Terms & Conditions

DATA AND SERVICES TERMS AND CONDITIONS

1. DEFINITIONS

1.1 The following terms shall, unless the context requires otherwise, have the following meanings.

Agreement means the Order Form and these terms and conditions.

Business Day means a day other than a Saturday, Sunday or public holiday in England when banks in London are open for business.

Cardwell means Cardwell Marketing Limited incorporated and registered in England and Wales with company number 04966074 whose registered office is at 62 Anchorage Road, Sutton Coldfield, England B74 2PG.

Cardwell Data means Data owned or licensed by Cardwell.

Client means the entity identified as such on the Order Form.

Client Consolidated Data means the single database in any form generated, maintained and held by Client which includes Data.

Client Data means any database of business names, telephone numbers, addresses, and other related information, owned by Client or licensed to Client by a third party other than Cardwell or ML. For the avoidance of doubt, Client Data shall include any data specifically procured by Cardwell on behalf of the Client pursuant to this Agreement.

Commencement Date means the Service and/or Data delivery date, or the date the Order Form is signed by Client, whichever is earlier.

Control means the ability to direct the affairs of another whether by means of voting or contractual rights or otherwise and whether directly or indirectly and “change of control” shall be construed accordingly.

Data means records of businesses contained in ML Data and/or Cardwell Data.

Data Fields means the specific pieces of information that may comprise the Data. The types of Data Fields may be set out on the Order Form.

Data Protection Requirements means: (i) the Data Protection Act 1998 or the General Data Protection Regulation (EU) 2016/679, whichever is in force in the UK at the relevant time; (ii) the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426); and/or (iii) all applicable laws and regulations relating to the processing of personal data and privacy and the equivalent of any of the foregoing in any relevant jurisdiction, all as amended, extended, reenacted or replaced from time to time.

Direct Marketing means any form of marketing by telephone, fax, direct mail, market research or use of circulation list, which is aimed at a target market and is carried out by Client, or on Client’s behalf by a third party (other than a Restricted Company), provided always that any Direct Marketing carried out by a third party on behalf of Client using the Data shall be on terms not less onerous than this Agreement. For the avoidance of doubt, Direct Marketing shall include Profiling and any other pre-sales activities that support Direct Marketing, conducted by Client or on Client’s behalf, but shall exclude any form of publishing of Data.

Emails means the email addresses contained in the Data, and Email shall be construed accordingly.

Force Majeure means any events, circumstances or causes beyond the party’s reasonable control including
accidents, fires, explosions and (when the party affected is Cardwell and/or any ML Group company or any affiliate of the foregoing) any legislation, order or regulation which materially restricts the licensing of the Data to Client.

Intellectual Property Rights means all copyright, database rights, trade marks, domain names, moral rights, patents and rights in inventions, rights in confidential information and any other similar or equivalent rights or forms of protection in any part of the world, in each case whether registered or unregistered.

ML means Market Location Ltd incorporated and registered in England and Wales with company number 01864009 whose registered office is at Rossmore House, Newbold Terrace, Leamington Spa, Warwickshire, CV32 4EA.

ML Data means any Data owned or licensed by ML.

ML Group means ML, any subsidiary or holding company from time to time and any subsidiary from time to time of a holding company of ML. For this purpose, a “subsidiary” and “holding company” have the meaning set out in section 1159 of the Companies Act 2006.

Order Total means the amount specified as such on the Order Form.

Profiling means profiling, analysis, research and reporting of Client Consolidated Data and/or Client Data.

Restricted Company means any company that is included in ML Restricted Companies list from time to time, as provided by Cardwell to Client from time to time and available upon request. The meaning of Restricted Company extends to such company’s holding company or subsidiaries and the subsidiaries of its holding company.

Services means the services specified on the Order Form.

Suppression Data means Data relating to live businesses who have indicated a wish not to receive marketing material from third parties.

Term means the duration of this Agreement as determined in accordance with clause 2.

Updates means the Data as amended or updated by changing, adding or deleting Data Fields.

Usage means the single-use or a period of use of the Data permitted under this Agreement, as set out on the Order Form (if any).

