Custromix CRM Terms and Conditions

1 Parties and formation

These Terms govern Custromix CRM and the services described in an accepted order form or subscription checkout record (“Order”). The supplier is CUSTROMIX LIMITED, company number 17414571, of 174 Hammersmith Road, London W6 7JP, United Kingdom. The customer (“Customer” or “you”) is the business identified in the Order. “We” and “us” mean CUSTROMIX LIMITED.

The person accepting confirms authority to bind the Customer. The agreement is formed by signature or an affirmative acceptance control presented with the agreement before purchase. Mere browsing does not create a paid subscription. We retain the accepted version and Order record and make them available to you. The service is offered for business purposes to adult authorised users; consumer purchases require separate arrangements and mandatory consumer rights are not displaced by a label.

2 Agreement documents and priority

The agreement comprises the Order, these Terms, the Data Processing Agreement (“DPA”) in Appendix 1, the operational schedules in Appendix 2, any applicable switching terms in Appendix 3, and any expressly agreed service-level agreement (“SLA”). “Customer Data” means information submitted, imported or generated on your behalf through the service, including your workspace content and AI outputs. “Customer Personal Data” means personal data processed on your behalf under the DPA.

Mandatory law and applicable mandatory transfer clauses prevail. The DPA prevails for personal-data processing, and Appendix 3 prevails for switching within its scope. A signed Order overrides another provision only where it expressly identifies the deviation, subject to those priorities. An SLA governs its stated service levels. The Privacy Policy provides transparency and is not consent or a substitute for the DPA. Roadmaps, demonstrations, prototypes and internal specifications are not binding feature commitments unless expressly incorporated into the Order.

3 Access and permitted use

During the paid or agreed trial term, you receive a non-exclusive right for authorised users to access the service for your internal business purposes within the purchased workspace, seat and usage limits. Contractors may use it for your business under your permissions and confidentiality controls. Resale, service-bureau provision or access for unrelated organisations requires written agreement. We retain all rights not expressly granted.

You designate administrators, keep account and billing contacts accurate, protect credentials, use available security controls appropriately and remove access promptly when no longer needed. Tell us promptly of suspected compromise. You are responsible for use you authorise and your users' compliance, but not for unauthorised activity to the extent caused by our breach. Disputes about control of a business workspace require appropriate evidence; we do not transfer control solely on an unsupported request.

4 Service scope and performance

Only the capabilities available in the agreed plan are included. These may include Records and Boards, communications, marketing and reporting, tasks, financial records, workflows and SAM assistance. Financial features do not provide a complete accounting, payroll, statutory-filing or regulated payment service. A recorded transaction does not itself move money or prove settlement.

We provide the service with reasonable care and skill and materially in accordance with its agreed description. Support is available at support@custromix.com. Coverage, response guarantees, uptime and recovery targets apply only where expressly agreed; no numerical SLA is implied. Notify us of a material failure with sufficient details so we can investigate and remedy it. Obligations in the DPA and Appendix 2 apply independently of any numerical SLA.

We may maintain and improve the service. We give at least 30 days' notice of a material adverse reduction in core subscribed functionality where practicable, or as much notice as possible where law, security or a third-party restriction requires earlier action. If we cannot provide a reasonable equivalent and the reduction materially impairs the agreed service, you may terminate the affected service before the change, or within 30 days after notice of an urgent change, and receive a refund of prepaid fees for its unused term. Other available remedies remain subject to the agreement.

5 Your information and instructions

You must have the rights and lawful authority to supply Customer Data, connect accounts and instruct the processing and communications you request. Give individuals the required information and establish the necessary lawful bases and permissions. Check imports, field mappings and record links before relying on them. A template, status flag or reminder does not certify legal or sector compliance.

Your instructions cannot authorise an unlawful use or override our DPA, security duties or another person's rights. We may seek clarification, decline an unlawful instruction and pause affected processing as necessary. We will explain the reason where lawful and work with you on a lawful alternative. Our own statutory responsibilities remain ours.

6 AI output and ownership

SAM can generate explanations, summaries, classifications, recommendations, content, extracted fields and proposed actions. Outputs can be wrong, incomplete, biased or unsuitable. Review them before publication, financial reliance or another consequential use. They are not professional legal, tax, accounting, medical or investment advice. No business result, revenue, conversion, ranking or saving is guaranteed.

You retain your rights in Customer Data. As between the parties, to the extent legally available, we assign to you any rights we hold in output generated specifically for you, excluding our pre-existing materials, software and third-party materials. Where assignment is unavailable, we grant the rights we can lawfully grant for your business use. This does not create exclusive rights in similar outputs produced for others or guarantee copyright protection or non-infringement. You must assess third-party rights before using output. Our service and platform materials remain ours or our licensors'.

We may process Customer Data only as needed to provide, secure and support the service under the agreement and your documented instructions. The standard agreement does not permit sale of Customer Data, advertising profiling across customers, or training of general-purpose models using it. Use of truly anonymous statistics must prevent identification or reasonable re-identification and must not disclose your confidential information. Pseudonymised information remains protected Customer Data.

7 Automation authority and approvals

An authorised user may activate a supported automation policy defining its owner, trigger, permitted actions, data scope, limits, required approvals and stop conditions. Activation authorises only those defined actions on the approved events or schedule. A prompt does not expand access permissions, and SAM cannot authorise its own high-impact proposal.

Low-risk internal actions may execute automatically within an active policy. External messages, publishing, financial changes, destructive actions, advertising control and critical-record changes require the human approval enforced for the released capability. A prototype or future capability is not enabled by these Terms. Approval must cover the final material payload; material changes require renewed approval. Permissions must be checked again at execution and after a paused run resumes.

You must review policies, approvers, recipients and limits before activation and monitor results. Supported pause and revoke controls stop future work to the extent technically possible; they cannot necessarily recall a delivered message or undo a completed external action. Retrying a failed workflow must not knowingly duplicate an action already completed. We may pause unsafe or malfunctioning automation and provide notice of material disruption where practicable. Your approval or use of AI does not excuse our failure of an agreed control.

8 Connected services

Connect only accounts you control or are authorised to use. Third-party terms, permissions, rate limits and separately disclosed charges may apply. Integrations can require reauthorisation or change when a provider changes or withdraws access. We use reasonable care in our integration but do not guarantee an independent provider's availability. We disclose material known limitations and any available fallback.

Disconnecting stops future access through the connection as the relevant controls provide; it does not automatically delete already imported records, revoke every permission at the source or recall delivered content. Use the provider's revocation controls where required. Our responsibility for providers we appoint as subprocessors remains governed by the DPA and is not excluded by this clause. We must meet any applicable third-party restricted-data or limited-use obligations for integrations we release.

8A Connected websites stores and performance reporting

Where released and included in your plan, supported website, store, analytics and sales-link connections let Custromix display your sales and traffic reports. Connect only websites, stores and accounts you own or are authorised to manage. The categories of sales, visitor, Analytics and Search Console information processed are described in sections 3A to 3D of our Privacy Policy. Providing the connection is a documented processing instruction within the DPA; it is not blanket consent from buyers or visitors.

Website Performance reads sales information for reporting and does not create, amend, refund or delete orders in your store. Where supported and authorised, it can create the event-notification subscriptions needed to receive order and refund updates and remove subscriptions it created when you disconnect. This limited connection setup does not authorise changes to the underlying orders. Provider delivery, rate limits and interruptions can delay updates; event notifications are not a guaranteed real-time service. We disable the connection, stop future imports and remove our notification subscriptions where the provider permits removal, promptly addressing or explaining any residual subscription that cannot be removed immediately.

The reporting-only restriction on store orders is separate from a supported Google setup action you expressly request. Creating, configuring or verifying Analytics or Search Console resources requires the additional disclosed authority and permissions for that action. A general report-reading connection does not provide them.

Figures can differ from the source because of synchronisation timing, refunds, cancellations, currency conversion, attribution definitions or information the provider does not supply. They are for operational information and are not a substitute for authoritative accounting or tax records. You must reconcile material decisions with the source records. Third-party terms also apply. Our responsibility for the integration, our own errors and agreed security controls remains governed by the agreement; a third party's involvement does not excuse our breach.

You can disconnect an available sales source at any time through the supported Custromix controls or request assistance from support. For Website Performance, disconnection stops future authorised source reads and triggers deletion of the imported order records and affected source-linked derivatives under Appendix 2. This specific rule takes priority over the general statement in clause 8 that disconnection does not automatically delete imported records. Removing a tracked website or deleting its workspace likewise triggers deletion of its visitor events. Export information you need before instructing deletion; lawfully required return and switching rights remain available. Disconnecting a reporting source does not delete orders in the original store or automatically erase separate lawful CRM records.

Before installing or activating the Custromix tracking code, you must give website visitors the required information and establish the necessary lawful basis, consent or applicable exemption and any required objection mechanism. Configure any consent-dependent collection to start only after valid consent and honour withdrawal or objections, including future events. Do not assume that a cookieless tracker is exempt from UK or EEA device-access or data-protection rules. Do not send prohibited or unnecessary personal information through URLs, campaign tags, event labels or ranking requests. We must provide the agreed information and controls and meet our own applicable duties; this clause does not transfer them to you.

9 Communications and reporting

You must lawfully obtain and record any necessary marketing permission, identify the sender accurately and honour objections, unsubscribe requests and suppression lists, including before queued sends. Do not send unlawful bulk messages or deceptive content, impersonate others or evade platform restrictions. AI authority does not override channel rules, messaging windows or template requirements. We may proportionately restrict affected sending to address abuse or a material legal or provider-policy risk.

Reports depend on their sources, periods, currencies, definitions and available evidence. Data can be incomplete, delayed or revised. First-touch attribution describes the selected attribution model and does not establish that a campaign caused a sale. Recommendations are advisory, not audited accounts or guaranteed forecasts. Check invoice details, tax treatment, bank details and payment status against authoritative records before acting. Changes to payment instructions should be independently verified.

