Welcome to Supply Lens. These Terms form our contract with you and set out our obligations as a service provider and your obligations as a customer. You cannot use our Services unless you agree to these Terms.
If you wish to suspend or change the Services (for example, by upgrading to a different tier), you must provide notice to us via email at least 24 hours before the next Payment Date. If you vary the Services and the Fees increase, we will charge you for the increase on a pro-rata basis for the remainder of the period until your next Payment Date.
You agree to the reasonable usage of the Services that form your chosen Membership. If you exceed the inclusions of your Membership (as set out on the Platform) you will incur over usage charges to reflect your increased use of our resources. These additional charges will be automatically charged based on your actual usage, at such rates as specified on the Platform, and are payable in addition to the Fees.
While we strive to always make our Services available to you, we do not make any guarantees that these will be available 100% of the time. Our Services may be disrupted during certain periods, including as a result of scheduled or emergency maintenance.
Our Services may interact with, or be reliant on, Third Party Services. To the maximum extent permitted by law, we are not liable for disruptions or downtime caused or contributed to by Third Party Services. This includes operational issues such as API unavailability, data synchronisation delays, or connectivity problems with third-party platforms, which do not constitute a breach of these Terms by us.
We will try to provide you with reasonable notice, where possible, of any disruptions to your access to our Services.
You represent, warrant and agree that:
To the extent that you are using or accessing our Platform on an iOS device, you acknowledge that these Terms are between you and us only, not with Apple Inc. (Apple), and Apple is not responsible for the Platform or any content available on the Platform. Apple has no obligation to furnish you with any maintenance and support services with respect to our Platform.
If our mobile application fails to conform to any applicable warranty, you may notify Apple and Apple will refund the purchase price of the mobile application to you. To the maximum extent permitted by applicable law, Apple will have no other warranty obligation whatsoever with respect to the mobile application.
Apple is not responsible for addressing any claims by you or any third party relating to our mobile application or your use of our mobile application, including: (1) product liability claims; (2) any claim that our mobile application fails to conform to any applicable legal or regulatory requirement; and (3) claims arising under consumer protection or similar legislation.
Apple and Apple subsidiaries are third-party beneficiaries of these Terms, and upon your acceptance of these Terms, Apple will have the right to enforce these Terms against you as a third-party beneficiary.
This Data Processing Addendum (DPA) supplements the Supply Lens Platform Terms and Conditions and applies to our provision of Services to you under the Terms. This DPA applies from the date you agree to our Terms.
The terms "Commission", "Controller", "Data Subject", "Member State", "Personal Data", "Personal Data Breach", "Processor", "Processing" and "Sub-Processor" have the same meaning as in the UK GDPR.
Where you provide us with Transferred Data, we will process the Transferred Data on your instructions as a Processor (or Sub-Processor if you are a Processor) and you are the Controller. Where we collect personal data from the primary Account holder, we are a Controller.
Each Party agrees to comply with Applicable Data Protection Law in the Processing of Transferred Data. You instruct us to process Transferred Data in accordance with this DPA. We agree to not process Transferred Data other than on your documented instructions.
We agree to take reasonable steps to ensure the reliability of any of our Personnel who may have access to the Transferred Data, ensuring that: (a) access is strictly limited to those individuals who need to access the relevant Transferred Data for the purposes of the Terms; and (b) the relevant Personnel are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, we agree to implement appropriate technical and organisational measures in relation to the Transferred Data to ensure a level of security appropriate to that risk in accordance with Applicable Data Protection Law, taking into account the risks presented by Processing, in particular from a Personal Data Breach.
Where we wish to engage a new Sub-Processor, we agree to provide written notice to you at least 14 days' prior to engaging the new Sub-Processor. You may object in writing within 7 days of such notice, provided that such objection is based on reasonable grounds relating to data protection. If the Parties are not able to achieve resolution, we may at our election: (a) not appoint the proposed Sub-Processor; (b) not disclose any Transferred Data to the proposed Sub-Processor; or (c) inform you that we may terminate the Terms for convenience.