1.2 In this Agreement unless the context otherwise requires:

1.2.1 data subject, personal data and processing shall bear the meanings given to those terms in the Data Protection Requirements;

1.2.2 a reference to a statute or statutory provision is a reference to it as amended, extended or re-enacted from time to time;

1.2.3 the singular includes the plural and vice versa;

1.2.4 any words following the terms “including”, “include”, “in particular” or “for example” or any similar phrase shall be construed as illustrative and shall not limit the generality of the related general words; and

1.2.5 references to a party or parties shall be the parties to this Agreement.

2. TERM

This Agreement shall commence on the Commencement Date and shall continue in effect until the later of the end of the Usage, or the date the last Service is performed under this Agreement, when it shall expire automatically, unless terminated earlier in accordance with clause 10, or unless:

2.1 Client continues to use the Data beyond the Usage; or

2.2 Client fails to comply with clause 11.3.2 (destruction of data on termination) and/or clause 11.3.5 (certification of destruction of data), in each such case and without prejudice to Cardwell’s other rights, the Agreement shall be extended automatically for 12 months period(s) and Cardwell may charge Client an appropriate fee upon each such extension.

3. DATA AND SERVICES

3.1 Cardwell hereby grants to Client a non-exclusive, nontransferable and non-sublicensable licence to combine Data supplied under this Agreement with other data that Client is entitled to hold to generate Client Consolidated Data which Client may use (excluding the Suppression Data) for its own Direct Marketing purposes only.

3.2 Client shall not use or supply any Data for any purpose except as expressly permitted by this Agreement. In particular, but without limitation, Client shall not supply any Data to any third party (including any companies in the same group of companies as Client) for any purpose.

3.3 Client hereby agrees not to send more than twelve (12) communications to any Email in any consecutive twelve (12) month period and/or send more than four (4) communications to any Email in any one calendar month.

3.4 Client shall ensure that Data are identifiable and capable of being extracted from Client Consolidated Data at all times, by being clearly and unambiguously flagged or marked.

3.5 Client shall only make copies of Data to the extent reasonably necessary for back-up, mirroring (and similar availability enhancement techniques), security, disaster recovery and testing purposes. Hosting by a third party is subject to ML approval and restricted to being hosted only within the UK, unless hosting outside the UK is in accordance with the applicable Data Protection Requirements.

3.6 Client hereby grants Cardwell and ML permission to contact and verify Client Data.

4. DELIVERY

4.1 Cardwell shall deliver the Services, the Data and the Updates (if any) to Client as specified on the Order Form. Any such dates shall be estimates only and time for performance by Cardwell shall not be of the essence of this Agreement.

4.2 Client acknowledges that not each record in the Data contains all the Data Fields, however, Cardwell will use reasonable endeavours to ensure that Client has as many of those Data Fields as exist in relation to each business.

4.3 Cardwell shall: (a) use reasonable endeavours to provide the Services in accordance with this Agreement in all material respects; (b) use reasonable skill and care in the provision of the Services; and (c) use reasonable endeavours to meet any performance and/or delivery dates specified on the Order Form. Any delivery dates are approximate only, and the time of delivery is not of essence.

5. PAYMENT

5.1 Client shall pay to Cardwell the Order Total as set out on the Order Form. Any delay in payment of sums beyond 30 days from the due date shall result in the sum bearing interest at the rate of 4% above the base rate from time to time of the Royal Bank of Scotland.

5.2 Without prejudice to clause 10.1.3, in the event Client fails to make any payment under this Agreement by its due date, Cardwell shall be entitled to suspend the delivery of the Data, Updates and/or the provision of the Services.

6. CLIENT OBLIGATIONS

6.1 Client shall comply with the DMA (Direct Marketing Association) Code of Practice when it uses any Data for Direct Marketing purposes.

6.2 Client shall notify ML in writing immediately upon the occurrence of a change of control of Client or Client’s holding company.

