[{"data":1,"prerenderedAt":804},["ShallowReactive",2],{"legal-\u002Fbusiness-user-agreement":3},{"id":4,"title":5,"body":6,"description":794,"extension":795,"meta":796,"navigation":797,"path":798,"seo":799,"stem":800,"updated":801,"version":802,"__hash__":803},"docs\u002Fbusiness-user-agreement.md","Business User Agreement",{"type":7,"value":8,"toc":747},"minimark",[9,13,18,21,30,33,36,39,42,48,51,54,57,60,64,67,70,73,76,79,82,85,89,92,95,98,101,104,107,110,113,116,119,123,126,129,132,135,138,141,144,147,150,153,156,160,163,166,169,172,175,179,182,185,188,191,194,197,200,203,206,209,212,218,221,225,228,231,234,237,240,243,246,249,252,255,258,261,264,267,271,274,277,280,283,286,289,293,296,299,302,305,308,311,314,318,321,324,327,330,333,336,340,346,349,352,355,358,361,364,367,370,373,376,379,383,386,389,392,395,398,401,404,407,410,413,416,419,423,426,429,435,438,442,445,448,451,454,457,460,463,467,470,473,477,482,485,488,491,495,498,501,505,508,511,515,518,521,524,528,531,535,538,541,545,548,551,554,557,560,564,567,570,573,577,580,583,586,589,593,596,599,603,607,610,613,616,619,622,625,628,631,634,638,641,644,647,651,654,657,660,663,666,669,673,676,680,684,687,691,697,700,703,707,710,713,717,720,723,727,730,733,737,740,744],[10,11,12],"p",{},"This Business User Agreement is between LeadCrowd Limited, trading as Xcho, and the business customer identified in the electronic order or other accepted order document. It is a business-to-business agreement only. Xcho is not supplied to consumers.",[14,15,17],"h2",{"id":16},"part-a-customer-order","Part A. Customer order",[10,19,20],{},"Provider: LeadCrowd Limited, trading as Xcho, company number 10963512, registered office The 1812 Building, Wheatley Park, Mirfield, England, WF14 8HE.",[10,22,23,24,29],{},"Contact: ",[25,26,28],"a",{"href":27},"mailto:hello@xcho.ai","hello@xcho.ai"," for support, contractual notices, privacy matters and security incident reports.",[10,31,32],{},"Customer: the business identified in the Xcho account and order record. The person accepting this agreement confirms that they are at least 18, are acting wholly or mainly for business purposes and are authorised to bind that business.",[10,34,35],{},"Commercial terms: the customer’s selected plan, subscription fee, included Active Contacts, user allowance, additional Active Contact rate, Xcho Messaging tariff, any trial or setup charges and other commercial terms are those expressly presented to and accepted by the customer in its Order. The accepted Order forms part of this agreement; prices and allowances are not fixed in this standard document. Enterprise minimum terms, support commitments, service levels and other bespoke terms apply only where expressly included in the accepted Enterprise Order. Changes to existing commercial terms take effect only through the agreed change process.",[10,37,38],{},"Subscription billing: standard subscriptions are charged in advance through Stripe. Variable usage charges, including Xcho Messaging and additional Active Contacts, are deducted from the customer’s prepaid Xcho balance unless LeadCrowd has expressly approved invoicing in arrears. Approved arrears accounts are payable within 7 days of invoice unless the order states otherwise.",[10,40,41],{},"Prepaid usage balance: the customer may top up manually and may separately opt in to automatic top-ups. Auto top-up is not enabled by default. The trigger, amount and any monthly auto top-up limit selected by the customer form part of its billing settings. If sufficient prepaid funds are unavailable, Xcho may pause new chargeable outbound activity until the balance is restored. Essential opt-out and suppression processing may continue. Xcho does not provide an unsecured usage overdraft unless expressly agreed in writing.",[10,43,44,45,47],{},"Standard term: rolling monthly. The customer may cancel through the available in-app cancellation control or by emailing ",[25,46,28],{"href":27},". Cancellation takes effect at the end of the current paid billing month. No pro-rata subscription refund is due for an ordinary mid-month cancellation unless LeadCrowd agrees otherwise or the law requires it.",[10,49,50],{},"Support: standard support is available 09:00 to 17:00 UK time, Monday to Friday, excluding UK bank holidays. Response and resolution times are targets only unless a binding SLA is expressly included in an Enterprise order.",[10,52,53],{},"Supported channels and territories: Xcho currently supports SMS and WhatsApp campaign messaging. The customer may contact recipients only in territories enabled for its account. LeadCrowd may add or remove supported territories and channels subject to this agreement, law and supplier requirements. The customer’s own country of establishment does not itself determine which recipient territories are enabled.",[10,55,56],{},"Integrations: supported integrations may include Google Calendar, HubSpot, website forms and webhooks and customer-enabled external assistants through Xcho’s MCP interface. LeadCrowd may add, replace or remove integrations in accordance