Terms and Conditions

Latest Update: 13 June 2026

1. Introduction

1.1 These Terms and Conditions (the Terms) govern access to and use of the website at www.growbysystems.com, our CRM, our software, our platform, and the services made available by Faithful Foundations Limited, a company registered in England and Wales with company number 15721077 and registered office at Unit 26 Silicon Business Centre, 28 Wadsworth Road, Perivale, UB6 7JZ, London, UK, trading as Grow by Systems (Grow by Systems, we, us or our).

1.2 The customer is the business, organisation, partnership, sole trader, self-employed business owner, or other legal person that purchases, accesses, trials, or uses the services (Customer, you or your).

1.3 These Terms apply to CRM access-only plans listed on our website, setup packages, onboarding services, marketing services, consulting services, business growth retainers, commission-based services, hybrid fee arrangements, add-ons, usage-based services, and any other services we agree to provide, except to the extent expressly varied by a separate written proposal, order form, statement of work, service agreement, or other written agreement accepted by us.

1.4 Grow by Systems is the customer-facing provider of the platform and services. References to “our platform”, “our CRM”, “our software”, “third-party technology providers”, “third-party infrastructure providers”, “payment providers”, “integrations”, “subprocessors”, or similar expressions describe service components and support arrangements without identifying any particular underlying provider unless we decide that disclosure is required or commercially appropriate.

2. Definitions and interpretation

2.1 In these Terms:

·       Add-ons means additional services, features, integrations, usage allowances, training, campaign support, configuration, or other extras purchased in addition to a plan or Tailored Service.

·       Applicable Law means all laws, regulations, regulatory guidance, industry rules, codes, sanctions regimes, export-control rules, platform policies, carrier rules, payment provider rules, advertising platform rules, and third-party provider requirements that apply to the Customer, its business, its campaigns, its data, or its use of the Services.

·       Communications Assets means telephone numbers, sender IDs, messaging profiles, domains, subdomains, tracking numbers, email sending domains, verified sender records, templates, registrations, and similar assets used for communications, attribution, or campaign delivery.

·       CRM Data means data entered into, uploaded to, generated by, stored in, transmitted through, or processed within our CRM or related platform features, including account data, contact records, lead records, pipeline data, communications, campaign data, transaction references, reporting data, and configuration data.

·       Customer Content means materials, copy, designs, trade marks, logos, data, lists, offers, landing page content, messages, emails, SMS, voicemail, scripts, adverts, prompts, automation logic, review request content, and other content supplied, uploaded, approved, or controlled by the Customer.

·       Customer Personal Data means personal data processed by Grow by Systems on behalf of the Customer as processor under the Data Processing Terms in Schedule 1.

·       Fair Use means use that is reasonable, lawful, non-abusive, technically safe, commercially proportionate, and consistent with any usage assumptions, plan limits, provider rules, network rules, and acceptable use requirements applicable to the relevant Services.

·       Order means any website checkout, subscription selection, proposal, order form, statement of work, service agreement, written acceptance, email confirmation, message, invoice, call-confirmed agreement, online meeting record, or other written communication that describes Services, pricing, scope, deliverables, cancellation terms, commission terms, or usage terms.

·       Services means CRM access, software access, onboarding, setup, marketing, consulting, business growth, campaign management, automation, funnel, reporting, commission-based, retainer, and related services supplied by or through Grow by Systems.

·       Suppression Records means opt-out lists, unsubscribe records, do-not-contact lists, bounce lists, spam complaint records, global exclusion lists, suppression lists, consent records, and similar records maintained to comply with law, provider rules, deliverability requirements, or recipient requests.

·       Tailored Services means any services not fully described by a standard website-listed CRM access plan, including setup packages, retainers, commission-based services, hybrid services, bespoke consulting, marketing, campaign management, automation, funnel building, and business growth services.

·       Usage Data means technical, diagnostic, statistical, performance, aggregated, anonymised, or de-identified data relating to the use, operation, security, performance, improvement, analytics, or availability of the Services, provided that externally used aggregated or anonymised data does not identify the Customer or any individual.

·       Usage Fees means fees based on usage, volume, message sending, email, SMS, telephony, voicemail, AI, contacts, transactions, payments, storage, integrations, or other metered functions.

2.2 References to writing include email, online checkout confirmations, proposals, order forms, statements of work, signed agreements, platform messages, written call summaries, and other written communications.

2.3 If there is a conflict between these Terms and a separate written Order, the order of precedence in clause 13 applies unless expressly stated otherwise.

3. Business-only use

3.1 The Services are supplied only to businesses and self-employed business owners acting wholly or mainly for business purposes. We do not knowingly supply the Services to consumers.

3.2 By accessing, trialling, purchasing, or using the Services, you represent and warrant that:

·       you are acting for business purposes and not as a consumer;

·       you have full authority to enter into the contract on behalf of the Customer;

·       the Customer is legally able to receive and use the Services in each country in which it operates or sends communications; and

·       all information you provide to us is accurate, complete, and not misleading.

3.3 If you are using the Services on behalf of a company, partnership, organisation, or other entity, you accept these Terms for that entity and confirm that the entity is bound by these Terms.

4. Acceptance of Terms and authority to bind a business

4.1 You accept these Terms when you create an account, start a free trial, subscribe to a plan, pay an invoice, sign or accept an Order, access the CRM, use the Services, or otherwise indicate acceptance in writing or by conduct.

4.2 You must not use the Services if you do not agree to these Terms, the Data Processing Terms, and any applicable Order.

4.3 You confirm that you have authority to bind the relevant business, organisation, partnership, company, sole trader business, or other Customer to these Terms. If you do not have such authority, you must not purchase, trial, access, or use the Services on behalf of that Customer.

4.4 We may require additional terms or policies to be accepted for particular features, integrations, payment functions, AI tools, communication tools, or Tailored Services. Those additional terms form part of the contract to the extent applicable.

5. Description of Services

5.1 Grow by Systems provides CRM access, onboarding, setup, marketing, consulting, and business growth services. The Services may include, depending on the plan or Order:

·       CRM access, pipelines, calendars, booking functions, forms, automations, websites, funnels, landing pages, email, SMS, voicemail, review requests, AI chat, tracking, payments, reporting, analytics, and integrations;

·       CRM setup, onboarding, campaign setup, SMS and email configuration, funnel building, automation setup, and related configuration;

·       consulting, marketing services, campaign management, business growth strategy, reporting, retainer services, commission-based services, and other Tailored Services; and

·       third-party integrations, infrastructure, communication tools, payment tools, AI features, and other technology components made available through or in connection with our platform.

5.2 The exact Services, package names, features, pricing, deliverables, usage allowances, limitations, and cancellation terms are those shown on the relevant website page, checkout page, proposal, Order, statement of work, service agreement, invoice, written confirmation, or other written agreement.

5.3 We may add, remove, suspend, vary, replace, or discontinue features or third-party integrations where reasonably necessary for security, legal compliance, technology changes, provider changes, product development, misuse prevention, or commercial reasons. We will use reasonable endeavours to avoid materially reducing core paid functionality during a paid subscription period, but we do not guarantee that any particular feature, integration, third-party provider, or provider policy will remain available indefinitely.

6. CRM access-only plans

6.1 CRM access-only plans may be listed publicly on our website and may be purchased through an online checkout, proposal, or other Order. These plans provide access to our CRM and the plan features specified for the package selected.

6.2 CRM access-only plans may be provided with or without an optional setup package. Unless expressly included in the plan or separately agreed in writing, CRM access-only plans do not include bespoke setup, campaign strategy, marketing management, consulting, custom implementation, data migration, copywriting, advertising management, or business growth services.

6.3 Features may include CRM access, pipelines, calendars, forms, automation, websites/funnels, email, SMS, voicemail, review requests, AI chat, tracking, payments, reporting, and integrations, depending on the package.

6.4 Feature availability may depend on the selected package, usage limits, third-party provider availability, integrations, the Customer’s configuration, regulatory requirements, and third-party rules. Some features may require additional setup, approvals, verification, third-party accounts, customer credentials, or payment of additional fees.

7. Free trials

7.1 We may offer a 14-day free trial for CRM access-only packages. Free trials apply only to CRM access-only packages unless we expressly state otherwise in writing.

7.2 Free trials do not apply to setup packages, retainers, commission-based services, hybrid services, bespoke marketing, consulting, funnel building, campaign management, onboarding services, or Tailored Services unless expressly agreed in writing.

7.3 We may require payment details to activate a free trial. If a trial is configured to convert to a paid subscription, the checkout or written Order should state this. You are responsible for cancelling before the trial ends if you do not wish to continue on a paid basis.

7.4 Free trials must not be used consecutively, repeatedly, under multiple accounts, through related businesses, through misleading details, or in any other manner designed to avoid payment or obtain more trial access than we intended to provide.

7.5 We may refuse, limit, suspend, or terminate a free trial at any time where we reasonably suspect misuse, duplicate trials, repeated or back-to-back trials, prohibited activity, excessive usage, legal risk, non-compliance, payment avoidance, or use outside the intended business purpose.

7.6 Trial access is provided as-is, subject to these Terms, and may be limited in functionality, duration, support, integrations, sending capability, volume, data retention, usage allowances, or third-party approvals.

8. Setup packages

8.1 Setup packages may include CRM setup, onboarding, campaign setup, SMS and email setup, funnel building, automation setup, and related configuration. Setup package scope, pricing, timeline, deliverables, customer inputs, assumptions, exclusions, and cancellation terms may vary and must be agreed at signup or later in writing.

8.2 Unless otherwise agreed in writing, setup services are not unlimited. Any work outside the agreed scope may be treated as an additional service and charged at our then-current rates or as otherwise agreed.

8.3 You must provide timely access, credentials, content, brand assets, data, instructions, approvals, and feedback reasonably required to perform setup services. We are not responsible for delay, reduced performance, missed deadlines, or additional cost caused by your failure to provide required cooperation.