6.3 Client shall keep, in paper and electronic form, at its normal place of business detailed, accurate and up-todate records sufficient to enable Cardwell to verify Client’s compliance with the provisions in this Agreement relating to Data and Services (clause 3), Data Protection (clause 7), Intellectual Property (clause 8) and Confidentiality (clause 9).

6.4 Client shall, on reasonable written notice in advance, allow Cardwell and/or ML, and any auditors or other advisors to Cardwell and/or ML, to access any of Client’s premises, personnel, relevant records and systems as may be reasonably required to verify Client’s compliance with the provisions referred to in clause 6.3 (provided that Client may redact commercially sensitive information in the relevant records), and shall provide Cardwell and/or ML with all reasonable co-operation and assistance. Cardwell and/or ML shall use its reasonable endeavours to not unreasonably disturb Client during any such verification process.

6.5 Cardwell’s and ML’s rights under clause 6.4 shall continue for two years after termination of this Agreement. Any costs of verification carried out under clause 6.4 shall be borne by Cardwell and ML (as applicable) unless the verification reveals a material failure by Client to comply with the provisions of this Agreement in which case Client shall reimburse Cardwell and/or ML (as applicable) for its costs on demand.

6.6 Notwithstanding any other provision of the Agreement failure by Client to comply fully with this clause 6 will entitle Cardwell without prejudice to its other rights to terminate the Agreement with immediate effect.

7. DATA PROTECTION

7.1 Client acknowledges that the Data may include personal data and that in accordance with the Data Protection Requirements, each of Cardwell and/or ML (as applicable) and Client shall act as data controller in respect of such personal data, as, without prejudice to the terms of this Agreement, they will each separately determine the purposes for which and the manner in which such data is processed. For the avoidance of doubt, Client shall not be processing any personal data on behalf of ML and/or Cardwell under this Agreement.

7.2 To the extent Cardwell processes any personal data on behalf of Client in the performance of the Services under this Agreement, the Data Processing Schedule shall apply.

7.3 Each party shall at all times comply with the Data Protection Requirements in relation to the Data.

7.4 If Client receives any complaint, notice or communication that relates directly or indirectly to the processing of the Data or to either party’s compliance with Data Protection Requirements (as it relates to the Data), it shall immediately notify Cardwell and provide full details and copies of any communication. Client shall use reasonable endeavours to work with Cardwell to remedy the situation, including, if requested by Cardwell and/or ML, suppressing the data in question from any further use.

7.5 Client shall indemnify on demand Cardwell for any cost, claim or expense arising as a result of Client: (a) breaching any of the Data Protection Requirements; or (b) causing Cardwell and/or ML to be in breach of any of the Data Protection Requirements.

8. INTELLECTUAL PROPERTY RIGHTS

8.1 Client acknowledges that all Intellectual Property Rights in the Data are the property of Cardwell, ML, ML Group or their affiliates or licensors, as the case may be, and Client shall have no rights in or to the Data other than the right to use it in accordance with the express terms of this Agreement.

8.2 Cardwell shall defend Client from and against any claim or action that the use by Client of Data (in accordance with this Agreement) infringes any UK Intellectual Property Right of a third party (IPR Claim) and shall be responsible for any losses, damages, costs (including all legal charges) and expenses incurred by or awarded against Client as a result of, or in connection with, any such IPR Claim, provided that, if any third party makes an IPR Claim, or notifies an intention to make an IPR Claim against Client, Client shall: (i) give written notice of the IPR Claim to Cardwell as soon as reasonably practicable; (ii) not make any admission of liability in relation to the IPR Claim without the prior written consent of Cardwell; (iii) at Cardwell’s request and expense, allow Cardwell to conduct the defence of the IPR Claim including settlement; and (iv) at Cardwell’s expense, co-operate and assist to a reasonable extent with Cardwell’s defence of the IPR Claim. This clause 8.2 constitutes Client’s sole and exclusive remedy and Cardwell’s only liability in respect of IPR Claims.

