Terms and Conditions of Service

Norden Leads Ltd Effective Date: January 1, 2026

Please read these terms and conditions carefully before using our services. By accessing or using our B2B lead generation services, you agree to be bound by these terms.

1 DEFINITIONS AND INTERPRETATION

1.1 Definitions

In these Terms:

  • "Agreement" means the Order Form, these Terms and Conditions, and the Data Processing Addendum, together forming the entire agreement between the parties.
  • "Commencement Date" means the date specified in the Order Form or, if none is specified, the date we begin providing Services.
  • "Confidential Information" means all information disclosed by one party to the other (whether orally, in writing, or otherwise) that is identified as confidential or that ought reasonably to be considered confidential, including business plans, customer data, pricing, ICP specifications, and outreach strategies.
  • "Data Protection Laws" means all applicable laws relating to the processing of Personal Data, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).
  • "Fees" means the monthly subscription fees specified in the Order Form.
  • "ICP" means Ideal Customer Profile, being the target prospect criteria and specifications provided by the Client.
  • "Initial Term" means the initial 3-month period commencing on the Commencement Date.
  • "MQL" means Marketing-Qualified Lead, being a prospect who meets ICP criteria and has shown initial engagement but requires further qualification.
  • "Order Form" means the order, proposal, or statement of work executed by both parties that references these Terms.
  • "Performance Guarantee" means our commitment to deliver the Minimum Lead Quota as specified in Clause 6.
  • "Personal Data" has the meaning given in Data Protection Laws.
  • "Ramp-Up Period" means the first two Subscription Periods during which we refine and optimize the ICP and outreach strategy.
  • "Sales-Qualified Lead" or "SQL" has the meaning set out in Clause 6.2.
  • "Services" means the AI-powered B2B lead generation and appointment-setting services described in the Order Form and Clause 2.
  • "Subscription Period" means each successive monthly period commencing on the Commencement Date or anniversary thereof.
  • "Minimum Lead Quota" means the minimum number of MQLs and/or SQLs guaranteed per month as specified in the Order Form (which may include flexible quota paths such as "12 MQLs and 5 SQLs" or other combinations).

1.2 Interpretation

References to clauses are to clauses of these Terms. Headings are for convenience only and do not affect interpretation. Words in the singular include the plural and vice versa.

2 SERVICES

2.1 Service Description

We shall provide the following Services to the Client:

  • (a)AI-powered multichannel outreach campaigns (including email, LinkedIn, telephone, and other channels as agreed) targeting prospects in the UK and Ireland logistics sectors;
  • (b)Bespoke prospect targeting based on the Client's ICP, including sectors such as parcels, freight forwarding, third-party logistics (3PL/4PL), cold chain, pharmaceutical logistics, warehousing, and related subsectors;
  • (c)Smart follow-up sequences and lead nurturing using AI-driven tools and processes;
  • (d)Delivery of Marketing-Qualified Leads (MQLs) and Sales-Qualified Leads (SQLs) meeting the criteria in Clause 6.2;
  • (e)Regular reporting on campaign performance, lead metrics, and MQL/SQL delivery;
  • (f)90%+ data accuracy through real-time data enrichment and verification;
  • (g)Dedicated account manager with monthly performance reviews and strategy consultations;
  • (h)Seamless CRM integration with platforms such as Salesforce, HubSpot, Pipedrive, or other systems as agreed.

2.2 Ramp-Up Period

  • (a)The Services include a 2-month Ramp-Up Period for ICP refinement, messaging optimization, and campaign calibration;
  • (b)During the Ramp-Up Period, lead volume may be approximately 60-80% of full capacity as we test and optimize targeting and outreach approaches;
  • (c)The Performance Guarantee set out in Clause 6 applies from the third Subscription Period onward (i.e., after completion of the Ramp-Up Period);
  • (d)During the Ramp-Up Period, we will work collaboratively with the Client to refine the ICP based on initial campaign results and feedback.

2.3 Service Delivery

We will use reasonable skill and care in performing the Services. We reserve the right to determine the methods, tools, and means by which we deliver the Services, provided they are consistent with industry standards and the specifications in the Order Form.