Where we engage a Sub-Processor to process Transferred Data, we agree to enter into a written agreement containing data protection obligations no less protective than those in this DPA. Where the transfer of Transferred Data from us to a Sub-Processor is a Restricted Transfer, it will be subject to the UK Addendum, which shall be deemed to be incorporated into this DPA.
Taking into account the nature of the Processing, we agree to assist you by implementing appropriate technical and organisational measures for the fulfilment of your obligations to respond to requests to exercise Data Subject rights under Applicable Data Protection Law. We agree to promptly notify you if we receive a request from a Data Subject, and ensure that we do not respond to that request except on your documented instructions or as required by Applicable Data Protection Law.
We agree to notify you without undue delay upon becoming aware of a Personal Data Breach affecting Transferred Data, and to provide you with sufficient information to allow you to meet any obligations to report or inform Data Subjects of the Personal Data Breach. We agree to co-operate with you and take reasonable commercial steps to assist in the investigation, mitigation and remediation of each such Personal Data Breach.
We agree to provide reasonable assistance to you, at your cost (to be charged on a reasonable time and materials basis), with any data protection impact assessments, and prior consultations with Supervisory Authorities, which you reasonably consider to be required by article 35 or 36 of the UK GDPR.
Subject to any document retention requirements at law, we agree to promptly and in any event within 30 business days of the date of cessation of any Services involving the Processing of Transferred Data, delete and procure the deletion of all copies of those Transferred Data.
Where required by law, we shall make available to you on request all information reasonably necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits, including inspections, by you or an auditor mandated by you. Any audit must be conducted during our regular business hours, with reasonable advance notice of no less than 30 business days; will be subject to our reasonable confidentiality procedures; must be limited in scope to matters specific to you; and may only be requested a maximum of one time per year, except where required by a competent Supervisory Authority or where there has been a Personal Data Breach caused by us.
To the maximum extent permitted by law, the Liability of each Party and its affiliates under this DPA is subject to the exclusions and limitations of Liability set out in the Terms.
A failure or inability to comply with the terms of this DPA and/or the Applicable Data Protection Law constitutes a material breach of the Terms. In such event, you may require us to suspend the processing of Transferred Data until such compliance is restored, or terminate the Terms effective immediately on written notice. We shall provide a prompt pro-rata refund of all sums paid in advance which relate to the period of suspension or the period after the date of termination. This DPA will remain in effect until, and will terminate automatically upon, deletion by us of all Transferred Data covered by this DPA.
You authorise our engagement of the Sub-Processors already engaged by us at the date of this DPA, which are set out at Annex 2.
| Personal Data Transferred |
|
|---|---|
| Special Categories of Personal Data | Special Categories of Data will not be processed |
| Relevant Data Subjects |
|
| Frequency of the Transfer | Continuous |
| Nature of the Transfer | Collection, organisation, storage (hosting), retrieval and other processing of Transferred Personal Data necessary for us to provide, maintain and improve the Platform; and transmission, disclosure and dissemination of Transferred Personal Data to provide the Services in accordance with the Agreement or as compelled by law. |
| Purpose of Processing | As specified in the Agreement and this DPA |
| Duration of the Processing | The term of the Agreement, and for a period of 30 days after termination or expiry of the Agreement, unless otherwise required by law |
| Sub-Processor | Location | Purpose | Contact |
|---|---|---|---|
| Google LLC (Google Kubernetes Engine) |
London, United Kingdom (European West 2) | Cloud infrastructure, data hosting and container orchestration | cloud.google.com 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA |
| Attio Ltd. | United Kingdom | Customer Relationship Management (CRM) and contact data management | attio.com 18 Crucifix Lane, London, SE1 3JW, United Kingdom |
| Stripe, Inc. | EU (Stripe Payments Europe, Ltd. in Ireland) | Payment processing and billing management | stripe.com The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland |