DATA AND SERVICES TERMS AND CONDITIONS

1. DEFINITIONS
1.1 The following terms shall, unless the context requires otherwise, have the following meanings.
Agreement means the Order Form and these terms and conditions.
Appending & Enhancing means the process of introducing additional Data Fields to existing records in the Client Data and or Client Consolidated Data (as the case may be) performed by Cardwell.
Broker means the entity identified as such on the Order Form (if any) who enters into this Agreement for and on behalf of the Client and is responsible for delivering the Data to the Client and paying the Total Price to Cardwell.
Business Database means any general database of business names, telephone numbers, addresses, and other related information.
Business Day means a day other than a Saturday, Sunday or public holiday in England when banks in London are open for business.
Cardwell means Cardwell Marketing Limited incorporated and registered in England and Wales with company number 04966074 whose registered office is at 62 Anchorage Road, Sutton Coldfield, England B74 2PG.
Cardwell Data means the master database of business names, telephone numbers, addresses, and other related information collected, verified and owned by Cardwell or 118 Group or affiliate, as updated from time to time by Updates.
118 Group means Cardwell, any subsidiary or holding company from time to time and any subsidiary from time to time of a holding company of 118 Group. For this purpose, a “subsidiary” and “holding company” have the meaning set out in section 1159 of the Companies Act 2006.
Cardwell Records means records of businesses contained in the Data, comprised of Data Fields.
Cleansing means any process performed by Cardwell on Client Data and/or Client Consolidated Data to identify inaccuracies in the existing records comprising Client Data and/or Client Consolidated Data.
Client means the entity identified as such on the Order Form.
Client Consolidated Data means the single database generated, maintained and held by Client which includes Cardwell Records in any form.
Client Data means any database of business names, telephone numbers, addresses, and other related information, owned by Client or licensed to Client by a third party other than Cardwell.
Commencement Date means the Service and/or Data delivery date, or the date the Order Form is signed by Client, whichever is earlier.
Control means the ability to direct the affairs of another whether by means of voting or contractual rights or otherwise and whether directly or indirectly and “change of control” shall be construed accordingly.
Data means any or all records of businesses contained in Cardwell Data, as selected on the Order Form.
Data Audit means the report that is output following Matching and Cleansing performed by Cardwell on Client Data and/or Client Consolidated Data.
Data Fields means the specific pieces of information that may comprise a Cardwell Record. The types of Data Fields may be set out on the Order Form.
Data Protection Requirements means: (i) either the Data Protection Act 1998 or the General Data Protection Regulation ((EU) 2016/679) (GDPR) and/or any UK implementing laws, whichever is in force in the UK at the relevant time; (ii) either the Privacy and Electronic Communications (EC Directive) Regulations 2003 or the EU ePrivacy Regulation whichever is in force in the UK at the relevant time; and (iii) all other applicable laws and regulations relating to the processing of personal data and privacy, all as amended, extended, re-enacted or replaced from time to time.
Data Solutions means any or all of the Data Solutions identified as such on the Order Form, carried out by Cardwell on Client Consolidated Data and/or any Client Data.
Direct Marketing means any form of marketing by telephone, fax, direct mail, market research or use of circulation list, which is aimed at a target market and is carried out by Client, or on Client’s behalf by a third party (other than a Restricted Company), provided always that any Direct Marketing carried out by a third party on behalf of Client shall be on terms not less onerous than this Agreement. For the avoidance of doubt, Direct Marketing shall include Profiling and any other pre-sales activities that support Direct Marketing, conducted by Client or by Broker on Client’s behalf, but shall exclude any form of publishing of Cardwell Records.
Email Broadcast means the transmission of email Direct Marketing communications to Emails by Cardwell on behalf of Client.
Emails means the email addresses contained in the Data, and Email shall be construed accordingly.
Force Majeure means any events, circumstances or causes beyond the party’s reasonable control including accidents, fires, explosions and (when the party affected is any 118 Group company or any affiliate of the foregoing) any legislation, order or regulation which materially restricts the licensing of the Data by Cardwell to Client.
Hosting means the physical hosting of Client Consolidated Data and/or any other Client Data, on a secure Cardwell server.
