Legal

Terms of Business

Version 1.1 · Last updated: 25 October 2026

These terms apply to every website project and ongoing service I provide. They're written to be as clear as possible, but they are a legal agreement, so please read them before signing a Client Agreement. If anything isn't clear, just ask.

How these terms are arranged: clauses 1 to 18 apply to every client. Schedule 1 applies if you take one of my monthly hosting or care plans, or I manage domain names for you. Schedule 2 applies whenever I handle personal data on your behalf.

1. About me and these terms

1.1Links Web Studio is the trading name of Stuart Mathieson, a sole trader based in Carnoustie, Angus, Scotland ("I", "me", "my"). My postal address is given in the Client Agreement. Email: [email protected]. Phone: 07775 106423.

1.2These Terms apply to all Services I supply to the business named in the Client Agreement ("Client", "you", "your"). They apply instead of any terms you try to impose or include, or which are implied by trade, custom, practice or course of dealing.

1.3My Services are supplied only to businesses and other organisations acting in the course of their trade, business, craft or profession. By accepting a Client Agreement you confirm that you are not acting as a consumer.

2. Definitions

2.1In these Terms:

1. (a)"Agreement" means the Client Agreement and these Terms, including the Schedules that apply to you under clause 3.3;
2. (b)"Business Day" means a day other than a Saturday, Sunday or public or bank holiday in Scotland;
3. (c)"Care Plan Services" means the website care services described in paragraphs 7 and 8 of Schedule 1, which are included in the Hosting + Care and Complete Care Plans;
4. (d)"Client Agreement" means my order form that records the website package and/or Plan you have chosen, the agreed price and any details specific to your project, once you have accepted it under clause 3.2;
5. (e)"Client Materials" means all text, images, logos, trade marks, data, content, logins and other materials that you, or anyone on your behalf, supply to me;
6. (f)"Deliverables" means the website, designs, code, graphics and other materials I produce for you under the Agreement, as described in the Client Agreement;
7. (g)"Hosting Services" means the hosting, backup, security and domain services described in Schedule 1;
8. (h)"Intellectual Property Rights" means copyright, database rights, design rights, trade marks, rights in domain names, rights in confidential information and all other intellectual property rights, whether registered or not, anywhere in the world;
9. (i)"My Pre-existing Materials" means code, frameworks, templates, plugins, components, tools, know-how and other materials that I created or obtained before, or independently of, the Agreement, including improvements to them;
10. (j)"Plan" means the monthly plan you choose in the Client Agreement: Essential Hosting, Hosting + Care or Complete Care;
11. (k)"Quote" means a fixed price I give you in writing for work that is not included in your package or Plan. A Quote only becomes binding when you accept it in writing (email is enough);
12. (l)"Services" means the services described in the Client Agreement, which may include design, development, Hosting Services and Care Plan Services;
13. (m)"Third-Party Materials" means software, themes, plugins, fonts, stock images, services and other materials owned by third parties, including open-source software such as WordPress and WooCommerce.

2.2Headings do not affect interpretation. "Including" and similar words do not limit the words before them. "Writing" and "written" include email. A reference to a "paragraph" is to a paragraph of the Schedule in which it appears, unless stated otherwise.

3. How the contract is formed

3.1A Client Agreement I send you is an offer that is valid for 30 days from its date, unless I withdraw it sooner.

3.2The Agreement comes into force when you accept the Client Agreement by signing it (including electronically), by confirming acceptance by email, or by paying the deposit, whichever happens first.

3.3The Agreement is made up of: (a) the Client Agreement; (b) clauses 1 to 18 of these Terms, which apply to every client; (c) Schedule 1 (Hosting and Care Plans), which applies if you buy a Plan or I register or manage domain names for you; and (d) Schedule 2 (Data Processing Terms), which applies whenever I process personal data on your behalf.

3.4If there is a conflict between the parts of the Agreement, they take priority in this order: (1) Schedule 2, as it relates to personal data; (2) the Client Agreement; (3) Schedule 1; (4) clauses 1 to 18 of these Terms.

