This document sets out the terms on which CAROUS LIMITED also trading as CAROUS (a company registered in England and Wales with company number 15180341) (“CAROUS LIMITED”) provides its web-based CMS/DMS tool, associated marketing services, and associated website development, hosting and support services to its customers.

1. DEFINITIONS

1.1. In these terms of service, unless the context otherwise requires, the following definitions shall apply:

“CAROUS Materials“: all information, documents, records, designs, text, images, media files, software, coding, reports and other content and materials which CAROUS provides to or creates for the Customer within the CMS Tool, for the Customer Website or otherwise as part of the Services.

“CAROUS Technology“: Carous software and technology used to provide the Services, including the CMS Tool software.

“Agreement“: the agreement between Carous and the Customer for the provision of Services, comprising these terms of service and the Order (including any terms incorporated by reference within these terms of service or the Order).

“CMS Tool“: the Carous web-based Content Management System (CMS) and Dealer Management System (DMS) tools for assisting with marketing and sales in the automotive industry.

“Customer“: the recipient of the Services, as specified in the Order.

“Customer Account“: The details and files held by Carous of the customer.

“Customer Materials“: all information, documents, records, designs, text, images, media files and other content and materials which the Customer provides to Carous Limited for the purpose of or in relation to the Customer Website or other Services.

“Customer Website“: the Customer’s website, which may be developed, hosted and/or supported by Carous Limited as part of the Services.

“Fees“: the fees payable by the Customer to Carous Limited for the Services, as specified in the Order or subsequently agreed between the parties in relation to that Order. The term “including” shall be interpreted as meaning “including, without limitation”, and “include” shall be interpreted accordingly.

“Intellectual Property“: all intellectual property rights subsisting anywhere in the world, whether or not registered, and all applications, renewals and extensions of the same including copyright, database rights, design rights, patents, utility models, trade marks, service marks, trade names and logos, rights to domain names, rights in goodwill, rights to sue for passing off or unfair competition, rights in know-how and trade secrets.

“Legal Requirements“: laws, regulatory requirements and codes of practice (in all relevant jurisdictions) applicable to the Customer’s business or organisational activities undertaken using the Services (such as its marketing and sales activities), including: (a) marketing laws and advertising codes of practice; (b) data protection and privacy laws; (c) equality and discrimination laws; (d) Intellectual Property laws; (e) laws relating to defamation, harassment and other online harms; (f) consumer protection laws; (g) requirements for online payments; and (h) laws, regulatory requirements and codes of practice which apply to the automotive industry.

“Order“: a written order containing details of the services to be provided by Carous Limited to the Customer and the associated fees.

“Services“: services specified in the Order relating to use of the CMS Tool; associated website development, hosting, support and ecommerce services; and/or SEO, PPC, email marketing, social media management or related marketing services;

“Service Description“: a description of the CMS Tool, marketing services and related services, as may be specified or referred to within the Order.

“Service Start Date“: the date for a Service to commence, as specified in the Order or otherwise agreed between the parties in writing (which, for the avoidance of doubt, may be a different date for different Services).

“User“: an individual user of the Customer Account on behalf of the Customer.

2. SERVICES AND CUSTOMER ACCOUNT
2.1. Carous will provide the Services to the Customer from the Service Start Date.
2.2. The Customer may access (if needed) the CMS Tool over the Internet and a compatible web browser using its Customer Account.
2.3. Carous will:
        (a) provide the Services using reasonable skill and care;
        (b) provide the Services substantially in accordance with the Service Description; and
        (c) use reasonable endeavours to meet any delivery dates and specifications specified in the Order.
2.4. The Customer shall:
        (a) set up individual login details for each User (other than a superuser set up by Carous Limited); and
        (b) seek the written permission of Carous Limited prior to granting access to the Customer Account to any User who is not an employee, officer or individual contractor of            the Customer’s organisation.

