls;
8.3.2 falsified any books, records or accounts;
8.3.3 established or maintained any fund or asset that has not been recorded in the books and records of any such entity; or
8.3.4 attempted to coerce or fraudulently influence an accountant in connection with any audit, review or examination of Your financial statements.
8.4 You undertake that You will not engage in any of the above activities during the term of any agreement between You and ASK4.
8.5 ASK4 and its authorised representatives may audit, examine and make copies of Your books, records, accounts and any other documents that relate to any agreement between ASK4 and You in whatever form they may be kept to verify Your compliance with these Compliance Requirements, including (where relevant) Your policies, procedures, training records, audit reports and other records demonstrating compliance. Where any such records contain personal data or confidential information relating to individuals, You may redact that information to the extent reasonably necessary to comply with applicable data protection and confidentiality obligations. You will keep and preserve all such records and accounts throughout the term of any agreement between You and ASK4 and for (i) three (3) years after the expiration or termination of any agreement between You and ASK4 or (ii) the length of time dictated by Your data retention policy (whichever is the greater). You agree to cooperate fully with such audits. The rights contained in this clause 8 must be explicitly included in any subsequent subcontract or agreement formed between You and any of Your Representatives in connection with the performance of any agreement between You and ASK4.
8.6 You shall ensure that Personnel providing the services receive appropriate compliance training relevant to their roles and responsibilities and shall maintain records of that training. Without limitation, You shall comply with the specific training obligations in clause 7.
8.7 You warrant and undertake that You and Your Representatives maintain, and will continue to maintain, adequate overarching policies, procedures and controls (including a whistle-blowing procedure) to ensure that services provided under any agreement between You and ASK4 comply with these Compliance Requirements. These shall include, where appropriate, accounting and financial controls, due diligence on third parties. The specific policies, procedures and controls relating to equality, dignity at work, harassment, workplace conduct, grievance handling, training, recordkeeping and subcontractors are set out in clause 7. You shall ensure that Your Representatives are aware of the policies, procedures and controls applicable to them and shall promptly provide ASK4 with copies or details of them upon written request.
8.8 If You become aware of, or reasonably suspect, any actual or potential breach of these Compliance Requirements, or any allegation, complaint or investigation relating to bribery, fraud, modern slavery, discrimination, harassment (including sexual harassment), health and safety or any other matter that may expose ASK4 to legal, regulatory or reputational risk, You shall notify ASK4 in writing without undue delay and, in the case of any allegation, complaint or investigation relating to sexual harassment or other serious misconduct, in any event within 48 hours. You undertake:
8.8.1 to commence an investigation, preserve all relevant evidence and take immediate steps to suspend any illegal or unethical activity identified in the notice pending the outcome of the investigation;
8.8.2 to cooperate fully with any ASK4 investigation to determine whether a violation has occurred and, as soon as practicable and in any event within thirty (30) days after the initial notification (or such shorter period as ASK4 may reasonably require where necessary to manage an immediate legal, regulatory or reputational risk), provide a written report to ASK4’s General Counsel describing the method, scope and results of the investigation. The report must include a proposed remedy for any actual or potential violation. You must carry out any further investigation and revise the proposed remedy as necessary to obtain ASK4’s approval within a reasonable period after submitting the report, and You must implement any approved remedy; and
8.8.3 that ASK4 may disclose information relating to a probable violation of these Compliance Requirements, including the existence and terms of any agreement between You and ASK4, to any relevant Governmental Authority and to any other person ASK4 or its legal counsel considers has a legitimate need to know.
8.9 If ASK4 should believe, acting in good faith, that You or any of Your Representatives has violated any of these Compliance Requirements in any way that may subject ASK4 to liability or to a material loss of reputation, ASK4 will have the unilateral right exercisable immediately upon written notice to You to:
8.9.1 require You immediately to remove, suspend or replace any member of Personnel where ASK4 reasonably considers that the individual's continued involvement presents a risk to ASK4, its workers, customers, reputation or the proper performance of the services. You shall comply with such requirement promptly and at Your own cost;
8.9.2 withhold, suspend or cease payment of all or any part of any amount due or becoming due under any agreement between You and ASK4. ASK4 shall have no automatic obligation to resume or make any such payment merely because the relevant violation is subsequently remedied, and any decision to do so shall be without prejudice to ASK4's rights of set-off, indemnity, termination and recovery of any losses or other amounts; and/or
8.9.3 terminate any agreement between You and ASK4 immediately.