4. My obligations

4.1I will supply the Services with reasonable care and skill and substantially in accordance with the Client Agreement.

4.2I will use reasonable efforts to meet any dates set out in the Client Agreement, but those dates are estimates only. Time is not of the essence unless I expressly agree otherwise in writing.

4.3I may use subcontractors, including hosting providers and freelance specialists, to supply parts of the Services. I remain responsible for their work under the Agreement.

5. Your obligations

5.1You will:

1. (a)supply all Client Materials, information, decisions and approvals I reasonably need, on time and in the formats I reasonably ask for;
2. (b)name one person with authority to make decisions and give approvals for you;
3. (c)make sure the Client Materials are accurate and lawful, and that you have all the rights and permissions needed for me to use them for the Services;
4. (d)give me access to your existing systems, accounts, domain registrar and hosting accounts where the Services need it; and
5. (e)keep your own passwords secure and tell me promptly if you believe any account related to the Services has been compromised.

5.2If you delay or fail to meet your obligations, I am not responsible for any resulting delay or failure on my part. I may adjust the timetable and charge reasonable additional fees for extra work or rescheduling caused by the delay.

5.3If a project is on hold for more than 30 days because I am waiting for Client Materials, approvals or payment from you, I may do one or more of the following after giving you written notice: (a) invoice for all work done to date; (b) treat the project as complete for the purpose of payment; or (c) move the project back in my work schedule.

5.4You are solely responsible for the content of your website and for making sure that the website, and your use of it, complies with the law. This includes your privacy notice, cookie consent choices, website terms, e-commerce and consumer law requirements, accessibility obligations, and advertising and sector-specific rules. I may give general technical guidance, but I do not provide legal advice.

5.5For e-commerce websites, you are also responsible for: opening and managing your own payment provider account (for example Stripe or PayPal); your product information, prices, delivery charges and VAT settings; your terms of sale, returns and cancellation policies; and handling your customers' orders, payments, refunds and complaints.

6. Fees and payment

6.1You will pay the fees set out in the Client Agreement. Unless the Client Agreement says otherwise:

1. (a)for projects, 50% of the project fee is payable as a deposit before work starts, and the balance is payable on completion or at the milestones set out in the Client Agreement. Once I have started work, the deposit is not refundable;
2. (b)Plans are invoiced monthly in advance; and
3. (c)work that is not included in your package or Plan is charged only under a Quote you have accepted. I will not start chargeable work without your written agreement.

6.2Invoices are payable within 14 days of the invoice date, by bank transfer to the account shown on the invoice.

6.3I am not currently registered for VAT. If I become VAT-registered, VAT will be added to my fees at the applicable rate from the date of registration.

6.4If you do not pay any amount on time, I may, without affecting my other rights:

1. (a)claim interest and fixed-sum compensation under the Late Payment of Commercial Debts (Interest) Act 1998, together with my reasonable costs of recovery;
2. (b)suspend work on any project; and
3. (c)suspend the Hosting Services and Care Plan Services in line with paragraph 10 of Schedule 1.

6.5I may review the fees for Plans once in each 12-month period by giving you at least 30 days' written notice. If you do not accept the increase, you may end the affected Plan by written notice before the increase takes effect, without paying an early termination fee.

6.6You may not withhold or set off any amount against sums due to me, except as required by law.

7. Changes to the Services

7.1Either of us may ask for a change to the scope of the Services. I will tell you in writing of any effect on fees and timescales. A change will only take effect once both of us have agreed it in writing (email is enough).

7.2Unless the Client Agreement says otherwise, a project includes two rounds of revisions. Further revisions, or requests outside the scope of the Client Agreement, are charged only under a Quote.

8. Acceptance

8.1When I tell you that the Deliverables (or a milestone) are ready, you have 5 Business Days to review them and either (a) confirm acceptance or (b) tell me in writing, in reasonable detail, where they do not materially meet the Client Agreement.

8.2I will fix any defects you notify under clause 8.1(b) within a reasonable time and resubmit the Deliverables. Clause 8.1 then applies again to the resubmitted Deliverables.