2.4 Client Cooperation

The Client shall:

  • (a)Provide accurate and timely information regarding its ICP, target sectors, key decision-maker roles, messaging preferences, and any exclusions;
  • (b)Respond promptly to MQLs and SQLs delivered and provide feedback on lead quality;
  • (c)Designate a primary contact person for liaison with Norden Leads;
  • (d)Comply with all applicable laws in its use of the leads and any data provided;
  • (e)Participate in monthly performance review calls and provide feedback to support ongoing optimization. Attendance at monthly review calls is strongly recommended to maximise campaign performance.

2.5 Service Modifications

We may update or modify our service delivery methods, AI tools, or outreach channels from time to time to improve performance, provided such changes do not materially diminish the Services.

3 TERM AND TERMINATION

3.1 Initial Term and Rolling Continuation

This Agreement commences on the Commencement Date and continues for an Initial Term of 3 months. Following the Initial Term, this Agreement continues on a rolling monthly basis unless terminated in accordance with this Clause 3.

3.2 Termination by Either Party

Either party may terminate this Agreement by giving the other party not less than 30 days' written notice to expire at the end of the Initial Term or (if after the Initial Term) at the end of any Subscription Period.

3.3 Termination for Breach

Either party may terminate this Agreement with immediate effect by written notice if:

  • (a)The other party commits a material breach of this Agreement and (if the breach is capable of remedy) fails to remedy it within 14 days of receiving written notice specifying the breach; or
  • (b)The other party becomes insolvent, enters administration, receivership or liquidation, or makes an arrangement with creditors.

3.4 Effect of Termination

  • (a)Upon termination, the Client shall pay all outstanding Fees up to the effective date of termination;
  • (b)We shall cease all outreach activities on behalf of the Client, save that we may complete any in-flight campaigns in progress unless the Client requests immediate cessation;
  • (c)All MQLs and SQLs delivered up to the termination date shall count toward the Minimum Lead Quota for the relevant Subscription Period;
  • (d)If termination occurs mid-Subscription Period and the Minimum Lead Quota has not been met, Clause 6.3 (Performance Guarantee remedy) shall apply pro-rata.

3.5 Survival

Clauses 5 (Fees and Payment), 8 (Confidentiality), 9 (Intellectual Property), 10 (Limitation of Liability), 11 (Data Protection), and any other provisions that by their nature should survive, shall survive termination of this Agreement.

4 NO LOCK-IN COMMITMENT AND NON-EXCLUSIVITY

4.1 No Long-Term Lock-In

Following the Initial Term, the Client is not required to commit to any minimum contract period beyond the current Subscription Period. There are no setup fees, onboarding fees, or cancellation penalties.

4.2 Termination Rights

The Client may terminate at any time in accordance with Clause 3.2, with notice to take effect at the end of the Initial Term or (thereafter) at the end of the then-current Subscription Period.

4.3 No Exclusivity

This Agreement is non-exclusive. We may provide similar services to other clients in the same or related industries, provided that we maintain the confidentiality of your Confidential Information in accordance with Clause 8 and do not share your specific ICP, targeting strategies, or proprietary information with any third party.

5 FEES AND PAYMENT

5.1 Subscription Fees

The Client shall pay the Fees specified in the Order Form. Fees are typically in the range of £2,000 to £5,000 per month depending on the scope and complexity of Services, target lead volumes, and quota paths (MQL/SQL mix), as customised in the Order Form.

5.2 Payment Terms

  • (a)Fees are payable monthly in advance on or before the first day of each Subscription Period;
  • (b)Payment shall be made by bank transfer, direct debit, or other method agreed in writing;
  • (c)All Fees are exclusive of VAT, which shall be added at the prevailing rate where applicable;
  • (d)Invoices are due within 7 days of the invoice date unless otherwise agreed in writing.

5.3 Late Payment

If any sum payable under this Agreement is not paid by the due date:

  • (a)We may charge interest on the overdue amount at the rate of 4% per annum above the Bank of England base rate from the due date until payment is received in full (both before and after any judgment);
  • (b)We may suspend the Services until payment is received; and
  • (c)We may terminate this Agreement in accordance with Clause 3.3(a).

