Fire Risk Assessment — service terms
TO ACTION CIC (company 17515320), c/o Life Dronfield, 21–23 Church Street, Dronfield, Derbyshire, S18 1QB supplies this service. Contact hello@toaction.co.uk for support, complaints or cancellation.
Your purchase
£120 paid once buys one new fire risk assessment for the named building shown at checkout, with one assigned person and six calendar months’ access beginning when payment is verified. There is no subscription or automatic renewal. Downloading does not end access. A further purchase creates a separate assessment; it does not reopen an expired assessment. One organisation account may manage separately purchased assessments for several buildings.
Check the building, price and assignee before paying. The named building cannot be replaced by an ordinary edit. Organisation administrators manage assignment, but administration alone does not authorise reading or editing an assessment. Keep account credentials private. Stay signed in to finalise or open a final report. If you have enrolled an authenticator, verify it when signing in. Tell us promptly about suspected unauthorised access.
Using the assessment
This is a tool for preparing your own assessment for simpler non-domestic buildings in England. It does not include an inspection, professional certification or a guarantee that a building complies with fire-safety law. Use an appropriately competent assessor. The responsible person remains responsible for the building, the assessment and acting on findings. Check the information and suitability of your completed work; obtain specialist advice where necessary.
Use Save in each section and wait for the saved confirmation. Unconfirmed changes remain in the open tab and can be lost if it closes. You see one current saved assessment; internal security history and conflict protection are retained. Finalisation and protected report access require the assigned person’s active signed-in session. No additional password confirmation is required while that session remains valid. Accounts with an enrolled verified authenticator continue to require it when signing in. A finalised report cannot be overwritten. Downloads are HTML/JSON; automatic PDF generation is not included.
Access, delivery and deletion
Your purchase confirmation records the building, price, access dates and accepted terms. Before paid access closes, the service sends the finalised report, or the latest saved assessment clearly marked “DRAFT — NOT FINALISED” if unfinished, to the current authorised assignee. Keep that email address current and download your own copy. An unfinished draft is not a finalised assessment. Delivery problems are recorded for investigation and retry; email receipt cannot be guaranteed.
Access ends after six calendar months. Assessment answers, photos, report copies and content-bearing working history are deleted from active service storage 30 days later. Payment records, accepted purchase terms and minimal security/deletion evidence are retained separately where needed for legal obligations or reconciliation. Restricted backup copies follow their documented schedules; restoring a backup must reapply deletion before customer access or sending resumes. The privacy notice explains these distinctions. Download anything you need before access ends.
Cancellation and problems
Our voluntary change-of-mind refund is available if requested within 14 days of purchase and before the first report download. Outside those conditions we do not offer a voluntary change-of-mind refund. This does not remove any statutory cancellation right, refund, repair or other remedy you may have, including where the service is faulty or misdescribed. Requesting immediate service or downloading a report does not itself waive rights applying to the six-month hosted service. The separate cancellation policy forms part of these terms.
To cancel, email hello@toaction.co.uk with your name, purchase reference and a clear statement that you wish to cancel. You may use: “I give notice that I cancel my FRA purchase [reference], ordered on [date]. My name is [name] and my contact email is [email].” No particular form is required. We assess requests under the applicable statutory rules as well as our voluntary policy; no automatic refund is promised.
We must provide the service with the care and skill required by law. Nothing here excludes liability or rights that cannot lawfully be excluded. Contact us about errors or service problems so we can investigate and put them right. We do not promise an uninterrupted service or a fixed support response time. Changes to future offers do not alter the terms already accepted for your purchase.
These terms are governed by the law of England and Wales, without removing any mandatory consumer protections or court rights that apply to you.
Organisation assessment information — processing terms
These terms apply where an organisation uses the FRA service to process personal information in its assessment. They form part of its service contract with TO ACTION CIC, company 17515320. Contact hello@toaction.co.uk.
The organisation is controller of that assessment content. To Action is its processor for hosting, saving, securing, presenting and exporting it, delivering the authorised report, and deleting it under the agreed service. Processing lasts for the paid access period and the agreed deletion/backup period. Content may concern building users, employees, volunteers, assessors and other people the organisation chooses to describe or photograph. It may include names, contact details, roles, assessment observations and photographs. The service is not designed for unnecessary sensitive personal information; the organisation must minimise what it uploads and establish its own lawful basis and notices.
To Action will:
- Process that content only on documented instructions in the service contract and authorised use, including instructions concerning international transfers, unless applicable law requires otherwise. Where permitted, tell the organisation about a legal requirement before processing. Inform it if an instruction appears to infringe applicable data-protection law.
- Restrict content access to authorised people bound by confidentiality; apply appropriate access controls, private storage, secure transport and operational safeguards proportionate to the information and risks.
- Assist the organisation, considering the nature of processing and available information, with individual-rights requests, security duties, breach assessment/notification, data-protection impact assessments and regulatory consultation. Notify it of a personal-data breach without undue delay after becoming aware.
- Use only authorised subprocessors subject to equivalent applicable processing obligations. The organisation generally authorises Supabase for authentication/database/private files, Vercel for hosting and Resend for transactional report email. Stripe separately processes payment information under its applicable terms. To Action remains responsible for its subprocessors’ performance of these processing obligations. Notify the organisation before a relevant subprocessor addition or replacement and allow a reasonable opportunity to object; resolve an objection before the affected processing starts.
- Make the information necessary to demonstrate compliance available and allow reasonable controller or independent-auditor checks, respecting the security and confidentiality of other customers. This does not give access to another organisation’s records or provider credentials.
- Delete active assessment content, reports, photos, caches and content-bearing working history 30 days after six-month access ends, after making the authorised report available during access. Restricted backup copies follow the documented backup schedule and must not restore deleted access or restart sending. Keep only data that applicable law requires to be retained and minimal separate deletion evidence, subject to its appropriate lawful basis.
The organisation must give lawful instructions, manage its users and assignments, protect credentials, check recipients and avoid collecting unnecessary information. These processing terms do not reduce either party’s responsibilities or individuals’ rights under applicable law. Before launch, the provider/transfer schedule must identify the actual contractual arrangements; a UK project location alone is not evidence that no international transfer occurs.
Document version: fra-live-terms-20261019-v2