8.3The Deliverables are treated as accepted on the earliest of: (a) your written acceptance; (b) the end of the review period without a notice under clause 8.1(b); or (c) the website being made publicly available (going live) at your request.

8.4For 30 days after acceptance I will fix, free of charge, any errors in my code that stop the Deliverables from materially meeting the Client Agreement. This does not apply to problems caused by: changes made by you or a third party; Third-Party Materials or their updates; hosting that I do not provide; or browsers and devices not listed in the Client Agreement.

9. Intellectual property

9.1You keep ownership of all Intellectual Property Rights in the Client Materials. You grant me a non-exclusive, royalty-free licence to use the Client Materials for the purpose of supplying the Services.

9.2Subject to clause 9.3 and to your paying all sums due under the relevant Client Agreement in full, I assign to you, with effect from the date of that full payment, all Intellectual Property Rights in the Deliverables that were created specifically for you under that Client Agreement, including the final visual design. Until full payment, I grant you a non-exclusive, revocable licence to use the Deliverables for review and testing only.

9.3I keep ownership of all Intellectual Property Rights in My Pre-existing Materials. Where they form part of the Deliverables, I grant you, with effect from full payment, a non-exclusive, perpetual, irrevocable, royalty-free, worldwide licence to use, copy and modify them as part of your website and for your own business purposes. You may not resell or distribute them separately.

9.4Third-Party Materials are licensed to you under their owners' licence terms. Where a third-party licence is bought in my name (for example a premium theme or plugin developer licence), the Client Agreement will say so, and that licence may end if you stop using my Care Plan Services. I will tell you in the Client Agreement about any ongoing licence costs you will need to meet.

9.5To the extent the law allows, I waive any moral rights I have in the Deliverables assigned to you under clause 9.2.

9.6Unless you tell me otherwise in writing, I may show the Deliverables and your name and logo in my portfolio and marketing, and may include a discreet credit link in the website footer, which you may ask me to remove.

9.7You will indemnify me against all claims, losses and reasonable costs arising from any claim that my use of the Client Materials in accordance with the Agreement infringes a third party's rights.

10. Confidentiality

10.1Each of us will keep confidential all information about the other's business that it receives in connection with the Agreement and that is marked confidential or would reasonably be regarded as confidential. Neither of us will use that information except to perform the Agreement.

10.2Clause 10.1 does not apply to information that is or becomes public (other than through a breach of this clause), that was already lawfully known to the recipient, or that must be disclosed by law or by a court or regulator.

10.3This clause 10 continues for 3 years after the Agreement ends.

11. Data protection

11.1Each of us will comply with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended from time to time (together, "Data Protection Law").

11.2Where I process personal data on your behalf as your processor, including through the Hosting Services or Care Plan Services or when handling data on your website during a project, Schedule 2 applies.

11.3I process your contact and billing details, and those of your staff, as a controller in line with my privacy policy.

12. Security and backups

12.1I will take reasonable technical and organisational measures to protect the Deliverables and any systems I manage for you. Where you have a Plan, the security and backup arrangements are set out in Schedule 1.

12.2No website or system can be made completely secure. Once the Deliverables have been handed over: unless you have a Plan with me, you are responsible for keeping your own backups; and unless you have a Hosting + Care or Complete Care Plan, you are responsible for keeping your website's software updated.

13. My liability to you

13.1Nothing in the Agreement limits or excludes my liability for: (a) death or personal injury caused by my negligence or breach of duty; (b) fraud or fraudulent misrepresentation; or (c) any other liability that cannot be limited or excluded by law.

13.2Subject to clause 13.1, I am not liable, whether in contract, delict (including negligence), breach of statutory duty or otherwise, for any: (a) loss of profits, sales, business or revenue; (b) loss of anticipated savings; (c) loss of goodwill or damage to reputation; (d) loss or corruption of data, except that where I provide backups under paragraph 5 of Schedule 1 my liability for loss of data is limited to using reasonable efforts to restore the most recent available backup; or (e) indirect or consequential loss.