10 Restricted uses

Do not use the service unlawfully; infringe privacy or intellectual property rights; introduce malicious code; bypass permissions, usage limits or safeguards; access another tenant; extract credentials; or use prompt injection or another technique to obtain unauthorised data or actions. Reverse-engineering restrictions apply only to the extent lawful. Security testing requires prior written agreement on scope and timing; responsible reports may be sent to support@custromix.com.

Unless separately approved in writing with appropriate safeguards, do not use the service for emergency or safety-critical operations, significant decisions about people made solely by automated processing, or processing special-category, criminal-offence or children's personal data. Prohibited AI practices remain prohibited regardless of customer approval. Do not use it for regulated financial, medical or other functions outside its agreed scope. Do not place passwords, API secrets, full payment-card credentials or card authentication values in ordinary records or prompts.

Each party must comply with AI laws applicable to its role. Where applicable, we must identify SAM as AI and provide required output marking or other provider safeguards. You must give required notices and retain required labels when deploying or publishing outputs, and ensure people supervising AI have appropriate competence. These obligations do not transfer our own provider or deployer duties to you.

11 Fees and usage

The Order identifies the price, currency, billing interval, seats, allowances, taxes, start date and any minimum term. Fees exclude VAT or similar transaction taxes unless stated otherwise. You pay those taxes where lawfully due; we remain responsible for taxes on our income. Subscription fees are payable in advance at the start of the billing period; an expressly agreed invoice arrangement is due within 14 calendar days of invoice unless the Order says otherwise.

Recurring card or account charges require affirmative authorisation at checkout or in the Order. Additional AI, messaging, storage, external-data or other usage rates must be disclosed and accepted before chargeable activation. There is no automatic paid overage solely because these Terms are accepted. We may queue or pause requests at disclosed limits and provide relevant usage information. Changes in a supplier's cost do not by themselves authorise an undisclosed mid-term charge.

Raise billing queries promptly with enough detail to investigate; doing so does not waive later legal rights. Pay undisputed amounts when due. We may suspend for an overdue undisputed amount only after written notice and at least 14 calendar days to cure. Any default interest must be separately agreed or lawfully available; this agreement does not impose an undisclosed penalty. No fee increase applies during a committed term without express agreement or a change required by law.

12 Term renewal and cancellation

The Order states the initial term. Unless it expressly states a longer commitment, the subscription is monthly. Automatic renewal applies only if the Order or checkout expressly discloses it and you affirmatively accept it. Without that acceptance, the subscription expires at the end of its agreed term. An accepted automatic renewal is for the same term unless the Order expressly provides otherwise.

You can stop renewal at any time before the next term starts through an available subscription control or by emailing support@custromix.com. Email cancellation is effective when received under clause 24, even if confirmation is delayed. We confirm receipt and the end date. Cancelling renewal does not end access before the current paid term ends. We give at least 30 days' reminder of an annual or longer renewal and at least 30 days' notice of a price increase before the affected renewal, so you can cancel before the increased charge.

Except where law, an Order or another clause requires otherwise, voluntary cancellation does not refund an already commenced paid term and unused allowances expire at term end. Credits or promotions have no cash value unless expressly stated. There is no automatic conversion of a free trial into a paid plan without separately disclosed and affirmatively accepted payment terms. Statutory rights and refunds for our breach remain unaffected.

13 Suspension and termination

Either party may terminate for a material breach not remedied within 30 calendar days after written notice describing it. A breach incapable of remedy may justify immediate termination. Non-payment follows clause 11. Termination because of insolvency or restructuring applies only where permitted by applicable law.

We may suspend the affected functionality where reasonably necessary for a material security threat, unlawful activity, misuse or overdue undisputed payment following the required notice. We use the least disruptive reasonable measure, notify and explain where lawful and safe, and restore access promptly after resolution. Suspension does not remove data-return, security or DPA duties. We do not suspend solely to avoid addressing a good-faith complaint.

If you terminate for our uncured material breach, or under an express refund provision, we refund prepaid fees for the unused affected term within 30 calendar days after termination. If we terminate for your breach, accrued properly due fees remain payable; no acceleration of every future fee is implied. Ordinary voluntary cancellation follows clause 12. Necessary confidentiality, intellectual-property, accrued-payment, liability, dispute and data-exit obligations survive termination.

14 Export and deletion

You may export supported Customer Data during the term and for 30 calendar days after expiry or termination, through available controls or a support-assisted secure export. We do not charge for a standard export. Available formats and material exclusions must be disclosed before purchase. Bespoke migration work requires a separate scope and price and must not obstruct mandatory switching or data-protection rights. Appendix 3 provides additional rights where applicable.

During the exit period, processing is limited to safe access, export, protection and agreed exit assistance; paid automation and external sends may be disabled. At your choice, we return and then delete, or delete, Customer Personal Data under the DPA. If you give no different lawful instruction, the default instruction is deletion after the export window. An earlier irreversible deletion instruction ends the affected recovery opportunity. We provide a deletion confirmation on request after the applicable cycles complete and explain any specific legally required residual retention.