8.10 You shall indemnify ASK4 against all losses and expenses arising out of or in connection with any breach of these Compliance Requirements. This includes any reasonable third-party costs (including reasonable legal and other professional fees and expenses), fines, damages and other out-of-pocket monetary liabilities (including repayment of revenues or profits) suffered or incurred by, or imposed on, ASK4 in connection with the existence, findings or outcome of any complaint, investigation or proceeding relating to Your compliance with these Compliance Requirements. If any provision of this indemnity is void or unenforceable under applicable law, it shall be deemed modified to the extent necessary to make it legal, valid and enforceable. If such modification is not possible, the provision shall be deleted and the remaining provisions shall continue in full force and effect and, where necessary, be interpreted to give effect as closely as possible to the intended purpose of this indemnity.
8.11 ASK4 may conduct ongoing due diligence on You (the scope, method, nature and duration of which shall be at the sole reasonable discretion of ASK4). You agree to cooperate fully with any ongoing due diligence and agree to respond promptly and accurately to any due diligence request for information or documents.
8.12 Unless a separate written agreement expressly signed by ASK4 states otherwise and governs the relevant supplies, all supplies are provided subject to and in accordance with the ASK4 Terms for Purchase (https://www.ask4.com/legal/ask4-terms-of-purchase). Those terms apply to the exclusion of any other terms (including any referred to in quotations, acknowledgements, invoices, delivery notes, catalogues, or terms implied by trade, custom or course of dealing). Where a separate signed agreement states that it covers all supplies between the parties, it will take precedence for its stated scope and duration. Otherwise, the ASK4 Terms for Purchase continue to govern all other orders and apply to all supplies made to ASK4.
8.13 You will provide ASK4 at least annually or upon ASK4's request with a certificate confirming compliance with these Compliance Requirements.
Part 2 – Conditional Provisions
9. Insurance Certificates
This section only applies if you are this type of supplier: “Installation", “Contractors”, “Telco”, “Shipping”, “Professional Services”.
9.1 Where You provide goods or services that require a Representative to attend a location where the services are performed, You must maintain current insurance certificates and provide them to ASK4 upon request. Any lapse in cover shall constitute a material breach of these Compliance Requirements and may result in ASK4 suspending orders or access or exercising its rights under clause 8.
10. Responsible Sourcing of Minerals
This section only applies if you are this type of supplier: “Hardware Manufacturer”, “Hardware Distributor”.
10.1 You warrant and undertake that any minerals used in products supplied to ASK4 (including tin, tantalum, tungsten and gold) are sourced responsibly and do not directly or indirectly finance or benefit armed groups or contribute to human rights abuses.
10.2 You warrant and undertake to maintain appropriate supply chain due diligence and traceability measures aligned with the OECD Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas and, where applicable, EU Regulation 2017/821.
10.3 You warrant and undertake not to knowingly source minerals from Conflict-Affected and High-Risk Areas (CAHRAs) without appropriate risk assessment, mitigation controls, and documented due diligence, and You shall provide evidence of compliance upon request.
10.4 You warrant and undertake to cascade these Compliance Requirements contractually throughout Your own supply chain, including to sub-tier suppliers and hardware manufacturers.
11. Screening of Workers
This section only applies if you are this type of supplier: “Installation”, “Contractors”, “Telco”.
11.1 You agree to exercise due diligence in not placing any Personnel or other employees, workers or subcontractors to carry out the services at ASK4 client sites without a Disclosure and Barring Service (“DBS”) certificate (or local equivalent) which:
11.1.1 is dated not more than twelve (12) months prior to that individual(s) commencing the services;
11.1.2 has been checked and signed off in accordance with Your internal policies; and
11.1.3 is renewed at least every two (2) years from the date of issue of the previous DBS certificate, to the extent the individual continues to work with You to provide the services to ASK4.
11.2 You understand that it is Your duty to use responsible hiring practices and acknowledge ASK4 policies regarding the background screening of Your Representatives.
12. Right to Work / Right to Reside Compliance
This section only applies if you are this type of supplier: “Installation ”, “Contractors”, “Telco”.
12.1 Where any individual performs the Services in the United Kingdom, You shall carry out right to work checks, in the manner prescribed by Home Office guidance, on that individual — including any individual engaged under a contract for services, any individual sub-contractor, and any individual engaged through an online matching or platform-based service — before that individual begins work, in accordance with Section 48 of the Border Security, Asylum and Immigration Act 2025.
12.2 Where any individual performs the Services in any EU member state in which ASK4 operates, You shall carry out equivalent right to work or right to reside checks required under the applicable national law of that member state implementing Directive 2009/52/EC (the Employer Sanctions Directive) or any successor or replacement legislation, before that individual begins work.
12.3 Where a right of substitution applies, You shall complete the applicable check under clause 12.1 or 12.2 on any substitute before they begin performing the Services and shall not rely on the original individual to verify the substitute's right to work or reside. You shall maintain proportionate identity verification processes to confirm that the individual performing the Services is the same individual whose status was checked.