3. TERM
3.1. The Agreement will come into force when both parties have signed the Order and, subject to clauses 3.2, 9, 12 and 13 shall continue until completion or termination of all Services under an Order.
3.2. Services under an Order may be terminated upon at least two months’ notice by one party to the other party, such notice not to expire prior to the end of any applicable minimum term (or using such other notice period or termination mechanism as may be specified in the Order). Minimum terms for specific Services may be specified in the Order and, if no such minimum term is specified for Services (to the extent relating to hosting and support of the Customer Website and provision of the CMS Tool), the minimum term for such Services is 12 months from the go-live date of the Customer Website.

4. FEES AND PAYMENT
4.1. In consideration of the supply of the Services, the Customer shall pay Carous the Fees. Carous will send the Customer invoices for the Fees in accordance with the Order which, unless otherwise specified in the Order, may be in advance of the relevant Services.

4.2. Unless otherwise agreed, our monthly maintenance fees are collected via Direct Debit.

4.3. Carous may increase its Fees annually, by giving notice to the Customer at least two months prior to the increase. If the Customer does not agree to the increase, it may terminate the relevant Services in accordance with clause 3.2.

4.4. Should the Customer cease to use specific Services during any relevant payment period, norefund of Fees shall be payable.

4.5. In addition to the Fees, the Customer shall reimburse Carous for reasonable expenses and
disbursements incurred in the provision of the Services, including costs relating to third party
providers (see clause 6), and other expenses and disbursements as may be detailed in the Order.

4.6. Unless otherwise expressly stated, Fees and expenses are exclusive of value added tax (or
equivalent taxes in any jurisdiction) and the Customer is responsible for paying such taxes,
where applicable, in addition to the Fees and expenses.

5. CUSTOMER’S OBLIGATIONS
5.1. The Customer warrants that it is entering into the Agreement to receive Services in the course
of its business, craft, trade or profession.

5.2. The Customer acknowledges that any contracts of sale or supply entered into over the Customer
Website are between the Customer and its customers, and the Customer is responsible for:
        (a) ensuring that a valid contract is formed incorporating terms which meet the Legal Requirements and the Customer’s business and organisational needs; and
        (b) receiving and managing payments as between it and its customers.

5.3. The Customer is responsible for:
        (a) making arrangements and payments necessary to access and use its Customer Account, the Customer Website and related Services, including network and Internet connections, domain name registrations and renewals, and any additional software, hardware and equipment required;
        (b) the accuracy and quality of the Customer Materials and the lawfulness of their use for their intended purpose; and
        (c) without prejudice to the obligations of Carous under the Agreement, ensuring the Customer Website and the Customer Materials, and its use of the Services and the Carous Materials, meet its business and organisational requirements, and comply with the Legal Requirements and contractual requirements which it has to its customers and other third parties (including Third Parties as defined in clause 6).

5.4. The Customer shall, and shall procure that each User shall:
        (a) in using the Services and the Customer Account, comply with all applicable laws, regulations in all jurisdictions in which it uses the Services;
        (b) only access and use the CMS Tool and its content (including the Carous Materials) for the purpose of receiving the benefit of the Services;
        (c) only access the Customer Account using individual login details and keep passwords relating to the Services confidential;
        (d) without prejudice to (a), not make any unlawful or unauthorised use of the Services, nor of Carous’s or its service providers’ equipment, software or networks, including:             (i) attempting to gain unauthorised access; (ii) introducing any virus or malware or causing any denial of service attack; (iii) sending spam or unlawful unsolicited               commercial communications; (iv) causing harassment; (v) publishing or communicating obscene, abusive or defamatory material; or (vi) committing any criminal or fraudulent act;

        (e) without prejudice to clause 7.2, ensure that its provision of Customer Materials to Carous, and the storage, use or transmission of Customer Materials by Carous (or its
service providers) in providing the Services (in any relevant jurisdiction), is not an infringement or breach of Intellectual Property rights, data protection or confidentiality obligations or any rights of privacy (except to the extent such matters are Carous’s responsibility in accordance with clause 8 and Appendix 1);
        (f) not access, copy, modify, use, share or distribute the Carous Technology or the Carous Materials other than as expressly permitted in the Agreement, nor attempt to             reverse engineer, decompile or disassemble any Carous Technology;

        (g) inform Carous promptly if it becomes aware of any misuse of the Services, the CMS Tool, the Carous Technology or the Carous Materials; and
        (h) comply with such additional instructions, and provide such other information or assistance, as Carous may reasonably request from time to time, including in order to
        provide the Services effectively, to meet legal requirements, to resolve incidents oraddress vulnerabilities, or to meet requirements imposed by Carous’s service providers.