9. CONFIDENTIALITY

Neither of the parties hereto shall publicise or disclose to any third party, during or after this Agreement is terminated, the subject matter or content of this Agreement without the prior written consent of the other (which shall not be unreasonably withheld or delayed), although the fact that Client uses the Data is not confidential information. The receiving party shall only disclose such confidential information to those of its employees, agents and subcontractors who need to know it for the purpose of discharging the receiving party’s rights and obligations under the Agreement, and shall ensure that such employees, agents and subcontractors comply with the obligations set out in this clause as though they were a party to the Agreement. The receiving party may also disclose such of the disclosing party’s confidential information as is required to be disclosed by law, any governmental or regulatory authority or by a court of competent jurisdiction.

10. TERMINATION

10.1 Without affecting any other right or remedy available to it, this Agreement may be terminated by Cardwell:

10.1.1 on giving at least 30 days’ prior written notice to Client in the event of any legislation, order or regulation which materially restricts the provision or licensing of the Data by Cardwell to Client; or

10.1.2 on giving at least 30 days’ prior written notice to Client in the event of a change of control of Client or of any holding company of the Client; or

10.1.3 on giving at least 14 days’ prior written notice if Client is late in paying any instalment of the Order Total.

10.2 Without affecting any other right or remedy available to it, this Agreement may be terminated by either party on giving written notice to the other if:

10.2.1 the other party commits a material breach of the Agreement (for example, but without limitation, any breach of clause 8 (Intellectual Property) or clause 9 (Confidentiality)) and (in the case of a breach capable of remedy) fails to remedy such breach within 30 days of written notice requesting the breach to be remedied; or

10.2.2 the other party is unable to pay its debts or enters into compulsory or voluntary liquidation (other than for the purpose of reconstruction or amalgamation of the company), or commences negotiations with its creditors with a view to rescheduling any of its debts or entering into any compromise or arrangement with its creditors (other than for the purpose of a scheme for a solvent amalgamation or solvent reconstruction), or has a receiver or manager or an administrator appointed of its assets or ceases for any reason to carry on business.

11. CONSEQUENCES OF TERMINATION

11.1 Termination, for any reason, or expiry of this Agreement shall not affect the accrued rights, remedies, obligations or liabilities of the parties existing at termination or expiry. Any provision of this Agreement which is expressed or intended to come into or continue in force after termination of this Agreement (including clauses 1.2.1, 3.2, 6, 7, 8, 9, 11 and 13) shall do so.

11.2 Upon any expiry or termination of this Agreement:

11.2.1 the rights granted under this Agreement shall immediately cease and terminate and Client shall immediately cease all use of the Data;

11.2.2 each party shall destroy all confidential information disclosed by the other party;

11.2.3 Client shall erase or destroy all Data, all copies of the Data and all material relating to the Data in all systems and data including Client Consolidated Data and all other material relating thereto. However, Client shall be entitled to retain its own records relating to any business that was already a customer of Client prior to the Commencement Date, or that has become a customer of Client during this Agreement;

11.2.4 each party shall settle all monies due and payable by it to the other at the date of termination; and

11.2.5 Client shall within 28 days of termination confirm to Cardwell in writing (signed by an officer) that it has fully complied with its obligations in clause 11.2.

12. WARRANTIES

12.1 Cardwell warrants that it has the right to grant to Client the licence of the Data as specified in this Agreement.

12.2 Cardwell will use reasonable commercial efforts to ensure that Data are as complete and accurate as reasonably possible. However, Client acknowledges that the completeness or accuracy of Data relies on periodic verification by ML and/or Cardwell and that Data may not be complete or accurate for a number of reasons including, but not limited to, if businesses are created or fail between such periodic verifications, or if businesses request that they are not included on the Data. Accordingly, Cardwell accepts no responsibility and does not warrant Data are accurate, complete, reliable, useful, fit for purpose or timely.

12.3 Except as expressly stated in this Agreement, all warranties, conditions and terms, whether express or implied by statute, common law or otherwise are hereby excluded to the extent permitted by law.
T&Cs Cardwell 281117

13. LIABILITY

13.1 Neither party excludes or limits liability to the other party for: (i) fraud or fraudulent misrepresentation; (ii) death or personal injury caused by negligence; (iii) in respect of Client’s liability to Cardwell, infringement of Intellectual Property Rights in the Data; (iv) misuse of confidential information; or (v) any matter in respect of which it would be unlawful for the parties to exclude liability.