8.4 Setup fees are generally non-refundable once paid, particularly where work has commenced, resources have been allocated, or third-party costs have been incurred, unless required by law or expressly agreed in writing.

9. Tailored service packages and business growth retainers

9.1 We may provide Tailored Services on a monthly retainer, commission-based, hybrid, fixed-fee, project, or other fee structure. Tailored Services may include consulting, marketing services, SMS or email campaign setup, funnel building, CRM services, automation setup, campaign management, business growth strategy, reporting, and other related services.

9.2 Tailored Services are agreed separately through proposals, order forms, statements of work, service agreements, messages, emails, calls, online meetings, written confirmations, or other written communication. The relevant written agreement should specify scope, deliverables, fees, commission structure, payment timing, cancellation terms, performance assumptions, customer responsibilities, and exclusions.

9.3 Where no separate cancellation terms are agreed for tailored retainer services, the default cancellation term is 30 days’ written notice. Fees remain payable during the notice period and any committed third-party or non-cancellable costs remain payable.

9.4 Where no separate cancellation terms are agreed for other Tailored Services, the Customer must pay for all work performed, time reserved, resources allocated, agreed milestones reached, committed third-party costs, non-cancellable expenses, and reasonable wind-down or handover work incurred up to the effective cancellation date.

9.5 Unless expressly stated in the relevant Order, Tailored Services do not guarantee any specific number of leads, enquiries, appointments, sales, customers, revenue, profitability, rankings, advertising results, return on investment, or business outcome.

10. Commission-based and hybrid fee services

10.1 Commission-based services may be agreed where Grow by Systems is entitled to a commission, success fee, revenue share, percentage of sales, percentage of collected revenue, or other performance-linked fee. The exact commission structure must be set out in the relevant proposal, Order, statement of work, service agreement, or written confirmation.

10.2 Unless the relevant written agreement states otherwise:

·       commission is calculated by reference to the agreed metric, such as attributed leads, appointments, closed sales, revenue collected, transaction value, gross sales, net revenue, retained customers, or another agreed measure;

·       the Customer must provide accurate, timely, and complete data reasonably required to calculate, verify, audit, dispute, or evidence commission;

·       commission remains payable for qualifying leads, opportunities, customers, sales, renewals, transactions, or revenue generated, introduced, assisted, or attributable during the agreed commission period, including where payment is received after termination if the relevant agreement so provides;

·       we may retain relevant CRM, transaction, tracking, reporting, campaign, and commission data for as long as reasonably necessary to calculate, verify, audit, dispute, or evidence commissions; and

·       commission fees are generally non-refundable unless required by law or expressly agreed in writing.

10.3 If commission terms are unclear, the parties must act in good faith to clarify them in writing. Until clarified, we may suspend commission-based work, delay further campaign activity, or invoice undisputed fixed fees, retainers, setup fees, and usage fees.

11. Website-listed plans versus tailored plans

11.1 CRM access plans may be listed on the website. Tailored Services are agreed separately and may differ from website-listed plans in pricing, scope, features, cancellation terms, deliverables, usage allowances, or support.

11.2 Website descriptions are intended to describe standard plans and may not include all assumptions, limitations, exclusions, third-party requirements, usage costs, or legal compliance responsibilities. The Customer is responsible for checking that the selected plan is suitable for its requirements before purchase.

11.3 Tailored plans take effect only when confirmed in writing by us. Discussions, calls, estimates, proposals, or draft documents are not binding unless accepted in accordance with the relevant acceptance process or confirmed by us in writing.

12. Data Processing Terms

12.1 Where Grow by Systems processes Customer Personal Data as a processor on behalf of the Customer, the Data Processing Terms set out in Schedule 1 of these Terms apply and form part of the contract between Grow by Systems and the Customer.

12.2 By accepting these Terms, ordering Services, starting a trial, accessing the CRM, or using the Services, the Customer accepts Schedule 1 — Data Processing Terms.

12.3 The Customer authorises Grow by Systems to use subprocessors and third-party technology providers as set out in the Data Processing Terms, these Terms, the Privacy Policy, and any published or notified subprocessor list.

12.4 If there is any conflict between the main body of these Terms and the Data Processing Terms in relation to the processing of Customer Personal Data, the Data Processing Terms shall take precedence to the extent of that conflict only, unless a separate written agreement expressly states otherwise.

13. Separate proposals, order forms, statements of work, and order of precedence

13.1 A proposal, order form, statement of work, service agreement, email confirmation, or other written Order may set out package names, pricing, fees, commission structures, timelines, deliverables, cancellation terms, usage allowances, support arrangements, assumptions, and exclusions.

13.2 Unless expressly stated otherwise, if there is a conflict between documents, the following order applies:

1.     a separately signed written agreement between the parties, to the extent of the conflict;

2.     the applicable Order, proposal, order form, statement of work, or written confirmation, to the extent of the conflict;

3.     Schedule 1 — Data Processing Terms, but only for processor obligations and Customer Personal Data;

4.     these Terms; and

5.     website plan descriptions, pricing pages, help documents, or other general materials.

13.3 Any variation to these Terms must be expressly agreed in writing by an authorised representative of Grow by Systems. Customer purchase order terms, vendor portal terms, or similar customer terms do not apply unless expressly accepted by us in writing.

14. Customer responsibilities

14.1 The Customer is responsible for:

·       ensuring that the Services are suitable for its business and legal requirements;

·       selecting appropriate packages, usage allowances, settings, integrations, and workflows;

·       providing accurate information, data, content, instructions, consents, approvals, access credentials, and cooperation;

·       ensuring that all Customer Content, Customer Data, marketing lists, contacts, leads, prospects, customer records, and campaign instructions are lawful, accurate, current, and properly permissioned;

·       complying with all Applicable Law, including data protection, privacy, marketing, advertising, consumer protection, sector-specific, sanctions, export control, financial services, telecommunications, and platform rules where applicable;

·       maintaining its own records of consent, opt-ins, suppression lists, unsubscribe requests, do-not-contact requests, call or SMS permissions, and campaign approvals;

·       reviewing and approving campaign materials, automations, workflows, funnels, websites, emails, SMS, voicemail scripts, AI chat configurations, payment settings, and reporting outputs before use where relevant;

·       checking the accuracy and legality of information generated through the CRM, AI tools, reporting, or third-party integrations before relying on it; and

·       ensuring that its users comply with these Terms.

14.2 We are not responsible for legal compliance failures caused by Customer Content, Customer Data, Customer instructions, Customer industry rules, Customer misuse, or the Customer’s failure to obtain valid consents or comply with Applicable Law.

15. Account registration and security

15.1 The Customer must provide accurate, complete, and current account, billing, business, verification, and contact information.

15.2 The Customer is responsible for maintaining the confidentiality of login credentials, controlling user permissions, enabling appropriate security settings, and all activity occurring under its account.

15.3 The Customer must promptly notify us of suspected unauthorised access, compromise, misuse, loss of credentials, or security incidents affecting its account.

15.4 We may disable, restrict, or require changes to login credentials, integrations, sending features, user permissions, or account access where reasonably necessary for security, compliance, fraud prevention, provider requirements, or suspected misuse.

15.5 Platform accounts are intended to be controlled by the Customer named in the relevant Order or by the business that authorised and paid for the account. Accounts are not transferable except with our prior written consent or as required by law.

15.6 If there is a dispute regarding ownership or control of an account, sub-account, domain, Communications Asset, data set, subscription, or workspace, we may request evidence and may consider factors such as the paying entity, account creator, verified administrator, company documents, proof of authority, correspondence history, domain ownership, signed agreements, court orders, or other evidence we reasonably consider relevant.

15.7 We are not required to act as arbitrator of account ownership disputes. We may suspend or restrict access while a dispute is unresolved, and we may act on the evidence reasonably available to us. The disputing parties remain responsible for resolving the underlying dispute between themselves.

15.8 The Customer indemnifies Grow by Systems against claims, losses, liabilities, costs, and expenses arising from false authority, unauthorised account access, disputed ownership, internal business disputes, or instructions given by persons who appeared to us to be authorised, except to the extent caused by our breach of these Terms.

16. Acceptable use policy and prohibited activities

16.1 You must use the Services only for lawful business purposes and in accordance with these Terms, the applicable Order, third-party provider rules, provider pass-through requirements, Fair Use, and Applicable Law.

16.2 You must not, and must not permit anyone else to:

·       use the Services for unlawful, harmful, fraudulent, misleading, abusive, harassing, discriminatory, defamatory, obscene, exploitative, violent, extremist, or unsafe activity;

·       send spam, unsolicited messages, unlawful marketing, phishing messages, malware, deceptive communications, misinformation, fake reviews, or messages without required consent or lawful basis;

·       upload or process data that you do not have the right to use, disclose, transfer, import, or instruct us to process;

·       attempt to gain unauthorised access to the Services, our systems, another customer’s data, third-party systems, or connected services;

·       interfere with, disrupt, overload, reverse engineer, decompile, disassemble, scrape, copy, resell, sublicense, benchmark for competitive purposes, or misuse the Services except as expressly permitted;

·       circumvent usage limits, sending limits, identity verification, sender registration, compliance checks, suppression lists, billing controls, suspension measures, or security controls;

·       use the Services to make unlawful automated decisions, conduct unlawful profiling, or process special category, criminal offence, children’s, financial, health, or highly sensitive data without our prior written approval and appropriate safeguards;

·       misrepresent identity, sender details, caller ID, domain ownership, business name, offer, pricing, customer relationship, review status, or opt-out mechanism;

·       infringe third-party intellectual property, privacy, publicity, confidentiality, contractual, platform, carrier, or provider rights;

·       use AI chat, content generation, automation, or campaign tools in a manner that is deceptive, unlawful, discriminatory, unsafe, high-risk, or likely to cause harm; or

·       access or use the Services in breach of UK, US, EU, UN, or other applicable sanctions, export-control restrictions, restricted-party rules, or prohibited-jurisdiction rules.