6. THIRD PARTY SERVICES AND CONTENT
6.1. As part of the Services, Carous may:
        (a) facilitate inclusion on the Customer Website, or the integration of the Customer Website with, third party software, materials, services or technology systems. This may include APIs, links, widgets, software tools, images and advertisements, other technology systems (such as payment processing systems);
        (b) facilitate the provision of Customer Materials (or content created for the Customer as part of the Services) to third parties for inclusion within such third parties’ websites or tools, which may include advertisements, images and information relating to the Customer’s products;
        (c) facilitate the exchange of information relating to the Customer and its products with third parties, including vehicle providers or vehicle data providers;
        (d) facilitate the purchase of domain names from third parties; and
        (e) use other third party services on behalf of the Customer, including social media platforms, and mailing or communications services, in order for the Customer and the
        Customer Website to benefit from the relevant products and services of such third parties (“Third Parties”).

6.2. Except to the extent otherwise specified in the Order or the Service Description, or otherwise agreed in writing between the parties:
        (a) Carous is not responsible for the quality, accuracy, standard, lawfulness, security or fitness for purpose of Third Party services or content;
        (b) it is the Customer’s responsibility to check that each Third Party service and content meets its requirements, and to obtain or enter into direct services agreements and/or licenses from or with such Third Party, and to familiarise itself with and comply with the terms of the same;
        (c) it is the Customer’s responsibility to make any required payments to Third Parties for their services and content; and
        (d) it is the Customer’s responsibility to ensure that Customer Materials and other content and information provided to a Third Party as part of the Services are appropriate             for the relevant Third Party service, website and/or tool and do not breach the terms or requirements of such Third Party.

6.3. For the avoidance of doubt, should Carous facilitate the integration of the Customer Website with any Customer software or system, Carous is not responsible for the quality, standard, lawfulness, security or fitness for purpose of such Customer software or system.

7. INTELLECTUAL PROPERTY RIGHTS
7.1. The parties acknowledge that:
        (a) Intellectual Property in the Customer Materials belongs to the Customer and its licensors (as applicable), and all rights not expressly granted to Carous are reserved to             the Customer (and its licensors, where applicable); and

        (b) subject to clause 7.4, Intellectual Property in the Carous Materials and the Carous Technology (including copyright and database rights) belongs to C a r o u s (and its licensors, where applicable), and all rights not expressly granted to the Customer are reserved to Carous (and its licensors, where applicable).

7.2. The Customer grants Carous a non-exclusive, non-transferable licence to use the Customer Materials to the extent required for providing the Services as envisaged by the Agreement, and shall obtain and maintain any required licences and permissions for Carous (and its service providers) to store and use the Customer Materials in this way.

7.3. Carous grants the Customer a non-exclusive, non-transferable licence to use the Carous Materials and the Carous Technology to the extent required for receiving the benefit of the Services as envisaged by the Agreement. The licence includes the right to make copies of Customer Website content and Customer data within the Customer Account in accordance with the Service Description or as otherwise agreed with the Customer (and such copies may be retained by the Customer beyond termination of the Agreement).

7.4. Carous agrees to assign to the Customer Intellectual Property in specific content created for the Customer as part of the Services only to the extent such assignment is expressly specified in the Order or subsequently agreed in writing between the parties (and clause 7.3 shall not apply to any such content in which Intellectual Property has been assigned to the Customer).

8. CONFIDENTIALITY, SECURITY AND DATA PROTECTION
8.1. Each party agrees to take reasonable steps to ensure that all personal data and information of a confidential nature (including any of the other party’s Intellectual Property of a confidential nature) provided by the other party under or in relation to the Agreement is kept confidential. This includes taking reasonable steps to ensure that persons authorised to access or use such personal data or information have committed themselves to confidentiality. For the avoidance of doubt, this clause 8.1 does not affect Carous sharing information with third parties in accordance with clause 6.