13.3Subject to clause 13.1, my total liability to you arising out of or in connection with the Agreement, whether in contract, delict (including negligence), breach of statutory duty or otherwise, is limited to the total fees you have paid to me under the Agreement in the 12 months before the event giving rise to the claim.

13.4I do not guarantee any particular search engine ranking, traffic level, sales or business result, or that the website will be compatible with all browsers, devices or future software versions.

13.5Except as set out in the Agreement, all warranties, conditions and other terms implied by statute or common law are excluded to the fullest extent the law allows.

14. Term and termination

14.1The Agreement starts as described in clause 3.2. It continues until all projects are completed and all Plans have ended in line with Schedule 1.

14.2You may end a project before it is completed by giving me written notice. You must then pay: (a) a fair proportion of the project fee reflecting the work done up to the date of termination; and (b) any committed costs I cannot recover. The deposit counts towards these sums. Once I have started work it is not refundable, even if these sums are less. If you end the project before I have started work, I will refund the deposit less any committed costs I cannot recover.

14.3Either of us may end the Agreement, or any part of it, with immediate effect by written notice if the other:

1. (a)commits a material breach that cannot be remedied, or does not remedy a remediable breach within 14 days of being asked in writing to do so;
2. (b)becomes insolvent or apparently insolvent, has a trust deed granted or sequestration awarded (or the equivalent anywhere else), enters into any arrangement with creditors, has a receiver, administrator or liquidator appointed, or stops trading; or
3. (c)is the Client and has not paid any undisputed invoice within 30 days of its due date (only I may rely on this ground).

14.4When the Agreement or any part of it ends:

1. (a)you will pay all outstanding invoices, and I may invoice for work done but not yet invoiced;
2. (b)clause 9.2 applies only to Deliverables that have been paid for in full;
3. (c)paragraphs 12 and 13 of Schedule 1 (ending a Plan) apply to any Plan; and
4. (d)clauses 6, 9, 10, 11, 13, 14.4 and 16 to 18, paragraph 13 of Schedule 1 and Schedule 2 continue in force for as long as they are relevant.

15. Events outside our control

15.1Neither of us is liable for any delay or failure to perform its obligations (other than payment obligations) caused by events beyond its reasonable control. These include failures of third-party hosting, data centres, networks, power or telecommunications, cyber-attacks that could not reasonably have been prevented, severe weather, pandemic, industrial action by third parties, and acts of government.

15.2If such an event continues for more than 30 days, either of us may end the affected Services by written notice, without any early termination fee.

15.3Because I am a sole trader, if I am unable to work because of serious illness or injury, this counts as an event beyond my control. Where possible, I will arrange for a suitably qualified substitute or help with an orderly handover to another provider.

16. Notices

16.1Notices under the Agreement must be in writing and sent by email to the address given in the Client Agreement (or any updated address notified in writing), or by recorded delivery post to the other party's business address.

16.2An email notice is treated as received at 9.00am on the next Business Day after it is sent, unless the sender receives a delivery failure message. A posted notice is treated as received two Business Days after posting.

17. General

17.1Entire agreement. The Agreement is the entire agreement between you and me about its subject matter and replaces all earlier discussions and proposals. Neither of us has relied on any statement not set out in the Agreement. This does not limit liability for fraud.

17.2Changes to these Terms. I may update these Terms from time to time. Updated Terms apply to new Client Agreements. For an existing Plan, they apply from the start of the first billing month that begins at least 30 days after I give you written notice. If you do not accept the change, you may end the affected Plan by written notice before it takes effect, without paying an early termination fee. Earlier versions are available on request.

17.3Assignation. You may not assign, transfer or subcontract the Agreement without my written consent. I may assign or transfer the Agreement to a successor business (including a company I control) by giving you written notice.

17.4Waiver. A failure or delay in exercising a right is not a waiver of that right.

17.5Severability. If any provision is found invalid or unenforceable, the rest of the Agreement is unaffected.