16.3 Fair Use applies to all Services, including plans described as unlimited, all-inclusive, generous, or similar. We may throttle, restrict, suspend, require an upgrade, apply additional charges, impose usage limits, or terminate affected Services where usage is excessive, abusive, technically harmful, unusually high, commercially unreasonable, unlawful, or likely to affect other customers, providers, networks, deliverability, security, or platform integrity.

16.4 We may investigate suspected breaches and may suspend, restrict, disable, remove, or terminate access, features, sending, integrations, campaigns, Communications Assets, or data processing where we reasonably consider it necessary to protect Grow by Systems, other customers, third-party providers, data subjects, networks, reputation, or legal compliance.

17. Prohibited industries and restricted activities

17.1 We may refuse, suspend, or terminate Services for businesses, campaigns, content, or activities that we consider high-risk, prohibited by third-party provider rules, unlawful, unsuitable, harmful to deliverability or reputation, or outside our risk appetite. Additional prohibited or restricted industries may be listed on our website, in an Order, or notified to you in writing.

17.2 Unless expressly approved by us in writing and permitted by all Applicable Law and third-party provider rules, you must not use the Services in connection with:

·       illegal products, services, content, or activities;

·       fraud, scams, phishing, malware, impersonation, social engineering, fake reviews, fake engagement, pyramid schemes, get-rich-quick schemes, deceptive earnings claims, or misleading business opportunities;

·       unlicensed financial services, unlawful financial promotions, credit repair, debt relief, payday lending, lending, investment, securities, cryptoasset, insurance, tax, legal, immigration, or regulated professional services where approval, licensing, or regulatory permissions are required;

·       adult entertainment, sexual content, escort services, pornography, or sexually explicit products or services;

·       weapons, explosives, controlled substances, illegal drugs, cannabis products, drug paraphernalia, tobacco, vaping, nicotine, or regulated age-restricted goods except where expressly permitted;

·       gambling, betting, lotteries, competitions, sweepstakes, or prize promotions except where lawful and expressly approved;

·       healthcare, medical, pharmaceutical, mental health, supplements, weight-loss, or high-risk wellbeing claims unless lawful, substantiated, appropriately licensed, and expressly approved;

·       hate, harassment, extremist content, political manipulation, voter suppression, unlawful discrimination, misinformation, or activities that exploit vulnerable persons;

·       data broking, list selling, unlawful lead generation, unlawful scraping, unsolicited marketing without proper permissions, or enrichment activities prohibited by applicable data providers;

·       high-risk automated eligibility, credit, employment, housing, education, insurance, healthcare, legal, or similarly significant decision-making unless expressly approved and fully lawful;

·       unlawful advertising, misleading claims, unsubstantiated testimonials, false scarcity, deceptive pricing, or non-compliant promotions; or

·       any industry, country, campaign, content, data use, or activity prohibited or restricted by payment providers, SMS providers, email providers, advertising platforms, telecommunications providers, AI providers, app stores, infrastructure providers, or other third-party providers.

17.3 Approval of any restricted activity does not transfer legal responsibility to us. The Customer remains responsible for all legal, regulatory, licensing, platform, provider, advertising, carrier, and consent requirements.

18. Marketing, SMS, email, voicemail, AI, reviews, and advertising compliance

18.1 The Services may enable the Customer to create, manage, automate, send, or track emails, SMS, MMS, RCS, calls, voicemail drops, AI chat interactions, review requests, online forms, adverts, funnels, websites, pixels, and other communications. These tools may be subject to strict legal, carrier, network, provider, advertising, privacy, and platform rules.

18.2 Unless a separate written managed-services agreement expressly states otherwise, the Customer is the sender, advertiser, marketer, seller, telemarketer, campaign owner, data controller, content owner, and business responsible for communications, campaigns, adverts, review requests, calls, messages, lists, audiences, and related tracking sent or configured through the Services.

18.3 The Customer is solely responsible for ensuring that each campaign, message, communication, list, workflow, automation, AI chat flow, review request, advert, funnel, and tracking activity complies with Applicable Law and third-party provider rules in each relevant country, including rules relating to consent, opt-ins, lawful basis, electronic marketing, cookies, tracking, caller identification, sender identification, registration, vetting, throughput, content approval, unsubscribe mechanisms, do-not-call lists, suppression lists, advertising claims, testimonials, reviews, promotions, and record keeping.

18.4 The Customer must comply with all carrier, network, messaging provider, email service provider, app store, advertising platform, payment provider, AI provider, and communications provider requirements, including any registration, vetting, approved-use, content, opt-out, throughput, sender-identification, sender ID, domain verification, number verification, and brand/campaign registration requirements.

18.5 The Customer must maintain adequate evidence of consent, opt-in, customer relationship, lawful basis, suppression handling, unsubscribe compliance, sender authority, campaign approval, and required registrations. We may request evidence where reasonably necessary for compliance, provider requirements, complaints, audits, deliverability, investigations, or risk management.

18.6 Grow by Systems, our CRM, or third-party communications providers may maintain Suppression Records, unsubscribe lists, global exclusion lists, blocked-recipient lists, bounce lists, complaint records, and do-not-contact records to comply with law, provider rules, recipient requests, deliverability requirements, and platform integrity. The Customer must not bypass, disable, override, import around, or otherwise circumvent these records.

18.7 The Customer must not send, instruct us to send, or permit the sending of communications to any person who has not provided required consent, who has opted out, who appears on a suppression list, who has requested not to be contacted, or where sending would breach Applicable Law or provider rules.

18.8 Where Grow by Systems assists with campaign setup, strategy, automation, content, or campaign management, the Customer remains responsible for final approval of recipients, content, claims, sender information, compliance settings, consent status, lawful basis, opt-out handling, and campaign legality unless a separate written agreement expressly allocates responsibility differently.

18.9 AI chat, AI assistance, automation, and content-generation features may be provided by third-party AI providers and may produce inaccurate, incomplete, biased, unsuitable, non-compliant, or unexpected outputs. The Customer is responsible for testing, monitoring, supervising, reviewing, approving, and lawfully using AI configurations, prompts, outputs, and automated workflows, and for ensuring appropriate human review where required.

18.10 The Customer must not use AI features for unlawful, harmful, deceptive, discriminatory, regulated, high-risk, medical, legal, financial, eligibility, employment, housing, credit, insurance, or similarly significant decision-making purposes unless expressly approved in writing and unless all required legal safeguards are in place.

19. Payment terms

19.1 We may charge monthly subscriptions, annual subscriptions, setup fees, usage-based fees, monthly retainer fees, commission-based fees, add-on fees, and other fees agreed in a proposal, Order, statement of work, service agreement, invoice, or written agreement.

19.2 Fees, billing periods, due dates, renewal terms, usage allowances, taxes, currency, payment method, and payment timing are as stated on the website, checkout page, invoice, Order, proposal, or other written agreement.

19.3 Payment methods may include payment providers, bank transfer, or other payment providers added in future. We may change payment providers or require an alternative payment method where reasonably necessary.

19.4 You authorise us and our payment providers to charge your selected payment method for all fees, recurring charges, usage fees, add-ons, taxes, and other amounts due. You must keep payment details valid and up to date.

19.5 All fees are exclusive of VAT and other taxes unless expressly stated otherwise. The Customer is responsible for all applicable taxes, duties, levies, bank charges, currency conversion charges, and withholding taxes. If withholding is required by law, the Customer must gross up the payment so we receive the full amount invoiced, unless prohibited by law.

20. Subscription billing, annual plans, setup fees, retainers, commission fees, usage fees, add-ons, and taxes

20.1 Monthly subscriptions are billed monthly in advance unless stated otherwise. Annual subscriptions are billed annually in advance unless stated otherwise.

20.2 Subscriptions renew automatically for successive billing periods unless cancelled in accordance with these Terms or the applicable Order. Inactivity, non-use, lack of logins, or failure to use the Services is not cancellation.

20.3 Annual subscriptions are paid upfront and are non-refundable unless required by law, expressly agreed in writing, or approved as a conditional exception by Grow by Systems. If you cancel an annual subscription before the end of the annual term, you retain access until the end of the then-current annual billing period unless the account is suspended or terminated earlier under these Terms.

20.4 Setup fees, retainer fees, commission fees, usage-based fees, add-on fees, third-party costs, and fees for Tailored Services are generally non-refundable unless required by law or expressly agreed in writing.

20.5 Retainer fees are payable in advance unless the relevant Order states otherwise. Retainers reserve availability, capacity, and expertise; unused time, activity, or support does not roll over unless expressly agreed in writing.

20.6 Usage Fees may include charges from or relating to communication providers, AI tools, payment functions, storage, email, SMS, telephony, voicemail, integrations, tracking, or other metered services. Usage Fees may vary based on provider pricing, exchange rates, taxes, network charges, carrier charges, provider surcharges, regulatory charges, or usage patterns.

20.7 Some Orders may be all-inclusive and some may be usage-dependent. Where prepaid balances, usage credits, wallet balances, top-ups, automatic replenishment, expiry, refunds, or usage-credit mechanics apply, those terms should be set out in the relevant proposal, Order, statement of work, service agreement, or written agreement. Unless expressly stated in an Order, these Terms do not create any universal wallet or credit-balance arrangement.

20.8 Add-ons may be billed immediately, at the next renewal, pro rata, or as otherwise stated at purchase or in the applicable Order.

20.9 We may increase fees on renewal or by giving reasonable written notice, unless the applicable Order fixes pricing for a specified term. Continued use after the effective date of a price change constitutes acceptance of the updated fees.

20.10 If third-party providers increase costs, add surcharges, impose new compliance fees, require registration charges, change currency conversion arrangements, or alter usage-based pricing, we may pass through those charges or update the affected fees on reasonable notice or as stated in the applicable Order.

21. Bank transfer terms

21.1 Where payment by bank transfer is accepted, invoices are payable by the due date stated on the invoice or, if no date is stated, within 7 days of invoice date.

21.2 Payment is not made until cleared funds are received in our nominated bank account. You are responsible for including accurate invoice references and paying all bank, transfer, currency conversion, and intermediary charges.