8.2. As part of Carous’s performance of the Services, it (and its service providers) may store and  process personal data or other information obtained from use of cookies, and/or send direct marketing communications, as a processor on behalf of the Customer, the controller. In such circumstances, the provisions of Appendix 1 to these terms of service will apply.

8.3. Carous shall use reasonable endeavours to:
        (a) implement appropriate security measures for the CMS Tool and, to the extent the Services include hosting the Customer Website, the Customer Website, to protect against unauthorised or unlawful access to or use of their content. These include measures described in Carous’s information security policy from time to time; and
        (b) maintain backups of such content.
        However, the Customer acknowledges that there are security and data protection risks inherent with web- and cloud-based Services.

8.4. Subject to its compliance with clauses 2.3, 8.1, 8.2 and 8.3, and Appendix 1 (and any other relevant service levels for the Services agreed by Carous in writing), Carous shall not be liable to the Customer for any loss or damage arising from any loss of Customer Materials or other content of the Services, and, subject to paragraph 5(e) of Appendix 1, may delete any or all relevant Customer Materials and other such content from its systems following termination of the relevant Services.

8.5. Carous may store and process contact details, account details and related records of Users and other Customer contacts as a controller for its own purposes, including provision of the Services, invoicing and payments, reviewing and enforcing compliance with the Agreement, communicating with the Customer and Users in relation to the Services (and any related services), maintaining business records, complying with legal obligations and defending its legal rights. Carous also has access to the Customer Account and Customer Materials for providing the Services, and for administration and maintenance purposes. Note: further information about Carous’s use of personal data is available within its (Privacy Policy).

8.6. Without prejudice to clause 5.4(c), any use of the Customer Account using the Customer’s login details and/or passwords (other than by Carous’s service administrators) will be the Customer’s responsibility.
8.7. Following termination of any Services or the Agreement, Carous shall be entitled to retain such records relating to the Services and the Agreement as it may reasonably require to maintain records of the Services, to comply with its legal obligations and to defend its legal rights.

9. TERMINATION AND SUSPENSION OF SERVICES
9.1. Either party may, by notice to the other, terminate the provision of Services and the Agreement with immediate effect if the other party:
        (a) commits a material breach of the Agreement and, in the case of any remediable breach, fails to remedy the same within 30 days of receipt of a notice from the non-breaching party requiring such remedy. Failure to pay any Fees within 15 days of their due date shall be deemed a material breach of Agreement; or
        (b) becomes insolvent or is wound up due to insolvency, makes or seeks a composition with its creditors, is the subject of an administration order, becomes the subject of the appointment of a receiver or liquidator, ceases (or threatens to cease) to carry on business, or any equivalent event in any applicable jurisdiction.

9.2. Carous shall be entitled to terminate or temporarily suspend the Service if it reasonably considers that such action is necessary to comply with any governmental, legal or other regulatory requirement or request.

9.3. All provisions of the Agreement which by their nature are intended to continue shall survive termination, including terms relating to limitations of liability, indemnity and confidentiality, and terms limiting use of the Carous Materials.

9.4. Termination of the Agreement or any Services shall not affect accrued rights and liabilities of either party up to the date of termination including the Customer’s obligations to pay Fees to Carous for Services undertaken or otherwise due in accordance with the Agreement.

9.5. Without prejudice to clause 9.1 and any other available remedy for breach of the Agreement by the Customer, Carous may:
        (a) suspend the provision of Services if the Customer commits any breach of the Agreement (including non-payment of Fees on their due date), until the breach is resolved;         and

        (b) remove from the CMS Tool or, if hosted by Carous, the Customer Website, any Customer Materials or content which, in its reasonable opinion, do not meet the requirements of clauses 5.4 or 7.2.
9.6. Carous may temporarily suspend the provision of any Service for repair, maintenance or upgrades to the Service (including the Carous Technology) upon reasonable notice to the Customer.

10. GENERAL LIABILITY LIMITATIONS
10.1. Neither party excludes or limits any liability for fraud or for death or personal injury caused by negligence, or other liability which cannot lawfully be excluded, and the other provisions of the Agreement are subject to this clause 10.1.