5.4 No Refunds

Fees paid are non-refundable. The sole and exclusive remedy for failure to meet the Minimum Lead Quota is the Performance Guarantee remedy set out in Clause 6.3. No refunds, chargebacks, or other payment reversals shall be available except as expressly provided in Clause 6.3.

5.5 Fee Increases

We may increase the Fees on not less than 60 days' written notice. If the Client does not accept the increase, the Client may terminate this Agreement in accordance with Clause 3.2.

6 PERFORMANCE GUARANTEE

6.1 Minimum Lead Quota

Subject to Clause 6.3(d), we guarantee to deliver the Minimum Lead Quota per Subscription Period as specified in the Order Form, which may include flexible quota paths such as:

  • (i)12 Marketing-Qualified Leads (MQLs) and 5 Sales-Qualified Leads (SQLs) per month; or
  • (ii)15 Sales-Qualified Leads (SQLs) per month; or
  • (iii)Such other combination of MQLs and SQLs as agreed in the Order Form.

The Performance Guarantee applies from the third Subscription Period onward, following completion of the Ramp-Up Period.

6.2 Definition of Leads

(a) Marketing-Qualified Lead (MQL): A prospect who meets all of the following:

  • (i)ICP Match: The prospect's company operates in the Client's target sector(s) and meets the geographic, size, and other criteria specified in the ICP;
  • (ii)Contact Information Accuracy: We have verified contact details (email, phone, LinkedIn profile) with 90%+ accuracy;
  • (iii)Initial Engagement: The prospect has opened, clicked, or responded to outreach, or otherwise demonstrated awareness of the campaign.

(b) Sales-Qualified Lead (SQL): A prospect who meets all of the following:

  • (i)ICP Match: The prospect's company operates in the Client's target sector(s) and meets the geographic, size, and other criteria specified in the ICP;
  • (ii)Decision-Maker Contact: The prospect is a decision-maker or senior influencer in the relevant purchasing or operational function (e.g., Logistics Director, Supply Chain Manager, Operations Director, Procurement Manager, or equivalent);
  • (iii)Demonstrated Interest: The prospect has responded positively to outreach (e.g., expressed interest in a conversation, requested more information, agreed to a meeting, or otherwise engaged meaningfully with the campaign);
  • (iv)Qualified Response: The response indicates genuine commercial interest and is not a polite decline, out-of-office reply, or referral to a non-decision-maker without further engagement;
  • (v)BANT-Qualified: The prospect meets Budget, Authority, Need, and Timeline criteria based on engagement and information gathered during the qualification process (to the extent reasonably ascertainable through outreach).

6.3 Remedy for Shortfall

(a) If we fail to deliver the Minimum Lead Quota in any Subscription Period (after the Ramp-Up Period), we shall provide either (at the Client's election):

  • (i)Pro-rata credits applied to the next invoice equal to the value of the shortfall (calculated as: [shortfall leads / Minimum Lead Quota] × monthly Fees); or
  • (ii)Continue to provide the Services for up to one additional Subscription Period at no charge until the cumulative shortfall is made up,

whichever is the lesser remedy.

  • (b)The total free continuation period under (ii) shall not exceed one month in aggregate;
  • (c)This remedy is the sole and exclusive remedy for failure to meet the Minimum Lead Quota;

(d) The Performance Guarantee does not apply if the shortfall results from:

  • (i)The Client's failure to provide accurate ICP information or timely feedback;
  • (ii)The Client's breach of this Agreement;
  • (iii)Force Majeure events;
  • (iv)Factors outside our reasonable control, including material changes in the Client's target market or regulatory restrictions on outreach; or
  • (v)Material changes in outreach regulations, platform policies, or technical restrictions imposed by third-party platforms (e.g., LinkedIn connection limits, email deliverability changes, anti-spam filter updates).