21.3 We may require recurring card or direct debit payment for subscriptions or usage-based services and may suspend Services where bank transfer payments are late, incomplete, or administratively unsuitable.

22. Overdue payment and non-payment

22.1 If any amount is overdue or not received in cleared funds by the due date, we may:

  • suspend or restrict access to the Services, including CRM access, sending features, integrations, campaigns, and support;

  • pause or terminate Tailored Services, setup work, retainers, and campaign management;

  • withhold deliverables, exports, handover support, or transfer assistance until payment is made;

  • require payment in advance, a deposit, or a different payment method for future Services; and

  • exercise any other contractual or legal remedy available to us, except that we will not charge interest or late fees on overdue amounts.

22.2 Grow by Systems does not charge contractual interest, statutory interest, late payment interest, late fees, default fees, penalty fees, administrative late fees, or fixed-sum late-payment compensation on overdue amounts.

22.3 We may recover payment-provider, bank, card-network, failed-payment, chargeback, reversal, or similar third-party charges that we actually incur as a result of failed, disputed, reversed, or unauthorised payments, to the extent permitted by law. These are not interest or late fees and are not charged merely because a payment is overdue.

22.4 Suspension for non-payment does not relieve the Customer of the obligation to pay accrued or continuing fees, including subscription fees, notice-period fees, usage fees, commission fees, and third-party costs.

22.5 The Customer must raise any invoice or billing dispute in writing within 30 days of the relevant invoice, charge, or renewal. The notice must identify the disputed amount and the reasons for dispute. Undisputed amounts must be paid when due while the parties review the dispute in good faith.

22.6 Chargebacks, payment reversals, failed payments, or payment-provider disputes do not cancel the Services or remove the Customer’s obligation to pay valid fees. We may suspend Services while a payment issue is investigated or unresolved.

23. Cancellation

23.1 CRM access customers may cancel at any time through the available cancellation process or by written notice to [email protected], unless a different cancellation method is specified in the relevant plan or Order. After cancellation, access continues until the end of the current billing cycle, unless the account is suspended or terminated earlier under these Terms.

23.2 Cancellation stops future renewals but does not entitle the Customer to a refund of amounts already paid, except where required by law or expressly agreed in writing.

23.3 Retainer, setup, commission-based, and Tailored Services may have different cancellation terms as agreed in a proposal, Order, statement of work, service agreement, or other written agreement.

23.4 Where no separate cancellation terms are agreed for tailored retainer services, the default cancellation notice period is 30 days’ written notice. Fees remain payable during the notice period.

23.5 Where no separate cancellation terms are agreed for setup, project, commission-based, or other Tailored Services, cancellation does not affect the Customer’s obligation to pay for work performed, milestones achieved, time reserved, resources allocated, committed costs, usage fees, commission accrued, and any agreed minimum term or non-cancellable fees.

23.6 The Customer is responsible for exporting required data, disabling campaigns, cancelling chargeable add-ons, stopping active sending, and preserving records before cancellation takes effect. We may provide reasonable assistance at our then-current rates unless otherwise agreed.

24. Refund policy

24.1 No refunds are provided as standard.

24.2 Refunds may be processed only in conditional cases at Grow by Systems’ discretion, where required by law, or where agreed in writing.

24.3 Setup fees, annual plans, retainers, commission fees, usage-based fees, add-ons, third-party costs, and fees for Tailored Services are generally non-refundable unless otherwise agreed in writing.

24.4 Any discretionary refund may be subject to conditions, deductions for actual third-party charges incurred, reversal of promotional pricing, repayment of discounts, settlement of outstanding amounts, or confirmation that the Customer has ceased using the relevant Services.

24.5 Issuing a refund in one case does not create an obligation to issue refunds in any other case.

25. Plan changes, upgrades, downgrades, and add-ons

25.1 The Customer may request plan changes, upgrades, downgrades, or add-ons. We may accept or reject such requests at our discretion and may require payment of additional fees or acceptance of additional terms.

25.2 Upgrades may take effect immediately, at the next renewal, or as otherwise agreed. Downgrades may take effect at the next billing cycle unless agreed otherwise.

25.3 Downgrades may result in loss of features, usage allowances, data access, integrations, automation, reporting, sending capability, or support. The Customer is responsible for exporting data and adjusting workflows before a downgrade.

25.4 We may require an upgrade, add-on, usage-dependent arrangement, or separate Order where usage exceeds Fair Use, plan assumptions, provider limits, technical limits, or commercial limits.

26. Suspension and termination

26.1 We may suspend, restrict, or terminate the Services, in whole or in part, immediately or on notice, where:

  • you fail to pay any amount when due;

  • you breach these Terms, the Data Processing Terms, an Order, or third-party provider rules;

  • we reasonably suspect unlawful, fraudulent, harmful, high-risk, abusive, or prohibited activity;

  • required by law, regulator, court, payment provider, communication provider, technology provider, or other third-party provider;

  • continued provision could expose us, customers, providers, networks, data subjects, or the public to legal, security, reputational, financial, or operational risk;

  • your account usage threatens service availability, security, deliverability, network reputation, provider relationships, or platform integrity; or

  • you become insolvent, cease trading, or are unable to pay debts as they fall due.

26.2 Suspension may include disabling access, sending, workflows, integrations, payment functions, AI functions, campaigns, support, exports, or other features. We will use reasonable endeavours to notify you where lawful and practicable, but may act without prior notice where necessary.

26.3 Termination does not affect accrued rights, payment obligations, refund limitations, confidentiality obligations, data protection obligations, limitations of liability, indemnities, dispute resolution provisions, or any clause intended to survive termination.

27. Data access after cancellation or termination

27.1 The Customer should export or download required CRM Data before cancellation or termination. After cancellation or termination, account access may cease at the end of the applicable billing period or earlier if the account is terminated for breach, misuse, legal risk, provider requirement, or non-payment.

27.2 Communications Assets may be released, disabled, suspended, filtered, blocked, reassigned, deleted, disconnected, become unavailable, or become unrecoverable after cancellation, termination, non-payment, provider action, compliance issue, regulatory issue, prolonged inactivity, failed verification, or breach of provider rules. This may include telephone numbers, sender IDs, domains, tracking numbers, email sending domains, verified sender records, templates, registrations, and related assets.

27.3 We are not liable for loss, release, blocking, suspension, filtering, reassignment, or non-recovery of Communications Assets where this results from cancellation, termination, non-payment, provider or carrier action, failure to complete verification, legal or regulatory requirements, or circumstances outside our reasonable control.

27.4 Customer Data may be retained for up to 6 months after cancellation in case the Customer returns, unless deletion is requested earlier in writing and deletion is legally and technically practicable.

27.5 Data may be deleted earlier upon written request unless retention is required or reasonably necessary for legal, accounting, tax, fraud prevention, dispute resolution, contractual, backup, security, audit, regulatory, or commission-based purposes.

27.6 For commission-based services, relevant data may be retained for longer where necessary to calculate, verify, audit, dispute, or evidence commissions.

27.7 Backups and archived copies may not be immediately deleted but will be protected and deleted or overwritten in accordance with our backup and retention processes, subject to legal or contractual retention requirements.

28. Customer Content and Customer Data

28.1 The Customer retains ownership of Customer Content and Customer Data, subject to the rights granted in these Terms and any rights held by third parties.

28.2 The Customer grants Grow by Systems a non-exclusive, worldwide, royalty-free licence to host, copy, transmit, process, display, modify, configure, analyse, use, and otherwise handle Customer Content and Customer Data to provide, secure, support, improve, bill, administer, and protect the Services; comply with law; enforce these Terms; manage disputes; and perform agreed Services.

28.3 The Customer represents and warrants that it has all rights, permissions, licences, consents, notices, and lawful bases necessary to provide Customer Content and Customer Data to us and to authorise our processing, hosting, transmission, use, and disclosure of it as contemplated by these Terms, the Data Processing Terms, and the Services.

28.4 We are not responsible for reviewing Customer Content or Customer Data for accuracy, legality, completeness, consent status, regulatory compliance, or suitability unless expressly agreed in writing.

29. Intellectual property

29.1 Grow by Systems and its licensors retain all rights, title, and interest in and to the Services, platform, CRM configuration methods, software, templates, workflows, automation structures, know-how, methodologies, documentation, training materials, designs, processes, systems, and Grow by Systems materials, except for Customer Content and third-party materials.

29.2 Subject to payment of all applicable fees and compliance with these Terms, we grant the Customer a limited, non-exclusive, non-transferable, revocable right to access and use the Services for its internal business purposes during the applicable subscription or service term.

29.3 Unless expressly agreed in writing, bespoke materials created by us as part of Tailored Services are licensed to the Customer for its internal business use after payment in full, but we retain ownership of underlying templates, methods, know-how, reusable components, generic designs, automation logic, non-customer-specific materials, and pre-existing intellectual property.

29.4 The Customer must not copy, resell, sublicense, disclose, exploit, reverse engineer, or create competing products or services from our platform, documentation, methodologies, templates, workflows, or other Grow by Systems materials except as expressly permitted in writing.

29.5 We may use aggregated, anonymised, or de-identified data and learnings to improve the Services, develop features, analyse usage, benchmark performance, and support our business, provided such data does not identify the Customer or any individual.

30. Third-party technology providers, integrations, infrastructure, and payment providers

30.1 The Services rely on third-party technology providers, third-party infrastructure providers, payment providers, communications providers, analytics providers, AI providers, hosting providers, advertising platforms, app stores, carriers, networks, and integrations.

30.2 Third-party services may be subject to their own terms, acceptable use policies, fees, verification requirements, registration requirements, sending limits, content restrictions, data processing terms, privacy notices, availability, outages, changes, and data practices. The Customer must comply with all applicable third-party rules and provider pass-through requirements.