13.2 Subject to clause 13.1, neither party shall in any circumstances be liable whether in contract, tort (including for negligence and breach of statutory duty howsoever arising), misrepresentation (whether innocent or negligent), restitution or otherwise, for (i) any loss (whether direct or indirect) of profits, business, business opportunities, revenue, turnover, reputation or goodwill; (ii) any loss or liability (whether direct or indirect) under or in relation to any other contract; (iii) loss (whether direct or indirect) of anticipated savings or wasted expenditure (including management time); (iv) any ex gratia payments; or (v) any indirect or consequential losses.

13.3 Subject to clause 13.1, either party’s total aggregate liability in contract, tort (including negligence and breach of statutory duty howsoever arising), misrepresentation (whether innocent or negligent), restitution or otherwise, arising out of or in connection with this Agreement shall be limited to the higher of the Order Total payable under the Agreement or £100,000.

13.4 Nothing in this clause 13 shall reduce or affect either party’s duty to pay any sums properly due and payable under this Agreement.

13.5 Client acknowledges that damages may not be an adequate remedy for the resulting losses suffered by Cardwell arising out of a breach of this Agreement and that Cardwell is entitled to injunctive relief in relation to any such breach or threat of such a breach.

13.6 Neither party shall be in breach of this Agreement nor liable for delay in performing, or failure to perform, any of its obligations under this Agreement if that delay or failure results from Force Majeure. In these circumstances the affected party shall be entitled to a reasonable extension of the time for performing its obligations, provided that, if the period of delay or nonperformance continues for three months, the party not affected may terminate this Agreement by giving 14 days’ written notice to the other party.

14. NOTICES

14.1 Any notice required to be given to a party under or in connection with this Agreement shall be in writing with proof of delivery and shall be delivered to the address for each party as set out on the Order Form, or as notified to the other party from time to time.

14.2 Notices under this Agreement shall be made by (a) first class prepaid mail, providing proof of delivery or postage; or (b) by hand or reputable courier, in either case addressed to the recipient at its notice address.

14.3 Any notice shall be deemed to have been received, if (a) made by mail, on the second Business Day after posting or at the time recorded by the delivery service; (b) delivered by hand or courier, on signature of a delivery receipt or at the time the notice is left at the proper address.

15. MISCELLANEOUS

15.1 Neither party is the agent nor representative of the other and neither party has any authority or power to bind or contract in the name of or to create any liability against the other in any way or for any purpose.

15.2 This Agreement constitutes the entire agreement between the parties and supersedes and extinguishes all previous agreements, promises, assurances,
warranties, representations and understandings between them, whether written or oral, relating to its subject matter. Each party agrees that it shall have no remedies in respect of any statement, representation, assurance or warranty (whether made innocently or negligently) that is not set out in this Agreement. Each party agrees that it shall have no claim for innocent or negligent misrepresentation or negligent misstatement based on any statement in this Agreement.

15.3 A waiver of any right or remedy is only effective if given in writing and shall not be deemed a waiver of any subsequent breach or default. A delay or failure to exercise, or the single or partial exercise of, any right or remedy shall not (a) waive that or any other right or remedy; or (b) prevent or restrict the further exercise of that or any other right or remedy.

15.4 If any court or competent authority finds that any provision of this Agreement (or part of any provision) is invalid, illegal or unenforceable, that provision or partprovision shall, to the extent required, be deemed to be deleted, and the validity and enforceability of the other provisions of this Agreement shall not be affected. If any invalid, unenforceable or illegal provision of this Agreement would be valid, enforceable and legal if some part of it were deleted, the parties shall negotiate in good faith to amend that provision so that, as amended, it is legal, valid and enforceable, and, to the greatest extent possible, achieves the parties’ original commercial intention.

15.5 The rights and remedies of the parties in connection herewith are cumulative and are not exclusive of any rights or remedies provided by law.