with this agreement.",[10,58,59],{},"Order record: an Order is the electronic checkout, trial or plan-selection record accepted by the customer and activated by LeadCrowd, or a written order expressly accepted by both parties. It records the service, fees, tariff, allowances, billing cycle, tax treatment, any trial or setup terms, any authorised credit terms and any agreed variations. LeadCrowd will retain a reproducible record of the accepted Order and the agreement version. A later change to a public pricing page or account display does not, by itself, replace the accepted terms or retrospectively change accrued charges.",[14,61,63],{"id":62},"_1-contract-formation-authority-and-precedence","1. Contract formation, authority and precedence",[10,65,66],{},"1.1 This agreement comprises Part A, clauses 1 to 14, Schedules 1 and 2, Schedule 3 where it applies and the accepted Order. The Privacy Policy and Cookie Policy are notices, not additional commercial terms or permission to reuse customer campaign data. References to an order or accepted order\u002Faccount mean the Order and subsequent changes validly made under this agreement.",[10,68,69],{},"1.2 For standard customers, the contract is formed when an authorised user affirmatively accepts the then-current version in Xcho and LeadCrowd activates the account or trial. Xcho may record the organisation, accepting user, acceptance timestamp and exact version accepted. Payment alone is not treated as acceptance of terms that were not properly presented.",[10,71,72],{},"1.3 Enterprise or bespoke customers may instead sign an order form or negotiated agreement. In a conflict, an expressly negotiated Enterprise term prevails only to the extent it specifically changes this agreement. A customer purchase order, procurement portal, onboarding form, policy or other customer document does not add to or override this agreement unless LeadCrowd expressly accepts the relevant change in writing.",[10,74,75],{},"1.4 Before real customer personal data is uploaded, synchronised or processed in a paid account, free trial or pilot, the applicable contract and data-processing terms must have been accepted. Demonstrations using synthetic or test data may be provided separately.",[10,77,78],{},"1.5 A free trial or pilot does not automatically convert into a paid subscription. The customer must actively select or accept a paid plan before the first subscription charge is taken. Trial duration, limits and features are those shown at signup or in the relevant order.",[10,80,81],{},"1.6 This version applies when accepted for a new contract on or after 1 October 2026. Existing contracts change only in accordance with clauses 6.12 and 12.1 or an expressly agreed variation. A Business Day means a day other than a Saturday, Sunday or public holiday in England. A billing month is the recurring period shown in the Order, not necessarily a calendar month.",[10,83,84],{},"1.7 An expressly negotiated Order prevails only to the extent it identifies the provision varied. Schedule 1 prevails on conflicts concerning personal-data processing, subject to mandatory international-transfer terms and applicable law. Schedule 3 prevails to the extent necessary to give effect to the mandatory switching rights within its scope. The liability provisions in clause 11 continue to apply between the parties to the extent lawful. No Order, policy or precedence rule overrides obligations that cannot lawfully be excluded.",[14,86,88],{"id":87},"_2-the-xcho-service","2. The Xcho service",[10,90,91],{},"2.1 Xcho provides AI-assisted business conversations, qualification of interest, human handover and appointment booking through supported channels. It may also provide imports, campaign controls, reporting, inbox tools and supported integrations.",[10,93,94],{},"2.2 Xcho is intended for legitimate businesses in any industry, including regulated businesses, subject to supported territories, applicable law, supplier rules and Xcho’s restrictions. Use by a regulated business does not transfer that business’s licensing, authorisation, financial-promotion, professional, supervisory or record-keeping duties to LeadCrowd.",[10,96,97],{},"2.3 Qualification means collecting information, identifying interest and routing or booking appropriate human follow-up. Xcho does not make final eligibility, underwriting, affordability, entitlement or other solely automated decisions that produce legal or similarly significant effects. The customer must not configure or use Xcho as the final decision-maker for credit, insurance, employment, healthcare or comparable consequential decisions. Legitimate businesses in those sectors may use the agreed conversation and booking functions, subject to appropriate human decision-making and their own regulatory obligations.",[10,99,100],{},"2.4 Xcho does not provide financial, legal, medical, tax or other regulated or professional advice and does not make personal recommendations. The no-advice guardrail is mandatory and customers must not configure, prompt or instruct Xcho to bypass it. In