30.3 We may pass through, enforce, or require compliance with requirements imposed by third-party technology providers, communications providers, infrastructure providers, payment providers, app stores, advertising platforms, carriers, networks, AI providers, and integration providers. This may include identity checks, sender registration, message vetting, campaign approval, domain verification, payment verification, data protection terms, acceptable use restrictions, usage caps, and content restrictions.

30.4 We may suspend, limit, disable, remove, replace, or change features, integrations, Communications Assets, campaigns, sending capability, payment functions, or other Services where required or requested by third-party providers, regulators, carriers, networks, payment providers, advertising platforms, infrastructure providers, or Applicable Law.

30.5 We are not responsible for third-party services, outages, errors, delays, data loss, deliverability issues, provider rejections, policy changes, integration changes, account restrictions, payment holds, chargebacks, network filtering, carrier blocking, registration delays, or feature removals beyond our reasonable control.

30.6 We may add, remove, replace, suspend, or change third-party technology providers, integrations, and infrastructure providers where reasonably necessary or commercially appropriate.

30.7 Payment processing is provided by payment providers and banks. We do not control their approval decisions, settlement timing, chargeback processes, account holds, verification requirements, reserve requirements, or fees.

31. Platform availability and changes

31.1 We will use reasonable endeavours to make the Services available, but we do not guarantee uninterrupted, error-free, secure, or continuous availability.

31.2 The Services may be unavailable, degraded, delayed, restricted, or changed because of maintenance, updates, outages, cyber incidents, provider issues, third-party integrations, regulatory requirements, carrier or network filtering, payment provider restrictions, security measures, excessive usage, force majeure, or other matters beyond our reasonable control.

31.3 We may add, remove, suspend, vary, replace, or discontinue features, integrations, workflows, templates, AI tools, reports, tracking tools, payment functions, or communications functions. Where a material change affects paid Services, we will use reasonable endeavours to provide notice where practicable.

31.4 We may collect, generate, analyse, use, retain, and own Usage Data for security, diagnostics, analytics, reporting, product improvement, service improvement, support, benchmarking, capacity planning, compliance, and business purposes, provided that externally disclosed aggregated or anonymised data does not identify the Customer or any individual.

32. Service-specific deliverables and client cooperation

32.1 For setup, marketing, consulting, retainer, commission-based, and Tailored Services, deliverables, timelines, milestones, dependencies, revisions, assumptions, exclusions, approval processes, and acceptance criteria should be specified in the relevant Order.

32.2 Unless otherwise agreed in writing, estimated timelines are not guaranteed and depend on Customer cooperation, availability of information, third-party approvals, provider availability, technical constraints, and timely payment.

32.3 Customer delays, late feedback, missing information, delayed approvals, unavailable credentials, changed requirements, or failure to attend agreed calls may extend timelines and may result in additional charges.

32.4 If the Customer does not provide required cooperation within a reasonable period, we may pause work, treat milestones as delayed, invoice for work performed or time reserved, revise timelines, or terminate the relevant Services.

33. No guarantee of results

33.1 The Customer acknowledges that CRM use, marketing, advertising, campaigns, funnels, automation, consulting, AI tools, strategy, and business growth services depend on many factors outside our control, including the Customer’s offer, pricing, reputation, sector, market conditions, data quality, customer demand, sales process, response times, budget, compliance, competition, and third-party platforms.

33.2 We do not guarantee any specific results, leads, appointments, sales, revenue, rankings, profitability, conversion rate, deliverability rate, open rate, response rate, customer retention, cost per lead, return on investment, or business outcome.

33.3 Any case studies, examples, estimates, projections, forecasts, benchmarks, or previous results are illustrative only and do not guarantee future performance.

34. Confidentiality

34.1 Each party may receive confidential information from the other. Confidential information includes non-public business, technical, financial, pricing, customer, supplier, marketing, strategic, operational, platform, campaign, account, and data information disclosed in connection with the Services.

34.2 Each party must protect the other party’s confidential information using reasonable care, use it only for the purposes of the contract, and disclose it only to personnel, contractors, advisers, providers, and representatives who need to know it and are subject to appropriate confidentiality obligations.

34.3 Confidentiality obligations do not apply to information that is public other than through breach, already known without restriction, independently developed, lawfully received from a third party, or required to be disclosed by law, regulator, court, or professional adviser.

34.4 These confidentiality obligations survive termination for 5 years, and trade secrets remain protected for so long as they remain trade secrets.

35. Data protection overview

35.1 Each party must comply with applicable data protection laws, including the UK GDPR, Data Protection Act 2018, EU GDPR-style requirements where applicable, PECR and other electronic marketing and cookie rules where applicable.

35.2 For Customer Personal Data processed by Grow by Systems as processor, Schedule 1 — Data Processing Terms applies. For Grow by Systems’ own business administration, billing, account management, analytics, security, legal compliance, product/service improvement, and other controller-side activities, Grow by Systems may act as controller as described in the Privacy Policy.

35.3 The Customer is responsible for its own contacts, leads, prospects, customers, employees, contractors, and end users, including providing privacy notices, obtaining valid consents or other lawful bases, honouring data subject rights, complying with marketing rules, maintaining Suppression Records, and ensuring that Customer instructions are lawful.

35.4 Where the Customer gives end customers, clients, staff, contractors, or other users access to the CRM or any sub-account, the Customer must implement appropriate terms, privacy notices, user controls, consent flows, security settings, and support processes for those users and data subjects.

36. Disclaimers

36.1 The Services are provided on an “as is” and “as available” basis to the maximum extent permitted by law. We exclude all warranties, representations, conditions, and terms that are not expressly set out in these Terms or the applicable Order, including implied warranties of fitness for a particular purpose, satisfactory quality, uninterrupted availability, non-infringement, and compatibility, to the extent permitted by law.

36.2 We do not provide legal, tax, financial, accounting, investment, medical, regulatory, or professional compliance advice unless expressly agreed in writing by a suitably qualified professional. Any general information or suggestions relating to campaigns, privacy, consent, or compliance are not a substitute for the Customer’s own legal advice.

36.3 We do not warrant that third-party providers, integrations, communication networks, payment providers, advertising platforms, search engines, AI tools, or external services will accept, deliver, approve, maintain, display, or process any Customer Content, campaign, transaction, integration, or account.

37. Limitation of liability

37.1 Nothing in these Terms limits or excludes liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, deliberate default, wilful misconduct, breach of any obligation that cannot lawfully be limited or excluded, or any other liability that cannot be excluded or limited by law.

37.2 Subject to clause 37.1, Grow by Systems is not liable for any indirect, consequential, special, incidental, exemplary, or punitive loss or damage, or for any loss of profits, sales, revenue, business, goodwill, reputation, opportunity, anticipated savings, data, use, production, contracts, customers, leads, rankings, advertising performance, return on investment, or wasted expenditure, whether arising in contract, tort, negligence, breach of statutory duty, misrepresentation, restitution, or otherwise.

37.3 Subject to clause 37.1, Grow by Systems’ total aggregate liability arising out of or in connection with the Services, these Terms, the Data Processing Terms, any Order, or their subject matter is limited to the total fees actually paid by the Customer to Grow by Systems for the affected Services in the 12 months immediately preceding the first event giving rise to liability. For free trials, the total aggregate liability is limited to £100. For a one-off setup or project service, the total aggregate liability is limited to the fees paid for that specific service.

37.4 Subject to clause 37.1, Grow by Systems is not liable for loss or damage caused by Customer Content, Customer Data, Customer instructions, Customer systems, third-party providers, integrations, payment providers, communication providers, advertising platforms, network filtering, deliverability issues, account suspensions, legal compliance failures, consents, opt-outs, unlawful campaigns, or circumstances outside our reasonable control.

37.5 The limitations and exclusions in these Terms are intended to apply to the maximum extent permitted by law and are considered by the parties to be reasonable in a business-to-business contract, having regard to the nature of the Services, the fees, the availability of insurance, the Customer’s ability to take independent advice, and the Customer’s control over its data, content, campaigns, and business outcomes.

38. Indemnity

38.1 The Customer indemnifies Grow by Systems against claims, losses, liabilities, damages, fines, penalties, costs, and expenses arising out of or in connection with:

  • the Customer’s breach of these Terms, the Data Processing Terms, an Order, Applicable Law, or third-party provider rules;

  • Customer Content, Customer Data, CRM Data, lists, contacts, leads, campaigns, messages, adverts, funnels, websites, review requests, AI prompts, AI outputs, or communications supplied, approved, uploaded, sent, configured, or controlled by the Customer;

  • lack of consent, invalid opt-ins, deficient privacy notices, unlawful lawful-basis decisions, failure to honour opt-outs, failure to maintain Suppression Records, or non-compliant marketing;

  • chargebacks, payment disputes, payment-provider issues, customer refunds, tax issues, payment holds, transaction disputes, or commission disputes arising from the Customer’s business, products, services, or customers;

  • use of the Services in prohibited industries, restricted activities, sanctioned countries, by restricted parties, or for high-risk activities without required approval;

  • breach of carrier, messaging, email, advertising, AI, payment, app store, or other provider rules;

  • misuse of AI, automation, tracking, pixels, reviews, calls, SMS, email, voicemail, or advertising tools;

  • account ownership disputes, unauthorised instructions, disputed access, or false authority given by or relating to the Customer;

  • relationships, disputes, claims, services, products, advice, communications, or transactions between the Customer and its contacts, leads, prospects, customers, suppliers, contractors, or end users; or

  • any claim that Customer Content, Customer Data, campaign materials, or use of the Services infringes, misuses, or violates a third-party right.

38.2 The indemnity does not apply to the extent a claim is caused by Grow by Systems’ breach of these Terms, gross negligence, wilful misconduct, fraud, or any matter for which liability cannot lawfully be excluded or limited.

38.3We will use reasonable endeavours to notify the Customer of indemnified claims, but failure to notify promptly does not relieve the Customer of liability except to the extent the delay materially prejudices the Customer’s defence.