15.6 No provision of this Agreement may be varied without prior written agreement of both parties.

15.7 Client shall not be entitled to assign, sub-license, subcontract, charge or otherwise part with any of its rights or obligations arising under this Agreement.

15.8 Unless this Agreement expressly states otherwise, a person who is not a party to this Agreement shall not have any rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of this Agreement.

15.9 This Agreement shall be construed in accordance with and governed by the Laws of England and Wales and the parties hereto submit to the non-exclusive jurisdiction of the English Courts.

Schedule 1 DATA PROCESSING SCHEDULE

1. In so far as it relates to personal data processing by Cardwell on behalf of the Client in connection with the provision of the Services under this Agreement, where there is any inconsistency between the terms of this Schedule and any other term of this Agreement, the terms of this Schedule shall take precedence.

2. Client warrants that:

2.1 any personal data contained in Client Data has been collected and processed in accordance with the applicable Data Protection Requirements; and

2.2 it is entitled to appoint Cardwell (in compliance with the applicable Data Protection Requirements) to provide the Services which may include processing of personal data on behalf of Client.

3. To the extent Cardwell acts as data processor on behalf of Client under or in connection with the supply of the Services pursuant to this Agreement, Cardwell warrants that it shall:

3.1 only process personal data in accordance with the reasonable lawful instructions of the Client, including those set out in this Agreement;

3.2 implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks that are presented by processing (in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data), taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing of personal data, as well as the risk of varying likelihood and severity for the rights and freedoms of the data subjects;

3.3 ensure that access to personal data is limited to those employees who need access to such personal data to meet Cardwell’s obligations under this Agreement and that such employees shall respect and maintain the confidentiality and security of such personal data;

3.4 provide to Client, on request, a written description of the technical and organisational measures implemented pursuant to paragraph 3.2;

3.5 in the case of any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to the personal data arising from any act or omission of Cardwell or any of its sub-contractors (a “Security Breach”):

3.5.1 notify Client without undue delay and, where feasible, not later than 72 hours after having become aware of the Security Breach, unless the Security Breach is unlikely to result in a risk to the rights and freedoms of the data subjects (as reasonably determined by Cardwell); and

3.5.2 provide Client, on request, with such information and co-operation as may reasonably be required in relation to such Security Breach, provided that such notification and co-operation is required under applicable Data Protection Requirements.

3.6 promptly notify Client in writing if it receives:

3.6.1 any complaint, notice or communication from any supervisory or government body which relates directly to the processing of personal data or to either party’s compliance with applicable Data Protection Requirements; and

3.6.2 any request made by a data subject which relates to the personal data and is pursued in accordance with their rights under Data Protection Requirements, which may include any data subject request to know whether their personal data is being processed, for access to their personal data or for rectification, deletion or erasure of their personal data;

3.7 subject to paragraph 4, provide Client, on request, with such information and co-operation, as may reasonably be required in relation to any complaint, notice, communication or request which is notified to Client pursuant to paragraph 3.6;

3.8 subject to paragraph 4, provide to Client, on request, such other assistance as may reasonably be required by Client to comply with its own obligations under applicable Data Protection Requirements in relation to the Services; and

3.9 return or destroy (as directed in writing by Client) all personal data as soon as reasonably practicable upon termination of this Agreement, unless otherwise required by, and only to the extent necessary to comply with any applicable Data Protection Requirements.

4. Any assistance provided by Cardwell to Client pursuant to paragraphs 3.7 and 3.8 shall be subject to payment of a separate fee, as agreed between the parties.

5. Cardwell may subcontract its processing of personal data, provided that Cardwell shall make available to Client on request, a current list of those sub-contractors which are used by Cardwell in its performance of its obligations under this Agreement, and the purposes for which they are used.

6. By entering into this Agreement, Client is deemed to have approved the use of those sub-contractors set out in paragraph 17 (“Approved Sub-Contractors”). The rights afforded to Client in paragraph 7 shall not apply in relation to Approved Sub-Contractors.