6.4 Lead Quality Disputes

  • (a)If the Client disputes whether a delivered lead qualifies as an MQL or SQL, the Client must notify us in writing within 48 hours of delivery, providing specific reasons and evidence;
  • (b)We will review the dispute in good faith and provide a written response within 3 business days;
  • (c)If the parties cannot resolve the dispute, it will be escalated in accordance with Clause 15 (Dispute Resolution);
  • (d)Leads not disputed within the 48-hour period shall be deemed accepted as meeting the relevant qualification criteria.

7 COMPLIANCE AND LAWFUL USE

7.1 Our Compliance Obligations

We shall:

  • (a)Conduct all outreach activities in compliance with Data Protection Laws, including UK GDPR and PECR;
  • (b)Comply with sector-specific regulations applicable to the logistics industry, including data handling requirements and professional standards;
  • (c)Implement appropriate technical and organisational measures to ensure lawful processing of Personal Data;
  • (d)Maintain suppression lists and honour opt-out requests promptly;
  • (e)Use reasonable efforts to ensure outreach messages are not misleading and comply with applicable marketing and communications regulations.

7.2 Client Obligations

The Client shall:

  • (a)Ensure that its instructions to us and its use of the Services and leads comply with all applicable laws;
  • (b)Not use the Services for any unlawful, defamatory, harassing, or fraudulent purpose;
  • (c)Not provide or request that we target individuals or organisations in breach of any legal or regulatory restriction;
  • (d)Indemnify us against any claims, losses, or liabilities arising from the Client's breach of this Clause 7.2.

7.3 Anti-Spam Commitment

Both parties acknowledge the importance of compliance with anti-spam laws. We will not knowingly send unsolicited communications in breach of PECR or equivalent legislation.

8 CONFIDENTIALITY

8.1 Confidentiality Obligations

Each party shall:

  • (a)Keep confidential all Confidential Information received from the other party;
  • (b)Not disclose Confidential Information to third parties without prior written consent, except to employees, contractors, or professional advisers on a need-to-know basis under obligations of confidentiality;
  • (c)Use Confidential Information solely for the purposes of this Agreement.

8.2 Exceptions

The obligations in Clause 8.1 do not apply to information that:

  • (a)Is or becomes publicly available through no fault of the receiving party;
  • (b)Was already in the receiving party's possession without obligation of confidentiality;
  • (c)Is independently developed by the receiving party without use of the Confidential Information;
  • (d)Must be disclosed by law or court order (provided the receiving party gives prompt notice to the disclosing party where legally permitted).

8.3 Return of Information

Upon termination or at the disclosing party's request, the receiving party shall promptly return or destroy all Confidential Information and confirm such destruction in writing.

9 INTELLECTUAL PROPERTY

9.1 Our IP

All intellectual property rights in our AI tools, outreach templates, scripts, campaign frameworks, methodologies, software, and any materials created by us in the course of providing the Services (excluding Client-specific data) shall remain our exclusive property.

9.2 Client IP

All intellectual property rights in the Client's ICP specifications, branding, messaging, and any materials provided by the Client shall remain the Client's exclusive property.

9.3 MQL and SQL Data

All contact data, prospect information, and details relating to MQLs and SQLs delivered to the Client ("MQL and SQL Data") shall become the property of the Client upon delivery. We retain the right to use anonymised, aggregated data for internal analytics and service improvement.

9.4 Licence to Client

We grant the Client a non-exclusive, non-transferable licence to use any reports, dashboards, or materials provided under the Services solely for the Client's internal business purposes during the term of this Agreement.

9.5 Licence to Norden Leads

The Client grants us a non-exclusive licence to use the Client's branding, messaging, and ICP information solely for the purpose of delivering the Services.

10 LIMITATION OF LIABILITY

10.1 Excluded Losses

Neither party shall be liable to the other for any:

  • (a)Loss of profits, revenue, or business;
  • (b)Loss of anticipated savings;
  • (c)Loss of data (except as covered by Clause 10.4);
  • (d)Loss of goodwill or reputation; or
  • (e)Any indirect, consequential, special, or punitive losses,

whether arising from breach of contract, tort (including negligence), or otherwise, even if such loss was foreseeable or the party was advised of the possibility of such loss.