39. Force majeure

39.1 We are not liable for delay or failure to perform caused by events outside our reasonable control, including acts of God, fire, flood, storm, epidemic, pandemic, war, terrorism, civil unrest, labour disputes, network failures, utility failures, internet outages, provider outages, cyberattacks, denial-of-service attacks, governmental action, regulatory action, changes in law, sanctions, payment provider issues, telecommunications failures, and third-party technology failures.

39.2 If a force majeure event continues for more than 60 days and materially prevents performance, either party may terminate the affected Services on written notice, without prejudice to accrued payment obligations and non-refundable fees.

40. Changes to the Terms

40.1 We may update these Terms from time to time to reflect changes in law, regulation, provider requirements, business practices, Services, technology, security, or commercial arrangements.

40.2 Updated Terms will be published on our website or otherwise notified to you. Unless a different effective date is stated, updated Terms apply when published for new customers and on renewal or continued use for existing customers.

40.3 Material changes that significantly affect existing paid Services will be notified by reasonable means where practicable. Continued use after the effective date constitutes acceptance of the updated Terms.

41. Internal dispute resolution

41.1 If a dispute arises, either party may give written notice describing the dispute and the outcome sought. The parties must first attempt to resolve the dispute through good faith discussions between appropriate representatives.

41.2 Each party must provide reasonable information and cooperation to help resolve the dispute, while preserving all rights and remedies.

41.3 Nothing prevents either party from seeking urgent injunctive relief, protecting confidential information or intellectual property, suspending Services for non-payment or misuse, or taking action to comply with law or provider requirements.

42. Mediation

42.1 If a dispute is not resolved through internal dispute resolution within 30 days, either party may propose mediation. Unless otherwise agreed, mediation will take place in England, in English, with a mediator agreed by the parties or appointed by the Centre for Effective Dispute Resolution (CEDR) or another recognised mediation body.

42.2 Mediation does not prevent either party from commencing court proceedings where necessary to preserve limitation periods, seek urgent relief, recover unpaid undisputed amounts, or protect rights.

43. Governing law and courts of England and Wales

43.1 These Terms, the Data Processing Terms, each Order, and any dispute or claim arising out of or in connection with them or their subject matter are governed by the laws of England and Wales.

43.2 The courts of England and Wales have exclusive jurisdiction over any dispute or claim arising out of or in connection with these Terms, the Data Processing Terms, any Order, or their subject matter, except that Grow by Systems may bring proceedings in any jurisdiction to seek injunctive relief, protect intellectual property or confidential information, recover unpaid amounts, or enforce judgments.

44. Notices and contact details

44.1 Notices to Grow by Systems should be sent to [email protected].

44.2 Notices to the Customer may be sent to the email address, billing address, account address, or contact details associated with the Customer’s account or Order.

44.3 The Customer must keep its contact details up to date. Notices sent by email are deemed received when sent unless the sender receives an automated delivery failure notice.

Schedule 1 — Data Processing Terms

1.     Status and application

1.1 These Data Processing Terms form Schedule 1 to the Terms and Conditions between Faithful Foundations Limited, company number 15721077, registered office Unit 26 Silicon Business Centre, 28 Wadsworth Road, Perivale, UB6 7JZ, London, UK, trading as Grow by Systems (“Grow by Systems”, “we”, “us” or “our”) and the Customer.

1.2 These Data Processing Terms apply where and to the extent that Grow by Systems processes Customer Personal Data as processor on behalf of the Customer in connection with the Services.

1.3 These Data Processing Terms do not apply to Grow by Systems’ processing of personal data as controller for its own business administration, billing, analytics, security, legal compliance, marketing, supplier management, professional advice, dispute handling, service improvement, or other independent purposes described in the Privacy Policy.

1.4 If a separate written data processing agreement, data transfer agreement, proposal, order form, statement of work, or service agreement is agreed between the parties and expressly states that it overrides these Data Processing Terms, that separate agreement will apply to the extent of any conflict.

2.     Parties and roles

2.1 For Customer Personal Data, the Customer is generally the controller and Grow by Systems is generally the processor.

2.2 The Customer determines the purposes and means of processing Customer Personal Data, including what data is uploaded, who it relates to, why it is processed, which campaigns are run, what communications are sent, what consents are required, and how long Customer Personal Data should be retained.

2.3 Grow by Systems processes Customer Personal Data on behalf of the Customer for the purpose of providing, supporting, securing, configuring, administering, and improving the Services, and otherwise in accordance with the Customer’s documented instructions.

2.4 If the parties’ roles differ for a particular processing activity, the relevant Order, proposal, statement of work, service agreement, or other written agreement should state this.

2.5 Grow by Systems may act as controller for its own business administration, billing, account management, analytics, security, fraud prevention, legal compliance, service improvement, marketing to its own prospects and customers, provider management, supplier management, and commission administration.

2.6 Nothing in these Data Processing Terms prevents Grow by Systems from processing personal data where required by law, regulator, court order, or to protect legal rights, provided that Grow by Systems complies with Applicable Data Protection Law.

3.     Definitions

3.1 Terms used in these Data Processing Terms have the meanings given in the Terms unless otherwise stated.

3.2 “Applicable Data Protection Law” means the UK GDPR, the Data Protection Act 2018, PECR where relevant, EU GDPR-style requirements where applicable, and any other privacy or data protection law that applies to the relevant processing.

3.3 “Customer Personal Data” means personal data processed by Grow by Systems as processor on behalf of the Customer in connection with the Services.

3.4 “Customer” means the business, organisation, sole trader, self-employed business owner, or other legal person that uses the Services and determines the purposes and means of processing Customer Personal Data.

3.5 “Subprocessor” means another processor engaged by Grow by Systems to process Customer Personal Data on behalf of the Customer.

3.6 “Suppression Records” means unsubscribe records, opt-out records, do-not-contact records, blocked-recipient records, bounce records, complaint records, suppression-list records, global exclusion records, and similar records used to prevent unlawful or unwanted communications, manage deliverability, evidence compliance, or comply with law or provider requirements.

3.7 The terms “controller”, “processor”, “personal data”, “processing”, “data subject”, “personal data breach”, and “subprocessor” have the meanings given in Applicable Data Protection Law.

4.     Scope of processing

4.1 These Data Processing Terms cover processing of Customer Personal Data in connection with CRM access, software access, CRM setup, onboarding, campaign setup, SMS and email setup, funnel building, automation setup, consulting, marketing services, campaign management, retainer services, commission-based services, reporting, support, and related Services.

4.2 The subject matter, duration, nature and purpose, categories of personal data, categories of data subjects, and processing activities are described in these Data Processing Terms, the Terms, the applicable Order, and Annex 1.

5.     Subject matter, duration, nature, and purpose of processing

5.1 The subject matter of processing is the provision of the Services to the Customer, including CRM access, CRM configuration, onboarding, setup, marketing support, campaign management, consulting, retainer services, commission-based services, reporting, support, security, and related platform functionality.

5.2 Processing continues for the duration of the Customer’s use of the Services and for any further period required or permitted under the Terms, these Data Processing Terms, applicable Orders, retention requirements, backup cycles, legal obligations, accounting or tax requirements, dispute resolution, fraud prevention, security, contractual enforcement, suppression requirements, provider requirements, or commission verification.

5.3 The nature and purpose of processing include hosting, storing, organising, accessing, configuring, transmitting, displaying, analysing, importing, exporting, copying, deleting, securing, supporting, reporting, troubleshooting, and otherwise processing Customer Personal Data to provide and support the Services.

6.     Categories of personal data

6.1 Categories of personal data may include:

  • contact details;

  • business details;

  • CRM notes and tags;

  • communications;

  • marketing preferences;

  • consent records and opt-out records;

  • pipeline, opportunity, booking, calendar, and form data;

  • website and funnel activity;

  • SMS, email, voicemail, AI chat, call, review request, and marketing campaign data;

  • transaction and payment-related CRM data;

  • financial tracking data;

  • commission tracking data;

  • reporting data;

  • usage data;

  • analytics data; and

  • other data uploaded, submitted, generated, or processed by the Customer through the Services.

6.2 The Customer must not upload special category data, criminal offence data, children’s data, or highly sensitive data unless expressly approved by Grow by Systems in writing and unless appropriate legal conditions, safeguards, notices, consents, and instructions are in place.

7.     Categories of data subjects

7.1 Categories of data subjects may include the Customer’s business users, employees, contractors, owners, directors, representatives, contacts, leads, prospects, customers, end customers, subscribers, form submitters, website visitors, booking contacts, reviewers, and other individuals whose data is uploaded to or processed through the Services.

8.     Customer instructions

8.1 Grow by Systems will process Customer Personal Data only on the Customer’s documented instructions unless required to do otherwise by law.

8.2 The Customer’s documented instructions include the Terms, these Data Processing Terms, the applicable Order, the Customer’s account configuration, Customer instructions submitted through the Services, and written instructions accepted by Grow by Systems.

8.3 Grow by Systems may refuse or suspend an instruction if it reasonably believes the instruction breaches Applicable Data Protection Law, marketing law, third-party provider rules, the Terms, these Data Processing Terms, or creates legal, security, operational, reputational, deliverability, regulatory, or provider risk.

8.4 If Grow by Systems believes an instruction infringes Applicable Data Protection Law, it will inform the Customer unless prohibited by law or where doing so would compromise security, investigations, legal rights, provider compliance, or the rights of another person.

8.5 The Customer is responsible for ensuring that all instructions are lawful, documented, accurate, complete, and within the scope of the Services.

9.     Confidentiality

9.1 Grow by Systems will ensure that persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations, whether contractual, statutory, professional, or otherwise legally binding.

9.2 Grow by Systems will limit access to Customer Personal Data to personnel, contractors, providers, and subprocessors who need access for the purposes of providing, securing, supporting, or administering the Services.

10.   Security measures

10.1 Grow by Systems will implement appropriate technical and organisational measures designed to protect Customer Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure, taking into account the nature of the processing, available technology, implementation costs, and risk to individuals.

10.2 Security measures may include the measures described in Annex 2 and any other measures implemented from time to time.