The schedules in Appendix 2 govern service deletion, backups and provider-managed copies. Termination is not permission to retain raw Customer Data indefinitely for analytics, auditing or training. Necessary controller records described in the Privacy Policy are treated separately and must not become a substitute archive of workspace content.

15 Confidentiality

Each party protects the other's non-public business information with at least reasonable care, uses it only to perform or exercise rights under the agreement, and discloses it only to people who need it and are bound by confidentiality. Customer Data is confidential regardless of whether it is marked. Exceptions cover information lawfully public without breach, already lawfully known, independently developed without use of the confidential information, or received lawfully without restriction.

A legally compelled disclosure is limited to what is required, with prior notice where lawful and reasonable steps to protect confidentiality. These duties continue for five years after termination, and for trade secrets while they remain trade secrets; personal data remains protected for as long as it is held. Neither party may use the other's name, logo or customer story for publicity without prior written permission. Voluntary feedback may be used to improve the service without exposing Customer Data or confidential information.

16 Intellectual property complaints and indemnities

We will defend a third-party claim that the standard service we provide infringes a UK or EEA patent, copyright or trade mark, and pay damages or settlement amounts finally awarded or agreed by us, subject to clause 17. This does not cover a claim caused by your supplied material, unauthorised modification, use contrary to the agreement, or a combination not required or supplied by us where the infringement would not otherwise arise. AI-generated output is outside this specific indemnity unless expressly covered in an Order; that exclusion does not excuse our breach of another obligation.

If such a claim is likely, we may obtain continued rights or modify or replace the affected component with a materially equivalent one. If no reasonable solution is available, either party may terminate the affected service and we refund prepaid unused fees. This clause does not exclude remedies that cannot lawfully be excluded.

You will defend a third-party claim arising from Customer Data that you supplied in breach of third-party rights, or unlawful external communications you instructed in material breach of clause 9, and pay damages or settlement amounts finally awarded or agreed by you, subject to clause 17. You have no obligation to the extent caused by our breach, unauthorised use or modification. It is not an indemnity for every act of every user, every AI error or every regulatory fine.

The party seeking protection must give prompt notice, reasonable cooperation at the defending party's expense and control of the defence to that party. Delayed notice reduces protection only to the extent it materially prejudices the defence. No settlement may admit fault of, impose a non-monetary obligation on, or require payment from the protected party without its written consent, not unreasonably withheld. The protected party may participate with its own adviser at its own cost. There is no double recovery.

17 Liability

Nothing excludes or limits liability for fraud or fraudulent misrepresentation, death or personal injury caused by negligence, or any liability that cannot lawfully be excluded or limited. This includes liability for intentional misconduct or gross negligence wherever a restriction would be invalid under applicable mandatory law. The agreement does not restrict individuals' or regulators' statutory rights or statutory liability directly owed to them. Properly due payment obligations and express fee refunds are not damages and are not reduced by the damages caps below.

Subject to those exceptions, each party's total aggregate liability arising out of or connected with the agreement, in contract, tort including negligence, misrepresentation, indemnity or otherwise, is capped at the greater of GBP 1,000 and the fees paid or payable for the service during the 12 months preceding the first event giving rise to liability (“General Cap”). If the first event occurs during the first 12 months, the fee amount is the subscription fees committed for the first 12 months, annualising a monthly subscription at its then-current rate and excluding unpurchased optional usage. For a wholly free service the GBP 1,000 floor applies.

For breaches of confidentiality, breaches of data-protection or agreed security obligations, and the indemnities in clause 16, the total aggregate cap is instead the greater of GBP 10,000 and twice the General Cap (“Enhanced Cap”). Claims in the General Cap and Enhanced Cap categories combined cannot exceed the Enhanced Cap; claims subject only to the General Cap cannot exceed that cap. These are aggregate agreement caps, not separate caps per incident, claimant or renewal. Related events are treated as one event when the first occurred. Mandatory transfer-clause rights prevail where a cap would conflict with them.

To the extent lawful, neither party is liable for indirect or consequential loss. There is no blanket exclusion of every loss of profit, revenue or data regardless of whether it is direct. Reasonable direct costs of restoring affected Customer Data, investigating an incident, meeting applicable notification duties and obtaining substitute services are not excluded merely because they involve data or interruption; they remain subject to causation, mitigation and the applicable cap. A customer approval does not excuse our failure of an agreed permission or approval safeguard. Each party must take reasonable steps to mitigate loss. An unenforceable restriction applies only to the extent it can lawfully be enforced without rewriting the bargain.

18 Trial and beta features

A feature expressly identified as trial, beta, preview or experimental may change or be withdrawn and may be less reliable. We disclose the available scope, duration, permitted data and charges before activation. Do not use it as the sole basis for a critical operational process. Live personal data may be used only where the DPA and necessary safeguards cover the feature. A beta label does not remove confidentiality, security, data-protection duties or liabilities that cannot be limited.

