1. PURPOSE AND SCOPE

1.1 This policy sets out how Talik and Company Ltd (“Talik”) makes sure that the strategy, organisation development, leadership development and coaching work it delivers consistently meets its clients’ needs and improves over time. It establishes Talik’s Quality Management System and applies the requirements of ISO 9001:2026 Quality management systems – Requirements in a way that is proportionate to a micro-sized consultancy.

1.2 Talik has worked fully virtually since 2019 and delivers much of its work through Associates and Subcontractors. This policy therefore applies to every User, to every Assignment from first enquiry to close and follow-up, and to every service Talik offers, including consulting, facilitation, diagnostics, research, training and coaching, whether delivered online, on client sites or elsewhere.

2. DEFINITIONS

2.1 In this policy:

“Assignment” means a piece of work Talik agrees to deliver for a client under a proposal, contract, purchase order or call-off, including coaching programmes.

“Associate” means a self-employed consultant or coach engaged by Talik, and “Subcontractor” means an organisation engaged by Talik to deliver part of a client contract. “Complaint” means any expression of dissatisfaction from a client, coachee, participant or other interested party about Talik’s work or conduct, however it is made.

“Deliverable” means any report, presentation, design, framework, diagnostic, workshop material or other output provided to a client. “Director” means Dr Alexandra Stubbings, Managing Director of Talik, who is Talik’s top management for the purposes of ISO 9001.

“Nonconformity” means a failure to meet a requirement, whether of a client, a contract, the law, ISO 9001 or this policy.

“Quality Management System” means the policies, processes, records and responsibilities through which Talik plans, delivers, checks and improves its work, as described in this policy.

“Quality Objectives” means the measurable objectives set under clause 8.

“Quality Register” means the record kept under clause 14 of risks and opportunities, Quality Objectives, client feedback, Complaints, Nonconformities, corrective actions, audits and improvements.

“User” means the Director, anyone employed by Talik, every Associate and Subcontractor, and anyone else who delivers work on Talik’s behalf.

3. STANDARDS AND FRAMEWORK

3.1 ISO 9001:2026 was published in September 2026 and replaces ISO 9001:2015. Certificates issued against ISO 9001:2015 remain valid during a three-year transition period ending in September 2029. This policy is written to the 2026 edition, including its emphasis on quality culture, ethical behaviour, the organisation’s strategy and context, and the planning of change.

3.2 Talik applies the seven quality management principles in ISO 9000: customer focus, leadership, engagement of people, the process approach, improvement, evidence-based decision making and relationship management. Talik does not design or manufacture products, and Talik’s Quality Management System is scaled to its size, the nature of its work and the competence of its people, as ISO 9001 permits.

3.3 Talik shall describe itself as ISO 9001 certified only while it holds a current certificate issued by a certification body accredited by the United Kingdom Accreditation Service (“UKAS”). Until then, Talik may say that its Quality Management System is aligned to ISO 9001.

4. QUALITY POLICY STATEMENT

4.1 Talik exists to help organisations set clear direction and build the leadership, capability and culture to deliver it. Quality, for Talik, means work that is rigorous, evidence-based and practical, that is tailored to each client’s context, and that leaves the client better able to act for themselves. Talik is therefore committed to:

(a) understanding each client’s strategy, context and needs before proposing work, and agreeing clear outcomes, scope, roles and measures of success;

(b) delivering every Assignment through competent, appropriately qualified and supervised people, using sound methods and credible evidence;

(c) acting with integrity, independence and respect, protecting confidentiality and telling clients plainly when Talik is not the right provider or when evidence does not support a preferred answer;

(d) meeting all applicable client, contractual, legal and regulatory requirements;

(e) setting, monitoring and reviewing Quality Objectives that support Talik’s strategy;

(f) listening to clients, coachees, participants and Associates, and acting on what they say; and

(g) continually improving the Quality Management System, Talik’s services and its own practice.

4.2 This statement provides the framework for setting Quality Objectives. It is supported by Talik’s strategy and its Information Security, Environmental and Whistleblowing Policies and Data Protection and UK GDPR Statement.

5. ROLES AND RESPONSIBILITIES

5.1 The Director is accountable for the effectiveness of the Quality Management System. The Director shall set this policy and the Quality Objectives, make sure the system is built into how Talik wins and delivers work, provide the resources it needs, lead by example in promoting quality and ethical behaviour, carry out management review and approve every exception to this policy, recording its reason and review date.

5.2 The office manager supports the Director in maintaining the Quality Register, client feedback and Complaints records, Associate records and document control. The Director shall name a lead consultant for every Assignment, who is responsible for its planning, quality checks and client relationship.

5.3 Every User shall follow this policy, deliver work to the standard agreed with the client, raise any Nonconformity, risk or improvement idea straight away and take part in feedback, reviews and audits when asked.

6. CONTEXT AND INTERESTED PARTIES

6.1 At least annually, as part of management review, the Director shall consider the external and internal issues that affect Talik’s ability to deliver quality work, including market and public sector procurement conditions, client expectations, changes in law and standards, the availability of skilled Associates, technology including artificial intelligence tools, and climate change, and shall record any that are relevant.

6.2 Talik’s interested parties include clients and their commissioners, coachees and participants, Associates and Subcontractors, IT and other suppliers, professional and accrediting bodies, insurers, regulators and the communities affected by its clients’ decisions. The Director shall record their relevant requirements, including any relevant to climate change, and review them with the issues above.

7. RISKS, OPPORTUNITIES AND CHANGE

7.1 The Director shall keep risks and opportunities affecting quality in the Quality Register, with their likelihood, impact, owner and planned action, and shall review them quarterly and before any significant bid. Typical risks include the loss of a key Associate, scope creep, unclear client sponsorship, conflicts of interest and over-reliance on a small number of clients. Typical opportunities include new services, partnerships, frameworks and better use of technology.

7.2 Before making a significant change, such as introducing a new service, delivery method, technology, key Associate or Subcontractor, or a change to this system, the Director shall plan it, considering its purpose, consequences, resources and responsibilities, communicate it to those affected, and review whether it achieved what was intended.

8. QUALITY OBJECTIVES

8.1 The Director shall set Quality Objectives each year as part of management review. They shall be consistent with this policy and Talik’s strategy, measurable, monitored, communicated to Users and updated as needed, and shall record what will be done, by whom, with what resources, by when and how results will be evaluated.

8.2 Quality Objectives shall normally cover:

(a) client satisfaction, measured through end-of-Assignment feedback;

(b) delivery of Deliverables on time and to the agreed scope;

(c) repeat business and referrals;

(d) the number, handling and resolution of Complaints and Nonconformities;

(e) completion of Associate onboarding, continuing professional development and coaching supervision; and

(f) completion of planned improvement actions and internal audits.

9. CLIENT REQUIREMENTS AND PROPOSALS

9.1 Before Talik commits to an Assignment, the lead consultant shall confirm and record the client’s objectives, scope, Deliverables, timescales, fees, roles, success measures, information security and data protection requirements, and any statutory, regulatory or framework terms.

9.2 Before a proposal or contract is issued, the Director shall review it to confirm that Talik understands what is required, has the competence and capacity to deliver it, has no unmanaged conflict of interest, and can meet any requirement that differs from an earlier proposal. Changes to scope, timescale or fees shall be agreed with the client in writing before the changed work starts.

10. PLANNING AND DELIVERING ASSIGNMENTS

10.1 Each Assignment shall have a proportionate plan setting out its stages, methods, people, client touchpoints, review points and risks. Where Talik designs a new framework, diagnostic, programme or tool, the lead consultant shall define its inputs, test it against the client’s requirements and record design decisions, reviews and changes.

10.2 During delivery Users shall:

(a) use methods, models and evidence that are sound and appropriate to the client’s context, and state the sources and limits of any data or analysis;

(b) agree with the client how progress will be reviewed and keep a record of key decisions and changes;

(c) treat client materials and information as confidential under the Information Security Policy;

(d) not use public generative artificial intelligence tools with Client Information without the approvals required by the Information Security Policy, and check any output used in a Deliverable for accuracy; and

(e) for coaching, work within the agreed contract and the ethical code of their accrediting body and maintain regular supervision.

10.3 Before release, every significant Deliverable shall be checked against the agreed requirements by someone other than its author, normally the Director or another senior consultant, and the check recorded. Deliverables shall be released only once that check is complete, unless the client agrees otherwise.

10.4 Where a Deliverable or service does not meet the agreed requirements, the lead consultant shall stop or correct it, tell the client where it has been affected, agree the remedy and record the outcome as a Nonconformity.

11. ASSOCIATES, SUBCONTRACTORS AND SUPPLIERS

11.1 Before first engagement, the Director shall evaluate each Associate and Subcontractor for competence, qualifications and accreditations, references, insurance, availability and fit with Talik’s values, and record the result. Each shall work under a written agreement covering the standards in this policy, confidentiality, data protection, information security, conflicts of interest and the client’s requirements.

11.2 The Director shall brief each Associate and Subcontractor on the client, scope and quality expectations before each Assignment, review their performance through client feedback and at the end of each Assignment, and re-evaluate them at least annually. Other suppliers that affect quality, such as IT, platform and venue suppliers, shall be selected and reviewed in the same proportionate way.

12. COMPETENCE, AWARENESS AND KNOWLEDGE

12.1 The Director shall decide the competence each role requires, make sure every User meets it through education, training, accreditation or experience, and keep evidence of it. Coaches shall hold or be working towards a recognised professional accreditation, and every User shall undertake continuing professional development each year.

12.2 Every User shall be made aware of this policy, the relevant Quality Objectives, how their work contributes to quality, the importance of ethical behaviour, and the consequences of not following the Quality Management System.

12.3 Talik shall capture what it learns from each Assignment through a close-out review, and keep its methods, tools, case studies and lessons learned in its approved Cloud Services so that knowledge is retained when people change and can be shared with Users who need it.

13. QUALITY CULTURE AND ETHICAL CONDUCT

13.1 Talik seeks a culture in which people own the quality of their work, speak up early about problems and mistakes, challenge one another constructively and learn rather than blame. The Director shall model this by inviting feedback, sharing lessons learned with Users and recognising good practice.

13.2 Users shall act honestly and objectively, declare any actual or potential conflict of interest before and during an Assignment, not offer or accept inducements, respect diversity and inclusion, and never misrepresent their qualifications, Talik’s credentials or the evidence behind their advice. Concerns may be raised with the Director or under the Whistleblowing Policy.

14. DOCUMENTED INFORMATION

14.1 Talik shall keep the documented information needed to operate and evidence its Quality Management System, including this policy, the Quality Register, proposals and contracts, Assignment plans, review records, client feedback, competence records, audit reports and management review minutes.

14.2 Controlled documents, such as policies, templates and standard methods, shall show their version and date, be approved by the Director before use, be held in Talik’s approved Cloud Services and be protected, retained and disposed of in line with the Information Security Policy and the Data Protection and UK GDPR Statement.

15. CLIENT FEEDBACK AND COMPLAINTS

15.1 Talik shall seek feedback at the end of every Assignment, and at agreed points during longer Assignments and coaching programmes, and shall record and review it in the Quality Register.

15.2 Complaints shall be reported to the Director, who shall acknowledge them within two working days, investigate them fairly, respond in writing with the outcome within ten working days or explain why more time is needed, and record them with the action taken. Where a Complaint concerns the Director, the complainant may ask for it to be reviewed by an independent Associate or adviser.

16. NONCONFORMITY AND CORRECTIVE ACTION

16.1 When a Nonconformity or Complaint arises, Talik shall:

(a) act to control and correct it and deal with its consequences for the client;

(b) identify its cause and whether similar Nonconformities exist or could occur;

(c) take corrective action proportionate to its effect, including updating risks, methods or this system where needed;

(d) check that the action has worked; and

(e) record the Nonconformity, its cause, the action taken and the result in the Quality Register.

17. MONITORING, MEASUREMENT AND INTERNAL AUDIT

17.1 The Director shall monitor progress against the Quality Objectives quarterly, using client feedback, delivery records, the Quality Register, Associate reviews and financial information, and shall use the results to decide where action is needed.

17.2 Talik shall audit its Quality Management System at least annually, and before any certification assessment, against this policy and ISO 9001. Because the Director cannot objectively audit her own work, audits shall be carried out by a competent Associate not involved in the processes audited or by an external auditor. Findings shall be reported to the Director, recorded and acted on under clause 16.

18. MANAGEMENT REVIEW

18.1 The Director shall carry out a management review at least annually, and record its conclusions. The review shall consider:

(a) actions from previous reviews and changes in context, interested parties’ requirements and strategy, including climate change;

(b) client satisfaction, Complaints and feedback;

(c) performance against the Quality Objectives, Nonconformities and corrective actions, audit results and Associate, Subcontractor and supplier performance;

(d) the adequacy of resources and the effectiveness of actions on risks and opportunities; and

(e) opportunities for improvement and any changes needed to this policy, the Quality Objectives or the Quality Management System.

19. CONTINUAL IMPROVEMENT

19.1 Talik shall continually improve the suitability, adequacy and effectiveness of its Quality Management System and its services, drawing on client and Associate feedback, close-out reviews, audits, management review, professional development and developments in organisational and leadership practice. Improvement ideas shall be recorded in the Quality Register and prioritised by the Director.

20. COMMUNICATION

20.1 This policy shall be communicated to every User at onboarding and whenever it changes, and shall be available to clients and other interested parties on request and in tender submissions. The Director shall decide what quality information is communicated to clients, Users and other interested parties, when and by whom.

21. COMPLIANCE AND BREACH

21.1 A breach of this policy may lead to removal from an Assignment, termination of an Associate’s or Subcontractor’s engagement, or disciplinary action for anyone employed by Talik. Concerns may also be raised under the Whistleblowing Policy.

22. REVIEW AND RELATED DOCUMENTS

22.1 The Director shall review this policy annually as part of management review, and whenever ISO 9001, the law, client requirements or Talik’s strategy, services or structure change significantly. It should be read with the Information Security Policy, the Data Protection and UK GDPR Statement, the Whistleblowing Policy and the Environmental Policy.

1. PURPOSE AND SCOPE

1.1 This policy sets out how Talik and Company Ltd (“Talik”) protects its own information and the information its clients entrust to it. It applies the five technical controls in Cyber Essentials: Requirements for IT Infrastructure v3.3 and the guidance of the National Cyber Security Centre (the “NCSC”) for small organisations.

1.2 Talik has worked fully virtually since 2019, so its security rests on the Devices, accounts and Cloud Services its people use at home, on client sites and while travelling. This policy applies to every User, to every Device and Cloud Service used for Talik work, whoever owns it, and to Talik Information and Client Information in any form, including paper notes and conversations.

2. DEFINITIONS

2.1 In this policy:

“Associate” means a self-employed consultant engaged by Talik, and “Subcontractor” means an organisation engaged by Talik to deliver part of a client contract. “Client Information” means any information received from, or created for, a client, including Personal Data.

“Cloud Service” means an on-demand, scalable internet service on shared infrastructure, used through an account to store or process Talik’s data.

“Device” means any internet-connected computer, tablet, smartphone, router or other equipment used for Talik work.

“Director” means Dr Alexandra Stubbings, Managing Director of Talik.

“MFA” means multi-factor authentication: two or more different factors, such as a password and an authenticator app code.

“Passkey” means a passwordless sign-in credential based on public key cryptography, including a FIDO2 authenticator.

“Personal Data” and “Personal Data Breach” have their UK GDPR meanings.

“Security Incident” means any event that compromises, or may compromise, the confidentiality, integrity or availability of Talik Information, Client Information, a Device or an account.

“Talik Information” means information belonging to Talik. “User” means the Director, anyone employed by Talik, every Associate and Subcontractor, and anyone else with access to Talik accounts or Client Information.

3. LEGAL AND REGULATORY FRAMEWORK

3.1 Article 32 of the UK GDPR requires Talik, as controller or processor, to secure Personal Data with appropriate technical and organisational measures, including where appropriate encryption and the ability to restore data promptly after an incident. The Data Protection Act 2018 supplements the UK GDPR, and Talik’s wider duties are set out in the Data Protection and UK GDPR Statement.

3.2 Since 30 September 2026 the Information Commission, still known as the ICO, has replaced the Information Commissioner under the Data (Use and Access) Act 2025.

3.3 Procurement Policy Note 014 requires central government and NHS bodies to ask for Cyber Essentials or Cyber Essentials Plus in contracts involving personal information, OFFICIAL information systems or the day-to-day business of government, with evidence before award and annual renewal for the life of the contract.

4. ROLES AND RESPONSIBILITIES

4.1 The Director is accountable for information security, approves every account, Device and Cloud Service, leads incident response, signs the Cyber Essentials declaration, and records any exception to this policy with its reason and review date. The office manager supports the Director in keeping the register, incident log and joiner and leaver records.

4.2 Talik’s IT supplier administers its Cloud Services and Devices under a written agreement and shall apply this policy. Every User shall follow this policy and report any Security Incident straight away.

5. SCOPE AND BRING YOUR OWN DEVICE

5.1 Talik shall certify its whole organisation. End user Devices and every Cloud Service holding Talik data must be in scope, and Cloud Services cannot be excluded. Every account Talik owns is in scope, including accounts used by its IT supplier, Associates or Subcontractors.