financial services this includes recommending a particular mortgage, lender, rate, protection or investment product, borrowing amount or whether a person should remortgage.",[10,102,103],{},"2.5 The customer may configure an AI persona, tone and approved business facts within the available controls. AI disclosure is to be enabled by default. The customer must not impersonate a real person or disable, remove, obscure or contradict any disclosure, label or marking required by applicable law or channel rules. Where required, a clear AI disclosure must be given at or before the first relevant interaction, rather than only when requested. Any permitted alternative setting must remain lawful for the actual deployment. Xcho will not intentionally represent the AI as a human and, if directly asked, will identify it as an AI assistant. LeadCrowd may enforce required disclosures or restrict affected functionality. The customer must provide accurate information about its deployment and intended recipient territories; this does not transfer LeadCrowd’s own legal duties to the customer.",[10,105,106],{},"2.6 Human takeover, handback, booking, follow-up, sending windows and escalation operate according to the enabled product settings. The customer must keep calendars, approved facts, time zones, team access, handover routes and campaign settings accurate, reasonably test material configurations and imports before live use and ensure that suitably authorised people deal with escalations requiring human attention. The customer must promptly pause affected activity and notify LeadCrowd when it becomes aware of a material configuration error or unsafe use. This does not require the customer to approve every routine automated message.",[10,108,109],{},"2.7 AI can misunderstand context, produce inaccurate or incomplete content or fail to interpret unusual messages. Safeguards reduce risk but do not guarantee accuracy, compliance, conversion, sales, bookings, contact rates, revenue, commission, lead quality or uninterrupted availability.",[10,111,112],{},"2.8 LeadCrowd may change, improve, replace or remove models, workflows, integrations and non-core features where the service remains materially capable of performing its main agreed purpose. Roadmap items, sales discussions, demonstrations, previews, marketing examples and statements about future features are not binding commitments unless expressly included in the accepted order.",[10,114,115],{},"2.9 Xcho is not an emergency-response, medical-triage or safety-critical service. The customer must not rely on it to detect or respond to emergencies or use it where failure could reasonably result in death, personal injury or serious physical harm. The customer remains responsible for appropriate emergency and safeguarding routes for its own business.",[10,117,118],{},"2.10 The agreed service does not authorise Xcho to enter into contracts for the customer, accept orders, grant refunds, vary prices, waive rights or make binding commercial commitments unless that specific functionality and its authority limits are expressly agreed in an Order. Appointment booking is not a guarantee of attendance or a completed transaction. No generated message expands LeadCrowd’s authority or changes this agreement. These provisions allocate responsibility between the parties and do not purport to remove a third party’s rights under applicable law.",[14,120,122],{"id":121},"_3-customer-data-permissions-and-campaign-activation","3. Customer data, permissions and campaign activation",[10,124,125],{},"3.1 The customer retains its rights in its data and materials, subject to the rights of individuals and third parties. The customer grants LeadCrowd the rights reasonably necessary to provide, secure and support Xcho.",[10,127,128],{},"3.2 The customer is solely responsible for ensuring that every contact, lead, list, campaign instruction and connected data source it supplies or enables has been lawfully obtained and may lawfully be used for the intended purpose and channel. The customer is responsible for appropriate privacy information, lawful bases, consents, opt-ins and any separate electronic-marketing or provider-specific permissions required.",[10,130,131],{},"3.2A These responsibilities are continuing and apply to every later addition, refresh or change to a live campaign, including contacts supplied through forms, webhooks, CRM synchronisation or an authorised external assistant. The customer warrants that permissions remain valid for the actual sender, purpose, channel and recipient when each communication is instructed. A reply in one channel is not, by itself, permission to move marketing to another channel.",[10,133,134],{},"3.3 Uploading or importing a contact, holding a telephone number, receiving an old enquiry, purchasing a lead or having a general data-protection lawful basis does not by itself prove that an SMS or WhatsApp communication is permitted. The customer must determine and evidence the permission it relies on.",[10,136,137],{},"3.4 LeadCrowd is entitled to rely on the