17.6Third parties. Nothing in the Agreement confers any right on a third party, whether under the Contract (Third Party Rights) (Scotland) Act 2017 or otherwise.

17.7Relationship. I am an independent contractor. Nothing in the Agreement creates a partnership, employment or agency relationship, except that I act as your agent when managing domain names under paragraph 11 of Schedule 1.

17.8Electronic acceptance. The Agreement may be accepted electronically and, where signed, may be executed in counterparts and delivered electronically in line with the Legal Writings (Counterparts and Delivery) (Scotland) Act 2015.

18. Governing law and disputes

18.1If a dispute arises, each of us will first try in good faith to resolve it by discussion within 14 days of written notice of the dispute. This does not stop either of us seeking urgent interim relief, including interim interdict.

18.2The Agreement, and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it, is governed by the law of Scotland.

18.3The Scottish courts have exclusive jurisdiction.

Schedule 1 – Hosting and Care Plans

Applies if you buy a Plan, or I register or manage domain names for you

1. Interpretation

1.1This Schedule forms part of the Agreement. Words defined in clauses 1 to 18 of these Terms have the same meaning here.

1.2"Content Hours" means the time included in the Complete Care Plan each month for content changes and small tasks, recorded in 15-minute units.

1.3"Hosting Account" means the hosting space, databases, email accounts (if included) and related resources I provide for your website, as described in the Client Agreement.

1.4"Upstream Provider" means the third-party hosting company I use to provide the Hosting Services, currently Hostinger, with servers located in the United Kingdom.

1.5"Working Hours" means 9am to 5pm on Business Days.

2. The Plans

2.1The table below summarises what each Plan includes. The price in your Client Agreement is the one that applies to you.

2.2Paragraphs 3 to 6 and 8 to 14 apply to every Plan. Paragraph 7 applies only to the Hosting + Care and Complete Care Plans.

3. Hosting

3.1I will provide the Hosting Account for your website, including: secure UK hosting; an SSL certificate; the backups described in paragraph 5; server-level security monitoring; and email accounts, but only where they are listed in your Client Agreement.

3.2The Hosting Services are shared hosting unless the Client Agreement says otherwise. Resource limits (such as storage, bandwidth and processing) apply as set out in the Client Agreement or as reasonably set by me to protect other users.

3.3I may change the Upstream Provider, server or technical set-up, provided this does not materially reduce the Hosting Services. Where a change needs downtime or affects where your data is stored, I will give you reasonable notice.

4. Availability

4.1I will use reasonable efforts to make the Hosting Services available 24 hours a day, 7 days a week, with a target availability of 99.5% each calendar month, excluding Planned Maintenance and the events described in paragraph 4.3.

4.2"Planned Maintenance" means maintenance I have given you at least 48 hours' notice of, or emergency maintenance needed to deal with security threats, which I will carry out outside Working Hours where reasonably possible.

4.3The availability target does not apply to unavailability caused by: (a) you, your users or your contractors, including changes to the website, plugins or code; (b) events outside my reasonable control under clause 15; (c) suspension under paragraph 10; or (d) failures of DNS, domain registrars or internet connectivity outside the Hosting Account.

4.4The availability figure is a target, not a guarantee, and failing to meet it is not in itself a breach of the Agreement. If you report a shortfall, I will investigate it and tell you what I am doing about it.

5. Backups

5.1On every Plan, I will take daily backups of the website files and databases in the Hosting Account and keep them for 30 days, stored securely by me or the Upstream Provider.

5.2On request, I will use reasonable efforts to restore the most recent available backup. The first restore in any 12-month period is free of charge. Further restores requested by you (other than to fix my own error) are charged under a Quote.

5.3Backups are provided for disaster recovery. They are not an archive. I do not guarantee that any backup will be complete or free from errors. You should keep your own copies of important content and data.

6. Security

6.1I will take appropriate technical and organisational measures to protect the Hosting Account. These include: keeping server software updated (where I manage it); SSL/TLS encryption; firewall and malware scanning; restricted access to administrative credentials; and two-factor authentication on my administrative accounts.