7. Following the date of this Agreement:

7.1 Cardwell shall notify Client of its intention to appoint or use a new sub-contractor (which is not an Approved Sub-Contractor), or to use an Approved Sub-Contractor for a materially different purpose, prior to transferring, or continuing to transfer, any personal data to such subcontractor;

7.2 if Client has a reasonable basis to object to Cardwell’s use of such sub-contractor, and such objection directly relates to Client’s obligations under Data Protection Requirements, Client shall notify Cardwell promptly in writing within 10 Business Days after receipt of Cardwell’s notice;

7.3 if Client makes an objection in accordance with the requirements of paragraph 7.2, Cardwell will use reasonable efforts to make available to Client an alternative solution or arrangement to avoid the processing of personal data by the relevant subcontractor, provided that:

7.3.1 Cardwell shall not be required to implement an alternative solution or arrangement which unreasonably burdens Cardwell; and

7.3.2 Cardwell shall be entitled to make a reasonable charge to cover the costs of implementing and operating the alternative solution or arrangement;

7.4 if Cardwell is unable to make available an alternative solution or arrangement within a reasonable period of time (which shall not exceed 60 days) or Client is unwilling to pay any charge by Cardwell to cover the costs of implementing and operating the alternative solution or arrangement, Client may, by written notice to Cardwell:

7.4.1 discontinue its use of that part of the Service which is impacted by the Client’s objection; or

7.4.2 terminate the Agreement, but only in such circumstances as it is not technically possible to discontinue only part of the Service pursuant to paragraph 7.4.1, and in either case Client shall be entitled to receive a pro rata refund of any prepaid fees and other applicable charges for the period following the effective date of the relevant part of the Service being discontinued or termination (as applicable).

8. Cardwell shall procure that any sub-contractors engaged pursuant to paragraph 7 shall enter a written contract with Cardwell which contains obligations for the protection of personal data which are no less onerous than those set out in this Schedule.

9. Cardwell shall not be relieved from its obligations under this Agreement as a result of sub-contracting pursuant to paragraph 7.

10. Cardwell shall only transfer personal data to countries outside the European Economic Area, if it has provided appropriate safeguards, as required by the applicable Data Protection Requirements.

11. At Client’s reasonable request and subject to Client entering into adequate confidentiality agreements (as required by Cardwell), Cardwell shall:

11.1 make available to Client such information as may reasonably be necessary to demonstrate compliance with its obligations under this Schedule, including copies of any audit reports demonstrating compliance with paragraph 3.2; and

11.2 subject to the restrictions in paragraph 12 below, allow Client (or an independent, third-party professional auditor engaged by it) to conduct an audit, including inspection, of Cardwell’s processing of personal data pursuant to this Agreement.

12. When exercising its rights under paragraph 11.2 above, Client shall:

12.1 promptly provide Cardwell with information regarding any non-compliance discovered during the course of an audit;

12.2 conduct such audits during reasonable times and for a reasonable duration, which shall not unreasonably interfere with Cardwell’s day-to-day operations; and

12.3 if an audit requires the equivalent of more than one Business Day of time expended by one or more of Cardwell employees (or other personnel), Client agrees to reimburse Cardwell for any additional time expended at Cardwell’s then current professional services rates.

13. In relation to any sub-contractors that are engaged pursuant to paragraph 7, Client acknowledges and agrees that it is sufficient, for the purposes of satisfying the requirements of paragraph 8, that Cardwell has a right to audit those sub-contractors on behalf of Client, subject to reasonable restrictions.

14. Specification of processing:

14.1 Subject matter: the provision of Services specified on the Order Form

14.2 Duration: the Term of this Agreement;

14.3 Nature and purpose of processing: the provision of the Services in respect of Client Data and/or Client Consolidated Data;

14.4 Type of personal data: first and last name, title, position, organisation, business contact information (email, phone, business address);

14.5 Categories of data subjects: prospects, customers, business partners and vendors of Client who are natural persons, employees of contact persons of Client’s prospects, customers, business partners and vendors and Client’s employees authorised to communicate with Cardwell in connection with this Agreement.