10.2 Cap on Liability

Subject to Clause 10.4, our total aggregate liability to the Client under or in connection with this Agreement (whether in contract, tort, including negligence, breach of statutory duty, or otherwise) shall not exceed the total Fees paid by the Client in the 6 months immediately preceding the event giving rise to the claim (or, if the Agreement has been in force for less than 6 months, the total Fees paid to date).

10.3 Client Cap

Subject to Clause 10.4, the Client's total aggregate liability to us under or in connection with this Agreement shall not exceed the total Fees payable under this Agreement in the 6-month period following the event giving rise to the claim.

10.4 Exceptions

Nothing in this Agreement shall limit or exclude either party's liability for:

  • (a)Death or personal injury caused by negligence;
  • (b)Fraud or fraudulent misrepresentation;
  • (c)Breach of obligations under Clause 11 (Data Protection) to the extent liability cannot be limited under Data Protection Laws;
  • (d)Wilful misconduct or gross negligence;
  • (e)Any other liability that cannot be limited or excluded by law.

10.5 Reasonable Care

We warrant that we will perform the Services with reasonable skill and care. This is the sole and exclusive warranty provided under this Agreement. All other warranties, whether express or implied by statute, common law, or otherwise (including warranties of merchantability, fitness for a particular purpose, or non-infringement) are excluded to the fullest extent permitted by law.

11 DATA PROTECTION

11.1 Data Processing Roles

For the purposes of Data Protection Laws:

  • (a)The Client is the data controller in respect of Personal Data relating to prospects, MQLs, and SQLs;
  • (b)We are a data processor acting on the Client's behalf when processing Personal Data as part of the Services.

11.2 Data Processing Addendum

The parties agree to the Data Processing Addendum set out in Schedule 1, which forms part of this Agreement and includes:

  • (a)Details of the nature, purpose, and duration of processing;
  • (b)Categories of Personal Data and data subjects;
  • (c)Security measures and sub-processor arrangements;
  • (d)Provisions regarding data subject rights, data breaches, and audits.

11.3 Our Obligations as Processor

We shall:

  • (a)Process Personal Data only on documented instructions from the Client (unless required by law);
  • (b)Ensure that persons authorised to process Personal Data are bound by confidentiality obligations;
  • (c)Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk;
  • (d)Assist the Client (at the Client's cost) in responding to data subject requests and complying with Data Protection Laws;
  • (e)Notify the Client without undue delay upon becoming aware of a personal data breach;
  • (f)Delete or return all Personal Data to the Client (at the Client's election) upon termination, unless retention is required by law.

11.4 Sub-Processors

We may engage third-party sub-processors (e.g., CRM providers, email service providers, data enrichment tools) to assist in delivering the Services. We shall:

  • (a)Maintain a list of sub-processors (as set out in Schedule 1 and updated from time to time);
  • (b)Impose data protection obligations on sub-processors substantially equivalent to those in this Agreement;
  • (c)Remain liable for the acts and omissions of sub-processors.

11.5 Client as Controller

The Client warrants that:

  • (a)It has a lawful basis under Data Protection Laws for instructing us to process Personal Data;
  • (b)It has provided (or will provide) any required privacy notices to data subjects;
  • (c)Its instructions to us comply with Data Protection Laws.

12 INDEMNITY

12.1 Client Indemnity

The Client shall indemnify, defend, and hold harmless Norden Leads, its officers, employees, and agents from and against any and all claims, liabilities, damages, losses, costs, and expenses (including reasonable legal fees) arising out of or in connection with:

  • (a)The Client's breach of this Agreement;
  • (b)The Client's use of the Services or leads in violation of applicable law;
  • (c)Any claim that the Client's ICP, messaging, branding, or instructions to us infringe third-party intellectual property rights or violate any law.

12.2 Our Indemnity

We shall indemnify the Client against any claims arising from:

  • (a)Our wilful breach of Data Protection Laws; or
  • (b)Our gross negligence or wilful misconduct in the delivery of the Services,

subject to the limitations in Clause 10.

