Between the Client (named in the sign-up form) and Harrison Murray trading as DuePaid, a sole trader, whose address is the address shown on our Contact and legal details page, [email protected]. Registration with the Information Commissioner's Office is in progress. Forms part of the Terms of Business. Version 1.0. Date 19 October 2026.
This is a controller-to-controller agreement. Each of us decides for ourselves how we use the personal data we hold. Neither of us acts as the other's processor for debtor contact data. Capitalised terms have the meanings given in clause 14.
1.1 The Client is an independent controller of its own customer and ledger data. It decides why and how that data is collected and used in its own business, and it remains responsible under data protection law for its own collection of that data and for its decision to share a copy of it with us under this agreement.
1.2 DuePaid is an independent controller of the debtor contact data it holds for collection. Within the Client's instructions in the Terms, we decide how, when and by what channel to chase, we use our own systems, and we source role emails ourselves (for example from company websites and Companies House). The Client does not control those decisions, and we do not act on the Client's behalf as its processor.
1.3 The Client shares the ledger data in clause 2 with us under this agreement. Once we hold it, we are responsible for our own use of it. For the avoidance of doubt, the Client is not responsible for the manner in which we use that data in accordance with this agreement, and we are not responsible for the Client's separate use of the data it holds.
1.4 For our own marketing, our records of the Client's own staff, our fee billing, and our legal and regulatory records, we are also a controller. Those uses are separate from the sharing described in this agreement. Our Privacy Notice explains them, and the Client's own staff may exercise their rights in relation to those records by writing to [email protected].
1.5 Each of us follows the UK GDPR and the Data Protection Act 2018, and each of us will comply with all other data protection law that applies to it in the course of performing this agreement. Neither of us will do anything, or permit anything to be done, that would cause the other to breach those laws, and each of us will give the other reasonable help to show compliance.
2.1 The table below describes the data shared under this agreement and the individuals it concerns. The Client must not send us anything outside it without our prior written agreement. If we receive data that we did not ask for, including any special category data, we will tell the Client and delete it as soon as reasonably practicable, unless we are required by law to keep it.
| Item | Detail |
|---|---|
| Data shared by the Client | Debtor company names and numbers, contact names, work email and postal addresses, job titles, invoice and payment details |
| Data we add | Contact details we find ourselves, replies, message history, contact records, suppression records |
| Data subjects | Directors, employees and finance staff of debtor limited companies and LLPs |
| Special category data | None intended. The Client must not send any. |
3.1 We use the data only to: check and chase overdue business invoices for the Client; record replies and payments; keep an audit trail; handle complaints and legal claims; keep suppression records; and meet our legal duties. We will not use the data for any other purpose that is incompatible with those purposes unless the law requires it or the Client has given its written agreement.
3.2 We do not sell the data, use it for advertising, or use it to market other services to debtor contacts. For the avoidance of doubt, we will not disclose the data to any third party except to the service providers listed in clause 7, to a professional adviser or insurer under a duty of confidence, or where we are required to do so by law, by a court or by a regulator.
3.3 The Client uses data we give back (message history, replies, payment records) only to manage and recover its debts and to meet its own legal duties. The Client will not use that data to contact debtor contacts for any unrelated purpose, will keep it secure, and will not pass it to any third party except its own advisers, service providers and regulators under a duty of confidence.
4.1 Each of us relies on legitimate interests (Article 6(1)(f) UK GDPR): recovering money properly owed between businesses. We have a written legitimate interests assessment, available to the Client on request. Each of us is responsible for deciding for itself that this basis applies to its own use, and each will reconsider it if the circumstances change materially.
4.2 We contact limited companies and LLPs only, never individuals trading as sole traders or partnerships, and we offer a clear way to stop contact. A person who asks us to stop is added to our suppression records, and we will not contact them again about any debt, subject to our duty to pass on to the Client any dispute or reply that concerns the debt itself.
5.1 The Client confirms, for all data it gives us, that: (a) it may lawfully share the data with us for the purposes in clause 3; (b) it has told its customers, in its privacy notice or terms, that it may share their contact data with a collection agent, or it will do so before sharing; (c) the data is accurate, up to date, and limited to what we need; (d) it will tell us the same working day of any change, payment, dispute, objection, or request from an individual that affects the data.
5.2 We rely on the confirmations in clause 5.1 when we accept and use the data. Subject to clause 13 and without prejudice to any other right or remedy available to us, if any confirmation is or becomes untrue, we may suspend our use of the data concerned, and we may stop contacting the affected debtors until the Client has put the matter right to our reasonable satisfaction.
6.1 We will: (a) use the data only for clause 3; (b) tell debtor contacts who we are, that we act for the Client, where we got their data, and their rights (Article 14 information, via our Privacy Notice linked in each message); (c) make sure everyone who handles the data is bound by confidentiality; (d) keep the data secure (clause 8); (e) honour opt-outs and stop requests, and keep a suppression list (email address only); (f) use service providers only under clause 7; (g) not transfer the data outside the UK except under clause 9.