10.3 Security measures may evolve and be updated, provided that the updates do not materially reduce the overall level of protection for Customer Personal Data.

10.4 The Customer acknowledges that security also depends on the Customer’s configuration, user access controls, credentials, devices, networks, connected accounts, integrations, user permissions, and internal practices.

10.5 The Customer must implement appropriate security measures for its own systems, users, accounts, devices, connected tools, and CRM configuration.

11.   Subprocessors

11.1 The Customer gives Grow by Systems general written authorisation to engage subprocessors and third-party technology providers to process Customer Personal Data in connection with the Services.

11.2 Grow by Systems may maintain a subprocessor list online, in Annex 3, in a customer portal, by email notice, or by another reasonable method.

11.3 The Customer is deemed to approve the subprocessors listed or otherwise disclosed for the Services at the time the Customer enters into the Terms, starts a trial, signs or accepts an Order, accesses the CRM, or uses the Services.

11.4 Grow by Systems will impose data protection obligations on subprocessors that are appropriate to the processing and provide a level of protection for Customer Personal Data materially consistent with these Data Processing Terms, taking into account the nature of the subprocessor’s services.

11.5 Grow by Systems remains responsible to the Customer for performance of its processor obligations under these Data Processing Terms, subject to the limitations of liability in the Terms and these Data Processing Terms.

11.6 Grow by Systems may add, remove, or replace subprocessors from time to time. Where required by Applicable Data Protection Law, Grow by Systems will provide notice of intended material changes by publishing an updated subprocessor list, updating the Privacy Policy, notifying account administrators, or using another reasonable method.

11.7 The Customer may object to a new subprocessor on reasonable data protection grounds only by written notice within 30 days of notice. The objection must identify the relevant subprocessor and explain the specific data protection grounds for objection.

11.8 The parties will work in good faith to address a valid objection. If the objection cannot be resolved, Grow by Systems may provide a workaround, suspend the affected Services, or permit termination of the affected Services.

11.9 The Customer’s remedy for an unresolved subprocessor objection is termination of the affected Services, unless Applicable Data Protection Law requires a different remedy.

12.   Third-party technology providers

12.1 The Customer acknowledges that the Services are provided using third-party technology providers, infrastructure providers, communications providers, AI providers, payment providers, analytics providers, hosting providers, integrations, and other service providers.

12.2 Some third-party providers may act as subprocessors for Customer Personal Data, while others may act as independent controllers for their own processing, such as payment processing, fraud prevention, regulatory compliance, network security, provider account administration, or legal compliance.

12.3 The precise role of a third-party provider should be assessed based on the provider and the relevant processing activity.

12.4 The Customer must comply with all applicable third-party provider terms, platform rules, carrier rules, communications rules, payment provider rules, advertising platform rules, AI provider rules, and other provider requirements communicated or made available to the Customer.

13.   International transfers

13.1 Grow by Systems and its subprocessors may process Customer Personal Data in, or transfer Customer Personal Data to, countries outside the UK or the country in which the Customer or data subjects are located.

13.2 Where such transfer is a restricted transfer under Applicable Data Protection Law, Grow by Systems will use an appropriate transfer mechanism where required.

13.3 Appropriate transfer mechanisms may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, EU Standard Contractual Clauses, transfer risk assessments, supplementary measures, or another lawful mechanism.

13.4 The Customer authorises Grow by Systems to make international transfers as necessary to provide the Services, subject to the safeguards required by Applicable Data Protection Law.

14.   Assistance with data subject rights

14.1 Taking into account the nature of the processing and the information available to Grow by Systems, Grow by Systems will provide reasonable assistance to the Customer, by appropriate technical and organisational measures where possible, to help the Customer respond to requests from data subjects exercising rights under Applicable Data Protection Law.

14.2 If Grow by Systems receives a request directly from a data subject relating to Customer Personal Data, Grow by Systems may refer the request to the Customer unless legally required to respond directly.

14.3 Assistance beyond standard platform functionality or ordinary support may be chargeable at Grow by Systems’ then-current rates unless the request arises from Grow by Systems’ breach of these Data Processing Terms.

15.   Assistance with security, breach notifications, and DPIAs

15.1 Taking into account the nature of the processing and the information available to Grow by Systems, Grow by Systems will provide reasonable assistance to the Customer in relation to security obligations, personal data breach notifications, data protection impact assessments, and prior consultation with regulators where required by Applicable Data Protection Law.

15.2 Grow by Systems will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.

15.3 A notification under clause 15.2 may include available information about the nature of the breach, categories and approximate number of affected data subjects and records where known, likely consequences, and measures taken or proposed, to the extent available and appropriate.

15.4 The Customer is responsible for determining whether a breach is notifiable to a regulator or data subjects and for making such notifications unless Applicable Data Protection Law requires Grow by Systems to notify directly.

15.5 The Customer is responsible for complying with breach notification obligations arising from its own systems, users, campaigns, end customers, integrations, instructions, CRM configurations, unlawful marketing, or Customer-controlled data practices, except to the extent caused by Grow by Systems’ breach of these Data Processing Terms.

15.6 Grow by Systems’ notification of, investigation into, or response to a security incident is not an admission of fault or liability.

16.   Return or deletion of data

16.1 At the end of the Services, Grow by Systems will, at the Customer’s choice and subject to the Terms, these Data Processing Terms, technical feasibility, payment of applicable non-late-payment fees, and Applicable Data Protection Law, delete or make available for return Customer Personal Data processed as processor.

16.2 Customer data may be retained for up to 6 months after cancellation in case the Customer returns, unless deletion is requested earlier in writing and deletion is legally and technically practicable.

16.3 Grow by Systems may retain Customer Personal Data or copies where required or reasonably necessary for legal, accounting, tax, fraud prevention, dispute resolution, contractual, backup, security, audit, regulatory, compliance, provider, sanctions, export-control, suppression, or commission-based purposes.

16.4 Suppression Records may be retained for as long as reasonably necessary to honour opt-outs, prevent unlawful re-contact, evidence consent or opt-out status, comply with law or provider rules, protect deliverability, and manage complaints.

16.5 For commission-based services, relevant data may be retained for longer where necessary to calculate, verify, audit, dispute, or evidence commissions.

16.6 Backup copies may not be immediately deleted but will be protected from active processing and deleted or overwritten in accordance with backup cycles, unless retained for legal, security, dispute, compliance, provider, suppression, or commission-related purposes.

17.   Audit rights

17.1 Grow by Systems will make available information reasonably necessary to demonstrate compliance with these Data Processing Terms, subject to confidentiality, security, legal privilege, provider restrictions, protection of other customers, and commercial sensitivity.

17.2 The Customer may request an audit no more than once in any 12-month period, unless required by a regulator or following a confirmed personal data breach affecting Customer Personal Data.

17.3 Audits must be conducted on reasonable written notice, during normal business hours, in a manner that minimises disruption and protects the confidentiality and security of Grow by Systems, its systems, providers, and other customers.

17.4 Where possible, audits should be satisfied through written responses, summaries, security documentation, certifications, third-party reports, or remote review rather than on-site inspection.

17.5 Any on-site audit requires Grow by Systems’ prior written approval, appropriate confidentiality undertakings, scope agreement, and reimbursement of reasonable costs.

17.6 The Customer must ensure that any auditor is independent, suitably qualified, not a competitor of Grow by Systems, and bound by confidentiality obligations acceptable to Grow by Systems.

18.   Customer responsibilities

18.1 The Customer is responsible for:

(a)   complying with Applicable Data Protection Law in relation to Customer Personal Data;

(b)   providing all required privacy notices to data subjects;

(c)    identifying and documenting lawful bases for processing;

(d)   obtaining and recording consents where required;

(e)   ensuring that Customer Personal Data is accurate, relevant, limited, lawful, and not prohibited by the Terms;

(f)     ensuring that Customer instructions to Grow by Systems are lawful and within the scope of the Services;

(g)   responding to data subject rights requests, regulator enquiries, complaints, and marketing opt-outs relating to Customer-controlled data;

(h)   maintaining Suppression Records, unsubscribe records, do-not-contact records, consent records, opt-in evidence, and campaign approvals;

(i)     not bypassing, disabling, overriding, or circumventing suppression lists, unsubscribe controls, global exclusion lists, or blocked-recipient records maintained by the CRM, Grow by Systems, or third-party providers;

(j)     configuring the CRM, user permissions, integrations, security settings, tracking tools, cookie or consent tools, and retention settings appropriately;

(k)    complying with carrier, email, SMS, voicemail, payment, advertising, AI, app store, telecommunications, and other provider rules;

(l)     complying with sanctions, export-control, restricted-party, prohibited-jurisdiction, and regulated-industry requirements; and

(m)  ensuring that Customer users, employees, contractors, agents, end customers, and sub-account users comply with the Terms and these Data Processing Terms.

19.   Marketing law responsibility

19.1 The Customer is responsible for ensuring that all marketing, SMS, MMS, RCS, email, voicemail, calls, AI chat, review request, advertising, tracking, funnel, form, website, and campaign activities comply with Applicable Law.

19.2 Applicable Law for campaigns may include PECR, UK GDPR, EU GDPR-style requirements, CAN-SPAM, TCPA, US state privacy laws, platform policies, telecommunications rules, carrier rules, advertising platform rules, payment provider rules, and local laws applicable to recipients.

19.3 Unless a separate written managed-services agreement expressly states otherwise, the Customer is the sender, advertiser, marketer, seller, telemarketer, campaign owner, data controller, content owner, and business responsible for communications and campaigns configured, sent, tracked, or managed through the Services.

19.4 Grow by Systems is not responsible for the Customer’s failure to obtain valid consent, maintain opt-in records, honour opt-outs, comply with suppression lists, provide privacy notices, substantiate advertising claims, complete sender registrations, or comply with campaign-specific laws unless caused by Grow by Systems’ breach of these Data Processing Terms.

19.5 The Customer must promptly notify Grow by Systems of any complaint, regulator enquiry, provider enquiry, carrier complaint, claim, or investigation relating to campaigns or Customer Personal Data processed through the Services where Grow by Systems may be affected or required to assist.