5.2 Talik’s own Devices are in scope. A personally owned Device that the Director, or anyone employed by Talik, uses for Talik data or services is a bring your own device, is in scope and shall meet this policy before use. A phone used only for native calls, native texts or an MFA app is outside scope.

5.3 Devices owned by Associates and Subcontractors, whom the scheme treats as third party contractors, fall outside the certification scope, but Talik remains responsible for confirming they are configured correctly. Each Associate and Subcontractor shall therefore apply clauses 7 to 11 to every Device used for Talik work, and confirm this in writing before first access and annually.

6. ASSET AND SOFTWARE REGISTER

6.1 Talik shall keep a register of every Device used for Talik work (user, owner, operating system, support end date and security status), every software product and Cloud Service (purpose, administrator, MFA status and data location) and every account with its access level, reviewed quarterly, before each assessment and when a User joins or leaves. Nothing shall be used for Talik work until registered.

7. FIREWALLS

7.1 Home routers that Talik has not supplied are outside the scheme, so every laptop and desktop shall keep its built-in software firewall switched on, blocking unauthenticated inbound connections, especially on public wifi or other networks Talik does not control.

7.2 Any router or firewall Talik supplies shall have a strong, unique administrative password, no administrative access from the internet unless protected by MFA or an IP allow list, unauthenticated inbound connections blocked, and each inbound rule approved and documented by the Director with its business need and removed when no longer needed.

8. SECURE CONFIGURATION, SCREEN LOCK AND ENCRYPTION

8.1 Before a Device is used for Talik work, and regularly afterwards, unnecessary accounts, software and services shall be removed or disabled, default or guessable passwords changed and auto-run disabled.

8.2 Every Device shall require a password, PIN or biometric to unlock. A PIN or password used only to unlock a Device shall be at least six characters, and one that also signs in to an account shall meet clause 10.4. Devices shall lock after ten failed attempts at most, or allow no more than ten attempts in five minutes, and lock automatically after five minutes of inactivity.

8.3 Every Device shall use the operating system’s built-in full disk encryption, and phones and tablets shall have remote locate and wipe enabled. This goes beyond Cyber Essentials and supports Article 32 of the UK GDPR.

8.4 In line with the Environmental Policy, Talik shall keep Devices in use to the end of their supported life, then securely erase them or have them destroyed by a recycler certifying data destruction.

9. SECURITY UPDATE MANAGEMENT

9.1 All software shall be licensed and supported, with automatic updates enabled wherever possible. Unsupported software shall be removed, and a Device whose operating system no longer receives security updates shall not be used for Talik work.

9.2 Updates fixing vulnerabilities that the vendor rates critical or high risk, or with a CVSS version 3 base score of 7 or above, or for which the vendor gives no severity, shall be installed within 14 days of release, including combined updates containing such fixes. Talik shall aim to apply all other updates within the same period.

10. USER ACCESS CONTROL, PASSWORDS AND PASSKEYS

10.1 Accounts shall be created only with the Director’s approval. Each User shall have their own account and unique credentials, never shared, with access limited to what their role needs. Access no longer needed shall be removed, and accounts unused for 90 days disabled unless the Director confirms otherwise.

10.2 Administrator rights shall be held only by the Director and the IT supplier, through separate administrator accounts never used for email or web browsing.

10.3 MFA shall be enabled wherever available and is mandatory on every Cloud Service and administrator account. Under the current requirements, a Cloud Service without MFA where available, free or paid, fails the whole assessment. Authenticator apps, Passkeys or security keys shall be preferred to text message codes, and Users shall never approve a sign-in request they did not start.

10.4 Passkeys shall be used wherever supported. Otherwise each password shall be unique, at least 12 characters with no maximum length, ideally three random words, and kept in a password manager approved by the Director. Talik shall not force regular expiry or complexity rules. A password known or suspected to be compromised shall be changed at once and reported.

11. MALWARE PROTECTION

11.1 Every Windows and macOS Device shall run up to date anti-malware software, which may be the built-in protection, set to stop malware and malicious code running and to block malicious websites. Phones and tablets shall install apps only from the official app store, which allows only signed apps, shall use only registered apps for Talik work, and shall not be jailbroken or rooted. No User shall disable malware protection.

12. CLIENT INFORMATION AND PERSONAL DATA

12.1 Talik classifies information as Public, Internal or Confidential. All Client Information and Personal Data is Confidential. Where a client applies its own marking, such as OFFICIAL under the Government Security Classifications Policy, Talik shall treat the information as Confidential as a minimum and follow the client’s handling instructions.

12.2 Confidential information shall:

(a) be stored only in Talik’s approved Cloud Services or the client’s systems, never in personal email or cloud storage, on removable media or in any unregistered service;

(b) be shared only with Users who need it, through links restricted to named people or by the method the client specifies, rather than as email attachments;

(c) never be entered into a public online service, including generative chat, transcription or translation tools, without the Director’s approval and the client’s agreement;

(d) be kept to the minimum needed, especially health or other special category data from coaching; and

(e) be returned or securely deleted when the work ends, as the contract requires.

12.3 Users shall not forward Talik or client email to a personal account. Paper notes shall be kept to a minimum, stored securely and shredded when no longer needed.

13. EMAIL AND PHISHING

13.1 Users shall treat unexpected links, attachments, sign-in pages and requests for payment or credentials with caution. Requests to change bank details or make urgent payments shall be checked by calling the sender on a number Talik already holds.

13.2 Suspicious emails shall be reported to the Director and forwarded to the NCSC at report@phishing.gov.uk, and suspicious texts to 7726. Anyone who clicks a suspicious link or enters credentials shall tell the Director at once. No one will be blamed for reporting promptly.

14. REMOTE, HOME AND TRAVEL WORKING

14.1 Home wifi shall have a strong password. On public wifi Users shall check that the software firewall is on, use only networks they can identify and prefer their own mobile hotspot for Confidential work. Public or shared computers shall never be used.

14.2 Users shall keep screens out of others’ view, and Confidential matters, including coaching conversations, shall not be discussed where they can be overheard. Devices shall be kept with the User when travelling and never left unattended in vehicles or public places. Users travelling abroad shall take only what they need and follow any client restriction on overseas access.

15. WORKING ON CLIENT SYSTEMS AND CLIENT DEVICES

15.1 Where a client provides an account, a Device or system access, Users shall follow the client’s security and acceptable use rules as well as this policy, use that access only for that client’s work, copy nothing out without the client’s authority, report any Security Incident to the client and the Director, and return all client Devices and access when the work ends.

16. BACKUPS AND RECOVERY

16.1 Backing up is not a Cyber Essentials requirement, but the NCSC strongly recommends it. Talik Information shall be held in approved Cloud Services, not only on Devices, with a further backup kept separate from the primary service and protected by MFA, so that ransomware or deletion cannot destroy both. External backup drives shall be encrypted and disconnected when not in use. Talik shall test a restore every six months and record the result.

17. CLOUD SERVICES AND IT SUPPLIERS

17.1 Before approving a Cloud Service, the Director shall confirm that it supports MFA, offers UK GDPR compliant data processing terms and lawful arrangements for any transfer of Personal Data overseas. Talik remains responsible for every Cyber Essentials control on its Cloud Services and shall ensure that any control the provider implements is committed to in the contract or a document it refers to, such as a published security statement.

17.2 Talik’s IT supplier shall work under a written agreement covering confidentiality, data protection, MFA on its administrator access, prompt incident notification and confirmation that the Cyber Essentials controls are met for the services it manages.

18. JOINERS, MOVERS AND LEAVERS

18.1 Before access is granted, the Director shall approve it and the User shall accept this policy, complete training, set up MFA and, if an Associate or Subcontractor, give the confirmation in clause 5.3. Access shall be adjusted on the day a role or assignment changes.

18.2 By a User’s last working day, Talik shall disable their accounts, remove their access to shared folders, links and client systems, recover Talik Devices and papers, change shared credentials they knew, and obtain written confirmation that all Talik Information and Client Information has been returned or deleted.

19. SECURITY INCIDENT REPORTING AND RESPONSE

19.1 Security Incidents include a lost Device, a misdirected email, an unexpected sign-in alert, a clicked phishing link, malware and unauthorised access to Client Information.

19.2 Any User who discovers or suspects a Security Incident shall report it to the Director immediately, and in any event within 24 hours, including at weekends, and shall preserve evidence. The 72 hour period for reporting a Personal Data Breach runs from when Talik becomes aware of it, so any delay shortens the time available.

19.3 The Director shall:

(a) contain the incident, for example by resetting credentials or remotely wiping a Device, and assess its cause, extent and impact, including whether Personal Data is involved;

(b) where Personal Data is involved, apply the test in the Data Protection and UK GDPR Statement: as controller, notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people’s rights and freedoms, and tell the people affected without undue delay where the risk is high; as processor, notify the client without undue delay and within any shorter period the contract sets;

(c) tell any affected client as its contract requires, even where no Personal Data is involved;

(d) report fraud and cyber crime to Report Fraud (reportfraud.police.uk, 0300 123 2040), consider reporting significant incidents to the NCSC, and notify insurers where Talik’s policies require; and

(e) record every Security Incident, including those not reported externally, with its facts, effects, action taken and lessons learned.

20. TRAINING

20.1 Every User shall complete security training before accessing Client Information and annually, covering this policy, phishing, Passkeys and MFA, handling Client Information, remote working and incident reporting. The Director shall keep training records.

21. CYBER ESSENTIALS CERTIFICATION

21.1 Talik’s Cyber Essentials certificate has lapsed. Assessment for renewal is under way with its IT supplier, against the v3.3 requirements, which apply to applications started on or after 27 April 2026. Talik shall not describe itself as certified until a new certificate is issued.

21.2 Talik shall hold a current certificate before the award of any public sector framework or contract, renew it every twelve months, obtain Cyber Essentials Plus where a buyer requires it, and keep every control in place between assessments.

22. MONITORING, COMPLIANCE AND BREACH

22.1 The Director shall monitor compliance through quarterly register reviews, Cloud Service reports on MFA enrolment and sign-in alerts, the annual Associate and Subcontractor confirmations and each assessment.

22.2 A breach of this policy may lead to removal of access and to termination of an Associate’s or Subcontractor’s engagement, or disciplinary action for anyone employed by Talik. Concerns may also be raised under the Whistleblowing Policy.

23. REVIEW AND RELATED DOCUMENTS

23.1 The Director shall review this policy annually, before each Cyber Essentials renewal, after any significant Security Incident and whenever the requirements, the law or Talik’s systems change. It should be read with the Data Protection and UK GDPR Statement, the Whistleblowing Policy and the Environmental Policy.

1. PURPOSE AND SCOPE

1.1 This statement sets out how Talik and Company Ltd (“Talik”) complies with data protection law. It covers all personal data Talik handles about Clients and their staff, participants, Associates, suppliers and website users.

1.2 It applies to the Director, any employee and every Associate and subcontractor who handles personal data for Talik (“Talik people”), wherever they work.

1.3 Talik pays the data protection fee under the Data Protection (Charges and Information) Regulations 2018. Its registration number is ZA688388.

2. DEFINITIONS

2.1 In this statement:

“Associate” means a self-employed consultant engaged by Talik to deliver work on its behalf.

“Client” means an organisation for which Talik provides services. “Controller” and “Processor” have the meanings given in Article 4 of the UK GDPR.

“Data Protection Law” means the UK GDPR, the Data Protection Act 2018 (“DPA 2018”) and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), each as amended by the Data (Use and Access) Act 2025 (“DUAA”).

“Information Commission” means the UK data protection regulator, which replaced the Information Commissioner on 30 September 2026.

“Personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

“Special category data” has the meaning given in Article 9(1) of the UK GDPR, and “criminal offence data” means personal data within Article 10. “UK GDPR” means the UK General Data Protection Regulation.

3. LEGAL FRAMEWORK

3.1 Talik shall comply with Data Protection Law, have regard to Information Commission guidance and meet any higher standard set by a Client contract. Most DUAA changes took effect on 5 February 2026, the complaints duty on 19 June 2026 and the transfer of functions to the Information Commission on 30 September 2026.

4. TALIK AS CONTROLLER AND AS PROCESSOR

4.1 Talik is Controller of personal data it uses for its own purposes, such as running its business, engaging Associates and suppliers, and marketing. It is Processor where it handles personal data only on a Client’s documented instructions, such as participant lists supplied for a programme. Where Talik and a Client jointly decide the purposes and means, they shall agree an arrangement under Article 26. At the start of each engagement Talik shall record its role for each category of data, including coaching notes.

4.2 As Processor, Talik shall act under a written contract containing the terms required by Article 28(3) and shall:

(a) act only on the Client’s documented instructions, telling the Client at once if an instruction appears unlawful;

(b) ensure that everyone handling the data is bound by confidentiality;

(c) use a sub-processor, including an Associate or cloud service provider, only with the Client’s prior written authorisation, giving notice of any change so that the Client can object, imposing the same obligations in writing and remaining liable for it;

(d) help the Client with rights requests, security, breaches and impact assessments;

(e) delete or return the data at the end of the services, as the Client chooses, unless the law requires retention; and

(f) provide the information needed to demonstrate compliance and allow audits.

4.3 As Controller, Talik shall use only processors that give sufficient guarantees, under written terms meeting Article 28. Every Associate shall sign Talik’s confidentiality and data protection terms before receiving personal data.

5. PRINCIPLES AND ACCOUNTABILITY

5.1 Talik shall apply the principles in Article 5(1) of the UK GDPR: lawfulness, fairness and transparency; purpose limitation, including the DUAA rules on compatible further processing; data minimisation; accuracy; storage limitation; and integrity and confidentiality.

5.2 Talik shall be able to demonstrate compliance under Article 5(2) through this statement, its records, assessments, logs, contracts and training records, and shall apply data protection by design and by default under Article 25.

6. LAWFUL BASIS

6.1 Talik shall record a lawful basis under Article 6(1) for each purpose before processing starts, normally:

(a) contract, for Associates, suppliers and individuals who contract with Talik;

(b) legal obligation, for tax, accounting and other legal duties;

(c) legitimate interests, for serving Clients, managing Client contacts, securing its systems and marketing to organisations, with a recorded legitimate interests assessment, which remains necessary even for purposes the UK GDPR names as examples, such as direct marketing;

(d) recognised legitimate interests under Article 6(1)(ea) and Annex 1, such as safeguarding a vulnerable individual or responding to an emergency, where no balancing test is needed but the processing must be necessary; and

(e) consent, only where no other basis fits, such as for a named testimonial, recorded and as easy to withdraw as to give.

6.2 As Processor, Talik relies on the Client’s lawful basis and acts only on its instructions.

7. SPECIAL CATEGORY AND CRIMINAL OFFENCE DATA

7.1 Talik shall process special category data only where necessary and where a condition in Article 9(2) and, where required, a condition in Schedule 1 to the DPA 2018 applies. It mostly arises from health information shared to request an adjustment or in coaching and wellbeing conversations, handled in line with the Mental Health at Work Commitment, which Talik has signed.

7.2 Talik shall process criminal offence data only where the law or a Client contract requires a criminal record check, under a Schedule 1 condition.

7.3 Before relying on a Schedule 1 condition that requires one, such as the employment or safeguarding condition, Talik shall adopt an appropriate policy document under Part 4 of Schedule 1 and retain it for at least six months after the processing ends. None is needed for explicit consent or legal claims.

8. PRIVACY INFORMATION

8.1 Talik shall give the information required by Articles 13 and 14 in clear privacy notices on its website, to Associates and suppliers on engagement and to participants where Talik is Controller, and as Processor shall support the Client’s notices. Notices shall explain individuals’ rights and how to complain to Talik and to the Information Commission.

9. RECORDS OF PROCESSING

9.1 The Article 30(5) exemption for organisations with fewer than 250 employees does not cover processing that is not occasional, is likely to result in risk or involves special category or criminal offence data. Talik shall therefore keep records of processing as Controller and as Processor under Article 30, updated as its processing changes.

10. IMPACT ASSESSMENTS AND AUTOMATED DECISIONS

10.1 Talik shall screen each new programme design, system, tool and supplier, and complete a data protection impact assessment under Article 35 before any processing likely to result in a high risk, including large-scale processing of special category data. If a high risk remains, it shall consult the Information Commission under Article 36 before starting.

10.2 Talik makes no decisions based solely on automated processing with legal or similarly significant effects, and shall not do so without an impact assessment and the safeguards in Articles 22A to 22D.

11. COACHING AND PROGRAMME DATA

11.1 To minimise personal data in programme and coaching work, Talik people shall:

(a) collect only what the programme needs, such as name, role, contact details, attendance and any adjustment required;

(b) keep coaching notes brief, factual and relevant to the coaching goals, record special category data only where necessary and with the coachee’s knowledge, and never share notes with the sponsoring Client;

(c) agree in advance with the coachee and sponsor what will be reported, normally attendance and themes the coachee agrees to share;

(d) report feedback and evaluation results only in anonymised or aggregated form, and never for a group small enough to identify individuals;

(e) where 360 degree feedback or psychometric tools are used, tell participants who will see their results, protect anyone promised confidentiality and put any provider under proper contract terms;

(f) record a session only with advance notice to all participants, deleting the recording once its purpose is served; and

(g) use only systems approved under the Information Security Policy, never personal accounts or unprotected devices.