12.4 You shall not engage any further sub-contractor to perform the Services without ASK4's prior written consent, and where consent is given, You shall impose obligations on that sub-contractor equivalent to this clause 12.
12.5 You shall permit ASK4 to audit Your compliance with this clause 12 on reasonable notice.
12.6 If any individual is found to be working illegally in connection with the Services and no statutory excuse or equivalent defence exists under the applicable law, ASK4 may suspend or terminate any agreement between You and ASK4 with immediate effect.
12.7 You shall indemnify ASK4 against any civil penalty, fine or other loss ASK4 incurs as a result of Your failure to comply with this clause 12.
13. Product Certification and Compliance
This section only applies if you are this type of supplier: “Installation, “Telco”, “Hardware Manufacturer”, “Hardware Distributor”, “Consumables”.
13.1 In this clause 13 “Products” means all goods supplied.
13.2 All Products shall comply with all applicable laws, regulations, and standards governing the sale and distribution of such products in all markets in which ASK4 operates (being the United Kingdom, European Union, the United States of America and any country as is notified to You by ASK4). Without limiting the generality of the foregoing, You specifically warrant and undertake that all Products shall be:
13.2.1 duly marked with the CE and UKCA marks;
13.2.2 marked with any marking required (directly or to enable ASK4’s compliance) under the Waste Electrical and Electronic Equipment Regulations 2013, the Waste Electrical and Electronic Equipment Directive (and local implementations thereof) and Regulation (EU) 2023/1542 of the European Parliament and of the Council of 12 July 2023 concerning batteries and waste batteries;
13.2.3 compliant with all applicable safety, health, and environmental protection requirements and compliant with the regulations and standards set by the Federal Communications Commission (FCC) and the Consumer Product Safety Commission (CPSC);
13.2.4 compliant with the Electromagnetic Compatibility Directive (and local implementations thereof), ensuring that such Products do not generate, or are not affected by, electromagnetic disturbance or cause interference with other products or devices.
13.3 You shall ensure that all Products supplied hereunder are fit for purpose and may be legally sold, used, and placed on the market within the territories of the United Kingdom, the European Union and the United States. You shall obtain all approvals and certifications.
13.4 In the event that any Product is found not to comply with the provisions of this clause 13, You shall promptly take all necessary steps at Your own expense to ensure such compliance, including but not limited to, the modification, replacement, or recall of any non-compliant Product.
14. Information Security Provisions
This section only applies if you are this type of supplier:
- "Installation", “Hardware Manufacturer”, “Hardware Distributor”(clause 14.1);
- “Telco”, “Cloud-hosted solution (SaaS)”, “Marketing”, “Professional Services”, “Travel” (clauses 14.2 & 14.3);
- “Hardware Manufacturer”, “Cloud-hosted solution (SaaS)” (clause 14.4).
14.1 Where You supply, provide or make available goods, services or facilities for use in connection with the provision of ASK4’s public electronic communications network or public electronic communications service, You shall support ASK4’s compliance with the Electronic Communications (Security Measures) Regulations 2022 and section 105A(1) of the Communications Act 2003 (and any similar requirements implemented in other countries where ASK4 operates under Directive (EU) 2018/1972 establishing the European Electronic Communications Code). In particular, You shall:
14.1.1 identify security compromise risks in relation to ASK4's network or service that could be caused by Your goods, services, or facilities and notify and cooperate with ASK4 to mitigate those risks at Your own cost;
14.1.2 where You are a network provider with access to ASK4’s network or service or sensitive data, You must take such measures as are appropriate and proportionate for the purposes of (a) identifying the risks of security compromises occurring; (b) reducing the risks of security compromises occurring; and (c) preparing for the occurrence of security compromises;
14.1.3 enable ASK4 to monitor all activities undertaken or arranged by You in relation to its network or service;
14.1.4 cooperate with ASK4 in resolving incidents that cause or contribute to a security compromise in relation to ASK4’s network or service or that increase the risk of such a compromise;
14.1.5 ensure that all network connections and data sharing with ASK4, or arranged by You or any third party on Your behalf, are managed securely; and
14.1.6 have appropriate written plans to manage the termination of, and transition from, contracts with ASK4 while maintaining the security of the network or service.
14.2 Where You handle ASK4 confidential information or personal data (“ASK4 Data”), You shall ensure that You have in place appropriate technical and organisational measures to protect against unauthorised or unlawful processing of ASK4 Data and against accidental loss or destruction of, or damage to data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymising and encrypting ASK4 Data, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to ASK4 Data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of Your adopted technical and organisational measures). You shall, upon reasonable request by ASK4, provide evidence of such measures and permit ASK4 or its authorised representatives to audit Your compliance with this clause 14.