13 FORCE MAJEURE

13.1 Neither party shall be liable for any failure or delay in performing its obligations under this Agreement (other than payment obligations) to the extent that such failure or delay is caused by events beyond its reasonable control, including acts of God, natural disasters, war, terrorism, pandemic, government restrictions, strikes, utility failures, or failures of third-party infrastructure.

13.2 If a Force Majeure event continues for more than 60 days, either party may terminate this Agreement on written notice without liability (other than for accrued obligations).

14 GENERAL PROVISIONS

14.1 Entire Agreement

This Agreement (comprising the Order Form, these Terms, and the DPA) constitutes the entire agreement between the parties and supersedes all prior discussions, representations, or agreements relating to its subject matter. Each party acknowledges it has not relied on any representation, warranty, or statement not expressly set out in this Agreement.

14.2 Variation

No variation of this Agreement shall be valid unless made in writing and signed by authorised representatives of both parties.

14.3 Waiver

No failure or delay by either party in exercising any right or remedy shall constitute a waiver, nor shall any single or partial exercise preclude further exercise of that or any other right.

14.4 Severability

If any provision of this Agreement is held to be invalid, illegal, or unenforceable, the remaining provisions shall remain in full force and effect.

14.5 Assignment

  • (a)The Client may not assign, transfer, or sub-contract any of its rights or obligations under this Agreement without our prior written consent;
  • (b)We may assign this Agreement to an affiliate or in connection with a merger, acquisition, or sale of business, provided such assignment does not materially adversely affect the Client's rights.

14.6 No Partnership

Nothing in this Agreement creates a partnership, joint venture, or agency relationship between the parties.

14.7 Third Party Rights

This Agreement does not confer any rights on third parties under the Contracts (Rights of Third Parties) Act 1999.

14.8 Notices

  • (a)Any notice under this Agreement must be in writing and delivered by email (with confirmation of receipt) or recorded delivery to the addresses specified in the Order Form;
  • (b)Notices shall be deemed received: if by email, on the date of transmission (if transmitted before 5pm on a business day, otherwise the next business day); if by recorded delivery, on the second business day after posting.

14.9 Counterparts

This Agreement (including the Order Form) may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one instrument.

15 DISPUTE RESOLUTION

15.1 Good Faith Negotiation

The parties shall attempt in good faith to resolve any dispute arising out of or relating to this Agreement through negotiation between senior representatives within 14 days of written notice of the dispute.

15.2 Mediation

If the dispute is not resolved by negotiation, the parties agree to attempt to settle it by mediation in accordance with the Centre for Effective Dispute Resolution (CEDR) Model Mediation Procedure before commencing litigation.

15.3 Continuing Obligations

During any dispute, both parties shall continue to perform their obligations under this Agreement to the extent possible.

16 GOVERNING LAW AND JURISDICTION

16.1 This Agreement and any dispute or claim arising out of or in connection with it (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of England and Wales.

16.2 The parties irrevocably agree that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this Agreement.

SCHEDULE 1

DATA PROCESSING ADDENDUM

This Data Processing Addendum ("DPA") forms part of the Agreement between Norden Leads Ltd (the "Processor") and the Client (the "Controller").

1 NATURE AND PURPOSE OF PROCESSING

The Processor shall process Personal Data on behalf of the Controller for the following purposes:

  • (a)Identification and targeting of prospects matching the Controller's Ideal Customer Profile in the UK and Ireland logistics sectors;
  • (b)Multichannel outreach campaigns (email, LinkedIn, telephone) to generate business leads;
  • (c)Lead qualification, follow-up, and nurturing activities;
  • (d)Reporting and analytics on campaign performance and lead generation metrics;
  • (e)CRM integration and data enrichment to support the Services.

2 DURATION OF PROCESSING

Processing shall commence on the Commencement Date and continue for the duration of the Agreement, plus 30 days post-termination to allow for data return, deletion, or retention as required by law.

3 TYPES OF PERSONAL DATA

The Processor may process the following categories of Personal Data:

  • (a)Contact Information: Names, job titles, business email addresses, business telephone numbers, LinkedIn profiles, company names and addresses;
  • (b)Professional Information: Job roles, seniority levels, departmental responsibility, industry sector, company size and revenue data;
  • (c)Engagement Data: Email open/click data, response history, meeting scheduling information, communication preferences;
  • (d)Qualification Data: Budget, authority, need, and timeline information gathered through outreach (to the extent disclosed by prospects).