20.   Grow by Systems as controller for its own business purposes

20.1 Grow by Systems may process personal data as controller for its own business purposes, including account administration, billing, supplier management, customer relationship management, sales, marketing, analytics, security, fraud prevention, tax, accounting, legal compliance, service improvement, and dispute resolution.

20.2 Such controller processing is governed by the Privacy Policy and is outside the processor obligations in these Data Processing Terms, except where Applicable Data Protection Law requires otherwise.

20.3 Grow by Systems may collect, generate, use, retain, and own Usage Data, aggregated data, anonymised data, de-identified data, diagnostics, and service analytics for security, reporting, product and service improvement, benchmarking, capacity planning, compliance, and business purposes.

20.4 Externally disclosed aggregated or anonymised data will not identify the Customer or any individual.

20.5 For Customer Personal Data processed as processor, Grow by Systems does not receive Customer Personal Data as consideration for the Services and does not intend to sell Customer Personal Data or take action that would cause transfers of Customer Personal Data to Grow by Systems to constitute a “sale” of Customer Personal Data under applicable US privacy laws, unless otherwise expressly disclosed and legally permitted.

21.   Liability and indemnity

21.1 The limitations, exclusions, indemnities, and liability caps in the Terms apply to these Data Processing Terms to the maximum extent permitted by law.

21.2 Nothing in these Data Processing Terms limits any liability that cannot lawfully be limited or excluded.

21.3 Nothing in these Data Processing Terms prevents data subjects or regulators from exercising rights or powers under Applicable Data Protection Law.

21.4 The Customer indemnifies Grow by Systems for claims, losses, fines, penalties, costs, and expenses arising from Customer instructions, Customer Personal Data, unlawful campaigns, missing consents, inadequate privacy notices, data subject complaints, marketing law breaches, third-party provider rule breaches, or Customer breach of these Data Processing Terms, subject to the Terms and Applicable Law.

22.   Order of precedence

22.1 If there is a conflict between the main body of the Terms and these Data Processing Terms in relation to the processing of Customer Personal Data, these Data Processing Terms take precedence to the extent of that conflict only.

22.2 If there is a conflict between these Data Processing Terms and a separate signed data processing agreement, data transfer agreement, standard contractual clauses, UK International Data Transfer Agreement, UK Addendum, or other mandatory transfer terms, the mandatory or signed terms will prevail to the extent required by law or expressly agreed.

22.3 If there is a conflict between a Customer instruction and Applicable Data Protection Law, Grow by Systems may suspend the instruction and notify the Customer where legally permitted.

23.   Governing law and jurisdiction

23.1 These Data Processing Terms and any dispute or claim arising out of or in connection with them are governed by the laws of England and Wales.

23.2 The courts of England and Wales have exclusive jurisdiction over disputes arising out of or in connection with these Data Processing Terms, subject to any mandatory rights of regulators or data subjects under Applicable Data Protection Law and any enforcement rights set out in the Terms.

24.   Data protection contact

24.1 Data protection requests and notices relating to these Data Processing Terms should be sent to [email protected].

Annex 1 — Processing details

Subject matter: Provision of CRM access, software access, onboarding, setup, marketing, consulting, campaign management, automation, funnel, reporting, retainer, commission-based, and business growth services.

Duration: For the term of the Services and any further period required or permitted under the Terms, these Data Processing Terms, applicable Orders, legal obligations, backup cycles, dispute resolution, security, suppression, provider compliance, or commission verification requirements.

Nature of processing: Hosting, storing, organising, accessing, configuring, transmitting, displaying, analysing, importing, exporting, copying, deleting, securing, supporting, reporting, troubleshooting, and otherwise processing Customer Personal Data.

Purpose of processing: To provide, support, secure, configure, administer, bill, and report on the Services; to perform agreed setup, marketing, retainer, commission, and growth services; to comply with lawful Customer instructions; and, where applicable, to maintain, troubleshoot, and improve the Services in a manner consistent with the Terms, the Privacy Policy, and Applicable Data Protection Law.

Categories of personal data: Contact details, business details, CRM notes, communications, marketing preferences, consent and opt-out records, pipeline data, booking data, form submissions, website and funnel activity, SMS, email, voicemail, AI chat data, review request data, transaction and payment-related CRM data, financial tracking data, commission tracking data, reporting data, usage data, analytics data, and other data uploaded or generated by the Customer.

Categories of data subjects: Customer users, employees, contractors, owners, directors, representatives, contacts, leads, prospects, customers, end customers, subscribers, form submitters, website visitors, booking contacts, reviewers, and other individuals whose data is uploaded to or processed through the Services.

Special category data: Not intended or permitted unless expressly approved by Grow by Systems in writing and supported by appropriate legal bases, safeguards, notices, consents, and contractual terms.

Customer instructions: The Terms, these Data Processing Terms, applicable Orders, account configuration, Customer use of the Services, and written instructions accepted by Grow by Systems.

Annex 2 — Security measures

Grow by Systems will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure, taking into account the nature of the processing, the Services provided, the available technology, implementation costs, and the risk to individuals.

Such measures may include, where appropriate and applicable to the Services:

(a)   access controls designed to limit access to Customer Personal Data to authorised personnel, contractors, providers, and subprocessors who require access for legitimate business purposes;

(b)   confidentiality obligations for personnel and contractors who are authorised to access Customer Personal Data;

(c)    authentication and account-access controls where supported by the relevant platform, infrastructure, or technology providers;

(d)   technical protections for data transmission, hosting, storage, and platform security where supported or provided by relevant third-party technology and infrastructure providers;

(e)   reasonable administrative, organisational, and provider-management measures relating to subprocessors and third-party technology providers;

(f)     processes for assessing and responding to suspected security incidents affecting Customer Personal Data;

(g)   data backup, restoration, deletion, or deactivation processes where supported by the relevant Services, platform, and infrastructure providers; and

(h)   periodic review and improvement of security practices where appropriate.

Security measures may be updated, replaced, or improved from time to time, provided that such changes do not materially reduce the overall level of protection for Customer Personal Data.

The Customer acknowledges that the security of Customer Personal Data also depends on matters within the Customer’s control, including account configuration, user permissions, password practices, multi-factor authentication settings where available, device security, network security, connected accounts, integrations, user training, and the Customer’s own internal policies and procedures.

The Customer is responsible for implementing appropriate technical and organisational measures for its own systems, users, devices, accounts, connected tools, CRM configuration, campaign configuration, and Customer-controlled data practices.

Annex 3 — Subprocessors and third-party providers

Grow by Systems uses third-party technology providers, infrastructure providers, communications providers, payment providers, analytics providers, support providers, professional advisers, and other service providers to provide, secure, support, administer, and improve the Services.

These providers may include providers in the following categories:

a)     CRM/platform technology providers;

b)     cloud, hosting, infrastructure, storage, backup, and security providers;

c)     email delivery, tracking, bounce, complaint, and suppression providers;

d)     SMS, MMS, RCS, telephony, voicemail, phone-number, carrier-compliance, and communications providers;

e)     AI, automation, content-assistance, and workflow-support providers;

f)      payment, subscription billing, refund, fraud-prevention, chargeback, payment-dispute, and settlement providers;

g)     website analytics, pixel, attribution, advertising measurement, reporting, and audience-measurement providers;

h)     cookie consent, preference-management, and consent-record providers;

i)       customer support, live chat, ticketing, and customer communications providers;

j)       accounting, bookkeeping, invoicing, tax, reconciliation, and financial-record providers; and

k)     legal, accounting, tax, compliance, insurance, audit, and other professional advisers.

Grow by Systems may update, add, remove, or replace subprocessors and third-party providers from time to time in accordance with these Data Processing Terms. Where required by Applicable Data Protection Law, Grow by Systems will provide notice of intended material changes by publishing an updated list, updating the Privacy Policy, notifying account administrators, or using another reasonable method.

Customers may request further information about subprocessors relevant to their Services by contacting [email protected]. Grow by Systems may require appropriate confidentiality protections before disclosing commercially sensitive provider information.

Annex 4 — International transfer mechanisms

Where Customer Personal Data is transferred outside the UK or other protected territory in a manner requiring safeguards, the parties may rely on one or more of the following, as applicable and as updated from time to time:

(a)   UK adequacy regulations or other adequacy decisions applicable to the destination country or recipient;

(b)   the UK International Data Transfer Agreement;

(c)    the UK Addendum to the EU Standard Contractual Clauses;

(d)   EU Standard Contractual Clauses where EU GDPR applies;

(e)   transfer risk assessments and supplementary technical, contractual, or organisational measures where required; and

(f)     derogations or other lawful mechanisms where legally available and appropriate.

Annex 5 — Customer marketing law responsibilities

The Customer is responsible for confirming and documenting the following before running campaigns through the Services:

(a)   lawful basis for processing each contact, lead, prospect, customer, or end user record;

(b)   valid opt-in or other permission for each email, SMS, MMS, RCS, voicemail, call, review request, or marketing communication where required;

(c)    accurate sender identity, contact information, and business identity disclosures;

(d)   working unsubscribe, opt-out, suppression, global exclusion, and do-not-contact handling;

(e)   privacy notice and cookie/tracking disclosures for forms, funnels, landing pages, websites, pixels, CRM tracking, analytics, and advertising technologies;

(f)     evidence of consent, existing customer relationship, legitimate interests assessment, suppression status, or other lawful basis where applicable;

(g)   required sender, brand, campaign, number, domain, email, advertising, or communications-provider registrations, vetting, and approvals;

(h)   country-specific rules for recipients outside the UK, including EU, US, California, Canada, Australia, and other local rules where applicable;

(i)     sanctions, export-control, prohibited-jurisdiction, and restricted-party screening where relevant; and

(j)     advertising platform, telecommunications, carrier, payment provider, email provider, SMS provider, voicemail provider, review platform, AI provider, app store, and other third-party rules.