6.2You are responsible for: keeping your website administration passwords confidential and strong; the security of any software or plugins you install yourself; and, unless you have a Hosting + Care or Complete Care Plan, keeping your website's content management system (such as WordPress), themes and plugins updated.

6.3If I find that the website has been compromised or is spreading malware, I may immediately isolate it or take it offline to protect other users and systems. I will tell you as soon as reasonably possible. Clean-up work beyond any allowance included in your Plan is charged under a Quote.

7. Care Plan Services (Hosting + Care and Complete Care only)

7.1I will provide the items listed for your Plan in paragraph 2 with reasonable care and skill.

7.2Before applying significant updates I will take a backup, and where reasonably practicable I will check the website after applying them. If an update causes a problem, I will use reasonable efforts to roll it back or fix it. Time spent fixing problems caused by my updates does not count towards your Content Hours.

7.3Content Hours can be used for: content updates (text, images, new pages using existing templates); minor layout adjustments; plugin configuration; and advice on the website. They cannot be used for new features, redesigns or development work over 2 hours per task, which I will provide under a Quote.

7.4Unused Content Hours expire at the end of each month. They have no cash value and are not refunded.

7.5Work beyond your Plan is charged only under a Quote that you have accepted before I start.

7.6The Care Plan Services do not include:

1. (a)fixing problems caused by changes you or third parties make to the website without my agreement;
2. (b)fixing problems caused by third-party services, plugins or themes that are no longer supported by their developers, or where no fix is available;
3. (c)upgrades that need significant redevelopment, such as a major version change of the content management system or PHP, or replacing an abandoned plugin, which I will provide under a Quote;
4. (d)content creation, copywriting, SEO campaigns or marketing; or
5. (e)guaranteeing that the website will be free from security breaches.

8. Support requests and response times

8.1Please send support requests to [email protected]. Urgent issues (the website is down, hacked or unable to take orders) should also be reported by phone to 07775 106423.

8.2Response times in paragraph 2 are targets for my first response, not for resolving the issue. They run only during Working Hours or on Business Days, as stated. I will use reasonable efforts to meet them, but failure to meet a target is not a breach of the Agreement.

8.3I may decide how to prioritise requests, acting reasonably, and will give priority to urgent issues.

9. Your responsibilities

9.1You will: give me the administrative access I need; tell me promptly about any issues you notice; and keep your payment details up to date. If you have a Hosting + Care or Complete Care Plan, you will not install plugins or change code without telling me first.

9.2Where your website has a content management system such as WordPress, you must keep at least one administrator account of your own. I will not remove your access.

9.3You will comply with, and make sure users of your Hosting Account comply with, the Acceptable Use Policy in paragraph 14 and the Upstream Provider's acceptable use terms, which I will provide on request.

9.4You are responsible for all content on your website, including content posted by your users, and for any obligations you have under the Online Safety Act 2023 or other laws that apply to user-generated content.

10. Suspension

10.1I may suspend all or part of the Hosting Services and Care Plan Services:

1. (a)immediately, where necessary to deal with a security threat, a breach of the Acceptable Use Policy that is causing or may cause harm, or a legal requirement, or where required by the Upstream Provider; or
2. (b)after at least 7 days' written notice, if any invoice is more than 14 days overdue.

10.2I will restore the services promptly once the reason for the suspension has been resolved.

10.3Fees remain payable during a suspension caused by you.

11. Domain names

11.1Where I register or renew domain names for you, I will register them in your name (or your organisation's name) as the registrant, with your contact details, unless you ask me in writing to do otherwise. I will act as your agent in managing them.

11.2You are responsible for making sure the domain names you ask for do not infringe anyone else's rights, and for complying with the registry's terms (for example Nominet's terms for .uk domains).

11.3I will use reasonable efforts to renew domain names before they expire, provided the relevant fees have been paid. I am not liable for the loss of a domain name where renewal fees are unpaid, or where you have not responded to renewal requests at least 14 days before expiry.