10.2. Save as expressly set out in the Agreement:
        (a) all conditions and warranties implied by law are excluded to the fullest extent permitted by law; and
        (b) in entering into the Agreement, the Customer acknowledges that it has not relied on any representations, promises or warranties (written or oral).
10.3. Carous is not responsible to the Customer for the availability, speed or quality of the Internet or any communications network or equipment used by the Customer to access or use the Services, or by visitors to the Customer Website.

10.4. To the fullest extent permitted by law, Carous shall not be liable to the Customer for any loss of profits, business or goodwill or any type of special, indirect or consequential loss or damage whether arising from negligence, other tort, breach of contract or otherwise, even if any such loss was reasonably foreseeable or Carous had been advised of the possibility of the Customer incurring any such loss.
10.5. Without prejudice to the other limitations of liability in the Agreement, Carous’s total liability to the Customer in relation to any claim or series of related claims arising in relation to the Services and the Agreement shall not exceed 500% of the Fees relating to the 12 month period of the Agreement preceding the date on which the relevant liability arose (or, if the period preceding this date is under 12 months, the first 12 months of the Agreement).

11. INDEMNITY
The Customer agrees to indemnify Carous against any losses, expenses or liability which it suffers as a result of the Customer’s breach of the Agreement, including its obligations under clause 5.4.

12. FORCE MAJEURE
12.1. Carous shall not be liable to the Customer for any breach or non-performance of its obligations under the Agreement resulting from causes beyond its reasonable control (an “Event of Force Majeure”) including acts of God, governmental or parliamentary act, war, fire, drought, flood, explosion, civil commotion, epidemic or pandemic, strikes, failure of power or utility supply, communications or Internet connections.
12.2. Either party may terminate the Agreement if Carous is prevented from performing its obligations because of an Event of Force Majeure for more than four consecutive weeks.
13. CHANGES TO THE SERVICES AND THE AGREEMENT
13.1. Carous may, from time to time, make updates or changes to the Service Description and/or delivery of the Services (including changes to the features, content or functionality of the CMS Tool) without seeking the agreement of the Customer or notifying the Customer in advance, provided such updates and changes do not have a material adverse impact on the provision of the Services to the Customer.

13.2. If Carous is required by law or by its service providers to change the Services, these terms of service or any other provision of the Agreement, the Customer agrees to cooperate with Carous to implement such changes whilst maintaining, as far as possible, the intention of the Agreement.

13.3. Without prejudice to clauses 13.1 and 13.2, Carous may from time to time propose changes to the Services, the Service Description, the Order, these terms of service and/or any other provision of the Agreement upon at least two months’ notice to the Customer. The Customer shall not unreasonably withhold or delay its agreement to such changes. If the Customer does not agree to any reasonable proposed change, Carous may terminate the relevant Services to take effect from the date of the proposed change.

13.4. The Customer may from time to time, by notice in writing to Carous, request changes to the Services and Carous shall cooperate with the Customer with a view to agreeing such changes as are reasonably requested, together with any consequential amendments to Fees, delivery dates and/or other terms of the Agreement.

14. ASSIGNMENT
14.1. Subject to clause 14.2, neither party may transfer, assign, sub-contract nor sub-license any rights or obligations under the Agreement to any person without the prior written consent of the other party.

14.2. Carous may, without the Customer’s consent: (a) sub-contract performance of the Services or any of its obligations under the Agreement to any third party and sub-license associated rights; and/or (b) upon notice to the Customer, transfer or assign all or any of its rights or obligations under the Agreement to any group company, or purchaser of the Carous Technology, the Carous Materials, its company and/or all or part of its business.

15. GENERAL
15.1. The Agreement constitutes the entire agreement and understanding between the parties relating to the subject matter hereof and supersedes all prior agreements, arrangements and undertakings between the parties relating to such subject matter.

15.2. Notices to be given under the Agreement shall be made in writing and sent by prepaid first class post, delivered by hand or sent by email, to the address or email address (as applicable) specified in the Order, or otherwise notified to the other party from time to time. Notices sent by post shall be deemed given two business days after posting, notices delivered by hand shall be deemed given upon delivery, and notices sent by email shall be deemed given at the time of successful transmission.