19 Events beyond reasonable control

Neither party is liable for delay to the extent caused by an event outside its reasonable control that it could not reasonably prevent or mitigate. The affected party gives prompt notice and takes reasonable steps to resume performance. A supplier outage is not automatically excused if caused or prolonged by failure of agreed resilience or vendor-management measures. This clause does not excuse accrued payment or necessary data protection and confidentiality safeguards.

If material interruption continues for 30 consecutive calendar days, either party may terminate the affected service and we refund prepaid fees for its unused term. Data-return and deletion duties continue as far as lawfully and technically possible and are completed promptly once the impediment ends.

20 Changes to the agreement

We give at least 30 calendar days' notice of material changes. Material commercial changes apply at renewal unless expressly agreed earlier. An urgent legal or security change may apply sooner only to the necessary extent, with prompt notice. Changes are not retroactive and cannot be used to broaden Customer Data uses or reduce mandatory DPA protections by posting a new privacy notice.

If a necessary in-term change materially disadvantages you and you do not agree, you may terminate the affected service before it takes effect or, for an urgent change, within 30 days after notice, with a refund of unused prepaid fees. Continued use alone does not create consent to optional tracking, marketing, training or paid overages.

21 Assignment and subcontracting

Neither party may assign the agreement without the other's consent, not unreasonably withheld or delayed, except to a successor to substantially all of the relevant business that assumes the obligations and does not materially reduce the other party's protection. The assigning party gives advance notice where lawful. A transfer creating a material new security, confidentiality or legal risk must be addressed; if no reasonable protection is available, the affected customer may terminate with a refund of unused prepaid fees. Subcontracting does not relieve our responsibility, and subprocessors remain subject to the DPA.

22 General provisions

The parties are independent contractors and neither can bind the other. The agreement is the entire agreement on its subject, without excluding fraud or mandatory rights. A waiver must be express and applies only to the particular matter. If a provision is invalid, the remainder continues where legally possible. Neither party relies on a statement not incorporated into the agreement, subject to fraud and restrictions that cannot lawfully be excluded. No third party has a right to enforce it under the Contracts (Rights of Third Parties) Act 1999, except where mandatory transfer clauses or applicable law provide otherwise. Counterparts and electronic acceptance are permitted.

23 Law and disputes

The agreement and non-contractual obligations connected with it are governed by the law of England and Wales. Courts of England and Wales have exclusive jurisdiction, subject to mandatory law and any mandatory transfer-clause jurisdiction. EEA individuals' rights to complain to their supervisory authority or bring data-protection proceedings in an available forum are unaffected.

The parties first refer a business dispute to designated senior contacts for good-faith discussion for 30 calendar days after written escalation. This does not prevent urgent relief, preserve a claim beyond its limitation period or delay a statutory request or regulator notification. No mandatory arbitration is imposed.

24 Notices

Legal, cancellation and privacy notices to us may be sent to support@custromix.com or our registered office. We send notices to your designated administrator, billing or legal email as appropriate. You must keep these contacts current. A notice by email is received when it reaches the recipient's mail system without a delivery-failure message; the sender must retain reasonable evidence of sending and delivery. The date of actual receipt governs cancellation deadlines. Post is received on evidenced delivery. These rules do not govern service of court proceedings or alter statutory request deadlines.

Appendix 1 Customer Data Processing Agreement

This DPA forms part of the accepted agreement between CUSTROMIX LIMITED and the Customer identified in the Order. It applies whenever we process Customer Personal Data on your behalf and continues for as long as we hold it.

1 Definitions roles and scope

“Applicable Data Protection Law” means the UK GDPR, the Data Protection Act 2018 as amended, and the EU GDPR and relevant EEA implementing laws to the extent applicable to the processing. “Controller”, “processor”, “personal data”, “personal data breach” and related terms have their applicable statutory meanings. References to security, breach, assessment and assistance duties include the corresponding UK and EU GDPR provisions where applicable.

You act as controller or, where authorised by another controller, as processor; we act as your processor or subprocessor. Each party remains responsible for obligations that apply directly to it. Our separate controller activities are described in our Privacy Policy and do not enlarge our rights over Customer Personal Data.

The subject matter is operation, support and secure administration of your Custromix workspace. Processing includes collection, import, organisation, storage, retrieval, transmission, AI inference and extraction, authorised changes, export, restriction and deletion as needed for enabled features. Its purpose is to provide the agreed CRM and instructed workflows. Processing lasts for the service term and the limited exit and deletion periods in Appendix 2.

Data subjects can include customer representatives, users, staff, contractors, prospects, contacts, suppliers, buyers and website visitors, and people named in authorised business communications or records. Data categories include identity and business contact information, account identifiers and permissions, communications and business records, campaign and task information, receipt/invoice and transaction details, attachments, prompts and tool results, AI outputs and workflow/audit information. For connected performance features, categories also include order and purchase-event information, referral and campaign data, page and click events, device category, visit times, transient IP and browser information used to create daily visitor identifiers, the resulting protected identifiers, report data and connection identifiers. The minimisation and purpose limits in sections 3A to 3D of our Privacy Policy apply. Special-category, criminal-offence and children's data are excluded unless specifically agreed in writing with additional safeguards. Any customer-specific variation must identify its purpose, categories, duration and safeguards in the Order or an agreed processing annex.