Intellectual Property Rights means all copyright, database rights, trade marks, domain names, moral rights, patents and rights in inventions, rights in confidential information and any other similar or equivalent rights or forms of protection in any part of the world, in each case whether registered or unregistered.
Matching means any process where an enquiry is made in relation to any Cardwell Record to ascertain whether a corresponding record (whether or not accurate or complete) appears in any other Business Database.
descriptions fall under the sector(s) specified on the Order Form.
Email Data means the database of personal and company email addresses attached to individual Cardwell Records.
Net Data means the provision of any Data without any Cardwell Records identified as a duplicate of records appearing in any Client Data.
Profiling means profiling, analysis, research and reporting of Client Consolidated Data and/or Client Data.
Restricted Company means any company that is included in Cardwell Restricted Companies list from time to time, as provided by Cardwell to Client from time to time and available upon request. The meaning of Restricted Company extends to such company’s holding company or subsidiaries and the subsidiaries of its holding company.
Services means any or all of Data Solutions and/or Email Broadcast, as selected on the Order Form.
Suppression Data means Cardwell Records in the Data relating to live businesses who have indicated a wish not to receive marketing material from third parties.
Targeting & Segmentation means a process performed by Cardwell resulting in identifying and grouping records in Client Data and or Client Consolidated Data according to specified characteristics.
Total Price means the amount specified as such on the Order Form.
Updates means the Data as amended or updated by changing, adding or deleting Cardwell Records or Data Fields.
Usage means the single-use or a period of use of the Data permitted under this Agreement, as set out on the Order Form, and if not so specified, 12 months from the Commencement Date.
1.2 In this Agreement unless the context otherwise requires:
1.2.1 a reference to a statute or statutory provision is a reference to it as amended, extended or re-enacted from time to time;
1.2.2 the singular includes the plural and vice versa;
1.2.3 any words following the terms “including”, “include”, “in particular” or “for example” or any similar phrase shall be construed as illustrative and shall not limit the generality of the related general words; and
1.2.4 references to a party or parties shall be the parties to this Agreement.
2. TERM
This Agreement shall commence on the Commencement Date and shall continue in effect until the later of the end of the Usage, or the date the last Service is performed under this Agreement, when it shall expire automatically, unless terminated earlier in accordance with clause 10 (termination), or unless:
2.1 the Client continues to use the Data beyond the Usage; or
2.2 Client fails to comply with clause 11.2.2 (destruction of data on termination) and/or clause 11.2.4 (certification of destruction of data),
in each such case and without prejudice to Cardwell’s other rights, the Agreement shall be extended automatically for 12 months period(s) and Cardwell may charge Client / Broker (as applicable) an appropriate fee upon each such extension.
3. DATA AND SERVICES
3.1 Cardwell hereby grants to Client a non-exclusive, non-transferable and non-sublicensable licence to combine Data supplied under this Agreement with other data that Client is entitled to hold to generate Client Consolidated Data which Client may use (excluding the Suppression Data) for its own Direct Marketing purposes only.
3.2 Client shall not use or supply any Cardwell Records for any purpose except as expressly permitted by this Agreement. In particular, but without limitation, Client shall not supply any Cardwell Records to any third party (including any companies in the same group of companies as Client) for any purpose.
3.3 Client hereby agrees not to send more than twelve (12) communications to any Email in any consecutive twelve (12) month period and/or send more than four (4) communications to any Email in any one calendar month.
3.4 Client shall ensure that Cardwell Records are identifiable and capable of being extracted from Client Consolidated Data at all times as Cardwell Records, by being clearly and unambiguously flagged or marked.
3.5 Client shall only make copies of Data and/or ML Records to the extent reasonably necessary for back-up, mirroring (and similar availability enhancement techniques), security, disaster recovery and testing purposes. Hosting outside of the European Economic Area and the UK (in the event the UK is no longer part of the European Economic Area) is subject to Cardwell’s prior approval in writing.