15.3. If there is any inconsistency between these terms of service, the Order and/or the Service Description, these terms of service shall prevail, followed by the Order, followed by the Service Description.

15.4. No provision of the Agreement is intended to be enforceable by anyone other than the Customer and Carous.

15.5. No failure or delay by either party in exercising any right or remedy under the Agreement shall be construed as a waiver by that party of such right or remedy and no partial exercise of any such right or remedy shall restrict the further exercise of that right or remedy.

15.6. Subject to clause 13, no amendments to the Agreement shall be valid unless agreed in writing by both parties.
15.7. Each party shall (and shall use reasonable endeavours to procure that any necessary other person shall) at its own cost, promptly carry out such further acts (including signing all such documents), as the other party may reasonably require for the purpose of giving full effect to the Agreement.

15.8. If any provision of the Agreement is found to be invalid, unenforceable or illegal, the other provisions shall remain in force, and, to the extent possible, the provision shall be modified to ensure it is valid, enforceable and legal, whilst maintaining or giving effect to its commercial  intention.

15.9. Neither the entry into nor the performance of the Agreement constitutes a partnership or joint venture, nor establishes a relationship of principal and agent between the parties, except that, to the extent approved by the Customer (within the Order or otherwise), Carous shall have authority to enter into commitments with Third Parties on behalf of the Customer in relation to the Third Party Services described in clause 6 above.

15.10. The Agreement shall be governed by and construed in accordance with the laws of England and Wales, and the parties agree to submit to the exclusive jurisdiction of the courts of England and Wales.

Appendix 1 – Data processing terms
1. This Appendix 1 applies to the extent Carous, in its performance of the Services and on behalf of the Customer: processes personal data; processes information obtained from use of cookies; or sends direct marketing communications. The parties acknowledge that this applies in relation to the following processing activities (to the extent such activities are within the scope of the Services):

     (a) processing of personal data within the content of the Customer Materials for the purpose of providing the Services (including personal data which the Customer or its Users input or upload into the CMS Tool using the Customer Account);
     (b) processing personal data included within or collected by the Customer Website and processed by Carous in developing, hosting or supporting the Customer Website, and in referring leads to the Customer, including personal data of individuals who make enquiries or purchase products via the Customer Website;
     (c) sending direct marketing communications and processing associated contact lists on behalf of the Customer;
     (d) processing information obtained from use of cookies on the Customer Website; and
     (e) any other processing activities for which it is agreed within the Order (or otherwise in writing between the parties) that Carous acts as a processor on behalf of the Customer, the controller.
2. For the purposes of this Appendix 1, the terms “personal data”, “process/processing”, “controller”, “processor”, “data subject” and “special categories of personal data” shall have the same meanings as in UK data protection laws.

3. The Customer acknowledges that it must comply with controller obligations under applicable data protection and privacy laws in relation to the processing activities of Carous described under paragraph 1 above. The Customer acknowledges that applicable laws may include the laws of jurisdictions: (a) in which the Customer is established; (b) from which a User (or a user of the Customer Website) is accessing or using the Services, the CMS Tool or the Customer Website; and (c) where recipients of marketing communications are located.

4. Without prejudice to paragraph 3, the Customer shall ensure that:
     (a) data subjects are aware of the processing activities undertaken by Carous on behalf of the Customer and are provided with appropriate information about such activities      to ensure transparency;

     (b) there is a legitimate purpose (or purposes) and an appropriate lawful basis for Carous’s use of personal data in conducting the Services;
     (c) any personal data provided to Carous is accurate, adequate, relevant and limited to what is necessary for those purposes and Carous’s Services;
     (d) the relevant personal data shall not include any special categories of data, except to the extent notified to and approved by Carous in advance, and the Customer shall ensure that it satisfies additional legal conditions required for use of special categories of data;
     (e) without prejudice to (b), in relation to direct marketing or other electronic communications to be sent by Carous on its behalf, it has obtained required consents and provided appropriate rights to object under applicable data protection, direct marketing and privacy laws;
     (f) without prejudice to (b), in relation to use of cookies, it has obtained required consents;
     (g) it promptly informs Carous of any need to update, correct or delete any personal data, or of any exercise by a data subject of their rights which impact Carous or the Services;
     (h) without prejudice to Carous’s obligations under paragraph 5(c) below, it takes steps to ensure appropriate security of personal data provided to Carous;
     (i) it complies with applicable international data transfer obligations in relation to any instruction to Carous to transfer any personal data between different countries as part of
the Services; and 