6.2 We will keep accurate records of how we use the data and will, on reasonable written request and not more than once in any 12 months unless a breach has occurred, give the Client the information it reasonably needs to check that we are complying with this agreement. We will use reasonable endeavours to respond within 10 working days.
7.1 We use the providers below to run our service. Each acts for us as a processor under a written contract that requires it to process the data only on our instructions, to keep it confidential and secure, and to meet the requirements of Article 28 UK GDPR. We stay responsible for them, and we will not allow any of them to use the data for its own purposes except as the law requires.
| Provider | What it does | Data | Location / transfer |
|---|---|---|---|
| Anthropic, PBC | Provides software tools that help sort and prepare correspondence | Debtor contact details, invoice details, message content | United States. UK-US data bridge where certified, otherwise the UK IDTA or UK Addendum. |
| Brevo (Sendinblue SAS) | Sends and receives our email | Email addresses, message content | France and the European Economic Area. UK adequacy regulations. |
| Cloudflare, Inc. | Domain, email routing, website delivery, security | Email addresses and message content in transit; website visitor data | Global network; company based in the United States. UK-US data bridge where certified, otherwise the UK IDTA or UK Addendum. |
| Hetzner Online GmbH | Server hosting our database | All data above | Germany and Finland. UK adequacy regulations. |
| A UK print-and-post provider | Printing and posting letters (if used) | Debtor name, address, letter content | UK |
7.2 For Anthropic we use only the commercial API route. The data is not used to develop the provider's own products, and the provider keeps the data only as its commercial terms allow. We do not send client or debtor data to free online services, and we will not do so during the term of this agreement.
7.3 We will give the Client 14 days' written notice of any new or replaced provider. The Client may object in writing on reasonable data protection grounds. If we cannot resolve it, the Client may end the agreement. The Client's right to object does not affect any fee that has already fallen due, and clauses 10.4 and 12 of the Terms of Business will apply on ending.
8.1 Each of us keeps appropriate technical and organisational measures to protect the data against unauthorised or unlawful processing and against accidental loss, destruction or damage, having regard to the state of the art, the cost of implementation, and the nature, scope and risk of the processing. Ours are set out in clause 8.2, and the Client will keep measures of an equivalent standard for the data it holds.
8.2 Our measures are: access limited to those who need it; encrypted connections; the database stored outside any public code repository and backed up nightly; unique credentials with secrets kept out of code; an audit log of every action taken on a debt; and suppression and opt-out records. We review them at least once a year and will improve them where a review shows it is reasonably necessary.
9.1 We will not transfer personal data outside the UK unless there is a lawful safeguard: UK adequacy regulations (including the UK-US data bridge where the recipient is certified), the UK International Data Transfer Agreement or UK Addendum, or another allowed safeguard. Clause 7 states the mechanism for each provider. Where a transfer relies on a safeguard that later ceases to be valid, we will put an alternative safeguard in place or stop the transfer.
9.2 The Client will do the same for any transfer it makes of data shared under this agreement, and it will not transfer that data to any country or organisation in a way that would put us in breach of data protection law. Each of us will, on reasonable request, tell the other which safeguard it relies on for a particular transfer.
10.1 Each of us tells the other without undue delay, and within 48 hours, of becoming aware of a personal data breach that affects data shared under this agreement. The notice must be sent in writing to the contact details given in clause 15, and the time limit applies whether or not the party that is giving it has yet decided that the breach must be reported to the ICO.
10.2 The notice says what happened, what data was involved, the likely effects, and what is being done. Each of us decides for itself whether to notify the ICO (within 72 hours where required) and individuals, and we share information so each can do so. We keep a record of every breach. Neither of us will make any public statement naming the other without giving the other a reasonable chance to comment, unless the law requires it.
11.1 Each of us answers requests (access, correction, deletion, objection) about data it holds, within one month. A request is answered by the party that holds the data to which it relates, and that party is responsible for deciding whether any exemption applies. Neither of us will give a response on behalf of the other without the other's prior agreement.
11.2 If a request reaches one of us and concerns data the other holds or created, we tell the other within 2 working days and give reasonable help (for example, copies of messages or ledger entries). The party that receives the request will also tell the individual who should answer it, where it is lawful and practical to do so, so that the one-month period is met.
11.3 We tell each other of any complaint to the ICO, or ICO enquiry, about shared data, unless the law stops us. Each of us will cooperate reasonably with the other, and with the ICO, in relation to any such complaint or enquiry, and neither of us will admit liability on behalf of the other.
12.1 We keep debtor data while a debt is open, then for 12 months after the case closes. We then delete it. Closing a case includes payment in full, withdrawal by the Client, or the ending of the Terms of Business. Deletion means that we remove the data from our live systems, and it is then overwritten in our backups in the ordinary course.
12.2 We may keep records we must keep by law, or need to deal with a fee dispute, complaint or claim, for 6 years. We then delete them. We will keep such records only to the extent that it is necessary for those purposes, and we will restrict access to them.