3.6 Client shall grant Cardwell permission to contact and verify Client Data.
4. DELIVERY
4.1 Cardwell shall deliver the Services, the Data and the Updates (if any) to Client as specified on the Order Form.
4.2 Client acknowledges that not each Cardwell Record in the Data contains all the Data Fields, however, Cardwell will use reasonable endeavours to ensure that Client has as many of those Data Fields as exist in relation to each business.
4.3 Cardwell shall: (a) use reasonable endeavours to provide the Services in accordance with this Agreement in all material respects; (b) use reasonable skill and care in the provision of the Services; and (c) use reasonable endeavours to meet any performance and/or delivery dates specified on the Order Form. Any delivery dates are approximate only, and the time of delivery is not of essence.
5. PAYMENT
5.1 Client or (if Broker is acting on behalf of Client) Broker shall pay to Cardwell the Total Price as set out on the Order Form. Any delay in payment of sums beyond 30 days from the due date shall result in the sum bearing interest at the rate of 4% above the base rate from time to time of the Royal Bank of Scotland.
5.2 Without prejudice to clause 10.1.3, in the event Client fails to make any payment under this Agreement by its due date, Cardwell shall be entitled to suspend the delivery of the Data, Updates and/or the provision of the Services.
6. CLIENT OBLIGATIONS
6.1 Client shall comply with the DMA (Direct Marketing Association) Code of Practice when it uses Client Consolidated Data for Direct Marketing purposes.
6.2 Client shall notify Cardwell in writing immediately upon the occurrence of a change of control of Client or client’s holding company.
6.3 Client shall keep, in paper and electronic form, at its normal place of business detailed, accurate and up-to-date records sufficient to enable Cardwell to verify Client’s compliance with the provisions in this Agreement relating to the Licence (clause 3), Data Protection (clause 7), Intellectual Property (clause 8) and Confidentiality (clause 9).
6.4 Client shall, on reasonable written notice in advance, allow Cardwell, and any auditors or other advisors to Cardwell, to access any of Client’s premises, personnel, relevant records and systems as may be reasonably required to verify Client’s compliance with the provisions referred to in clause 6.3 (provided that Client may redact commercially sensitive information in the relevant records), and shall provide Cardwell with all reasonable co-operation and assistance. Cardwell shall use its reasonable endeavours to not unreasonably disturb Client during any such verification process.
6.5 Cardwell’s rights under clause 6.4 shall continue for two years after termination of this Agreement. Any costs of verification carried out under clause 6.4 shall be borne by Cardwell unless the verification reveals a material failure by Client to comply with the provisions of this Agreement in which case Client shall reimburse Cardwell for its costs on demand.
6.6 Notwithstanding any other provision of the Agreement failure by Client to comply fully with this clause 6 will entitle Cardwell without prejudice to its other rights to terminate the Agreement with immediate effect.
6.7 To the extent that Broker is acting on behalf of Client, Broker undertakes to notify Cardwell promptly in writing in the event of any breach or threatened breach by Client of this Agreement.
7. DATA PROTECTION
7.1 Client acknowledges that the Data may include personal data and that in accordance with the Data Protection Requirements, each of Cardwell and Client shall act as data controller in respect of such personal data, as, without prejudice to the terms of this Agreement, they will each separately determine the purposes for which and the manner in which such data is processed. For the avoidance of doubt, Client shall not be processing any personal data on behalf of Cardwell under this Agreement.
7.2 To the extent that Cardwell in the performance of the Services acts as data processor on behalf of the Client in respect of personal data contained within Client Data the provisions of Schedule 1 (Data Processing Schedule) shall apply.
7.3 In this clause 7 and Schedule 1 (if applicable) the terms “data controller”, “data processor”, “personal data” and “processing” have the meanings as defined in the Data Protection Requirements.
7.4 Each party shall at all times comply with the Data Protection Requirements in relation to the Data and/or the Services.
7.5 If Client receives any complaint, notice or communication that relates directly or indirectly to the processing of the Data or to either party's compliance with Data Protection Requirements (as it relates to the Data), it shall immediately notify Cardwell and provide full details and copies of any communication. Client shall use reasonable endeavours to work with Cardwell to remedy the situation, including, if requested by Cardwell, suppressing the data in question from any further use.