     (j) it instructs Carous on any additional actions required which impact the processing activities, in order to comply with any data protection laws in any jurisdiction to which the Customer is subject in relation to the processing activities.To the extent Carous assists with any of the measures to be taken by the Customer in accordance with this paragraph 4 (for example, by facilitating the provision of information to and obtaining of consents from data subjects via the Customer Website), for the avoidance of doubt, the Customer remains legally responsible for such measures.

5. In carrying out the processing activities described in paragraph 1 above, Carous agrees:
     (a) unless otherwise required or permitted by law, to process the personal data, and (for direct marketing communications) recipient contact details, only for the purpose of performing the Services in accordance with the Customer’s instructions in the context of the Services (and such instructions include providing the Services in the manner described in the Service Description, these terms of service, or otherwise agreed with the Customer);
     (b) to inform the Customer if, in its opinion, any instruction of the Customer infringes any applicable UK legal requirement (or other legal requirement to which Carous is subject), and of any applicable UK legal requirement (or other legal requirement to which Carous is subject) which requires Carous to process the personal data for purposes not specified within the Agreement (unless it is prohibited by law from informing the Customer);
     (c) in its performance of the Services, to implement reasonable technical and organisational security measures to ensure a level of security for such personal data appropriate to the risk, (including, for the avoidance of doubt, the security measures specified in clause 8.3 of these terms of service). Notwithstanding this obligation, Carous shall not be obliged to implement higher levels of security to address risks associated with the use of special categories of personal data, except to the extent it has: (i) approved the processing of special categories of personal data in accordance with paragraph 4(d) above; and (ii) agreed to provide specific higher levels of security in relation to such data;
     (d) where appropriate in accordance with UK law and in the context of its role in providing the Services, and subject to reasonable additional fees, to provide reasonable assistance to the Customer in responding to requests from data subjects to exercise their rights, and in complying with the Customer’s data protection obligations relating to security, security breaches and data protection impact assessments;
     (e) at the choice of the Customer, to delete or return to the Customer the personal data after the end of the provision of the Services relating to the relevant processing, and, subject to clause 8.7 of these terms of service, delete its existing copies; and
     (f) at the reasonable request and cost of the Customer:
     ● to make available to the Customer reasonable information necessary to demonstrate its compliance with (a) to (e) above (and other provisions of this Appendix 1 and clause 8 of the terms of service relating to Carous’s activities as a processor on behalf of the Customer); and
     ● to the extent such information is (in the reasonable opinion of the Customer) insufficient to demonstrate such compliance, to allow for and contribute to reasonable audits, at reasonable intervals, conducted by the Customer or another auditor mandated by the Customer, in order to ascertain such compliance.

6. The Customer acknowledges that Carous may from time to time appoint one or more sub- processors for the processing activities described in paragraph 1 above. These sub-processors include the following:
     (a) providers of software development, maintenance and support services.
     (b) data centre providers ; and
     (c) individual or small company contractors who assist with the Services.

Where the Services include mailing or communications services, Carous’s standard procedure is to use the Customer’s account with the communications providers. Where this is not the case, a third party mailing or communications provider may act as an additional sub-processor of Carous.
Carous shall ensure that processor obligations substantially similar or equivalent to those included within this Appendix 1 (to the extent required by applicable UK data protection law) are imposed on its sub-processors.
Carous shall inform the Customer of any intended additions or changes to the list of sub- processors above, and give the Customer an opportunity to object. If the Customer does reasonably object to any such change within a reasonable period, and no reasonable solution is agreed between the parties, either party may terminate the Services (to the extent relevant to the sub-processor’s processing) immediately prior to the appointment of the new sub-processor (or category of sub-processor).