11.4On request, and once all sums due for the relevant domain name have been paid, I will provide the transfer authorisation code (or equivalent) and co-operate with transferring the domain name to another registrar or provider.

12. Term, changing and ending a Plan

12.1Your Plan starts on the date set out in the Client Agreement and continues for an initial term of 12 months. It then continues on a rolling monthly basis until either of us ends it by giving at least 30 days' written notice, expiring at the end of the initial term or at any time afterwards.

12.2Plan fees are invoiced monthly in advance. Fees paid for a month are not refundable if the Plan ends during that month, except where you end the Plan because of my material breach, in which case I will refund the fees paid for any period after the end date.

12.3You may move to a higher Plan at any time, effective from the next billing date. You may move to a lower Plan after the initial term, by giving 30 days' written notice.

12.4If your Plan ends before the end of the initial term because you end it, or because I end it under clause 14.3, you must pay an early termination fee equal to one month's fee for that Plan or, if less, the fees for the rest of the initial term.

12.5No early termination fee is payable where you end a Plan: because of my material breach; under clause 6.5 (fee increase), clause 15.2 (events outside our control) or clause 17.2 (changes to these Terms); or under paragraph 4.2 of Schedule 2 (objection to a new sub-processor).

13. When a Plan ends

13.1When a Plan ends for any reason, provided all sums due have been paid, I will:

1. (a)on request made at least 7 days before the end date, provide a full copy of your website files and database in a standard format (for example a compressed archive and database export), once free of charge;
2. (b)provide reasonable help with migrating to another provider, charged under a Quote;
3. (c)give you a list of the credentials I hold for your website, and remove or disable my access (or hand over admin access) as you reasonably ask; and
4. (d)give you any third-party licence keys held for your website, where the licence terms allow transfer. Where a licence was bought in my name and cannot be transferred, clause 9.4 applies.

13.2I will keep the Hosting Account data for 30 days after the end date and then permanently delete it, along with backups, within a further 30 days, unless the law requires me to keep it.

13.3Personal data in the Hosting Account is also covered by paragraph 3.1(g) of Schedule 2.

14. Acceptable Use Policy

14.1You must not use the Hosting Services to store, publish, send or link to material that:

1. (a)is unlawful, fraudulent, defamatory, obscene, threatening, harassing or discriminatory;
2. (b)infringes anyone's Intellectual Property Rights or privacy;
3. (c)contains viruses, malware or other harmful code; or
4. (d)promotes or facilitates illegal activity.

14.2You must not use the Hosting Services to:

1. (a)send unsolicited bulk email (spam) or messages that break the Privacy and Electronic Communications Regulations 2003;
2. (b)try to gain unauthorised access to any system, account or data, or carry out scanning, denial-of-service or other attacks;
3. (c)run cryptocurrency mining, file-sharing services, public proxies or other resource-heavy processes not described in the Client Agreement; or
4. (d)use resources in a way that damages the performance or stability of the service for others.

14.3I may remove or disable access to material that I reasonably believe breaches this Policy, or that I receive a credible legal complaint about. Where it is reasonable to do so, I will tell you first.

Schedule 2 – Data Processing Terms

Article 28 UK GDPR processor terms – applies whenever I process personal data on your behalf

When I build, host or look after your website, I may be able to see personal data it collects, such as contact form enquiries or customer orders. UK GDPR requires a written contract setting out how I handle that data for you. This Schedule is that contract.

1. Definitions and roles

1.1In this Schedule, "controller", "processor", "data subject", "personal data", "personal data breach", "processing" and "supervisory authority" have the meanings given in the UK GDPR. "Data Protection Law" has the meaning given in clause 11.1. "Client Personal Data" means the personal data described in Annex 1 that I process on your behalf under the Agreement.

1.2For Client Personal Data, you are the controller and I am the processor.

2. Your obligations as controller

2.1You are responsible for making sure you have a lawful basis for the processing, that you have given data subjects appropriate privacy information, and that your instructions to me comply with Data Protection Law.