4 CATEGORIES OF DATA SUBJECTS

Data subjects are business contacts in the logistics sector, including:

  • (a)Senior decision-makers and influencers in logistics, supply chain, warehousing, freight forwarding, and related roles;
  • (b)Employees of companies operating in the UK and Ireland logistics markets;
  • (c)Individuals in roles such as Logistics Director, Supply Chain Manager, Operations Director, Procurement Manager, and equivalent positions.

5 PROCESSOR OBLIGATIONS

The Processor shall:

  • (a)Process Personal Data only in accordance with documented instructions from the Controller (unless required by law to process otherwise, in which case the Processor shall inform the Controller before processing);
  • (b)Ensure that all personnel authorised to process Personal Data are subject to a duty of confidentiality;
  • (c)Implement and maintain appropriate technical and organisational measures as described in Section 6 below;
  • (d)Assist the Controller (at the Controller's cost) in responding to data subject rights requests (access, rectification, erasure, restriction, portability, objection);
  • (e)Assist the Controller in ensuring compliance with obligations relating to security, breach notification, and data protection impact assessments;
  • (f)At the Controller's election, delete or return all Personal Data upon termination of the Agreement (unless EU or UK law requires continued storage);
  • (g)Make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for audits as specified in Section 8.

6 SECURITY MEASURES

The Processor shall implement appropriate technical and organisational measures, including:

  • (a)Encryption: Encryption of Personal Data in transit (TLS 1.2 or higher) and at rest where technically feasible;
  • (b)Access Controls: Role-based access controls ensuring only authorised personnel can access Personal Data on a need-to-know basis;
  • (c)Authentication: Multi-factor authentication for system access;
  • (d)Monitoring: Logging and monitoring of access to systems processing Personal Data;
  • (e)Incident Response: Documented procedures for detecting, investigating, and responding to personal data breaches;
  • (f)Staff Training: Regular data protection and security training for personnel handling Personal Data;
  • (g)Vulnerability Management: Regular security testing and patching of systems;
  • (h)Physical Security: Secure data centres with appropriate environmental and physical access controls (where applicable).

7 SUB-PROCESSORS

7.1 Authorised Sub-Processors

The Controller grants general authorisation for the Processor to engage the following categories of sub-processors:

  • (a)CRM and Database Providers: e.g., HubSpot, Salesforce, Pipedrive (for lead management and storage);
  • (b)Email Service Providers: e.g., Mailchimp, SendGrid, Amazon SES (for email campaign delivery);
  • (c)Data Enrichment and Verification Services: e.g., Apollo, ZoomInfo, Clearbit (for prospect data enrichment and contact verification);
  • (d)Communication Platforms: e.g., LinkedIn Sales Navigator, Aircall (for outreach activities);
  • (e)Cloud Infrastructure Providers: e.g., Amazon Web Services, Microsoft Azure, Google Cloud Platform (for hosting and data processing);
  • (f)Analytics and Reporting Tools: e.g., Google Analytics, Mixpanel (for campaign performance tracking).

7.2 Sub-Processor Obligations

The Processor shall:

  • (a)Enter into a written contract with each sub-processor imposing data protection obligations substantially equivalent to those in this DPA;
  • (b)Remain fully liable to the Controller for the performance of any sub-processor's obligations;
  • (c)Maintain an up-to-date list of sub-processors, available to the Controller on request;
  • (d)Notify the Controller of any intended changes to sub-processors (additions or replacements) with at least 30 days' notice, giving the Controller the opportunity to object on reasonable data protection grounds.

7.3 Objection to Sub-Processors

If the Controller objects to a new sub-processor on reasonable data protection grounds, the parties shall discuss alternative solutions in good faith. If no resolution is reached, the Controller may terminate the affected Services on 30 days' notice without penalty.