14.3 Where You handle personal data in connection with the provision of a public electronic communications service, You shall notify ASK4 of any breach within twenty-four (24) hours. In respect of all other breaches of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data related to Your goods, services or facilities, You shall notify ASK4 within seventy-two (72) hours.
14.4 Where You are developing products, software or services for ASK4 or providing IT support services to ASK4, You shall use reasonable skill and care to ensure that the services are provided and/or developed in a secure manner; this includes, but is not limited to:
14.4.1 implementing secure coding practices to prevent common vulnerabilities such as SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF);
14.4.2 conducting regular security assessments, including code reviews and vulnerability scans;
14.4.3 ensuring, where appropriate, data encryption both in transit and at rest;
14.4.4 applying necessary patches and updates to address known vulnerabilities promptly;
14.4.5 ensuring that third-party libraries and components used in the software are regularly updated and free from known vulnerabilities;
14.4.6 conducting rigorous security testing and rectifying any identified security issues promptly;
14.4.7 implementing appropriate access controls to ensure that only authorised Personnel have access to the software and related data; and
14.4.8 not incorporating any open-source software that is licensed under terms that require any distributed software or any derivative work thereof to be distributed under the same open-source license (including but not limited to, software licensed under the GNU General Public License (GPL), Affero General Public License (AGPL)) (together, “Copyleft Open-Source Software”) into the developed software without the prior written consent of ASK4. You may use open-source software that is not Copyleft Open-Source Software.
15. Processing of Personal Data
This section only applies to any supplier that processes personal data on behalf of ASK4.
15.1 Unless otherwise agreed, where You handle ASK4 personal data as a data processor You shall do so subject to the ASK4 Data Processing (ASK4 Controller) Agreement (https://www.ask4.com/data-processing-agreement-ask4-controller).
16. Health & Safety
This section only applies if you are this type of supplier: “Installation ”, “Contractors”, “Telco”, “Professional Services”.
16.1 You shall:
16.1.1 have the skills, knowledge, experience and behaviours and, where necessary, the organisational capability, to fulfil the relevant competency requirements applicable to Your role and provide ASK4 with relevant information to enable ASK4 to successfully assess Your compliance with applicable health & safety laws; and
16.1.2 keep and maintain records of mandatory health and safety training and make these available to ASK4 upon request.
16.2 Where You are carrying out “construction works” for the purposes of the Construction (Design and Management) Regulations 2015 or any other locally applicable implementation of European Directive 92/57/EEC (the “CDM Regulations”), You shall:
16.2.1 fulfil the role of the Principal Contractor and/or Principal Designer as required by the CDM Regulations;
16.2.2 provide ASK4 with visibility of working practices at the site at which the construction works are carried out (the “Site”) and all documentation produced for the purposes of the CDM Regulations; and
16.2.3 comply with Part 2A of the Building Regulations 2010 and, where carrying out work in connection with a “higher-risk building” (as defined in the Higher-Risk Buildings (Descriptions and Supplementary Provisions) Regulations 2023 (SI 2023/275)), the Building (Higher-Risk Buildings Procedures) (England) Regulations 2023 (SI 2023/909).
16.3 You warrant and undertake that You have not been subject to any serious sanction imposed by any health and safety regulator (including the Building Safety Regulator, the Health and Safety Executive, any successor body or any local or public authority), nor committed any similar misconduct under the Building Regulations 2010. You shall notify ASK4 in writing without undue delay if this position changes or is likely to change during the term of any agreement between You and ASK4.
Updates
16 February 2024: Added section 8 (Equality, Dignity at Work and Workplace Conduct). Applies to all supplies of Products made on or after that date.
20 June 2024: Added section 9 (Screening of Workers). Applies to all supplies of Products made on or after that date.
8 July 2024: Added section 5.2 (Criminal Finances Act 2017). Applies to all Providers.
11 November 2024: Added section 12 (Processing of Personal Data). Applies to all relevant Providers.
13 March 2025: Added section 13 (Health & Safety). Applies to all relevant Providers.
6 October 2025: Added section 14.12 (Purchasing Terms). Applies to all Providers.
23 February 2026: Typographical and language corrections, clarifications to defined terms, amendments to certain definitions, and new section 7 (Responsible Sourcing of Minerals). Applies to all Providers.
30 September 2026: Strengthened equality, dignity at work and workplace conduct requirements; expanded Sanction Authority definition; required compliance with genuine onboarding requirements before appointment; clarified insurance lapse as material breach; aligned Criminal Finances Act 2017 obligations; shortened modern slavery incident-notification timeframes; limited product certification obligations to goods; introduced audit right for information security measures; added right-to-work and employment eligibility requirements; and strengthened additional provisions. Applies to all Providers.