7.6 Client shall indemnify on demand Cardwell for any cost, claim or expense arising as a result of Client: (a) breaching any of the Data Protection Requirements; or (b) causing Cardwell to be in breach of any of the Data Protection Requirements.
8. INTELLECTUAL PROPERTY RIGHTS
8.1 Client acknowledges that all Intellectual Property Rights in the Data are the property of Cardwell, 118 Group or their affiliates or licensors, as the case may be, and Client shall have no rights in or to the Data other than the right to use it in accordance with the express terms of this Agreement.
8.2 Cardwell shall defend Client from and against any claim or action that the use by Client of Cardwell Records (in accordance with this Agreement) infringes any UK Intellectual Property Right of a third party (IPR Claim) and shall be responsible for any losses, damages, costs (including all legal charges) and expenses incurred by or awarded against Client as a result of, or in connection with, any such IPR Claim, provided that, if any third party makes an IPR Claim, or notifies an intention to make an IPR Claim against Client, Client shall: (i) give written notice of the IPR Claim to Cardwell as soon as reasonably practicable; (ii) not make any admission of liability in relation to the IPR Claim without the prior written consent of Cardwell; (iii) at Cardwell's request and expense, allow Cardwell to conduct the defence of the IPR Claim including settlement; and (iv) at Cardwell's expense, co-operate and assist to a reasonable extent with Cardwell's defence of the IPR Claim. This clause 8.2 constitutes Client's sole and exclusive remedy and Cardwell's only liability in respect of IPR Claims.
9. CONFIDENTIALITY
Neither of the parties hereto shall publicise or disclose to any third party, during or after this Agreement is terminated, the subject matter or content of this Agreement without the prior written consent of the other (which shall not be unreasonably withheld or delayed), although the fact that Client uses the Data is not confidential information. The receiving party shall only disclose such confidential information to those of its employees, agents and subcontractors who need to know it for the purpose of discharging the receiving party's rights and obligations under the Agreement, and shall ensure that such employees, agents and subcontractors comply with the obligations set out in this clause as though they were a party to the Agreement. The receiving party may also disclose such of the disclosing party's confidential information as is required to be disclosed by law, any governmental or regulatory authority or by a court of competent jurisdiction.
10. TERMINATION
10.1 Without affecting any other right or remedy available to it, this Agreement may be terminated by Cardwell:
10.1.1 on giving at least 30 days’ prior written notice to Client in the event of any legislation, order or regulation which materially restricts the provision or licensing of the Data by Cardwell to Client; or
10.1.2 on giving at least 30 days’ prior written notice to Client in the event of a change of control of Client or of any holding company of the Client; or
10.1.3 on giving at least 14 days’ prior written notice if Client or (if Broker is acting on behalf of Client) Broker is late in paying any instalment of the Total Price.
10.2 Without affecting any other right or remedy available to it, this Agreement may be terminated by either party on giving written notice to the other if:
10.2.1 the other party commits a material breach of the Agreement (for example, but without limitation, any breach of clause 8 (Intellectual Property Rights) or clause 9 (Confidentiality)) and (in the case of a breach capable of remedy) fails to remedy such breach within 30 days of written notice requesting the breach to be remedied; or
10.2.2 the other party is unable to pay its debts or enters into compulsory or voluntary liquidation (other than for the purpose of reconstruction or amalgamation of the company), or commences negotiations with its creditors with a view to rescheduling any of its debts or entering into any compromise or arrangement with its creditors (other than for the purpose of a scheme for a solvent amalgamation or solvent reconstruction), or has a receiver or manager or an administrator appointed of its assets or ceases for any reason to carry on business.
11. CONSEQUENCES OF TERMINATION
11.1 Termination, for any reason, or expiry of this Agreement shall not affect the accrued rights, remedies, obligations or liabilities of the parties existing at termination or expiry. Any provision of this Agreement which is expressed or intended to come into or continue in force after termination of this Agreement (including clauses 1.2, 3.2, 6, 7, 8, 9, 11 and 13) shall do so.