11.2 Coaching is confidential, but not absolutely. A Talik person who reasonably believes that someone is at risk of serious harm shall tell the Director at once. Talik may share the minimum information necessary with an appropriate person or authority, relying on the safeguarding or emergencies recognised legitimate interest and, for special category data, the Schedule 1 safeguarding condition, and shall record its decision and reasons.

12. RETENTION AND SECURE DELETION

12.1 Talik shall keep a retention schedule stating how long each category of personal data is kept and why. In particular:

(a) Client data held as Processor shall be deleted or returned at the end of the services as the contract requires, with confirmation on request;

(b) coaching notes and programme records shall be deleted at the end of the period set in the schedule;

(c) financial and company records shall be kept as long as tax and company law require; and

(d) contract records may be kept while a claim could arise, or longer where a Client contract requires.

12.2 Secure deletion covers all systems and shared storage, shredding of paper, expiry of backups and wiping of devices before disposal or reuse. Associates shall delete or return all Talik and Client personal data when each engagement ends and confirm this in writing.

13. SECURITY

13.1 Talik shall protect personal data with appropriate technical and organisational measures under Article 32, as set out in the Information Security Policy. Talik people shall check recipients before sending personal data and protect screens and conversations in public places and on Client sites.

14. PERSONAL DATA BREACHES

14.1 Any Talik person who suspects a personal data breach, such as an email sent to the wrong person or a lost device, shall report it to the Director immediately.

14.2 The Director shall contain the breach, assess the risk and record every breach, its effects and remedial action in the breach log, whether or not it is reported, as Article 33(5) requires.

14.3 As Controller, Talik shall notify the Information Commission without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals’ rights and freedoms, giving reasons for any delay. Where a high risk is likely, Talik shall also tell affected individuals without undue delay, unless an exception in Article 34(3) applies.

14.4 As Processor, Talik shall notify the Client without undue delay after becoming aware of a breach, or sooner if the contract requires, and give it the information and help it needs, but shall not notify the regulator or individuals for the Client unless instructed.

15. INDIVIDUAL RIGHTS REQUESTS

15.1 Individuals have rights of access, rectification, erasure, restriction, portability and objection, and rights about automated decisions; the right to object to direct marketing is absolute. A request may be made in any form to any Talik person, or to info@talikandco.net, and shall reach the Director the same day.

15.2 Talik shall respond without undue delay and within one month of receiving the request or, if later, any information reasonably needed to confirm identity or any fee due. It may extend this by up to two further months for complex or numerous requests, telling the person why within the first month.

15.3 Where Talik reasonably needs more information to identify what a request concerns, for example because it holds a large amount of information about the person, it may ask for it. The time limit pauses on the day Talik asks and resumes the day after the reply. Talik shall not seek clarification routinely.

15.4 For subject access, Talik shall make a reasonable and proportionate search, including systems Associates use for it, which the DUAA confirms is the extent of the duty, and shall apply any relevant exemption in Schedule 2 to the DPA 2018, such as protecting the identity of those who gave confidential feedback.

15.5 No fee is charged unless a request is manifestly unfounded or excessive, or further copies are sought. Talik may then charge a reasonable fee or, for a manifestly unfounded or excessive request, refuse, giving reasons and explaining the right to complain to the Information Commission and to seek a judicial remedy.

15.6 Talik shall log every request. A request about Client data held as Processor shall be passed promptly to the Client, with help to respond.

16. DATA PROTECTION COMPLAINTS

16.1 Section 164A of the DPA 2018, in force since 19 June 2026, requires Controllers to facilitate and handle data protection complaints. Talik shall:

(a) accept complaints by email to info@talikandco.net or by a complaint form that can be completed electronically, and treat complaints received by any other route in the same way;

(b) acknowledge each complaint within 30 days of receiving it;

(c) without undue delay, make appropriate enquiries, keep the complainant informed and tell them the outcome; and

(d) tell the complainant they may complain to the Information Commission, and record each complaint and its outcome.

17. INTERNATIONAL TRANSFERS

17.1 Talik shall make a restricted transfer outside the United Kingdom only as Chapter V of the UK GDPR, as replaced by the DUAA from 5 February 2026, permits: under UK adequacy regulations; under an Article 46 safeguard, such as the International Data Transfer Agreement or Addendum issued under section 119A of the DPA 2018, supported by an assessment that the data protection test is met, so that protection is not materially lower than in the United Kingdom; or under a specific exception.

17.2 Before using a supplier that will store or access personal data abroad, Talik shall establish where and on what basis. As Processor, it shall transfer Client data abroad only with the Client’s authorisation.

18. DIRECT MARKETING AND PECR

18.1 In electronic marketing, Talik shall:

(a) email individual subscribers, including sole traders and ordinary partnerships, only with consent or under the soft opt-in, where Talik obtained their details directly during a sale or negotiations, markets only similar services and offers a simple opt-out at collection and in every message;

(b) for corporate subscribers, rely on legitimate interests for named contacts and always identify itself and give a valid opt-out address;

(c) act on every objection or opt-out promptly and keep a suppression list; and

(d) use non-essential cookies only with consent, unless an exception in regulation 6 of PECR as amended by the DUAA applies, such as statistical purposes or website appearance or functionality, and then with clear information and a simple means of objecting.

19. ROLES AND RESPONSIBILITIES

19.1 Dr Alexandra Stubbings, as Director, is accountable for data protection at Talik, including this statement, the records, assessments, logs and retention schedule, decisions on breaches, requests and complaints, the data protection fee and dealings with the Information Commission. The office manager supports her with administration.

19.2 Talik is not required to appoint a data protection officer under Article 37 of the UK GDPR: it is not a public authority, and serving public bodies does not make it one; and its core activities involve neither large-scale, regular and systematic monitoring of individuals nor large-scale processing of special category or criminal offence data. As a voluntary appointment would carry the same statutory requirements, the Director acts as data protection lead rather than as a designated officer.

19.3 All Talik people shall follow this statement, complete training and report breaches, requests and complaints to the Director at once.

20. TRAINING

20.1 Every Talik person shall be trained before first handling personal data for Talik and annually after that, covering this statement, breaches, requests and complaints, coaching confidentiality, safeguarding and secure working. Talik shall record completion and brief Associates on Client- specific requirements.

21. MONITORING AND CONSEQUENCES

21.1 The Director shall monitor compliance, including through the logs and end-of-engagement deletion checks. Failure to follow this statement may lead to disciplinary action or termination of an engagement, and unlawfully obtaining or disclosing personal data may be a criminal offence.

22. REVIEW AND RELATED DOCUMENTS

22.1 The Director shall review this statement at least annually, when Data Protection Law or Information Commission guidance changes, after any significant breach or complaint, and when Talik’s services, systems or suppliers change.

22.2 This statement should be read with the Information Security Policy, the Whistleblowing Policy and the Equality, Diversity and Inclusion Policy.

1. STATEMENT OF INTENT

1.1 Talik and Company Ltd (“Talik”) is a management consultancy that has worked fully virtually since 2019. Its people work from home, on client sites and at venues arranged for its programmes. Talik is committed to the health, safety and wellbeing of everyone who works for or with it and everyone affected by its work, and gives mental wellbeing the same weight as physical safety.

1.2 Talik shall comply with the Health and Safety at Work etc. Act 1974 (“the 1974 Act”) and the regulations made under it, follow the guidance of the Health and Safety Executive (“HSE”), and, so far as is reasonably practicable, control the risks of its work and keep improving.

1.3 Section 2(3) of the 1974 Act requires an employer to prepare, revise and bring to its employees’ notice a written statement of its general health and safety policy and the organisation and arrangements for carrying it out. The Employers’ Health and Safety Policy Statements (Exception) Regulations 1975 exempt an employer with fewer than five employees. Talik adopts this written statement voluntarily, as HSE recommends, for everyone who works on its behalf. The Director signs it in the approval table below.

2. SCOPE AND DEFINITIONS

2.1 This statement applies to all work done by or for Talik. In it:

“Associate” means a self-employed consultant engaged by Talik to deliver services to its clients. “Director” means Dr Alexandra Stubbings, Managing Director of Talik.

“Participant” means anyone taking part in an activity that Talik delivers.

“Subcontractor” means an organisation engaged by Talik to deliver part of a contract, and its personnel. “Talik People” means the Director, any employee of Talik, Associates and Subcontractors, when working for Talik.

“Venue” means premises hired or arranged for an activity that Talik delivers, other than a client’s own workplace.

3. LEGAL FRAMEWORK

3.1 The core duties are:

(a) section 2 of the 1974 Act, under which an employer must ensure, so far as is reasonably practicable, the health, safety and welfare at work of its employees;

(b) section 3(1), under which an employer must conduct its undertaking so that others, including Associates, Participants and client staff, are not exposed to risks to their health or safety; and

(c) section 3(2), as amended by the Deregulation Act 2015 from 1 October 2015, under which a self-employed person owes that duty only if their undertaking involves a prescribed activity, such as construction, or may pose a risk to the health and safety of others. Many Associates may fall outside it, so Talik makes compliance with this statement a term of every Associate’s engagement.

4. ORGANISATION AND RESPONSIBILITIES

4.1 The Director has overall responsibility for health and safety at Talik. She shall bring this statement to the attention of all Talik People, make sure risks are assessed and controlled, provide the resources needed, act on every report made under clause 13, keep the insurance in clause 16 in force and review this statement. The office manager may keep records for her, but the Director remains responsible.

4.2 Every member of Talik People shall take reasonable care of themselves and others affected by their work, as section 7 of the 1974 Act requires of employees; follow this statement, Talik’s risk assessments and any client or Venue rules; report accidents, near misses and hazards to the Director promptly; and tell the Director, in confidence, of any condition or circumstance, such as pregnancy, that may affect their safety at work.

5. RISK ASSESSMENT AND COMPETENT ADVICE

5.1 Under regulation 3 of the Management of Health and Safety at Work Regulations 1999 (“the 1999 Regulations”), Talik shall assess the risks to its employees and to others affected by its work, and review it whenever it may no longer be valid or there is a significant change. The law requires the significant findings to be recorded only where there are five or more employees; Talik keeps a written record in every case.

5.2 The assessment covers each area in clauses 6 to 14 and identifies anyone especially at risk, including new and expectant mothers and disabled people. Talik shall make a specific assessment before any unusual activity, such as a residential or outdoor programme or work in a clinical or secure setting.

5.3 Regulation 7 requires an employer to appoint a competent person to help it comply, and HSE accepts that the employer may take on this role personally. The Director is Talik’s competent person and shall obtain qualified external advice on any risk beyond her competence.

6. HOME AND HYBRID WORKING

6.1 HSE guidance, restated in March 2026, is that employers owe home and hybrid workers the same duties as any other worker. Talik applies this clause to its employees as a legal duty and to Associates as a term of their engagement.

6.2 The Health and Safety (Display Screen Equipment) Regulations 1992 protect “users”: employees who habitually use display screen equipment as a significant part of their normal work, which HSE takes to include daily use for continuous periods of an hour or more. For each user, Talik shall:

(a) assess every regular workstation, including at home, which HSE accepts may be done by self-assessment after suitable instruction, without a home visit;

(b) provide, at no cost to the user, any equipment the assessment shows is needed;

(c) plan work so that screen work is broken up by breaks or changes of activity; and

(d) arrange an eye and eyesight test on request and at regular intervals, provide corrective appliances where a test shows they are needed specifically for screen work, and give adequate training and information.

6.3 Talik is responsible for the electrical equipment it provides. Home workers shall check plugs, leads and sockets for damage, stop using anything damaged, avoid overloading sockets and keep their work area free of trailing cables. Talik shall hold an emergency contact for each home worker.

7. LONE WORKING

7.1 Working alone is lawful, but its risks must be controlled. Following HSE’s guidance Protecting lone workers (INDG73), Talik People shall keep their whereabouts in a shared diary; agree a check in with a named person when working late, going somewhere unfamiliar or meeting someone new; hold face to face coaching in a professional setting rather than a private home; carry a charged phone; and leave any situation in which they feel unsafe. Talik shall keep in regular contact, because isolation affects wellbeing too.

8. DRIVING FOR WORK

8.1 HSE guidance is that health and safety law applies on the road as on a fixed site, including when a person drives their own vehicle, but not to ordinary commuting. Talik minimises driving by working virtually where suitable and preferring public transport.

8.2 Anyone driving on Talik business shall hold a valid licence; use a roadworthy, serviced vehicle insured for business use, with a valid MOT certificate where required; tell the Director of anything affecting their fitness to drive; take regular breaks; and not drive when tired. Talik shall check each driver’s licence and insurance before they first drive for it and annually after that.

8.3 Since 25 March 2022 it has been illegal to hold and use a phone, sat nav or similar device for any purpose while driving, including when stopped in traffic, except to call 999 or 112 in an emergency when it is unsafe to stop, when safely parked, to make a contactless payment while stationary, or to park remotely. The penalty is six points and a £200 fine, with higher fines and disqualification in court. Hands-free use is lawful, but a driver who is not in proper control can still be prosecuted. Rule 149 of the Highway Code is unchanged on this as at October 2026. Talik goes further: no one shall make or take calls or read messages on Talik business while driving, even hands-free, and Talik shall never expect them to.

8.4 Talik drives electric. Vehicles shall be charged at home through a charge point installed by a registered electrician, or with the manufacturer’s lead plugged directly into a suitable socket, never through a domestic extension lead, and no cable shall cross a public footway without the highway authority’s approval. At public charge points, drivers shall follow rule 239 of the Highway Code: park close, avoid trip hazards from trailing cables, display a warning sign if possible and return cables neatly. After a collision, the driver shall tell the emergency services that the vehicle is electric.

9. WORKING ON CLIENT PREMISES

9.1 Under regulations 11 and 12 of the 1999 Regulations, a host must give people working in its undertaking comprehensible information on the risks, the control measures and who is responsible for evacuation, and those sharing a workplace must cooperate. Talik shall obtain each client’s site rules, induction requirements and specific risks in advance. Talik People shall complete any induction, sign in and out, follow the host’s fire and evacuation procedures, note the exits and assembly point on arrival, report hazards to the host and the Director, and tell the host of any risk that Talik’s own activity creates.

10. ARRANGING VENUES FOR WORKSHOPS AND PROGRAMMES

10.1 Before confirming a Venue, Talik shall check that the room suits the numbers and activities; that the operator, as responsible person under the Regulatory Reform (Fire Safety) Order 2005, has fire safety arrangements and an evacuation procedure, including for anyone who needs help to leave; that first aid is available; and that the Venue is accessible. Talik shall ask Participants about access needs in advance, so that it can make the reasonable adjustments that the Equality Act 2010 requires of a service provider.

10.2 Under article 5(3) of that Order, anyone who has control of premises to any extent has fire safety duties for the matters within their control. When running a session, Talik shall keep exits clear, stay within the room’s capacity, keep an attendance list, and open with a briefing on the fire alarm, exits, assembly point and first aid.

10.3 Where Talik orders catering, the caterer must give allergen information for any of the 14 regulated allergens in the food it supplies, under Regulation (EU) No 1169/2011 as it applies in Great Britain. Talik shall collect Participants’ allergy and dietary needs in advance, as health data under its Data Protection and UK GDPR Statement; pass them to the caterer in writing; ask for written allergen information for each item, as the Food Standards Agency’s best practice guidance of March 2025 recommends; and make sure food for people with allergies is clearly identified.

11. WORK RELATED STRESS AND MENTAL WELLBEING

11.1 HSE states that employers have a legal duty to protect employees from stress at work by assessing the risk and acting on it. Talik assesses work related stress using HSE’s Management Standards: demands, control, support, relationships, role and change.

11.2 Talik is a signatory to the Mental Health at Work Commitment and embeds the principles of Thriving at Work. Talik shall therefore plan realistic workloads and travel; not expect replies outside agreed working hours; hold regular one to one conversations that cover wellbeing; support access to professional supervision for emotionally demanding coaching and facilitation; carry out an individual stress risk assessment and agree adjustments where someone reports stress; signpost confidential support; and report its progress against the Commitment in the annual review.

12. FIRST AID

12.1 The Health and Safety (First-Aid) Regulations 1981 require an employer to provide adequate and appropriate first aid for its employees, based on an assessment of need. HSE’s guidance (L74, amended in 2024) asks employers to consider mental health in that assessment, and HSE advises that desk work at home needs no first aid equipment beyond normal domestic provision. On client premises and at Venues, Talik People shall use the host’s first aid arrangements, which Talik shall confirm in advance. For residential, outdoor or remote activities, Talik shall arrange first aid cover through the specific assessment under clause 5.2. In a medical or mental health emergency, Talik People shall call 999.

13. ACCIDENTS, INCIDENTS AND RIDDOR

13.1 Talik People shall report any accident, near miss, act of violence or aggression, or work related ill health to the Director within 24 hours. Talik shall record and investigate it and review the risk assessment.