customer’s confirmations and documented instructions that its data is lawfully contactable and has no general duty to independently verify the lawful basis or permission for each individual contact. This does not require LeadCrowd to carry out an instruction it reasonably believes is unlawful or remove either party’s own mandatory duties, including duties arising from its actual role in sending or instigating a communication.",[10,139,140],{},"3.5 Before activating a campaign, the customer must give the campaign-level confirmation presented by Xcho that it holds the permissions required for the selected recipients, purpose and channel and that relevant privacy information and suppression records are in place. The customer must renew the relevant confirmation when the campaign’s purpose, channel, sender or permission basis materially changes. Later contacts are covered by the continuing warranty in clause 3.2A, not by an assumption that the initial confirmation creates permission. The confirmation records the customer’s instruction and responsibility; it is not independent verification by LeadCrowd.",[10,142,143],{},"3.6 Xcho may prompt the customer to import or synchronise existing suppression and opt-out information before launch; that prompt is not a general requirement for manual approval of a suppression import. The customer remains responsible for supplying complete and accurate restrictions from its other systems and promptly recording restrictions it receives outside Xcho. Once Xcho records an opt-out or suppression instruction, LeadCrowd will apply the relevant suppression controls without undue delay to prevent further affected outbound marketing. Ordinary users must not bypass those controls. Re-enablement requires documented fresh permission where required and a lawful basis for the actual communication. A message already irreversibly accepted by a supplier may not be recallable, but this is not authority to initiate further suppressed messages.",[10,145,146],{},"3.7 The customer must retain evidence of permissions and withdrawals appropriate to the campaign, including source, collection wording, purpose, channel, date and any subsequent change. LeadCrowd may request reasonable evidence where there is a complaint, supplier enquiry or reasonable compliance concern.",[10,148,149],{},"3.8 LeadCrowd may suspend or restrict a campaign or contact where it reasonably suspects unlawful messaging, invalid permissions, suppression failure, abuse or material supplier risk. The right to investigate does not create a general duty to monitor every customer campaign.",[10,151,152],{},"3.9 Customer contacts and conversations are used to provide that customer’s Xcho service. They are not sold, added to a lead marketplace or reused for unrelated marketing or lead generation.",[10,154,155],{},"3.10 LeadCrowd may use service-generated information that has been genuinely anonymised and aggregated so that it cannot reasonably identify a customer or individual for security, service analytics, capacity planning, benchmarking and product improvement.",[14,157,159],{"id":158},"_4-ai-regulated-use-and-customer-content","4. AI, regulated use and customer content",[10,161,162],{},"4.1 Xcho’s built-in AI currently uses Anthropic Claude models through Amazon Bedrock in LeadCrowd’s AWS environment. LeadCrowd may change model versions or providers where the agreed purpose and material safeguards are maintained and the data-processing change process is followed.",[10,164,165],{},"4.2 LeadCrowd will not use customer contacts or conversations to train or fine-tune a general model and will not authorise a subprocessor to do so for its own model training.",[10,167,168],{},"4.3 The customer is responsible for the accuracy, lawfulness and approval of campaign scripts, facts, offers, claims, financial promotions, product descriptions and other content it supplies or approves. LeadCrowd does not undertake a general duty to check customer content against every law, FCA rule, professional rule or sector code.",[10,170,171],{},"4.4 Compliance safeguards, including no-advice controls, opt-outs, send windows, screening and any sector-specific mode, are risk controls rather than a warranty that the customer’s use is legally or regulatorily compliant.",[10,173,174],{},"4.5 LeadCrowd may refuse or remove customer content or instructions where it reasonably believes they create a material risk of fraud, deception, defamation, harassment, discrimination, unlawful content, regulatory breach, supplier breach or reputational harm.",[14,176,178],{"id":177},"_5-accounts-security-and-acceptable-use","5. Accounts, security and acceptable use",[10,180,181],{},"5.1 The customer must ensure that all human account users are at least 18, are authorised to act for the customer and use unique secure credentials. The customer is responsible for its authorised users, contractors and connected agents complying with this agreement, as if their permitted acts and omissions were its own. It must manage roles, devices, access scopes and connected credentials, use