12.3 Suppression records (email address only) are kept so we do not contact people again. For the avoidance of doubt, those records are not deleted at the end of the periods in clauses 12.1 and 12.2, because deleting them would defeat their purpose, but they contain no information other than the email address.
12.4 On request when the agreement ends, we give the Client a full record of what we sent and received. The Client's own ledger stays with the Client. We will provide the record in a commonly used electronic format within a reasonable time, and we will not charge for it unless the request is manifestly unreasonable or repeated.
13.1 Liability under this agreement follows the Terms of Business, including the limits and exclusions in clause 11 of those Terms. Nothing in this agreement limits or excludes any liability that cannot be limited or excluded by law, and nothing in it affects the rights of any individual under data protection law or limits the powers of the ICO.
13.2 This agreement and any dispute or claim arising out of or in connection with it, including any non-contractual dispute or claim, are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction to settle any such dispute or claim.
14.1 In this agreement: "ICO" means the Information Commissioner's Office; "Terms of Business" or "Terms" means the terms of that name between us; "UK GDPR" has the meaning given in section 3 of the Data Protection Act 2018; "controller", "processor", "personal data", "personal data breach" and "special category data" have the meanings given in the UK GDPR; and "working day" means a day other than a Saturday, a Sunday or a public holiday in England.
14.2 In this agreement, unless the context requires otherwise: a reference to a clause is to a clause of this agreement; headings are for convenience only; "including" and similar words do not limit the words that come before them; a reference to legislation is to that legislation as amended or re-enacted from time to time; and "writing" includes email. If this agreement conflicts with the Terms of Business on a data protection matter, this agreement prevails.
15.1 Any notice under this agreement must be in writing. A notice to us must be sent by email to [email protected] or by post to the address shown on our Contact and legal details page. A notice to the Client must be sent by email to the address given in the sign-up form or by post to the business address given in it. Each of us must tell the other promptly of any change to these details.
15.2 A notice sent by email is deemed received at the time of sending if that is on a working day between 08:00 and 18:00 UK time, and otherwise at 08:00 on the next working day, provided that the sender has not received a delivery failure message. A notice sent by first-class post is deemed received on the second working day after posting. This clause does not apply to the service of proceedings.
Neither of us is in breach of this agreement, or liable for any delay or failure in performing it, to the extent that the delay or failure is caused by an event or circumstance beyond that party's reasonable control, including fire, flood, severe weather, epidemic, war, terrorism, strikes, or failure of public utilities or telecommunications networks. The affected party must notify the other promptly and use reasonable endeavours to limit the effect. For the avoidance of doubt, this clause does not excuse any obligation to keep data secure under clause 8, to notify a breach under clause 10, or to respond to an individual's request under clause 11.
If any provision of this agreement is or becomes invalid, illegal or unenforceable under the law of any jurisdiction, it will be treated as modified to the minimum extent necessary to make it valid, legal and enforceable, or, if that is not possible, as deleted. Any such modification or deletion does not affect the validity or enforceability of the rest of this agreement, which continues in full force and effect.
A failure or delay by either of us in exercising a right or remedy under this agreement or by law is not a waiver of that right or remedy, and it does not prevent its later exercise. A waiver is effective only if it is given in writing and expressly states that it is a waiver. Unless this agreement says otherwise, the rights and remedies in it are in addition to, and not in substitution for, any rights and remedies provided by law.
19.1 This agreement and the Terms of Business are the whole agreement between us on the sharing and use of personal data, and they supersede all earlier discussions and understandings on that subject. Each of us confirms that it has not relied on any statement that is not set out in them. Nothing in this clause limits or excludes liability for fraud or fraudulent misrepresentation.
19.2 No variation of this agreement is effective unless it is in writing and agreed by us. We may change this agreement by giving the Client 30 days' written notice where the change is needed to reflect a change in the law or in guidance from the ICO, or is otherwise reasonable, and if the Client does not accept the change it may end the agreement under the Terms of Business before the change takes effect.
Neither of us may assign, transfer, subcontract or otherwise deal with this agreement, or any right or obligation under it, without the other's written consent, which must not be unreasonably withheld or delayed, except that we may transfer it to DuePaid Ltd (when formed) on written notice to the Client, and except for the use of service providers under clause 7, for whom we remain responsible. Any transferee must be bound by this agreement in full.
A person who is not a party to this agreement has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce or to enjoy the benefit of any of its terms. For the avoidance of doubt, this does not affect any right that an individual has under data protection law, and it does not affect the rights of the parties to end or vary this agreement without the consent of any third party.
22.1 This agreement may be entered into in any number of counterparts, and each counterpart is an original, but all counterparts together make one agreement. It is sufficient that each of us has accepted the same version of this agreement, whether as part of the Terms of Business or separately.
22.2 Each of us agrees that acceptance of this agreement by clicking to sign online is an electronic signature, that it is legally binding, and that it has the same effect as a handwritten signature. Neither of us will argue that this agreement is invalid or unenforceable only because it was made, signed or kept in electronic form.