13.2 Under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (“RIDDOR”), Talik reports for its employees. HSE guidance is that the person in control of premises reports an injury there to a self-employed Associate or to a Participant, and the Associate shall make sure that person knows; an Associate injured on their own or domestic premises reports the injury themselves.

13.3 Where Talik is the responsible person, it shall report online to HSE:

(a) a death, a specified injury to a worker or a dangerous occurrence: without delay, with the report received within 10 days. Fatal and specified injuries may also be reported by telephone on 0345 300 9923;

(b) an injury that leaves a worker unable to do their normal work for more than seven consecutive days, not counting the day of the accident: within 15 days of the accident;

(c) an injury to a person not at work who is taken directly to hospital for treatment: without delay, with the report received within 10 days; and

(d) a reportable occupational disease: as soon as a diagnosis is received.

13.4 An injury that keeps a worker off normal work for more than three consecutive days must be recorded, and RIDDOR records kept for at least three years. An incident during home working may be reportable only if it arose from the work or from equipment Talik provided.

14. FIRE SAFETY

14.1 The Regulatory Reform (Fire Safety) Order 2005 applies to non-domestic premises, not private homes, and in England since 1 October 2023 every responsible person must record the fire risk assessment in full. Talik has no premises and is not a responsible person for any building. It meets its fire duties at client sites and Venues through clauses 9 and 10, which also set out its procedures for serious and imminent danger under regulation 8 of the 1999 Regulations. Home workers are encouraged to keep working smoke alarms.

15. CONSULTATION, INFORMATION AND TRAINING

15.1 Under the Health and Safety (Consultation with Employees) Regulations 1996, an employer whose employees have no trade union safety representatives must consult them directly or through elected representatives. Talik shall consult any employees directly and in good time, and seeks Associates’ views in the annual review.

15.2 Talik People shall be briefed on this statement when engaged and whenever it changes, on each client site’s rules before working there, and again when risks change, as regulation 13 of the 1999 Regulations requires for employees.

16. EMPLOYER’S LIABILITY AND OTHER INSURANCE

16.1 The Employers’ Liability (Compulsory Insurance) Act 1969 and the regulations made under it require an employer to insure against liability for injury or disease to its employees for at least £5 million, unless exempt, as is a company whose only employee owns 50 percent or more of its shares. Talik holds employer’s liability insurance.

16.2 The certificate must be displayed where employees can easily read it, which since 1 October 2008 may be done electronically if they know where to find it. Talik shall make the current certificate available electronically to all Talik People and, as HSE advises, keep expired certificates. Employee status depends on the real working relationship, not on job title or tax status, so Talik shall confirm with its insurer at each renewal that its cover reflects how Associates work. Talik also holds public liability and professional indemnity insurance.

17. ASSOCIATES AND SUBCONTRACTORS

17.1 Following HSE’s guidance Using contractors (INDG368), Talik shall check that each Associate and Subcontractor is competent and insured before engaging them, give them this statement, the relevant parts of its risk assessment and the client’s site rules, and coordinate arrangements with them.

17.2 Their terms of engagement shall require them to work to this statement, report incidents to the Director within 24 hours, tell Talik of any risk their work creates and use only competent people. Talik may end the engagement of anyone who seriously or repeatedly breaches these terms.

18. RECORDS, MONITORING AND REVIEW

18.1 Talik shall keep records of its assessments, incidents, briefings, Venue checks, driver checks and insurance certificates, and handle the personal data in them under its Data Protection and UK GDPR Statement and Information Security Policy.

18.2 The Director shall monitor performance through the incident record and feedback. Talik shall review this statement and its risk assessment at least once a year, after any significant incident, and whenever its work, the law or HSE guidance changes. A breach of this statement by an employee may lead to disciplinary action.

19. RELATED POLICIES

19.1 This statement should be read with Talik’s Data Protection and UK GDPR Statement, Information Security Policy, Equality, Diversity and Inclusion Policy, Environmental Policy, Social Value Policy and Whistleblowing Policy, under which anyone may raise a concern about a danger to health or safety.

1. INTRODUCTION AND STATUS OF THIS STATEMENT

1.1 This statement is made by Talik and Company Ltd (“Talik”) for its financial year ending 31 August 2026. It describes Talik’s business and supply chain, the modern slavery risks Talik has identified in them, and the steps Talik takes and shall take to prevent modern slavery in its own business and in its supply chain.

1.2 Section 54 of the Modern Slavery Act 2015 (the “Act”) requires a commercial organisation that supplies goods or services and carries on business in the United Kingdom to publish a slavery and human trafficking statement for each financial year if its total turnover is £36 million or more, the figure prescribed by regulation 2 of the Modern Slavery Act 2015 (Transparency in Supply Chains) Regulations 2015. Talik’s turnover is below that threshold, so Talik is not legally required to publish a statement.

1.3 Talik publishes this statement voluntarily, as the Home Office encourages smaller organisations to do and as its public sector clients expect. Talik meets the standards that section 54 sets for organisations within its scope: the statement is approved by the board, signed by a director and published on Talik’s website with a link from its homepage.

1.4 The statement follows the Home Office statutory guidance Transparency in supply chains: a practical guide, as updated in March 2025 (the “Guidance”). In proportion to Talik’s size, it covers each of the six areas listed in section 54(5) of the Act: structure, business and supply chains; policies; risk assessment and management; due diligence; key performance indicators and effectiveness; and training.

1.5 Talik has a zero tolerance approach to modern slavery and shall act on every concern raised with it.

2. DEFINITIONS

2.1 In this statement:

“associate” means a self-employed consultant engaged by Talik to deliver services to Talik’s clients;

“Director” means Dr Alexandra Stubbings, Talik’s sole director and Managing Director;

“modern slavery” means slavery, servitude, forced or compulsory labour and human trafficking within sections 1 to 3 of the Act, whether or not the person exploited consents;

“subcontractor” means an organisation engaged by Talik to deliver part of a client contract; and “supply chain” means Talik’s suppliers and, so far as Talik can reasonably identify them, their own suppliers.

3. STRUCTURE, BUSINESS AND SUPPLY CHAINS

3.1 Talik is a private limited company incorporated in England and Wales on 1 August 2011 with company number 07724464. Its registered office is at 4 Winslow Road, Little Horwood, Buckinghamshire MK17 0PD. Its sole director, Dr Alexandra Stubbings, is also the only person with significant control of Talik.

3.2 Talik is a management consultancy and a small and medium-sized enterprise. It provides strategy, leadership and organisational design and development, change and transformation, coaching, facilitation, team development and service redesign to government departments, NHS trusts and other public bodies and to private sector organisations.

3.3 Talik’s work is delivered by twelve people: the Director and associates, and on some contracts a named subcontractor. An office manager supports the Director. Its services are professional and knowledge based, and Talik does not make or sell physical goods.

3.4 Talik has worked fully virtually since 2019. It has no office premises: its people work from home and on client sites. Talik therefore does not buy office cleaning, security or facilities management services, which public sector guidance identifies as higher risk.

3.5 Talik’s supply chain is short and largely based on direct relationships. It comprises:

(a) associates and the subcontractor, who deliver services alongside Talik;

(b) venues and catering for workshops and programmes, where Talik arranges these rather than using a client’s premises;

(c) travel and accommodation for work on client sites;

(d) information technology hardware, such as laptops and phones;

(e) software and cloud services;

(f) printed materials for programmes and workshops; and

(g) professional services, including accountancy, insurance and information technology support.

4. POLICIES

4.1 This statement is supported by Talik’s Whistleblowing Policy, which protects anyone who raises a concern; Anti-Bribery and Conflicts of Interest Policy; Equality, Diversity and Inclusion Policy; Health and Safety Statement; Data Protection and UK GDPR Statement, which governs personal information about anyone involved in a concern; and Social Value Policy.

4.2 Talik expects every associate, subcontractor and supplier to meet the following standards, and shall make them a condition of its written terms with associates and subcontractors:

(a) all work is freely chosen, and no one is made to work through force, threats, debt bondage or deception;

(b) no worker is charged a fee for being recruited or placed in work;

(c) no one’s identity documents or wages are withheld, and everyone is free to leave their work on reasonable notice;

(d) everyone is paid at least the legal minimum and on time, and has the right to work where they work;

(e) children are not employed unlawfully; and

(f) any concern about modern slavery connected with Talik’s work is reported to Talik promptly.

5. ASSESSING AND MANAGING RISK

5.1 Talik assesses risk using the indicators that the Guidance and public sector procurement guidance identify: the industry and type of work, the nature of the workforce, where the work is done, the commodity involved and how the supply chain is organised. Talik also considers how much influence it has over each supplier.

5.2 The Director carried out the risk assessment in this section in preparing this statement. Talik shall update it at least once a year and whenever it takes on a new type of supplier or a contract in a higher risk setting.

5.3 Talik assesses the risk in its own business as low: its work is delivered by the Director and by self-employed professionals engaged directly by Talik, and consultancy is not among the high risk industries identified in public sector guidance. Low risk is not no risk, so the steps in this statement apply to Talik’s own business too.

5.4 Talik’s assessment of its supply chain is as follows:

(a) associates and the subcontractor: low risk. The work is skilled professional work and Talik deals directly with the people delivering it. The subcontractor has its own people, so Talik checks its approach under clause 6.3;

(b) venues and catering: higher risk. Hospitality, catering and cleaning are identified in public sector guidance as high risk industries, as they often rely on low paid, agency, outsourced or migrant labour. Talik’s exposure is reduced because it works virtually where suitable and often on clients’ own sites;

(c) travel and accommodation: medium risk. Hotels share the hospitality risks in paragraph

(b) , particularly in housekeeping. Talik prefers public transport and virtual working, which limits this spend;

(d) information technology hardware: higher risk at the point of manufacture. Electronics manufacture, and the extraction of the materials used in it, carry a recognised risk of forced labour deep in global supply chains. Talik keeps devices in use to the end of their life, so it buys few, and before any hardware purchase it assesses the brand’s social and environmental record from its published sustainability reports;

(e) software and cloud services: low to medium risk. These come from large providers, many of which publish their own statements; the residual risk lies in the hardware and services behind data centres;

(f) printed materials: medium risk. Printing and delivery can involve low paid and agency labour, and logistics is identified in public sector guidance as a high risk industry. Where possible, Talik prefers to support local, known, small firms; and

(g) professional services: low risk, for the same reasons as Talik’s own business.

5.5 Talik’s influence over large manufacturers and technology providers is limited, so it concentrates its own checks where it has a direct relationship (associates, the subcontractor, venues and printers) and, for large suppliers, relies on choosing reputable suppliers and reviewing their published statements.

6. DUE DILIGENCE AND REMEDIATION

6.1 Talik shall engage every associate and subcontractor on written terms that:

(a) require compliance with the Act and with the standards in clause 4.2;

(b) require them to tell Talik promptly of any concern about modern slavery connected with Talik’s work;

(c) pass on any modern slavery obligations in Talik’s contract with the client, such as those in the corporate social responsibility schedule used in government framework contracts;

(d) require them to give Talik, and the client where its contract requires, the information reasonably needed to check compliance; and

(e) allow Talik to end the engagement if they breach those obligations and do not put the breach right.

6.2 Talik shall pay associates and subcontractors on the terms agreed and on time, and shall not ask anyone to work on terms that would breach employment or minimum wage law. Talik shall check the right to work of anyone it employs directly.

6.3 Before engaging a subcontractor on a client contract, Talik shall check its registration at Companies House, confirm that it is not on the debarment list kept under the Procurement Act 2023, review its modern slavery statement or, if it publishes none, ask it to confirm in writing how it makes sure its own people are engaged lawfully, paid at least the legal minimum and free to leave, and record the outcome.

6.4 For purchases in the higher and medium risk categories in clause 5.4, Talik shall:

(a) where it books a venue or catering, prefer providers that publish a modern slavery statement or can explain how they recruit and pay their staff, including agency and outsourced staff, and use clients’ premises or virtual delivery where suitable;

(b) buy hardware from established manufacturers or resellers that publish a modern slavery statement, and keep devices in use to the end of their life;

(c) ask any printer it intends to use regularly about its approach to modern slavery before first use, and prefer hotel groups that publish a statement where there is a reasonable choice; and

(d) keep a list of its regular suppliers recording, for each, the risk category in clause 5.4 and whether it publishes a modern slavery statement, and review that list at least once a year.

6.5 Where Talik has reason to suspect modern slavery in its business or supply chain, the Director shall:

(a) put the safety of any possible victim first and, where there is immediate danger, call 999;

(b) not confront the suspected exploiter or do anything that could put the person at greater risk;

(c) report the matter to the police or the Modern Slavery and Exploitation Helpline, and tell any public sector client affected where its contract requires or it is otherwise appropriate;

(d) work with the supplier to put things right, including remedy for the people affected, where that is possible and safe; and

(e) end the relationship only as a last resort, unless the supplier refuses to act or the conduct is serious, since walking away can leave the people affected worse off.

6.6 The Director shall keep a confidential record of each concern, the action taken and the outcome, and shall handle personal information in line with the Data Protection and UK GDPR Statement.

7. KEY PERFORMANCE INDICATORS AND EFFECTIVENESS

7.1 Talik shall measure the effectiveness of its approach using the following indicators, and shall report its results in each annual statement, starting with its statement for the financial year ending 31 August 2027:

(a) the percentage of associates and subcontractors engaged during the year on written terms containing the obligations in clause 6.1 (target: 100 per cent);

(b) the percentage of people working on Talik contracts who received the briefing in clause 8.2 before starting and the annual refresher (target: 100 per cent);

(c) whether the checks in clause 6.3 were completed and recorded for every subcontractor engaged;

(d) the number of regular suppliers in the higher and medium risk categories, and the percentage reviewed during the year under clause 6.4;

(e) the percentage of associate and subcontractor invoices paid within the agreed terms;

(f) the number of modern slavery concerns raised, and the action taken and outcome in each case; and

(g) whether the annual review in clause 11.3 was completed and the statement published within six months of the financial year end.

7.2 As the Guidance recognises, a nil return of concerns is not of itself proof that the approach works, so the annual review shall also test whether Talik’s people know how to recognise and report a concern.

8. TRAINING AND AWARENESS

8.1 The Director shall complete modern slavery awareness training from a recognised provider and refresh it at least every two years.

8.2 Talik shall brief every associate, and anyone else who works on Talik contracts, on this statement before they start and once a year after that. The briefing shall cover:

(a) what modern slavery is and its common signs, including in hospitality, catering and cleaning services at venues and on client sites;

(b) how to respond safely if someone discloses exploitation during coaching, facilitation or other work; and

(c) how to report a concern under clause 9.

8.3 Talik shall record who has received the briefing and when, and shall share this statement with its subcontractor and regular suppliers.

9. REPORTING A CONCERN

9.1 Anyone who suspects modern slavery in Talik’s business or supply chain, whether an associate, subcontractor, supplier, client or member of the public, should raise it with the Director straight away, by writing to info@talikandco.net or by using the routes in the Whistleblowing Policy.

9.2 Where a person is in immediate danger, call 999. Concerns can also be reported to the Modern Slavery and Exploitation Helpline on 08000 121 700 or online at www.modernslaveryhelpline.org.

9.3 Talik shall treat every concern seriously and in confidence so far as the law allows, and shall not tolerate any detriment to a person who raises a concern honestly.

10. PUBLIC SECTOR EXPECTATIONS

10.1 Procurement Policy Note 009, Tackling Modern Slavery in Government Supply Chains, issued in February 2025 for procurements under the Procurement Act 2023, requires central government departments, their executive agencies, non-departmental public bodies and NHS bodies to identify and manage modern slavery risk in their procurements and contracts. A public body may ask suppliers to complete the government’s Modern Slavery Assessment Tool, to give supply chain information for higher risk procurements and to accept modern slavery obligations in their contracts.

10.2 Under Schedule 6 to the Procurement Act 2023 a supplier must be excluded where it or a connected person has been convicted of a slavery or trafficking offence under the Act, and under Schedule 7 a supplier may be excluded for labour market misconduct, in each case where the circumstances are continuing or likely to occur again.

10.3 Talik shall answer promptly and accurately any request from a public sector client for information about modern slavery, including through the Modern Slavery Assessment Tool; accept the modern slavery obligations in its public sector contracts and pass them on as clause 6.1 provides; and tell the client promptly of any modern slavery concern connected with its contract.

11. APPROVAL, PUBLICATION AND REVIEW

11.1 Section 54(6) of the Act requires the statement of a company within its scope to be approved by its board of directors and signed by a director. Talik follows that requirement voluntarily. Talik’s board consists of its sole director, Dr Alexandra Stubbings, who has approved this statement on behalf of the board on the date recorded below, signs it as Director and is accountable for the steps it describes.

11.2 Talik shall publish this statement on its website, www.talikandco.net, with a link in a prominent place on the homepage, and shall add it to the government’s modern slavery statement registry, which accepts statements published voluntarily. Talik shall keep its earlier statements available and shall provide a copy to anyone who asks at info@talikandco.net.

11.3 Talik shall review this statement, its risk assessment and its supplier list each year, and shall publish its statement for each financial year within six months of the end of that year. The review shall consider the indicators in clause 7, any concerns raised, and changes in Talik’s business and supply chain, the law and the Guidance.

11.4 Talik shall also keep under review the Immigration and Asylum Bill, introduced in Parliament on 30 June 2026, which proposes to amend section 54 so that statements by organisations within its scope must cover set areas and be published within six months of the financial year end, backed by financial penalties. Those changes are not yet in force; this statement already covers each proposed area.

1. PURPOSE AND SCOPE

1.1 Talik and Company Ltd (“Talik”) does not tolerate bribery, fraud or corruption in any form. This policy sets out how Talik prevents them and identifies and manages conflicts of interest. It forms part of the adequate procedures Talik maintains under section 7 of the Bribery Act 2010, in proportion to its size and risks.

1.2 It applies to all Talik People in all their work for Talik.

2. DEFINITIONS

2.1 In this policy:

“Associated Person” means a person who performs services for or on behalf of Talik, in whatever capacity, including associate consultants and subcontractors delivering Talik’s work.

“Bribe” means a financial or other advantage given or received to induce or reward improper performance of a function or activity, or to influence a Public Official to win or keep business.

“Conflict of Interest” means a personal, financial, professional or family interest, or a duty to someone else, that could affect, or reasonably appear to affect, a person’s impartial work for Talik or a client.

“Director” means Dr Alexandra Stubbings, Managing Director and sole director of Talik.

“Live Procurement” means any procurement, contract award, extension or variation in which Talik is or may be a bidder or party, until the contract is entered into or the procurement ends.

“Public Official” means anyone who holds a legislative, administrative or judicial position, or works for or acts on behalf of a public body, in the United Kingdom or elsewhere, including NHS staff and civil servants.

“Talik People” means the Director, any employee, associate consultants, subcontractors and their staff, and anyone else acting for Talik.

3. LEGAL FRAMEWORK

3.1 The Bribery Act 2010 makes it an offence to bribe another person (section 1), to be bribed (section 2) and to bribe a foreign public official to win or keep business (section 6). Under section 7, Talik commits an offence if an Associated Person bribes anyone to win or keep business, or a business advantage, for Talik, anywhere in the world, unless Talik proves that it had adequate procedures designed to prevent it.

3.2 Individuals face up to ten years’ imprisonment and an unlimited fine, and Talik an unlimited fine (section 11). A director who consents to or connives in an offence by Talik under section 1, 2 or 6 is also guilty of it (section 14). Whether someone is an Associated Person depends on all the circumstances (section 8): associates and subcontractors delivering Talik’s services are likely to be.

3.3 The Ministry of Justice guidance under section 9 of the Act sets six principles: proportionate procedures, top-level commitment, risk assessment, due diligence, communication (including training), and monitoring and review.

3.4 Section 199 of the Economic Crime and Corporate Transparency Act 2023 created an offence of failure to prevent fraud, in force since 1 September 2025. It applies only to large organisations meeting two or more of these tests: more than 250 employees, more than £36 million turnover and more than £18 million total assets. It does not apply to Talik. Talik nevertheless adopts the anti-fraud controls in clause 9 as good practice, following the government’s guidance, not least because it may be an associated person of large clients.

3.5 Since 29 June 2026, section 250 of the Crime and Policing Act 2026 has made a company guilty of any offence committed by a senior manager acting within the actual or apparent scope of their authority, extending a rule previously limited to economic crimes. A senior manager is someone who plays a significant role in deciding how, or in actually managing or organising, the whole or a substantial part of the company’s activities. The Director is Talik’s senior manager, and there is no adequate procedures defence.

4. COMMITMENT AND RISK ASSESSMENT

4.1 The Director shall lead by example and make clear to everyone Talik works with that Talik would rather lose work than win it improperly.

4.2 The Director shall record a bribery, fraud and conflicts risk assessment at least once a year and before each new public sector bid. Talik’s principal risks are its work and bids for NHS trusts and other public bodies; associates with access to confidential or procurement sensitive client information; gifts and hospitality at events; time records, expenses and invoices; and personal relationships with client staff.

5. ROLES AND RESPONSIBILITIES

5.1 The Director is responsible for this policy, for the Gifts and Hospitality Register and the Conflicts of Interest Register (the “Registers”) and for decisions under this policy. Talik’s office manager may maintain the Registers on her behalf.

5.2 Where a matter concerns the Director personally, she shall record it in the relevant Register at the time with her reasons, disclose it to the client or authority concerned and follow any steps they require.

6. BRIBERY, FACILITATION PAYMENTS AND PUBLIC OFFICIALS

6.1 No Talik Person shall offer, promise, give, request or accept a Bribe, directly or through anyone else.

6.2 Talik does not make facilitation payments (small unofficial payments to a Public Official to secure or speed up a routine action). They are bribes, and the Act has no exemption for them. Anyone facing a demand backed by a threat to their safety or liberty may pay to protect themselves, and shall report it to the Director as soon as it is safe.

6.3 NHS and civil service staff are bound by their own rules on gifts, hospitality and conflicts, often stricter than this policy. Talik People shall not:

(a) give any gift to a Public Official;

(b) offer a Public Official hospitality beyond modest refreshments or a working meal at a meeting or event Talik is delivering;

(c) pay a Public Official’s travel or accommodation unless the client contract provides for it; or

(d) offer work, employment or any other benefit to a Public Official or their family in connection with a decision affecting Talik.

7. GIFTS AND HOSPITALITY

7.1 Gifts and hospitality may be given or accepted only where they are offered in good faith, open, modest in value and frequency, could not reasonably be seen to influence or reward a decision, and comply with clause 6.3 and the recipient’s own rules.

7.2 The threshold (the “Threshold”) is £50 for a single gift or item of hospitality, or £100 in total to or from the same person or organisation in any twelve months. The Director shall confirm the Threshold on approval and may change it on review. Anything above it requires the Director’s prior approval and an entry in the Gifts and Hospitality Register, with the decision and reasons. Hospitality given to a Public Official, other than refreshments at a meeting or event, and anything declined, shall also be recorded whatever its value.

7.3 The following are never acceptable:

(a) cash or cash equivalents, such as vouchers, gift cards or loans;

(b) anything beyond modest refreshments at a meeting, given to or received from anyone on the other side of a Live Procurement;

(c) anything asked for by either side;

(d) anything for the family or friends of a client decision maker;

(e) anything given in secret or sent to a private address; and

(f) lavish hospitality, or hospitality at which the host is absent, which shall be treated as a gift.

7.4 A gift above the Threshold that cannot politely be refused shall be passed to the Director to return or give to charity.

8. CHARITABLE AND POLITICAL DONATIONS

8.1 Talik supports community causes, including fundraising for Maggie’s Cancer Care. Charitable donations and sponsorship in Talik’s name require the Director’s prior approval, shall go only to registered charities or recognised community bodies, and shall be recorded. They shall never be made at the request or for the benefit of a client decision maker, or in connection with a Live Procurement.

8.2 Talik makes no political donations or contributions, in money or in kind, and no Talik Person may make one on its behalf.

9. FRAUD PREVENTION

9.1 No Talik Person shall act dishonestly to make a gain or cause a loss, whether by a false or misleading representation, by failing to disclose information they are legally obliged to disclose, or by abusing a position of trust (sections 2 to 4 of the Fraud Act 2006), in a bid, declaration, timesheet, expenses claim, invoice or report.

9.2 Talik’s anti-fraud controls are:

(a) every client invoice shall be checked against the contract, time records and receipts, and approved by the Director, before issue;

(b) associates and subcontractors shall submit accurate time records and claim only genuine expenses, with receipts;

(c) any change to a payee’s bank details shall be confirmed by telephone, on a number already held, before payment;

(d) bid statements about experience, accreditations and insurance shall be checked before submission and shall state the current position honestly; and

(e) payments shall be made only by bank transfer to an account in the payee’s name, and never in cash.

10. CONFLICTS OF INTEREST

10.1 A Conflict of Interest may be actual, potential or perceived. Examples include a family member or close friend at a client or competitor; a financial interest in a client, supplier or competitor; having advised a public body on work that Talik then bids for; and holding one client’s confidential information that is relevant to another.

10.2 Every Talik Person shall declare any Conflict of Interest to the Director in writing on joining, on starting each engagement, before taking part in any bid, as soon as one arises, and each year, including a nil return.

10.3 The Director shall record each declaration in the Conflicts of Interest Register and decide how to manage it, for example by disclosing it to the client, separating the person from the work or information, or reassigning the work. Where a conflict cannot be managed, the person shall step aside or Talik shall decline or withdraw from the work.

10.4 Associates shall declare any work for a client’s competitor or for a party opposed to a Talik client.

11. PUBLIC PROCUREMENT

11.1 Under the Procurement Act 2023, in force since 24 February 2025, a contracting authority must take all reasonable steps to identify and keep under review the conflicts of interest of anyone acting for it or influencing its decisions in a procurement, and to ensure that no conflict puts a supplier at an unfair advantage or disadvantage, and must prepare and keep under review a conflicts assessment (sections 81 to 83). It may require a supplier to take steps to deal with a conflict. Where an unfair advantage cannot be avoided, or the supplier will not take those steps, the supplier must be treated as excluded (section 82).

11.2 Talik shall therefore:

(a) complete every conflicts and integrity declaration fully and truthfully, disclosing any relevant relationship or prior involvement, including advice given to the authority on the service being procured;

(b) not bid for work it has helped an authority to specify or design unless the authority knows and has taken the steps it considers necessary;

(c) ensure that any Talik Person acting for an authority in a procurement declares their interests to it, keeps its information confidential and takes no part in any Talik bid for that work; and

(d) never seek or use confidential procurement information, or try to influence an evaluator or decision maker improperly.

11.3 Schedule 6 to the Act makes exclusion mandatory for offences including bribery under sections 1, 2 and 6 of the Bribery Act 2010, fraud, conspiracy to defraud, false accounting, fraudulent trading and cheating the public revenue. Schedule 7 allows exclusion for professional misconduct, including dishonesty, and for acting improperly in a procurement, such as giving misleading information or unduly influencing a decision. Either applies only where the circumstances are continuing or likely to recur, and events more than five years old are generally disregarded.

11.4 The grounds apply equally to Talik’s connected persons, including anyone with significant control over Talik and any director, which at present means the Director, and may apply to associates or subcontractors on whom Talik relies to meet the conditions of participation. The government keeps a central debarment list, which authorities must check and on which a supplier may remain for up to five years.

11.5 Talik shall keep its supplier information and declarations accurate; require associates and subcontractors named in a bid to tell it at once of any possible exclusion ground; check the debarment list before engaging anyone on public work; and, if a ground ever arises, deal with it promptly and keep evidence that it will not recur. Talik applies the same standards below the procurement thresholds and to private sector clients.

12. ASSOCIATES AND SUBCONTRACTORS

12.1 Before engaging an associate or subcontractor, and yearly after that, Talik shall confirm their identity and, where relevant, Companies House record; obtain declarations of conflicts and exclusion grounds; check the debarment list for public work; take a reference or rely on known previous work; and confirm insurance.

12.2 Each agreement shall require the associate or subcontractor to comply with the Bribery Act 2010 and this policy; make the declarations it requires; keep accurate records and allow Talik to inspect them; report any suspected bribery, fraud or exclusion ground at once; engage others on Talik’s work only with Talik’s consent and on equivalent terms; and accept immediate termination for breach.

13. BOOKS AND RECORDS

13.1 Talik shall keep accurate and complete financial records, with every payment and expense properly described and supported. No one shall create a false record, keep an account off the books or disguise a payment. False accounting is an offence under section 17 of the Theft Act 1968.

13.2 Records kept under this policy shall be retained for six years and handled in line with the Data Protection and UK GDPR Statement.

14. RAISING A CONCERN

14.1 Anyone who is offered or asked for a Bribe, or who suspects bribery, fraud or an undeclared Conflict of Interest, shall report it promptly to the Director or under the Whistleblowing Policy, which sets out other routes. Clients and other third parties may raise a concern at info@talikandco.net.

14.2 Talik shall not penalise anyone for refusing to pay or accept a Bribe, for refusing to take part in fraud, or for raising a concern in good faith, even if Talik loses business as a result.

15. TRAINING AND COMMUNICATION

15.1 Every Talik Person shall be briefed on this policy before starting work and annually, and anyone working on a public sector bid shall be reminded of clauses 7, 10 and 11 before the bid starts. Talik shall record training and make its zero tolerance approach known in its bids and contracts.

16. INVESTIGATION, BREACH AND CONSEQUENCES

16.1 The Director shall investigate every concern promptly, fairly and confidentially, and shall appoint an independent investigator where she is conflicted or the matter requires it.

16.2 A breach of this policy may lead to termination of an associate or subcontractor agreement, disciplinary action up to dismissal for an employee, recovery of any loss, and a report to the police, the Serious Fraud Office or another authority. Talik shall inform an affected client or contracting authority where required or otherwise appropriate.

17. MONITORING AND REVIEW

17.1 The Director shall review the Registers each quarter and check a sample of expenses claims and invoices. This policy and the risk assessment shall be reviewed at least annually, after any incident, and whenever the law or Talik’s business changes.

18. RELATED POLICIES

18.1 This policy should be read with the Whistleblowing Policy, Data Protection and UK GDPR Statement, Information Security Policy, Modern Slavery Statement and Social Value Policy.

1. PURPOSE AND SCOPE

1.1 Talik and Company Ltd (“Talik”) wants anyone who works for it or with it to raise concerns about wrongdoing early, safely and without fear of reprisal, and shall treat every concern seriously. This policy reflects the law of England and Wales as at October 2026; the statutory provisions it summarises apply equally in Scotland.

1.2 This policy applies to the following (together, “Talik People”, and each a “Talik Person”):

(a) the Director and anyone Talik employs, including on a temporary or agency basis;

(b) associate consultants engaged by Talik on a self-employed basis;

(c) subcontractors engaged on Talik’s contracts, and their staff working on those contracts; and

(d) anyone on work experience or training with Talik, and former Talik People.

1.3 Clients’ staff, programme participants and suppliers may also raise a concern about Talik or Talik People under this policy. Statutory protection is unlikely to apply to them as against Talik, but Talik shall handle their concerns in the same way.

1.4 This policy covers concerns about Talik, about Talik People, and about wrongdoing that Talik People encounter in a Client’s work. It does not form part of any contract of employment. Talik shall include the commitments in section 10 in its agreements with associates and subcontractors.

2. DEFINITIONS

2.1 In this policy:

“1996 Act” means the Employment Rights Act 1996. “Client” means any organisation for which Talik delivers services.

“Concern” means a concern about actual or suspected wrongdoing of a kind described in clause 3.2.

“Detriment” means any unfavourable treatment, including dismissal, ending an engagement, withholding work, removal from a Client contract, harassment, or a threat of any of these.

“Director” means Dr Alexandra Stubbings, Managing Director and sole director of Talik.

“Prescribed Person” means a person or body prescribed for the purposes of section 43F of the 1996 Act by the Public Interest Disclosure (Prescribed Persons) Order 2014, as amended.

3. LEGAL FRAMEWORK

3.1 The Public Interest Disclosure Act 1998 inserted Part IVA into the 1996 Act. Part IVA protects a worker who makes a qualifying disclosure to a person or body that it specifies (a “Protected Disclosure”). Section references are to the 1996 Act.

3.2 A qualifying disclosure is a disclosure of information which, in the reasonable belief of the worker making it, is made in the public interest and tends to show one or more of the following (section 43B(1)):

(a) that a criminal offence has been committed, is being committed or is likely to be committed, for example fraud or bribery;

(b) that a person has failed, is failing or is likely to fail to comply with any legal obligation;

(c) that a miscarriage of justice has occurred, is occurring or is likely to occur;

(d) that the health or safety of any individual has been, is being or is likely to be endangered;

(e) that sexual harassment has occurred, is occurring or is likely to occur;

(f) that the environment has been, is being or is likely to be damaged; or

(g) that information tending to show any of the above has been, is being or is likely to be deliberately concealed.

3.3 The category in clause 3.2

(e) was inserted as section 43B(1)(da) by section 23 of the Employment Rights Act 2025 and has been in force since 6 April 2026. Sexual harassment takes its meaning from the Equality Act 2010.

3.4 No proof is needed, and a reasonable belief that proves to be mistaken is still protected. The disclosure must convey information, not only a general complaint. A matter concerning only a person’s own employment or engagement will not usually be in the public interest.

3.5 A qualifying disclosure is protected if it is made: to the employer, or to another person whom the worker reasonably believes to be solely or mainly responsible for the matter (section 43C(1)); through a procedure the employer has authorised, which counts as a disclosure to the employer (section 43C(2)); in the course of obtaining legal advice (section 43D); to a Prescribed Person (section 43F); or, under strict conditions, more widely (sections 43G and 43H).

3.6 Statutory protection depends on status. It covers employees, workers and those within the extended meaning of “worker” in section 43K, but a genuinely self-employed associate or subcontractor in business on their own account may fall outside it. Talik does not rely on that distinction: it extends the protection in section 10 to every Talik Person by contract and in practice.

3.7 A worker has the right not to be subjected to any detriment for making a Protected Disclosure, including by a co-worker or an agent of the employer, who may be personally liable; the employer is also liable unless it took all reasonable steps to prevent it (section 47B). An employee dismissed for making a Protected Disclosure is automatically unfairly dismissed (section 103A).

3.8 Any provision in an agreement between a worker and their employer is void in so far as it purports to preclude a Protected Disclosure (section 43J). For agreements made on or after 1 October 2025, section 17 of the Victims and Prisoners Act 2024 also makes void any term preventing a victim of crime from making specified disclosures, such as to the police or a qualified lawyer. Further restrictions in the Employment Rights Act 2025 on agreements about harassment and discrimination are not yet in force; Talik shall comply with them when they take effect.

4. WHISTLEBLOWING AND PERSONAL GRIEVANCES

4.1 Whistleblowing concerns wrongdoing that affects others, such as Clients, programme participants, the public or public funds. A grievance is a complaint about a person’s own treatment, such as their pay, workload or working relationships, and is raised with the Director under Talik’s grievance arrangements or, for an associate or subcontractor, under their agreement.

4.2 Some matters, such as a report of sexual harassment, may be both. Anyone unsure should simply raise the matter. The Director shall agree the right process with them, and the choice of process does not affect any legal protection they have.

5. RAISING A CONCERN WITHIN TALIK

5.1 A Concern should be raised as soon as there is a reasonable suspicion. Proof is not needed, and Talik People should not investigate the matter themselves or access information or systems they are not authorised to use.

5.2 A Concern should normally be raised with the Director in writing, by email to alexandra@talikandco.net marked “Confidential concern”. It may also be raised by telephone or video call, and the Director shall then send the person a written note to check. The general Talik inbox should not be used.

5.3 The Concern should say, as far as the person can, what has happened or may happen, when and where, who is involved, how the person knows and what evidence exists.

6. CONCERNS ABOUT THE DIRECTOR OR ABOUT A CLIENT’S WORK

6.1 Talik has a sole director, so no one within Talik is independent of her. Talik therefore authorises the following routes for the purposes of section 43C(2), so that a Concern raised through any of them, instead of or as well as with the Director, is treated as raised with Talik:

(a) for a Concern about a Client’s services, staff or programmes, the Client’s own whistleblowing or speak up route, which in an NHS body includes its Freedom to Speak Up Guardian, or the Client’s contract manager for the work;

(b) any Prescribed Person whose remit covers the matter (clause 8.2); and

(c) a legal adviser, in the course of obtaining legal advice.

6.2 If a Concern about the Director is raised with her, she shall not investigate it herself. Talik shall appoint, at its own cost, an independent and suitably qualified investigator, such as an employment lawyer or human resources professional, who shall give feedback directly to the person who raised the Concern.

6.3 Where a Concern relates to a Client, the Director shall agree with the person how the Client is to be told. Talik shall tell the Client where its contract requires it or there is a risk of harm, without revealing the person’s identity unless they consent or the law requires it.

6.4 Associates who coach or facilitate shall agree the limits of confidentiality with participants at the outset. If a participant discloses a serious risk of harm or a serious crime, the associate shall agree the handling with the Director, naming the participant only if necessary, and shall normally encourage the participant to use their own organisation’s speak up route.

7. HOW TALIK RESPONDS

7.1 The Director, or the investigator appointed under clause 6.2, shall:

(a) acknowledge the Concern in writing within five working days;

(b) within a further ten working days, assess the matter, take any urgent action needed to prevent harm or preserve evidence, decide whether a Client, the police or a regulator must be told, and explain the next steps;

(c) investigate fairly and proportionately, independently of anyone implicated, giving those implicated a fair opportunity to respond;

(d) aim to conclude within three months of the acknowledgement, explaining any delay and giving updates at least every four weeks; and

(e) confirm the outcome and any action taken in writing, as far as the confidentiality of others and the law allow.

7.2 Outcomes may include putting matters right, changing Talik’s procedures, reporting to a Client, the police or a regulator, and action under an employment contract or an associate or subcontractor agreement. A person who is not satisfied may ask the Director to review the response and may at any time use the routes in section 8.

8. EXTERNAL ROUTES

8.1 No one is required to raise a Concern within Talik before using these routes. A disclosure made in the course of obtaining legal advice is protected (section 43D).

8.2 A disclosure to a Prescribed Person is protected if the person reasonably believes that the matter falls within that body’s remit and that the information, and any allegation in it, are substantially true (section 43F). The full list is published on GOV.UK as “Whistleblowing: list of prescribed people and bodies”; the Order was most recently amended by the Public Interest Disclosure (Prescribed Persons) (Amendment) Order 2026, in force from 2 June 2026. The bodies most relevant to Talik’s work are:

(a) the Care Quality Commission, for the provision of health and social care;

(b) NHS England, for the regulation and performance of NHS trusts and NHS foundation trusts in England, and the National Guardian’s Office, for freedom to speak up arrangements in the NHS in England;

(c) the Comptroller and Auditor General (National Audit Office), for value for money in public spending and for fraud and corruption in the provision of public services;

(d) the Serious Fraud Office, for serious or complex fraud, including bribery and corruption;

(e) HM Revenue and Customs, for tax, national insurance and customs matters;

(f) the Competition and Markets Authority, for breaches of competition or consumer law, such as bid rigging;

(g) the Information Commission (formerly the Information Commissioner), for data protection and freedom of information;

(h) the Health and Safety Executive, for health and safety at work;

(i) the Equality and Human Rights Commission, for equality and human rights law, including sexual harassment; and

(j) a Member of Parliament.

8.3 Protect, the whistleblowing charity, gives free and confidential advice to anyone unsure whether or how to raise a concern (protect-advice.org.uk). Talik shall not treat seeking advice from Protect as a breach of any confidentiality obligation owed to Talik.

8.4 A disclosure to anyone else, for example to the media or on social media, is protected only if the strict conditions in section 43G or 43H are met; advice should be taken first, and only the confidential information needed should be disclosed.

9. CONFIDENTIALITY AND ANONYMITY

9.1 A Concern raised in confidence means that the person’s identity is known to the Director, or to the investigator, but is not disclosed without their consent unless the law requires it, in which case Talik shall tell the person first where it lawfully can. In a small team others may be able to work out who raised a Concern, and Talik shall plan any investigation with that in mind.

9.2 A Concern raised anonymously, without the person giving their name, shall be considered, but it is harder to investigate, to protect the person and to give feedback. Talik therefore encourages Concerns to be raised openly or in confidence.

10. PROTECTION FROM DETRIMENT

10.1 Talik shall not subject any Talik Person to a Detriment because they have raised a Concern, are believed to have raised one, or have helped with an investigation, whether or not they have statutory protection and even if the Concern proves to be mistaken. Talik shall include this commitment in every associate and subcontractor agreement.

10.2 Any Talik Person who subjects another to a Detriment for raising a Concern, discourages anyone from raising one, or without authority seeks to identify someone who raised a Concern in confidence, shall face action under their employment contract or associate or subcontractor agreement, which may include dismissal or termination.

10.3 Talik shall not use any agreement, including a settlement or confidentiality agreement, to prevent a Protected Disclosure or a disclosure permitted by section 17 of the Victims and Prisoners Act 2024, and its confidentiality terms with Talik People shall say so expressly.

10.4 As a signatory to the Mental Health at Work Commitment, Talik shall offer appropriate support to anyone who raises a Concern or is the subject of one.

10.5 Anyone who believes they have suffered a Detriment for raising a Concern should tell the Director or use the routes in section 6. A worker may also bring a claim in the employment tribunal, which is subject to strict time limits, and should take advice promptly.

11. FALSE AND MALICIOUS CONCERNS

11.1 No one shall face any sanction for honestly raising a Concern that proves to be mistaken. Good faith is not a condition of statutory protection, although an employment tribunal may reduce compensation by up to 25 per cent where a Protected Disclosure was not made in good faith (sections 49(6A) and 123(6A)). A Talik Person who knowingly makes a false allegation, or raises a Concern maliciously, may face action under their employment contract or associate or subcontractor agreement.

12. RECORDS AND DATA PROTECTION

12.1 The Director shall keep a confidential register of Concerns recording each Concern, the steps taken, the outcome and the feedback given. Records shall be held securely in line with the Information Security Policy, with access restricted to the Director and any appointed investigator, and separately from personnel and associate files. They shall be kept for six years after a Concern is closed, unless needed for longer for legal or regulatory proceedings, and then securely deleted.

12.2 Talik shall process personal data relating to Concerns in accordance with the UK GDPR, the Data Protection Act 2018 and the Data Protection and UK GDPR Statement, taking particular care with information about criminal offences or health. When responding to any request for personal data, Talik shall protect the identity of anyone who raised a Concern as far as the law allows.

13. TRAINING AND COMMUNICATION

13.1 As part of taking all reasonable steps to prevent any Detriment, Talik shall give this policy to every Talik Person at induction and whenever it changes; brief Talik People on the Client’s own speak up route when they start work on each Client contract; ensure that the Director and anyone appointed to investigate are trained in handling Concerns; and refresh awareness of this policy with all Talik People at least once a year.

14. RESPONSIBILITY, MONITORING AND REVIEW

14.1 The Director has overall responsibility for this policy and shall review the register each year for trends, timeliness and lessons learned. Every Talik Person is responsible for following this policy and for treating anyone who raises a Concern with respect. This policy shall be reviewed at least once a year, after any significant Concern, and whenever the law or Talik’s business changes.

15. RELATED POLICIES

15.1 This policy should be read with the Anti-Bribery and Conflicts of Interest Policy, the Data Protection and UK GDPR Statement, the Information Security Policy, the Equality, Diversity and Inclusion Policy, the Health and Safety Statement and the Modern Slavery Statement.

1. PURPOSE AND SCOPE

1.1 This policy sets out how Talik and Company Ltd (“Talik”) promotes equality, diversity and inclusion and complies with the Equality Act 2010 (the “Act”).

1.2 It applies to everyone working on Talik’s business or applying to do so, and to how Talik treats clients, participants and suppliers. Talik has been fully virtual since 2019, so the policy applies online, at home, on client sites, at venues, while travelling and at work events.

1.3 It is not part of any contract of employment. Associates and subcontractors must comply with it under their written terms with Talik.

2. DEFINITIONS

2.1 In this policy:

“associate” means a self-employed consultant engaged by Talik;

“Director” means Dr Alexandra Stubbings, Managing Director of Talik; “participant” means anyone taking part in a programme, workshop, coaching or other service Talik delivers;

“protected characteristics” means age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race (including colour, nationality and ethnic or national origins), religion or belief (including a lack of religion or belief), sex and sexual orientation (section 4 of the Act); and

“team member” means the Director, anyone Talik employs, every associate and anyone a subcontractor supplies, while working on Talik’s business.

3. LEGAL FRAMEWORK

3.1 The Act prohibits the following, and Talik shall neither commit nor tolerate them:

(a) direct discrimination: less favourable treatment because of a protected characteristic, including one a person is thought to have or is associated with (section 13);

(b) indirect discrimination: a rule or practice that disadvantages people who share a protected characteristic and is not a proportionate means of achieving a legitimate aim (section 19). Since 1 January 2024 others who suffer the same disadvantage are also protected (section 19A);

(c) pregnancy and maternity discrimination at work (section 18);

(d) discrimination arising from disability: unjustified unfavourable treatment because of something arising from a person’s disability (section 15);

(e) failure to make reasonable adjustments for a disabled person (sections 20 and 21);

(f) harassment: unwanted conduct related to a protected characteristic other than marriage and civil partnership or pregnancy and maternity, or of a sexual nature (“sexual harassment”), that violates a person’s dignity or creates an intimidating, hostile, degrading, humiliating or offensive environment for them, including less favourable treatment for rejecting or submitting to it (section 26);

(g) victimisation: subjecting a person to a detriment because they complained, gave evidence or otherwise acted under the Act, unless they made a false allegation or gave false evidence in bad faith (section 27); and

(h) instructing, causing, inducing or helping anyone to do any of these (sections 111 and 112).

3.2 The Act protects employees and job applicants (sections 39 and 40), including people working under a contract personally to do work (section 83), which is likely to cover associates; people a subcontractor supplies, as contract workers (section 41); and people to whom Talik provides services, including participants (section 29). For services the duty to make adjustments is anticipatory, and disabled people must not be charged for them.

3.3 Talik is liable for what its employees do in the course of employment and what associates and subcontractors do with its authority, whether or not it knew (section 109), and individuals can be personally liable (section 110). Where Talik acts for a client, for example in an assessment informing a promotion decision, Talik, the client and the team member may each be liable.

3.4 In For Women Scotland Ltd v The Scottish Ministers [2025] UKSC 16 the Supreme Court held that “sex” in the Act means biological sex. Trans people remain protected because of gender reassignment and from direct discrimination and harassment, including because of how they are perceived. Talik shall take advice before making any single-sex arrangement in its work.

3.5 Talik shall follow the statutory Codes of Practice of the Equality and Human Rights Commission (the “EHRC”), which courts and tribunals must take into account. Gender pay gap reporting and equality action plans (250 or more employees) and the public sector equality duty do not apply to Talik directly; any related practice in this policy is voluntary.

4. SEXUAL HARASSMENT AND THIRD-PARTY HARASSMENT

4.1 Since 26 October 2024, section 40A of the Act, inserted by the Worker Protection (Amendment of Equality Act 2010) Act 2023, has required employers to take reasonable steps to prevent sexual harassment of their employees. The EHRC can enforce it, and a tribunal may increase sexual harassment compensation by up to 25 per cent for breach (section 124A).

4.2 From 30 October 2026, sections 20 to 22 of the Employment Rights Act 2025, commenced by the Employment Rights Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, require all reasonable steps; make employers liable for harassment of employees by third parties, related to any characteristic in clause 3.1(f) and including a single incident, unless they took all reasonable steps to prevent it; and allow regulations to specify reasonable steps, which Talik shall adopt.

4.3 Since 6 April 2026, reporting sexual harassment can be a qualifying disclosure under section 43B of the Employment Rights Act 1996 (see the Whistleblowing Policy).

4.4 Talik shall apply the all reasonable steps standard to every team member, whether or not legally its employee, following the EHRC technical guidance on sexual harassment and harassment at work. Its steps are in section 12.

5. COMMITMENTS AND ROLES

5.1 Talik shall treat everyone fairly and with dignity, design its work to be accessible from the outset and act promptly on concerns. As a signatory to the Mental Health at Work Commitment, embedding the principles of Thriving at Work, it shall give mental health equal weight with physical health.

5.2 The Director is accountable for this policy, the risk assessment, adjustments, concerns and review, supported in confidence by the office manager on records, adjustments and monitoring. Associates and subcontractors shall comply with this policy, complete the training in section 17, ask participants about access needs, act on inappropriate behaviour in their sessions and report concerns. Every team member shall challenge or report breaches where it is safe to do so.

6. SELECTING AND WORKING WITH ASSOCIATES AND SUBCONTRACTORS

6.1 Talik shall select associates and subcontractors on merit against written criteria linked to the work, applied consistently and briefly recorded, and shall:

(a) look beyond personal networks when seeking associates, where practicable;

(b) not ask about health or disability before offering work, except as section 60 allows, such as to adjust the selection process;

(c) not suggest, in advertising or otherwise, that it would not engage people with a protected characteristic;

(d) allocate assignments on skills, client needs and availability, and check annually that work is shared fairly;

(e) refuse a client request to include or exclude a team member because of a protected characteristic unless an exception such as an occupational requirement (paragraph 1 of Schedule 9) applies, and meet a participant’s request for a coach with a particular characteristic only where lawful; and

(f) require associates and subcontractors in writing to comply with the Act and this policy and to cooperate with investigations.

7. PAY

7.1 Talik shall set pay and fees by role, work, expertise and market rate, never by a protected characteristic. Reflecting the equal pay provisions in sections 64 to 66, it shall use a standard rate for each type of work, record the reason for any departure and review rates annually so that equivalent work is paid alike.

7.2 No term shall stop anyone discussing pay to check for a link with a protected characteristic (section 77). Talik shall pay on time and shall never reduce pay or fees because of an adjustment, pregnancy or maternity.

8. REASONABLE ADJUSTMENTS AND ACCESSIBLE DELIVERY

8.1 Talik shall make reasonable adjustments for disabled team members and applicants, such as flexible scheduling, shorter sessions, co-facilitation or assistive technology, without requiring a diagnosis. It shall signpost Access to Work, which can fund support in England, Scotland and Wales, including for eligible self-employed people.

8.2 For participants Talik shall anticipate needs, invite each participant beforehand to say what would help without disclosing a diagnosis, and make adjustments at no cost to them, agreeing with the client in advance how any significant cost, such as an interpreter, is met.

8.3 In virtual delivery Talik shall use platforms with live captions (on by default) and screen reader and keyboard support; send accessible materials in advance, aiming for the WCAG 2.2 AA standard; build in breaks and offer chat, polls and anonymous ways to contribute; make cameras optional and allow blurred backgrounds; arrange interpreters or captioners where needed; record only with agreement; and schedule around part-time and shift working, caring responsibilities and religious observance.

8.4 For in-person delivery Talik shall check venues for step-free access, accessible toilets, hearing loops and a quiet space, and offer an accessible alternative of equal value to any outdoor or nature-based activity.

9. INCLUSIVE DESIGN AND FACILITATION

9.1 Talik shall review new materials for inclusive language and varied examples, avoiding stereotypes; use psychometric and 360 degree tools only through trained practitioners, with adjustments, where the publisher evidences fairness across groups; agree clear criteria in advance where its assessment informs a client’s selection or promotion decision; set ground rules for group sessions and act on breaches; explain the limits of coaching confidentiality; and act on participant feedback on inclusion.

10. SUPPORTING PUBLIC SECTOR CLIENTS

10.1 Section 149 of the Act requires public authorities to have due regard to the need to eliminate discrimination, harassment and victimisation, advance equality of opportunity and foster good relations. Talik is not a public authority, and a public body buying from Talik remains responsible for its own duty.

10.2 Talik shall support public sector clients by meeting contractual equality requirements and passing them on to associates and subcontractors; providing equality information they reasonably request, anonymised where it concerns individuals; identifying equality effects early in service redesign and change work and contributing to equality impact assessments; making engagement reach people with relevant protected characteristics; and reporting equality concerns promptly.

11. POSITIVE ACTION

11.1 Talik may take positive action only within sections 158 and 159 of the Act, after the Director records the evidence that people who share a protected characteristic are disadvantaged, have different needs or are under-represented, the aim, and why the action is proportionate.

11.2 Talik may, for example, encourage applications from or mentor an under-represented group (section 158), and may prefer a candidate on that basis only between candidates who are as qualified as each other, case by case and never under a general policy (section 159). It shall not use quotas. Where a client commissions a programme limited to people with a particular protected characteristic, Talik shall record the client’s confirmation of its lawful basis.

12. PREVENTING HARASSMENT

12.1 Talik shall take all reasonable steps to prevent harassment of and by team members, and shall:

(a) assess harassment risk in writing each year and before any higher risk engagement, covering one-to-one coaching, residential work, evening events, alcohol, travel, power imbalances with senior client staff and online messaging;

(b) adopt controls such as paired facilitation, check-ins and every team member’s right to stop a session or leave without detriment;

(c) require clients by contract to act on harassment of team members by their staff and to cooperate with investigations, reserving Talik’s right to withdraw;

(d) set standards of behaviour at the start of group programmes; and

(e) provide several reporting routes, including anonymous reporting, and review its measures after any incident.

12.2 Talik shall not use confidentiality terms to stop anyone reporting discrimination or harassment to the police, a regulator or a lawyer, or making a protected disclosure. The Employment Rights Act 2025 provisions on this are not yet in force; Talik adopts the principle now.

13. EQUALITY MONITORING AND SPECIAL CATEGORY DATA

13.1 Equality monitoring is voluntary, always offers “prefer not to say”, and no one shall suffer any detriment for declining.

13.2 Racial or ethnic origin, religious or philosophical beliefs, health (including disability) and sexual orientation are special category data under Article 9 of the UK GDPR. Talik shall process them for monitoring only under the equality of opportunity or treatment condition in paragraph 8 of Schedule 1 to the Data Protection Act 2018, with an appropriate policy document, or with explicit consent, as set out in the Data Protection and UK GDPR Statement.

13.3 Talik shall keep monitoring data separate from selection and assessment records, limit access to the Director and the office manager, never use it for decisions about individuals, stop processing on request and report only figures that cannot identify anyone. With twelve people, Talik’s own results shall not be published by category. Health information given for an adjustment shall be used only for that purpose and shared only as needed, with consent.

14. RAISING A CONCERN

14.1 Anyone may raise a concern about discrimination, harassment or victimisation they have experienced or witnessed, with the Director, by phone, video call or in writing marked confidential. A concern about the Director should go to Talik’s non-executive advisor, Dr Andrew Mountfield, andrew.mountfield@mountfield-advisory.com, who shall handle it without her involvement. Anonymous concerns shall be acted on as far as possible.

14.2 Participants may also use their employer’s procedures, with Talik’s cooperation. Informal resolution is available on request but never required, and shall not be proposed for sexual harassment or other serious allegations. Legal rights, including contacting Acas or bringing a claim within strict time limits, are unaffected.

15. HOW CONCERNS ARE INVESTIGATED

15.1 Talik shall:

(a) acknowledge the concern in writing within five working days and take any interim steps needed to protect people, without disadvantaging the person who raised it;

(b) appoint an impartial investigator, normally the Director, or an external investigator where she is involved or conflicted or the matter is serious;

(c) give the person complained about the allegation and a fair chance to respond, and gather evidence from witnesses, messages and recordings;

(d) allow anyone to be accompanied at meetings by a colleague, trade union representative or other supporter;

(e) aim to finish within 28 days, confirm the outcome in writing and offer an appeal within ten working days to someone not previously involved; and

(f) for anyone it employs, follow the Acas Code of Practice on disciplinary and grievance procedures.

15.2 Information shall be shared only with those who need it. Where a concern involves a client’s staff or another third party, Talik shall, with the affected person’s agreement where possible, raise it with a senior client contact, ask the client to act, and take its own steps, up to ending the engagement. The Director shall review the risk assessment after every concern.

16. BREACH AND CONSEQUENCES

16.1 A breach may lead to disciplinary action up to dismissal for anyone Talik employs; removal from assignments and termination for associates and subcontractors; and, for clients and other third parties, stopped sessions, withdrawn team members or an ended engagement. Conduct that may be criminal shall be reported to the police where appropriate, respecting the wishes of the person affected.

16.2 No one shall suffer any detriment for an honest concern that is not upheld, but a knowingly false allegation made in bad faith may lead to action.

17. TRAINING AND COMMUNICATION

17.1 Every team member shall read this policy and complete equality and harassment prevention training on joining and at least every two years, covering prohibited conduct, sexual and third- party harassment, bystander intervention, inclusive facilitation, adjustments, disclosures and reporting. The Director shall be trained in handling complaints and shall brief team members annually on legal changes and lessons learned. Talik shall publish this policy on its website.

18. RECORDS, MONITORING AND REVIEW

18.1 Talik shall keep risk assessments, selection, allocation and fee review records, adjustment records, concerns and outcomes, positive action decisions and training records securely, in line with the Data Protection and UK GDPR Statement and the Information Security Policy.

18.2 The Director shall review this policy annually, and sooner after a complaint, a change in the law or guidance (including regulations on reasonable steps) or significant feedback, considering concerns, the risk assessment, monitoring, fee and allocation reviews, feedback and training, and shall record the outcome.

19. RELATED POLICIES

19.1 This policy should be read with the Data Protection and UK GDPR Statement, the Information Security Policy, the Whistleblowing Policy, the Anti-Bribery and Conflicts of Interest Policy, the Health and Safety Statement, the Social Value Policy and the Modern Slavery Statement.

1. POLICY STATEMENT AND SCOPE

1.1 Talik and Company Ltd (“Talik”) is a management consultancy established with the purpose of enabling people and nature to flourish. This policy sets out how Talik delivers social value through its contracts, and the processes it has in place to meet social value obligations in public contracts, including call-off contracts under framework agreements.

1.2 Talik shall offer social value that is relevant and proportionate to the contract; commit only to what it can deliver and evidence; deliver each commitment through an agreed plan owned by a named person; report honestly using the metrics of the Social Value Model; and pay its associates and subcontractors promptly.

1.3 Talik is a small and medium-sized enterprise and has been fully virtual since 2019. Its work is delivered by twelve people: the Director and associate consultants, and on some contracts a named subcontractor. This policy is proportionate to that size.

1.4 This policy applies to all Talik people whenever they work on Talik business, and to associates and subcontractors through the terms on which Talik engages them.

2. DEFINITIONS

2.1 In this policy:

“buyer” means the contracting authority or other client with which Talik holds a contract;

“contract commitments” means the social value commitments Talik makes in a tender or agrees with a buyer, which become terms or performance indicators of the contract;

“Director” means Dr Alexandra Stubbings, Managing Director of Talik;

“PPN 002” means Procurement Policy Note 002, Taking account of social value in the award of central government contracts (Cabinet Office, February 2025), with the Social Value Model and the guide published with it;

“social value” means economic, social and environmental benefit that Talik delivers in performing a contract, over and above the core deliverables of that contract; and

“Talik people” means the Director, anyone Talik employs, and associates and subcontractors while working for Talik.

3. LEGAL AND POLICY FRAMEWORK

3.1 Section 1 of the Public Services (Social Value) Act 2012 requires a relevant authority, before procuring public services, to consider how what it proposes to procure might improve the economic, social and environmental well-being of the relevant area, and how it might act in the procurement to secure that improvement. The section was amended from 24 February 2025 to align it with the Procurement Act 2023.

3.2 The Procurement Act 2023 applies to procurements commenced on or after 24 February 2025. A contracting authority must have regard to the importance of maximising public benefit (section 12(1)), to the barriers that small and medium-sized enterprises may face (section 12(4)) and to the national procurement policy statement (section 13(9)). Its award criteria must relate to the subject matter of the contract and be proportionate, having regard to the nature, complexity and cost of the contract (section 23).

3.3 The National Procurement Policy Statement, published on 13 February 2025 and in effect from 24 February 2025, asks contracting authorities to deliver social and economic value that supports the Government’s national missions, to give small and medium-sized enterprises and voluntary, community and social enterprises a fair chance at public contracts, and to expect suppliers to eliminate late payment in their supply chains.

3.4 PPN 002 was published on 13 February 2025, and its guide was revised on 5 March 2025. It has been mandatory for central government departments, their executive agencies and non- departmental public bodies in above-threshold covered procurements commenced on or after 1 October 2025. Other contracting authorities, including NHS bodies, may choose to apply it. Under PPN 002:

(a) social value carries at least 10 per cent of the total score, where it is relevant and proportionate;

(b) commitments must be over and above the core deliverables and specific to the contract: criteria based on a supplier’s general corporate policies must not be used;

(c) evaluation is qualitative and volumes are not scored, but the quantity a supplier offers becomes a contract commitment; and

(d) every commitment must be reflected in the contract as contract terms, key performance indicators or performance indicators.

3.5 A framework must set out the social value outcomes that apply at call-off. A buyer may refine them with sub-criteria at call-off, but may not add social value the framework did not provide for. Frameworks launched before 1 October 2025 may use the earlier model under PPN 06/20, and their call-offs continue to apply it. Talik shall respond to whichever model the framework uses.

3.6 These duties fall on buyers. Talik’s own obligations arise from its contracts and from section 73 of the Procurement Act 2023 (clause 8.1).

4. THE SOCIAL VALUE MODEL

4.1 The Social Value Model aligns social value with five Government missions and eight policy outcomes:

(a) Mission 1, kick start economic growth: Outcome 1, fair work; Outcome 2, skills for growth; and Outcome 3, resilient, innovative and flexible supply chains;

(b) Mission 2, make Britain a clean energy superpower: Outcome 4, sustainable procurement practices;

(c) Mission 3, take back our streets: Outcome 5, support the reduction in crime through community cohesion, awareness raising and action;

(d) Mission 4, break down barriers to opportunity: Outcome 6, employment and training for those who face barriers to employment; and Outcome 7, creating a pipeline of opportunities for the contract workforce, reducing barriers to entry for under- represented groups; and

(e) Mission 5, build an NHS fit for the future: Outcome 8, increasing productivity through physical and mental wellbeing.

4.2 For each outcome the Model sets award criteria, sub-criteria and standard reporting metrics, each with a reference (for example criterion 8a and metric 8ai). The supplier answers the buyer’s question with a method statement and a timed project plan setting out its specific, measurable and time-bound commitments, its metrics and monitoring tools, its governance and escalation points, its feedback and improvement procedures and any plans to publish its performance. For Outcomes 1, 6 and 7 the supplier also states the number of people working on the contract, counted in roles rather than full-time equivalents.

5. HOW TALIK’S STRENGTHS MAP TO THE MODEL

5.1 Talik builds its offer first from four areas in which it has genuine capability and can evidence delivery.

5.2 Health and wellbeing (Outcome 8). Talik is a signatory to the Mental Health at Work Commitment and embeds the principles of Thriving at Work. Under criterion 8a it can offer structured wellbeing support for the Talik people delivering a contract and, where the buyer agrees it is additional, for the supply chain or the community, reported under metric 8ai (hours spent setting up and delivering staff health and wellbeing).

5.3 Skills and opportunity (Outcomes 1, 2 and 7). Talik people coach and mentor marginalised or purpose driven young people for 30 or more hours a year. On a contract Talik can offer mentoring, career support, learning sessions and outreach, reported under metrics such as 1dii (person hours of career support), 2aii (people-hours of learning interventions, by UK region) and 7bi (number of outreach activities).

5.4 Communities (Outcome 3). Talik has supported Maggie’s Cancer Care with facilitation and fundraising for seven years, for 24 or more hours a year, and facilitates and contributes to local green groups for 30 or more hours a year. On a contract it can offer pro bono facilitation for voluntary, community and social enterprises or anchor institutions in the relevant area under criterion 3b, reported under metric 3bi (number of engagement activities). Talik shall agree each activity with the partner in advance, so that it meets a need the partner has identified.

5.5 Environment (Outcome 4). Talik has been fully virtual since 2019. Its people choose public over private transport, drive electric and minimise flights; it uses solar power, battery storage and 100 per cent renewable energy; and it keeps devices, technology and vehicles to the end of their life. Under criterion 4b it can offer activity that helps staff, clients and communities support the environment, reported under metric 4bi. Talik has not yet measured its emissions, so it shall not offer a quantified carbon reduction under metric 4ai until it has a baseline. Its environmental commitments are in its Environmental Policy.

5.6 Fair and prompt payment (section 8) and the Modern Slavery Statement support Outcomes 1 and 3. For any other outcome a buyer selects, Talik shall offer only what it has confirmed before tendering that it can deliver.

5.7 Talik’s standing community activity is evidence of capability, not contract social value. Talik shall not present it as contract social value, and shall not count the same hours against more than one contract, or against both a contract and its own annual record.

6. DELIVERING SOCIAL VALUE ON EACH CONTRACT

6.1 Before Talik submits a response that asks for social value, the Director shall:

(a) identify the outcomes and criteria set by the framework and the call-off, and any priorities the buyer has stated;

(b) select commitments that relate to the contract and are over and above its core deliverables, stating the difference clearly where Talik’s core service is itself leadership, wellbeing or development work;

(c) confirm that the people, partners and time needed are available and are built into Talik’s price; and

(d) offer a quantity only where Talik can deliver and evidence it.

6.2 At the start of each contract with social value commitments, Talik shall agree a delivery plan with the buyer recording each commitment and its metric reference; the baseline, target and milestones; the person responsible; the evidence to be kept; the reporting dates and format; and each party’s escalation point.

6.3 The Director is accountable for every contract commitment and shall name in the delivery plan the person responsible for each, who may be the Director or an associate on the contract. That person shall deliver to the plan, record activity as it happens and keep the evidence.

6.4 Where a contract requires it, Talik shall advertise any new role it creates in the United Kingdom to perform that contract on the Government’s Find a Job website.

6.5 If a commitment is at risk, Talik shall tell the buyer promptly, explain why and propose how it will be recovered. Talik shall not change or substitute a commitment without the buyer’s written agreement. At the end of the contract Talik shall give the buyer a final account against each commitment.

7. MEASUREMENT AND REPORTING

7.1 Talik shall measure each commitment with the standard reporting metric in the Social Value Model where one fits, in that metric’s unit. Otherwise it shall agree with the buyer a metric that combines a deliverable and a numeric element, as the Model’s guide requires.

7.2 Talik shall report at the intervals and in the form the contract requires. Every figure shall be an actual figure supported by evidence, and any forecast shall be labelled as such. Talik shall not convert outcomes into financial proxy values unless the buyer asks, and shall then state the method used.

7.3 Evidence includes activity logs, attendance records, feedback and written confirmation from partners.

7.4 Where a contract includes a social value key performance indicator, Talik accepts that the buyer will rate its performance as good, approaching target, requires improvement or inadequate, and may publish it. Talik shall answer any rating below good with a written recovery plan.

7.5 Reports shall use aggregated, anonymised information wherever possible. Health information is special category personal data and shall be collected only where necessary, in line with the Data Protection and UK GDPR Statement. Talik shall correct any reporting error promptly and tell the buyer.

8. SUPPLY CHAIN AND PROMPT PAYMENT

8.1 Where Talik engages an associate or subcontractor substantially to perform all or part of a public contract, section 73 of the Procurement Act 2023 implies a term requiring Talik to pay a valid and undisputed invoice within 30 days of receiving it. Any term that restricts or overrides it has no effect.

8.2 Talik applies that standard to all its work, public and private. Talik shall:

(a) pay associates and subcontractors within 30 days of receiving a valid and undisputed invoice, or sooner where agreed;

(b) raise any dispute without undue delay, giving reasons, and pay any undisputed part on time;

(c) never make payment conditional on Talik being paid by the buyer; and

(d) set out payment terms in writing, and require subcontractors on public contracts to pay their own suppliers on the same terms.