2 Documented instructions

We process only on your documented instructions, including for international transfers, unless applicable law requires otherwise. The agreement, supported configuration, authorised user requests and written support instructions constitute instructions only within their lawful scope and permissions. Where law requires processing outside instructions, we inform you before processing unless prohibited on important public-interest grounds.

We immediately inform you if, in our opinion, an instruction infringes applicable data-protection law, and may suspend the affected instruction while clarification or a lawful alternative is arranged. We do not determine your unrelated business purposes, sell Customer Personal Data or use it to train general-purpose AI models. If we independently determine a new purpose and means contrary to this DPA, the relevant law determines our resulting role and responsibility; a contractual label does not avoid that responsibility.

3 Your responsibilities

You must have authority to instruct processing, provide required notices and establish the lawful basis and any additional conditions for your use. Configure access, minimise information supplied, keep records accurate and notify us of relevant restrictions. You may issue lawful instructions and exercise the information, assistance, return, deletion and audit rights in this DPA. If you act for another controller, you must pass through its lawful instructions and obtain any required subprocessor authorisation. Our obligations are not conditional on your performance where law requires otherwise.

4 Confidentiality and security

We ensure that anyone authorised to process Customer Personal Data is subject to confidentiality by contract or law, receives relevant instruction and accesses only what their duties require. This covers employees working in the Philippines as well as elsewhere. Access ends promptly when no longer authorised.

We implement the measures required by applicable Article 32 obligations and Appendix 2, taking account of the processing, risks, state of the art and implementation cost. We regularly assess and test effectiveness and may improve measures without materially reducing protection. You receive information reasonably necessary to assess the agreed measures. The contractual security schedule is not a claim that Custromix holds an unevidenced certification.

5 Subprocessors

You give general written authorisation only for subprocessors identified in the complete Service Processing Register supplied before processing begins, and replacements or additions introduced under this clause. We proactively provide and maintain the register with each relevant legal entity, address and contact details, service, purpose, data categories, processing and access locations, and applicable safeguards, and keep that information updated and readily available to you. Unlisted necessary providers must be identified and authorised before they receive Customer Personal Data; this clause is not blanket authorisation for an unknown vendor list.

We give at least 30 calendar days' notice of a proposed new or replacement subprocessor, allowing a reasoned data-protection objection before it begins processing. For an urgent change needed to address a security event or provider failure, we give as much prior notice as possible, explain the urgency and preserve the opportunity to object and obtain a remedy. We investigate a reasonable objection and seek an alternative or appropriate safeguard. If it cannot be resolved, you may terminate the affected service before the new processing begins, or promptly after an unavoidable urgent change, with a refund of unused prepaid fees.

We enter a written contract imposing equivalent applicable data-protection obligations, conduct appropriate due diligence and remain responsible to you for our subprocessors' performance of their data-protection obligations. Your independently selected integration is not excluded from assessment merely because you connected it; its actual role determines the arrangement. Direct employees of our legal entity are not separately appointed subprocessors.

6 Individual requests and complaints

Taking account of the processing, we provide appropriate technical and organisational assistance with rights requests and complaints. If we receive a request concerning Customer Personal Data, we notify your designated contact without undue delay and normally within five calendar days, sooner where necessary for the applicable deadline or risk. We do not substantively respond on your behalf without instructions unless law requires it.

We help locate, export, correct, restrict and delete relevant information, including information in prompts, shared logs and generated outputs, without disclosing another person's or tenant's information improperly. We maintain a process to identify the responsible controller and verify authority. We do not wait for a 30-day complaint acknowledgement deadline before escalating a time-sensitive request.

7 Personal data breaches

We notify your designated security or administrator contact without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and in any event within 24 hours. We do not delay initial notice until an investigation is complete. Notice is not an admission of liability.

To the extent available, we provide the nature of the breach, affected data and people, approximate volumes, likely consequences, containment and remediation measures, and a contact for follow-up. We provide missing details in phases without undue further delay, preserve relevant evidence and records, and reasonably assist with assessment, regulator and individual notifications and mitigation. We do not notify individuals on your behalf without instruction unless legally required. Our own direct notification duties remain unaffected.

8 Assessments and regulator cooperation

Taking account of the processing and information available to us, we assist with security obligations, breach notification, data protection impact assessments and required prior consultation with supervisory authorities. We cooperate with competent authorities as legally required. We notify you of a binding demand for Customer Personal Data where lawful, assess its validity, limit disclosure to what is required and seek appropriate protection where available. A request from an authority does not authorise an unrestricted voluntary disclosure.