8 AUDITS AND INSPECTION

8.1 Audit Rights

The Controller may, at its own cost, conduct an audit of the Processor's compliance with this DPA:

  • (a)No more than once per calendar year (unless required by a supervisory authority or in response to a data breach);
  • (b)Upon at least 30 days' prior written notice;
  • (c)During normal business hours and in a manner that does not unreasonably disrupt the Processor's operations;
  • (d)Subject to execution of a reasonable confidentiality agreement.

8.2 Audit Scope

Audits may include:

  • (a)Review of the Processor's policies, procedures, and security documentation;
  • (b)Inspection of relevant systems and facilities (where feasible);
  • (c)Review of security certifications (e.g., ISO 27001, SOC 2 reports where available).

The Processor shall provide reasonable assistance during the audit.

8.3 Audit Costs

The Controller shall bear all costs associated with audits, including any reasonable costs incurred by the Processor in facilitating the audit.

9 DATA BREACH NOTIFICATION

9.1 The Processor shall notify the Controller without undue delay (and in any event within 24 hours) upon becoming aware of a personal data breach affecting the Controller's Personal Data.

9.2 The notification shall include, to the extent known:

  • (a)The nature of the breach, including categories and approximate number of data subjects and records affected;
  • (b)The likely consequences of the breach;
  • (c)Measures taken or proposed to address the breach and mitigate its effects.

9.3 The Processor shall provide reasonable assistance to the Controller in investigating and remediating the breach, and in meeting any notification obligations to supervisory authorities or data subjects.

10 DATA SUBJECT RIGHTS

10.1 The Processor shall, at the Controller's cost, provide reasonable assistance to the Controller in responding to requests from data subjects exercising their rights under Data Protection Laws (including rights of access, rectification, erasure, restriction, portability, and objection).

10.2 If the Processor receives a data subject request directly, it shall promptly forward the request to the Controller and shall not respond without the Controller's prior written instructions.

11 INTERNATIONAL TRANSFERS

11.1 The Processor shall not transfer Personal Data outside the United Kingdom or to countries without an adequacy decision under UK GDPR without the prior written consent of the Controller or appropriate safeguards in place (e.g., UK Standard Contractual Clauses).

11.2 If international transfers are authorised, the Processor shall ensure that appropriate safeguards are in place (such as Standard Contractual Clauses, adequacy decisions, or other mechanisms approved under UK GDPR).

12 DELETION AND RETURN OF DATA

12.1 Upon termination of the Agreement, the Processor shall (at the Controller's election):

  • (a)Delete all Personal Data and existing copies (unless storage is required by UK or EU law); or
  • (b)Return all Personal Data to the Controller in a commonly used, machine-readable format.

12.2 The Processor shall provide written certification of deletion or return within 30 days of termination.

12.3 The Processor may retain Personal Data to the extent required by applicable law, provided such data is securely isolated and protected, and is only processed as necessary to comply with legal obligations.

DPA ACCEPTANCE

By signing the Order Form that references these Terms and Conditions (including this DPA), both parties agree to be bound by this Data Processing Addendum.

ACCEPTANCE

By signing the Order Form that references these Terms and Conditions, the Client confirms it has read, understood, and agrees to be bound by this Agreement (including Schedule 1).

ORDER FORM CUSTOMISATION PLACEHOLDERS

When completing the Order Form, specify:

Monthly Fees: £[AMOUNT] per month (typically £2,000–£5,000)
Minimum Lead Quota: [NUMBER] MQLs and [NUMBER] SQLs per month (e.g., "12 MQLs and 5 SQLs" or "15 SQLs")
ICP Specifications: [Target sectors, company size, geography, decision-maker roles, exclusions]
CRM Integration: [Platform name and integration requirements]
Reporting Frequency: [Weekly/monthly/as agreed]
Primary Contact: [Client contact name, email, phone]
Contract Start Date: [Commencement Date]
Custom Terms: [Any specific variations, additional services, or special provisions]

Company Information

Norden Leads Ltd

Registered Office: Clovelly House, 7 Eversley Park, Chester, CH2 2AJ

Company Number: 16890573

Email: [email protected]

Website: nordenleads.com

Last updated: January 1, 2026

For questions about these terms, please contact us at [email protected]