8.3 PPN 015 requires suppliers bidding for central government contracts above £5 million a year to show that they pay 95 per cent of invoices within 60 days (90 per cent with an action plan) and all invoices within an average of 55 days. PPN 021 provides for payment spot checks in the supply chains of those contracts from 1 October 2025. Talik’s 30-day standard is stricter. Talik shall record the dates it receives and pays invoices, so that it can demonstrate its performance, and shall cooperate with any payment check a buyer makes.

8.4 An associate or subcontractor paid late may raise it with the Director. A supplier on a public contract may also report late or unfair payment to the Cabinet Office’s Public Procurement Review Service.

8.5 Talik shall make it easy for small businesses and voluntary, community and social enterprises to work with it, through clear briefs, plain written terms, requirements proportionate to the work, and fair credit for partners’ contributions in its reports. It expects associates and subcontractors to follow this policy and Talik’s related policies on Talik work.

9. ROLES, RECORDS AND TRAINING

9.1 The Director owns this policy, approves every social value offer, is accountable for every contract commitment and signs off every report before it reaches a buyer.

9.2 All Talik people shall record social value activity accurately and raise any concern about the accuracy of Talik’s reporting with the Director or under the Whistleblowing Policy. Talik’s office support maintains the records under the Director’s direction.

9.3 Talik shall keep a social value register recording, for each contract, the commitments and metric references, the delivery plan, activity by date and person, the evidence, the reports and the buyer’s responses, and any agreed variation. It shall keep a separate annual record of the community hours Talik people give outside contracts. Records shall be kept for the life of each contract and any longer period it requires, in line with the Data Protection and UK GDPR Statement.

9.4 The Director shall brief every associate and subcontractor on this policy when they are engaged, and on the contract commitments before work starts. Talik shall publish this policy on its website.

10. MONITORING AND REVIEW

10.1 The Director shall review progress against each delivery plan at least monthly. Once a year the Director shall review the social value delivered across all contracts and community activity, any buyer ratings and the lessons learned, and set priorities for the coming year.

10.2 A failure to follow this policy, or knowingly inaccurate reporting, is a serious matter and, for an associate or subcontractor, may end the engagement.

10.3 The Director shall review this policy at least once a year, and sooner if PPN 002, the Social Value Model, the National Procurement Policy Statement, the law or a framework’s requirements change.

11. RELATED POLICIES

11.1 This policy should be read with Talik’s Environmental Policy; Equality, Diversity and Inclusion Policy, which supports Outcomes 6 and 7 and the information buyers need to meet the public sector equality duty; Modern Slavery Statement; Anti-Bribery and Conflicts of Interest Policy; Data Protection and UK GDPR Statement; Health and Safety Statement; and Whistleblowing Policy. Talik will publish a Carbon Reduction Plan once it has measured its emissions.

1. POLICY STATEMENT

1.1 Talik and Company Ltd (“Talik”) is a management consultancy that has been fully virtual since 2019, with no office premises. Its environmental impacts arise mainly from travel, home and digital working, what it buys, and the client programmes it designs. Talik has determined that climate change is a relevant issue for its business, its clients and the public bodies it serves.

1.2 In proportion to the nature and scale of its work, Talik is committed to:

(a) protecting the environment, including preventing pollution, using resources sustainably, mitigating climate change and protecting nature;

(b) fulfilling its compliance obligations;

(c) measuring its greenhouse gas emissions, publishing a Carbon Reduction Plan once it has done so, and reaching net zero by 2050 at the latest;

(d) setting environmental objectives within the framework in section 7 and reviewing them at least once a year; and

(e) continually improving its environmental management and performance.

1.3 This policy meets the requirements for an environmental policy in clause 5.2 of ISO 14001. Talik does not hold ISO 14001 certification and makes no claim to it; it uses the standard as a framework, in proportion to its size.

2. SCOPE

2.1 This policy applies to Talik people whenever they work on Talik business, in the United Kingdom or abroad. Associate consultants and subcontractors are independent businesses, and it applies to them through the terms on which Talik engages them, in respect of Talik work only.

3. DEFINITIONS

3.1 In this policy:

“compliance obligations” means the environmental law that applies to Talik and the environmental requirements it chooses or agrees to meet, including those in its contracts.

“Director” means Dr Alexandra Stubbings, Managing Director of Talik.

“GHG Protocol” means the Greenhouse Gas Protocol Corporate Accounting and Reporting Standard, with its Scope 3 Standard and technical guidance. “PPN 006” means Procurement Policy Note 006, Taking account of Carbon Reduction Plans in the procurement of major government contracts (Cabinet Office, February 2025), with its Technical Standard for the Completion of Carbon Reduction Plans, as updated from time to time. “Scope 1, Scope 2 and Scope 3” have their GHG Protocol meanings: direct emissions from sources Talik owns or controls; indirect emissions from the energy it buys; and other indirect emissions in its value chain.

“Talik people” means the Director, anyone Talik employs, and associate consultants and subcontractors while working for Talik.

4. LEGAL AND STANDARDS FRAMEWORK

4.1 ISO 14001:2015 was amended in February 2024 to require organisations to determine whether climate change is a relevant issue and to recognise that interested parties can have climate- related requirements. ISO 14001:2026, published on 15 April 2026, incorporates that amendment. This policy meets clause 5.2 of both editions.

4.2 Talik’s principal compliance obligations, recorded in a register reviewed under clause 16.2, are:

(a) the waste duty of care under section 34 of the Environmental Protection Act 1990 and its statutory code of practice: keeping waste secure, passing it only to an authorised person with a written description, and keeping transfer notes for at least two years and any hazardous waste consignment notes for at least three;

(b) regulation 12 of the Waste (England and Wales) Regulations 2011, which requires the waste hierarchy to be applied and confirmed on the transfer note;

(c) regulation 12 of the Waste Electrical and Electronic Equipment Regulations 2013, under which producers finance the take-back of non-household equipment they placed on the market from 13 August 2005, and of older equipment when supplying an equivalent replacement;

(d) the Waste Batteries and Accumulators Regulations 2009: waste portable batteries go to a battery collection point, never into general waste;

(e) the Business Protection from Misleading Marketing Regulations 2008 and the Competition and Markets Authority’s Green Claims Code, which govern Talik’s environmental claims (clause 13.2); and

(f) buyer requirements, including PPN 006 and NHS England’s carbon reduction plan and net zero commitment requirements (section 6).

4.3 Some duties do not apply to Talik, and it records why:

(a) the workplace recycling requirements in England (from 31 March 2025, or 31 March 2027 for micro-firms) apply to workplaces. Talik occupies none; at client sites and hired venues its people use the occupier’s separate collections;

(b) Streamlined Energy and Carbon Reporting applies to quoted companies and large companies and limited liability partnerships, and the Energy Savings Opportunity Scheme to undertakings with 250 or more employees, or turnover above £44 million and a balance sheet above £38 million. Talik is within neither and reports voluntarily;

(c) PPN 006 binds central government departments, their executive agencies and non- departmental public bodies for contracts, including under frameworks, worth more than £5 million a year. Talik adopts its standard voluntarily so that it is ready wherever a buyer applies it.

4.4 Section 1 of the Climate Change Act 2008, as amended in 2019, requires the net UK carbon account for 2050 to be at least 100 percent lower than the 1990 baseline. Talik’s net zero commitment is consistent with that target.

5. HOW TALIK AFFECTS THE ENVIRONMENT

5.1 Taking a life cycle perspective, Talik’s significant environmental aspects are:

(a) business travel to client sites, venues and meetings;

(b) the energy used by Talik people working from home;

(c) ICT and digital: making, using and disposing of devices, and the energy used by video conferencing and cloud services;

(d) the goods and services Talik buys, including those of associates and subcontractors;

(e) venues, catering and materials for the workshops and events Talik arranges; and

(f) waste, including electrical and electronic equipment at the end of its life.

5.2 Talik’s wider influence is through its client work in leadership, organisational development, change, coaching, facilitation and service redesign, which shapes how client organisations work. Talik designs nature connection into that work and designs waste out of it. This indirect aspect is significant, and it is where Talik can do most good.

5.3 Talik has identified no potential emergency situation with a significant environmental consequence, and shall reconsider this at each review.

5.4 Talik already acts on these aspects. It chooses public over private transport, drives electric, works virtually where that suits the work and keeps flights to a minimum. It uses solar PV, battery storage and 100 percent renewable energy, and keeps devices, technology and vehicles in use to the end of their life. Its people also facilitate and contribute to local green groups for 30 or more hours a year, as described in the Social Value Policy.

6. MEASURING EMISSIONS AND THE CARBON REDUCTION PLAN

6.1 Talik has not yet measured its annual greenhouse gas emissions and shall state no emissions figure until it has. It shall complete its first measurement by 31 March 2027.

6.2 Talik shall measure its emissions in tonnes of carbon dioxide equivalent, following the GHG Protocol and using the UK Government conversion factors for the relevant year, covering:

(a) all Scope 1 emissions, such as fuel used in any vehicle Talik owns or leases;

(b) all Scope 2 emissions, reported on both the location-based and market-based methods so that its renewable supply is shown accurately; and

(c) the five Scope 3 categories required by PPN 006: upstream transportation and distribution (category 4), waste generated in operations (category 5), business travel (category 6), employee commuting (category 7) and downstream transportation and distribution (category 9).

6.3 As Talik is fully virtual, it shall include home working energy in category 7, as the GHG Protocol permits, and count associates’ and subcontractors’ travel on Talik work as business travel. A required category that is nil or immaterial shall be reported as such, with the reason. Talik shall also screen the other Scope 3 categories, particularly purchased goods and services and capital goods, and report any that are material.

6.4 Talik shall use a consistent annual reporting period based on its financial year. Its first complete measurement shall be its baseline, recalculated only if a significant change would make comparison misleading.

6.5 Once it has measured its emissions, Talik shall publish a Carbon Reduction Plan in the form set out in PPN 006, which shall:

(a) confirm Talik’s commitment to net zero by 2050 at the latest;

(b) report its baseline and current emissions, its reduction targets and the measures taken and planned;

(c) state the Director’s approval as Talik’s board, with the date, and carry her sign-off; and

(d) be published on Talik’s UK website, linked from the home page, and updated at least annually and within six months of each financial year end.

6.6 Net zero by 2050 is the minimum. NHS England encourages suppliers to aim for 2045, and Talik shall consider an earlier date once its baseline is known. Talik shall prioritise real reductions, use offsetting, if at all, only for residual emissions and disclose it separately, and shall not claim to be carbon neutral or net zero unless the claim is fully substantiated.

6.7 For NHS contracts Talik shall meet NHS England’s requirements: a published Net Zero Commitment for contracts below £5 million a year, a Carbon Reduction Plan at or above that value and, from April 2027 under the NHS Net Zero Supplier Roadmap, public reporting of targets and emissions. Until its first measurement is complete, Talik shall state in any tender that measurement is under way and shall not estimate a figure.

7. OBJECTIVES AND MEASURES

7.1 Talik’s objectives are expressed as actions and measures. Numerical reduction targets shall be set once the baseline exists and published in the Carbon Reduction Plan. The objectives are:

(a) Measurement: complete the first measurement and publish the Carbon Reduction Plan. Measure: done by the date in clause 6.1, then updated yearly.

(b) Travel: apply section 8 and record every business journey. Measures: business travel emissions; share of journeys by public transport, walking or cycling; number of flights and the reason for each.

(c) Equipment: keep devices to the end of their life and send each retired device to reuse, refurbishment or authorised recycling. Measures: device age at replacement; share of retired devices with a documented route.

(d) Venues: apply clause 11.1. Measure: share of Talik events held virtually or at venues meeting the criteria.

(e) Suppliers: ask significant new suppliers environmental questions in proportion to value. Measure: share asked and answering.

(f) People: brief every Talik person at induction and yearly. Measures: share briefed; share of associates returning travel records on time.

(g) Client work: offer virtual or blended delivery where suitable and design in nature connection. Measure: share of programmes delivered wholly or partly virtually.

8. TRAVEL

8.1 Talik people shall choose the highest option in this hierarchy that meets the needs of the work and the client:

(a) avoid the journey by working virtually;

(b) walk or cycle;

(c) use public transport, with rail preferred to car and air;

(d) use an electric vehicle, share the journey or combine trips;

(e) use any other car only where no option above is reasonable; and

(f) fly only where there is no reasonable alternative, in economy class, and never where rail is a reasonable option.

8.2 Every business journey shall be recorded with its date, route, mode and distance. Any flight requires the Director’s prior agreement.

9. HOME WORKING, ICT AND DIGITAL

9.1 Talik encourages its people to choose renewable electricity and use energy efficiently at home, and shall record days worked from home so that home working energy can be estimated.

9.2 Talik shall repair before replacing, consider refurbished equipment, buy energy-efficient devices from suppliers with credible take-back arrangements, delete data it no longer needs, and prefer cloud and conferencing providers with credible renewable energy commitments.

9.3 Before any device leaves Talik’s control, its data shall be securely erased or the storage destroyed under the Information Security Policy and the Data Protection and UK GDPR Statement, and the transfer recorded.

10. WASTE

10.1 Talik applies the waste hierarchy, preventing waste first and treating disposal as the last resort. Programme materials are digital by default.

10.2 Waste Talik owns, including electrical equipment and batteries, shall go only to an authorised person, such as a producer take-back scheme, registered waste carrier, authorised treatment facility or battery collection point, with a transfer note where the law requires one. Associates and subcontractors manage their own waste, and Talik expects them to meet the same standard.

11. VENUES, EVENTS AND CATERING

11.1 Talik shall first consider whether a workshop or event can be held virtually or in a blended format without harming the outcome. Where a venue is needed, Talik shall prefer one that:

(a) is easy to reach by public transport, walking or cycling;

(b) shows credible environmental management, such as renewable energy and separate recycling and food waste collections;

(c) offers seasonal, local and mainly plant-based catering, tap water and no single-use plastics; and

(d) gives access to outdoor or green space.

11.2 Talik shall confirm catering numbers close to the event to avoid food waste and share low- carbon travel information with participants. Where a client provides the venue, Talik shall share these criteria and follow the venue’s own arrangements.

12. PURCHASING AND SUPPLIERS

12.1 In proportion to value and risk, Talik shall buy less and buy to last, prefer repairable, refurbished and energy-efficient products, and prefer suppliers that measure and reduce their own emissions. Through their terms of engagement, Talik shall ask significant suppliers, associates and subcontractors to support this policy and provide the data Talik needs to measure its emissions.

13. CLIENT WORK AND ENVIRONMENTAL CLAIMS

13.1 Where relevant to the brief, Talik shall consider the environmental dimension of its client work and support clients’ own net zero aims, within the scope of the engagement and its competence.

13.2 Talik’s environmental claims, in tenders, online or elsewhere, shall follow the Green Claims Code: truthful and accurate, clear and unambiguous, not omitting or hiding relevant information, fair and meaningful in any comparison, considering the full life cycle, and substantiated. The Director shall approve any new claim before it is used.

14. ROLES AND RESPONSIBILITIES

14.1 The Director is accountable for this policy and its resources. She approves the policy, the objectives, any flight and any new environmental claim, signs off the Carbon Reduction Plan and leads the annual review.

14.2 The office manager supports the Director by keeping the travel, home working, device and waste records, the register of compliance obligations and the measurement evidence.

14.3 Every Talik person shall follow this policy, record their business journeys, provide the data Talik asks for, and raise any environmental concern or suggestion with the Director.

15. COMMUNICATION AND AWARENESS

15.1 Every Talik person shall receive this policy at induction and on each revision, and shall understand the significant environmental aspects of their work, their part in the objectives and the consequences of not following the policy.

15.2 This policy shall be published on Talik’s website and provided to clients, buyers and other interested parties on request. Questions and suggestions may be sent to info@talikandco.net.

16. MONITORING, RECORDS AND REVIEW

16.1 Talik shall keep the records this policy requires for at least the period the law requires, and for as long as they are needed to support its baseline and Carbon Reduction Plan.

16.2 At least once a year the Director shall review and record:

(a) whether Talik is meeting each compliance obligation;

(b) progress against section 7, and the emissions data;

(c) changes in the law, in PPN 006, in NHS and other buyer requirements and in ISO 14001;

(d) any complaint, incident or failure to follow this policy, and the action taken; and

(e) whether this policy, the significant environmental aspects and the objectives remain appropriate, and what should improve.

16.3 Where this policy is not followed, Talik shall correct the issue, establish the cause, act to prevent it happening again and record what was done. A serious or repeated failure may lead to disciplinary action or to the end of an associate or subcontract engagement.

16.4 This policy shall be reviewed at least every twelve months, and sooner if the law, buyer requirements or Talik’s business change significantly.

17. RELATED POLICIES

17.1 This policy should be read with the Social Value Policy, the Information Security Policy, the Data Protection and UK GDPR Statement, the Health and Safety Statement and the Modern Slavery Statement. Talik will publish its Carbon Reduction Plan once it has measured its emissions.