9 International transfers

We make Customer Personal Data available outside the applicable UK or EEA protected transfer area only under documented instructions, with the required lawful transfer mechanism, assessment and supplementary protection. The register must distinguish hosting, inference, backups and remote access, rather than treating a hosting region as the answer for every flow.

Where required, the parties complete and execute the applicable unmodified EU Standard Contractual Clauses, UK Addendum or UK International Data Transfer Agreement, including the correct parties, modules, annexes, security measures, onward-transfer information and governing-law choices. A reference to those instruments alone does not establish that a particular transfer is covered. We do not start a transfer requiring an uncompleted instrument. Where an adequacy arrangement is relied on, we verify that it is current and covers the relevant recipient and activity. If protection becomes invalid or insufficient, we implement a lawful alternative or suspend the affected transfer.

Access by our direct employees in the Philippines is documented as access within the same legal entity, with appropriate security and legal assessment. It is not assumed to be a restricted transfer to a separate Philippine company. A change to a separate contractor or legal entity requires a new role, subprocessor and transfer assessment before access is given.

10 Return and deletion

At your choice after the service ends, we return Customer Personal Data in a usable agreed format and delete existing copies, or delete it, unless applicable law requires storage. The default exit instruction, timing and formats follow clause 14 of these Terms and Appendices 2 and 3, as applicable. We apply the instruction to records, attachments, prompts, tool contents, generated derivatives, active checkpoints, controlled replicas and backup systems, and instruct subprocessors as required by their relevant roles and lawful arrangements.

Backups awaiting expiry are protected and beyond ordinary use, with deletion reapplied on restoration. Provider-managed storage exceptions must be specifically identified in the verified schedule; a generic audit purpose or provider preference is not an indefinite exemption from deletion duties. Legally required retention is restricted, explained where lawful, reviewed and ended when the requirement expires. We provide reasonable evidence of completion on request and identify residual copies and their lawful deletion timetable.

11 Compliance information and audit

We make available information necessary to demonstrate compliance with this DPA and allow and contribute to audits and inspections by you or your appropriately confidential independent auditor. The parties first use relevant documentation, reports and reasonable remote assessment where sufficient. Ordinary audits use reasonable notice, normal working hours and safeguards for other customers and systems. On-site inspection remains available where necessary; urgency, a material incident, credible non-compliance or a regulator requirement may justify shorter notice or additional audit.

Routine scheduling and confidentiality cannot be used to defeat statutory audit rights. You pay your own auditor; any charge for our exceptional assistance must be reasonable and agreed in advance, and does not apply to correcting or verifying our material non-compliance or create an obstacle to a legally required audit. We remediate identified breaches under an agreed risk-based plan without delaying urgent containment.

12 Assistance costs liability and duration

Ordinary DPA compliance, standard exports and assistance needed because of our breach are included in the service fees. Exceptional bespoke assistance outside ordinary scope may be charged only at a reasonable rate agreed in advance; a price dispute must not delay a statutory deadline or mandatory duty. Contractual liability between the parties follows clause 17 of these Terms, subject to mandatory law and mandatory transfer-clause rights. Neither an agreement cap nor an indemnity limits the direct rights of individuals or regulators where law does not permit it.

This DPA continues until all Customer Personal Data is returned or deleted, apart from any specifically lawful residual retention, for which the relevant duties continue. Changes must preserve applicable mandatory protections and follow the agreement's change process. The Customer's Order contact and support@custromix.com are the initial operational privacy contacts unless a different contact is recorded.

Appendix 2 Retention Security and Processing Schedules

These schedules set contractual service requirements. The applicable Service Processing Register and export specification must be supplied with the service before live Customer Personal Data is processed. Customer-specific processing additions must be agreed in writing. No location, certification, payment provider or integration is implied merely by a template or vendor brand.

1 Service retention schedule

Times run from the relevant instruction or event described above. Verification must be proportionate and must not be used to delay a statutory deadline. A specifically required legal hold must identify its information, reason, access restriction, reviewer and end condition. Routine product analytics, model improvement or an indefinite audit trail are not legal holds.

2 Minimum security requirements

We must maintain the following measures appropriate to the risk throughout processing. More demanding requirements in an Order or mandatory transfer annex take priority.

• Enforce tenant, workspace, board, field and action permissions on the server at retrieval and execution, including log views, exports, background jobs and resumed AI runs. Test negative access cases and promptly revoke access after permission changes.
• Use individual workforce accounts, least privilege and multifactor authentication for privileged production and provider-console access. Review privileged access at least quarterly and promptly remove leavers' access. Overseas access must use managed or appropriately protected devices and an approved access method.
• Protect personal data in transit using current secure transport and at rest using appropriate encryption. Restrict access to encryption keys and secrets; store integration tokens outside ordinary business fields and prevent their exposure in prompts, client responses or customer-visible logs.
• Limit employee access to a documented service purpose. Record privileged access and investigate inappropriate access. Use confidentiality duties and privacy/security training. Production data must not be copied to development or personal systems without a documented lawful necessity and safeguards.
• Minimise AI payloads, apply permissions before content reaches a model, treat retrieved content as untrusted input and enforce tool authorisation independently of the model. Use human approval controls, execution limits, duplicate-action prevention and pause/revoke mechanisms.
• Maintain a documented vulnerability and patch process, secure change review, dependency management and proportionate security testing. Address critical risks promptly and keep evidence of remediation. Testing must not expose another tenant's information.
• Maintain incident escalation, evidence preservation, breach assessment and customer notification procedures supporting the DPA deadlines. Maintain continuity and recovery arrangements, test restoration and deletion replay at least annually, and do not promise an unagreed recovery time or recovery point.
• Implement the retention schedule across all controlled copies, track provider deletion obligations, review exceptions and test representative deletion and offboarding scenarios at least annually and after material changes.