11.2 Upon any expiry or termination of this Agreement:
11.2.1 the rights granted under this Agreement shall immediately cease and terminate and Client shall immediately cease all use of the Data;
11.2.2 Client shall destroy all confidential information, all Cardwell Records, all copies of the Data and all material relating to the Data in all systems and data including Client Consolidated Data and all other material relating thereto. However, Client shall be entitled to retain its own records relating to any business that is the subject of a Cardwell Record that was already a customer of Client prior to the Commencement Date, or that has become a customer of Client during this Agreement;
11.2.3 each party shall settle all monies due and payable by it to the other at the date of termination; and
11.2.4 Client shall within 28 days of termination confirm to Cardwell in writing (signed by an officer) that it has fully complied with its obligations in clause 11.2.
12. WARRANTIES
12.1 Cardwell warrants that it has the right to grant to Client the licence of the Data as specified in this Agreement.
12.2 Cardwell will use reasonable commercial efforts to ensure that Cardwell Records are as complete and accurate as reasonably possible. However, Client acknowledges that the completeness or accuracy of Cardwell Records and the Data relies on periodic verification by Cardwell and that Cardwell Records and the Data may not be complete or accurate for a number of reasons including, but not limited to, if businesses are created or fail between Cardwell’s periodic verifications, or if businesses request that they are not included on the Data. Accordingly, Cardwell accepts no responsibility and does not warrant Cardwell Records and/or the Data are accurate, complete, reliable, useful, fit for purpose or timely.
12.3 Except as expressly stated in this Agreement, all warranties, conditions and terms, whether express or implied by statute, common law or otherwise are hereby excluded to the extent permitted by law.
13. LIABILITY
13.1 Neither party excludes or limits liability to the other party for: (i) fraud or fraudulent misrepresentation; (ii) death or personal injury caused by negligence; (iii) in respect of Client’s liability to Cardwell, infringement of Cardwell’s Intellectual Property Rights in the Data; (iv) misuse of confidential information; or (v) any matter in respect of which it would be unlawful for the parties to exclude liability.
13.2 Subject to clause 13.1, neither party shall in any circumstances be liable whether in contract, tort (including for negligence and breach of statutory duty howsoever arising), misrepresentation (whether innocent or negligent), restitution or otherwise, for (i) any loss (whether direct or indirect) of profits, business, business opportunities, revenue, turnover, reputation or goodwill; (ii) any loss or liability (whether direct or indirect) under or in relation to any other contract; (iii) loss (whether direct or indirect) of anticipated savings or wasted expenditure (including management time); (iv) any ex gratia payments; or (v) any indirect or consequential losses.
13.3 Subject to clause 13.1, either party's total aggregate liability in contract, tort (including negligence and breach of statutory duty howsoever arising), misrepresentation (whether innocent or negligent), restitution or otherwise, arising out of or in connection with this Agreement shall be limited to the higher of the Total Price payable under the Agreement or £100,000.
13.4 Nothing in this clause 13 shall reduce or affect either party’s duty to pay any sums properly due and payable under this Agreement.
13.5 To the extent that:
13.5.1 Broker does not have appropriate authority to enter into this Agreement on behalf of Client; or
13.5.2 Broker encourages, permits, facilitates, incites, aids or otherwise causes Client to:
(a) exceed Usage of the Data;
(b) supply any Cardwell Records to any third party (including any companies in the same group of companies as Client) for any purpose;
(c) send more than twelve (12) communications to any Email in any consecutive twelve (12) month period and/or send more than four (4) communications to any Email in any one calendar month; or
(d) fail to comply with its obligations under clause 11.2.2,
the provisions of clause 13.2 shall not apply to the benefit of Client or Broker and Broker shall indemnify Cardwell against all liabilities, costs, expenses, damages and losses (including but not limited to any direct, indirect or consequential losses, loss of profit, loss of reputation, loss of contract and all interest, penalties and legal costs (calculated on a full indemnity basis) and all other professional costs and expenses) suffered or incurred by Cardwell arising out of or in connection with the acts or omissions of the Broker referred to in clauses 13.5.1 and 13.5.2 including, without limitation, any breach by the Client of this Agreement.