2.2You are responsible for deciding what personal data your website collects, and for the cookie consent and privacy settings you ask me to put in place.

3. My obligations as processor

3.1I will:

1. (a)process Client Personal Data only on your documented instructions, including about transfers outside the UK, unless the law requires otherwise; in that case I will tell you before processing unless the law prohibits this. The Agreement and your written instructions given through my normal support channels are your documented instructions. I will tell you immediately if I believe an instruction breaks Data Protection Law;
2. (b)make sure that anyone I authorise to process Client Personal Data is bound by a duty of confidentiality;
3. (c)take the technical and organisational security measures required by Article 32 UK GDPR, including those described in Annex 2;
4. (d)comply with paragraph 4 when engaging sub-processors;
5. (e)taking into account the nature of the processing, assist you by appropriate technical and organisational measures, so far as possible, to respond to requests from data subjects to exercise their rights;
6. (f)assist you in meeting your obligations under Articles 32 to 36 UK GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to me;
7. (g)at your choice, delete or return all Client Personal Data to you when the relevant Services end, and delete existing copies (including backups, within the backup retention period), unless the law requires me to keep them; and
8. (h)make available to you the information needed to show compliance with this Schedule and Article 28 UK GDPR, and allow for and contribute to audits and inspections carried out by you or an auditor you appoint, on reasonable notice, no more than once in any 12-month period (unless a supervisory authority requires it or following a personal data breach), and subject to reasonable confidentiality obligations.

3.2I may charge for help under paragraphs 3.1(e), (f) and (h) under a Quote, except where the help is needed because I have breached this Schedule.

4. Sub-processors

4.1You give me general authorisation to engage sub-processors. The sub-processors I use are listed in Annex 3 and, where relevant to your website, in your Client Agreement.

4.2I will tell you at least 14 days in advance of any intended addition or replacement of a sub-processor. You may object on reasonable data protection grounds within that period. If I cannot reasonably accommodate the objection, either of us may end the affected Services by written notice without penalty.

4.3I will impose data protection obligations on each sub-processor by written contract that are no less protective than those in this Schedule, to the extent they apply to the services the sub-processor provides. I remain liable to you for the performance of each sub-processor's obligations.

5. International transfers

5.1I will not transfer Client Personal Data outside the United Kingdom, or allow a sub-processor to do so, unless the transfer is permitted under Chapter V UK GDPR, for example to a country covered by UK adequacy regulations or subject to appropriate safeguards such as the UK International Data Transfer Addendum.

6. Personal data breaches

6.1I will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Client Personal Data.

6.2The notification will include, as far as the information is then available: the nature of the breach, including the categories and approximate number of data subjects and records involved; the likely consequences; and the measures taken or proposed to deal with it. I will provide further information as it becomes available.

6.3I will take reasonable steps to contain and investigate the breach, and will co-operate with you. You are responsible for deciding whether to notify the ICO and data subjects, and for doing so.

7. Liability and duration

7.1Each party's liability under this Schedule is subject to the limitations and exclusions in clause 13, except where Data Protection Law does not allow this.

7.2This Schedule continues for as long as I process Client Personal Data, and ends automatically when I have deleted or returned all Client Personal Data under paragraph 3.1(g).

Annex 1 – Details of processing

The details below describe my standard processing. Any details specific to your website are set out in your Client Agreement, and those take priority.

Annex 2 – Security measures

• Hosting in UK data centres operated by Hostinger
• Encryption in transit (TLS/SSL) for websites and administration
• Strong unique passwords kept in an encrypted password manager, and two-factor authentication on all my administrative accounts
• Access to client systems limited to me
• Regular software updates and security patches (where covered by the Services)
• Firewall and malware scanning, and uptime monitoring
• Daily backups kept for 30 days, stored securely
• Encrypted devices with screen locks and up-to-date anti-malware on my computers
• Secure deletion of data at the end of the retention period
• A documented procedure for responding to personal data breaches

Annex 3 – Approved sub-processors

If your website needs another sub-processor (for example a separate email provider), I will name it in your Client Agreement before it is used.