These requirements do not assert a particular certification, customer-facing MFA feature or numerical uptime guarantee. Our implementation must meet the agreed requirements before relevant live processing starts.

3 Service Processing Register requirements

For every provider handling personal information, we supply the actual contracting entity and service, whether it acts as our subprocessor or another role, the data and purpose, hosting and access countries, applicable provider DPA, transfer mechanism and assessment, deletion/retention rules, and any material customer choice. The register must cover the database, runtime, Redis deployment, hosting/CDN, authentication, file storage, AI, support email, payment processing and monitoring where actually used. Hostinger's domain-registration role is assessed separately from CRM hosting.

Only providers actually receiving the relevant Customer Personal Data are authorised as subprocessors. Providers used for our controller administration appear with their correct role. A service enabled later must pass the same assessment and change process. Customer-selected integrations need separate scope, role, permission and deletion information. Include enabled commerce platforms, Analytics/Search Console APIs and the keyword-ranking provider. Map source API responses, transient IP/browser processing, website events, webhooks and downstream reporting copies, and identify which providers actually receive each category.

4 Export specification requirements

Before purchase, we identify supported exports, formats, how to retrieve attachments and linked records, and any material exclusions. Standard export must include the customer's available business records and attachments in a usable structured format, together with the relationship information necessary to understand them to the extent technically supported and lawfully required. Credentials, other tenants' data and our proprietary code are excluded. Export limitations cannot override a mandatory return, portability or switching obligation. Support must provide a secure alternative where an ordinary interface is unavailable.

Appendix 3 EU Data Act Switching Terms

1 Application and priority

These terms apply where the mandatory switching provisions of Regulation (EU) 2023/2854 apply to the Customer and service. They supplement the ordinary exit rights and prevail over conflicting provisions. They do not promise identical operation at another provider or access to another customer's data, our source code, trade secrets or protected internal security information. Statutory limitations on an exclusion still apply.

2 Switching request and cooperation

You may request a switch to another provider of the same service type, move to your own infrastructure, or request deletion of exportable data and digital assets by contacting support@custromix.com. We acknowledge promptly and agree the execution plan, assistance, data, formats and security measures. We impose no notice period longer than 30 calendar days, and a shorter period applies where feasible or required. We provide reasonable assistance, relevant information and available open interfaces, maintain appropriate security and business continuity during switching, and identify known continuity risks.

The ordinary transition must complete without undue delay and within 30 calendar days after the applicable notice period. If a longer transition is technically unfeasible to avoid, we notify you within 14 working days of the request, explain and substantiate the impediment, and state an alternative period no longer than seven months, as the law permits. You may extend the transition once for a period you consider more appropriate, subject to the applicable law. We cooperate in good faith with you and the destination provider.

3 Exportable data and digital assets

Export includes the Customer's exportable input and output data and metadata generated or co-generated by use of the service and transferable digital assets within the statutory scope. We provide commonly used machine-readable formats and the required interface and interoperability information. The pre-contract export specification must identify categories, structures and formats and any excluded protected internal data, explaining the basis for exclusion. An exclusion must not impede the switching process beyond what law permits.

We make the necessary switching, format, interface and jurisdiction information available in the service's public switching information and supply its exact website address with the Order before acceptance. We also provide the required information about jurisdiction and measures relating to unlawful third-country governmental access to non-personal data. The public information and actual technical capability must support these terms.

4 Completion retrieval fees and termination

You have at least 30 calendar days to retrieve exportable data and digital assets after the transition ends, unless you expressly agree a different legally permitted arrangement. We erase the relevant data after that period and successful switching, or after a lawful deletion instruction, subject to specific required legal retention. We confirm the applicable completion and termination dates; the service agreement ends in accordance with the applicable switching provisions, including successful completion of switching, rather than being prolonged solely by an inconsistent renewal clause.

We charge no switching or data-egress fee under these standard terms. Ordinary service fees may continue for the actual service period while the contract lawfully remains in effect. No early-termination penalty is imposed for exercising a mandatory switching right under this Appendix; accrued undisputed fees remain payable. Optional consultancy genuinely outside our statutory switching duties requires a separate written scope and must not disguise a prohibited switching fee. We refund prepaid subscription fees attributable to the period after the affected service lawfully ends. Rights available under applicable law remain unaffected.