13.6 Client acknowledges that damages may not be an adequate remedy for the resulting losses suffered by Cardwell arising out of a breach of this Agreement and that Cardwell is entitled to injunctive relief in relation to any such breach or threat of such a breach.
13.7 Neither party shall be in breach of this Agreement nor liable for delay in performing, or failure to perform, any of its obligations under this Agreement if that delay or failure results from Force Majeure. In these circumstances the affected party shall be entitled to a reasonable extension of the time for performing its obligations, provided that, if the period of delay or non-performance continues for three months, the party not affected may terminate this Agreement by giving 14 days' written notice to the other party.
14. NOTICES
14.1 Any notice required to be given to a party under or in connection with this Agreement shall be in writing with proof of delivery and shall be delivered to the address for each party as set out on the Order Form, or as notified to the other party from time to time.
14.2 Notices under this Agreement shall be made by (a) first class prepaid mail, providing proof of delivery or postage; or (b) by hand or reputable courier, in either case addressed to the recipient at its notice address.
14.3 Any notice shall be deemed to have been received, if (a) made by mail, on the second Business Day after posting or at the time recorded by the delivery service; (b) delivered by hand or courier, on signature of a delivery receipt or at the time the notice is left at the proper address.
15. MISCELLANEOUS
15.1 Neither party is the agent nor representative of the other and neither party has any authority or power to bind or contract in the name of or to create any liability against the other in any way or for any purpose.
15.2 This Agreement constitutes the entire agreement between the parties and supersedes and extinguishes all previous agreements, promises, assurances, warranties, representations and understandings between them, whether written or oral, relating to its subject matter. Each party agrees that it shall have no remedies in respect of any statement, representation, assurance or warranty (whether made innocently or negligently) that is not set out in this Agreement. Each party agrees that it shall have no claim for innocent or negligent misrepresentation or negligent misstatement based on any statement in this Agreement.
15.3 A waiver of any right or remedy is only effective if given in writing and shall not be deemed a waiver of any subsequent breach or default. A delay or failure to exercise, or the single or partial exercise of, any right or remedy shall not (a) waive that or any other right or remedy; or (b) prevent or restrict the further exercise of that or any other right or remedy.
15.4 If any court or competent authority finds that any provision of this Agreement (or part of any provision) is invalid, illegal or unenforceable, that provision or part-provision shall, to the extent required, be deemed to be deleted, and the validity and enforceability of the other provisions of this Agreement shall not be affected. If any invalid, unenforceable or illegal provision of this Agreement would be valid, enforceable and legal if some part of it were deleted, the parties shall negotiate in good faith to amend that provision so that, as amended, it is legal, valid and enforceable, and, to the greatest extent possible, achieves the parties' original commercial intention.
15.5 The rights and remedies of the parties in connection herewith are cumulative and are not exclusive of any rights or remedies provided by law.
15.6 No provision of this Agreement may be varied without prior written agreement of both parties.
15.7 Client shall not be entitled to assign, sub-license, sub-contract, charge or otherwise part with any of its rights or obligations arising under this Agreement.
15.8 A person who is not a party to this Agreement shall not have any rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of this Agreement.
15.9 This Agreement shall be construed in accordance with and governed by the Laws of England and Wales and the parties hereto submit to the non-exclusive jurisdiction of the English Courts.

Schedule 1 DATA PROCESSING SCHEDULE

1. This Schedule only applies to personal data contained within the Client Data where Cardwell acts as data processor on behalf of the Client in respect of such personal data.
2. Client warrants that:
2.1 any personal data contained in Client Data has been collected and processed in accordance with the applicable Data Protection Requirements; and
2.2 it is entitled to appoint Cardwell (in compliance with the applicable Data Protection Requirements) to provide the Services which may include processing of personal data on behalf of Client.
3. To the extent that Cardwell in the performance of the Services acts as data processor on behalf of the Client in respect of personal data contained within Client Data, Cardwell undertakes that it shall:
3.1 only process personal data in accordance with the reasonable lawful instructions of the Client, including those set out in this Agreement, unless Cardwell is required by the laws of any member of the European Union or by the laws of the European Union applicable to Cardwell to process personal data (Applicable Laws). Where Cardwell is relying on laws of a member of the European Union or European Union law as the basis for processing personal data, Cardwell shall promptly notify Client of this before performing the processing required by the Applicable Laws unless those Applicable Laws prohibit Cardwell from so notifying Client;
3.2 implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks that are presented by processing (in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data), taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing of personal data, as well as the risk of and the severity of interference with the rights and freedoms of the data subjects (if any);
3.3 3.3 ensure that access to personal data is limited to those employees who need access to such personal data to meet Cardwell’s obligations under this Agreement and that such employees shall respect and maintain the confidentiality and security of such personal data;
3.4 provide to Client, upon prior written request from Client, a written description of the technical and organisational measures implemented pursuant to paragraph 3.2;
3.5 notify Client without undue delay on becoming aware of a personal data breach;
3.6 assist Client, at Client's cost, in responding to any request from a data subject and in ensuring compliance with the Client’s obligations under the Data Protection Requirements with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;
3.7 save to the extent that Cardwell is or becomes a data controller in respect of the same personal data contained in Client Data, at the written direction of Client, delete or return personal data and copies thereof to Client on termination of this Agreement unless required by any applicable laws to store the personal data;
3.8 not appoint a third party sub-contractor for the processing of any personal data under this Agreement without the prior written approval of Client. Cardwell confirms that it has entered or (as the case may be) will enter with any third-party processor into a written agreement on that third party's standard terms of business or incorporating terms which are substantially similar to those set out in this Schedule 1. As between Client and Cardwell, Cardwell shall remain fully liable for all acts or omissions of any third-party processor appointed by it pursuant to this paragraph 3.8; and
3.9 only transfer personal data to countries outside the European Economic Area, if it has provided appropriate safeguards, as required by the applicable Data Protection Requirements.
4. At Client’s reasonable request and subject to Client entering into adequate confidentiality agreements (as required by Cardwell), Cardwell shall:
4.1 make available to Client such information as may reasonably be necessary to demonstrate compliance with its obligations under this Schedule 1, including copies of any audit reports demonstrating compliance with paragraph 3.2 (appropriate technical and organisational measures); and
4.2 subject to the restrictions in paragraph 5 below, allow Client (or an independent, third-party professional auditor engaged by it) to conduct an audit, including inspection, of Cardwell’s processing of personal data pursuant to this Agreement.
5. When exercising its rights under paragraph 4.2 above, Client shall:
5.1 promptly provide Cardwell with information regarding any non-compliance discovered during the course of an audit;
5.2 conduct such audits on reasonable written notice, during reasonable times and for a reasonable duration, which shall not unreasonably interfere with Cardwell’s day-to-day operations; and
5.3 if an audit requires the equivalent of more than one Business Day of time expended by one or more of Cardwell employees (or other personnel), Client agrees to reimburse Cardwell for any additional time expended at Cardwell’s then current professional services rates.
6. In relation to any sub-contractors that are engaged pursuant to paragraph 3.8, Client acknowledges and agrees that it is sufficient, for the purposes of satisfying the requirements of paragraph 4 (information and audit), that Cardwell has a right to audit those sub-contractors on behalf of Client, subject to reasonable restrictions.
7. Approved sub-contractors
By entering into this Agreement, the Client is deemed to have approved the use of the following sub-contractors:
Sub-contractor Specification of processing
118 Data Resource Ltd (a 118 Group company) Hosting services (owner of the servers used by Cardwell)
Other 118 Group companies that Cardwell may engage from time to time in connection with the Services Supply of the Services on behalf of Cardwell
Microsoft Ireland Operations Ltd. Backup services
8. Specification of processing:
8.1 Subject matter: the provision of Services on the Client Data;
8.2 Duration: the term of this Agreement;
8.3 Nature and purpose of processing: the provision of the Services on the Client Data;
8.4 Type of personal data: first and last name, title, position, organisation, business contact information (email, phone, business address);
8.5 Categories of data subjects: prospects, customers, business partners and vendors of Client who are natural persons, employees and other officers of contact persons of Client’s prospects, customers, business partners and vendors and Client’s employees authorised to communicate with Cardwell in connection with this Agreement.

August 2018