available security controls appropriate to the risk and promptly remove access when no longer authorised. This does not make the customer responsible for loss caused by LeadCrowd’s own security breach or failure to enforce agreed access controls.",[10,183,184],{},"5.2 LeadCrowd may rely on instructions, approvals and settings submitted by the customer’s nominated administrators and authorised users unless LeadCrowd has a clear reason to suspect compromise or lack of authority.",[10,186,187],{},"5.3 The customer must not use Xcho for unlawful, fraudulent, deceptive, defamatory, abusive, harassing or discriminatory communications; malicious code; unauthorised access; interference with other customers; unlawful spam; or activity that breaches applicable messaging, commerce or platform rules.",[10,189,190],{},"5.4 Customers must not use Xcho to collect payment-card details, bank login credentials, passwords, one-time authentication codes or similar secrets. Full card details used to pay LeadCrowd are handled by Stripe rather than stored by Xcho.",[10,192,193],{},"5.5 Customers must not deliberately configure Xcho to collect special-category personal data or criminal-offence data unless LeadCrowd has expressly approved the processing scope in writing and appropriate legal conditions and safeguards are in place. Incidental sensitive information volunteered by a recipient may be processed only as necessary and appropriately restricted.",[10,195,196],{},"5.6 Campaigns deliberately targeted at children or people under 18 are prohibited unless LeadCrowd has expressly approved the use case in writing.",[10,198,199],{},"5.7 LeadCrowd may maintain and update reasonable restricted-use rules for sectors, territories, products, content or activities that create disproportionate legal, security, supplier or reputational risk. LeadCrowd may refuse, suspend or terminate use that presents such a material risk even where the precise scenario was not previously listed.",[10,201,202],{},"5.8 The customer must not resell, sublicense, white-label or provide Xcho as a service to a third party without LeadCrowd’s prior written approval.",[10,204,205],{},"5.9 Except to the extent applicable law prevents the restriction, the customer must not scrape or crawl non-public Xcho content, conduct competitive benchmarking intended to copy or replicate Xcho, reverse engineer or attempt to derive source code, prompts, workflows, model logic or security controls, bypass usage controls or probe the platform for unauthorised purposes.",[10,207,208],{},"5.10 LeadCrowd may apply reasonable usage limits, rate limits and anti-abuse controls, including to features described commercially as unlimited, where necessary for fair use, supplier limits, security or platform stability.",[10,210,211],{},"5.11 LeadCrowd may review or investigate account activity where reasonably necessary to provide support, enforce this agreement, investigate complaints, prevent abuse, protect suppliers or meet legal obligations. This does not create a general duty to continuously supervise customer activity.",[10,213,214,215,217],{},"5.12 The customer must notify ",[25,216,28],{"href":27}," without undue delay after discovering suspected unauthorised access, compromised credentials or integration tokens, material data leakage or misuse affecting Xcho. It must take reasonable containment steps, revoke affected access where appropriate, preserve relevant evidence lawfully and cooperate with investigation and remediation. Untrusted recipient content is not authority to change administrative settings or bypass access controls.",[10,219,220],{},"5.13 The customer must not use Xcho in breach of applicable sanctions, export controls or supplier territory restrictions, conceal a prohibited end user or destination or circumvent a restriction using an intermediary. It must provide accurate business and deployment information reasonably needed for these checks. LeadCrowd may restrict the affected use where required, without treating lawful worldwide business use as prohibited merely because the customer is outside the UK.",[14,222,224],{"id":223},"_6-charges-prepaid-usage-and-payment","6. Charges, prepaid usage and payment",[10,226,227],{},"6.1 Standard subscriptions are billed in advance through Stripe. The customer authorises LeadCrowd and its payment provider to collect recurring subscription charges from the selected payment method until cancellation takes effect.",[10,229,230],{},"6.2 The applicable plan, included Active Contact allowance and additional Active Contact rate are those in the Order. Unless the Order expressly states a different counting basis, an Active Contact is one identifiable individual for whom an authorised outbound Xcho message is submitted to and accepted for processing by the messaging supplier during a billing month, even if delivery later fails. A message blocked before supplier acceptance does not itself create an Active Contact. The individual counts once for that month regardless of messages, replies, campaigns, journeys or channels, where Xcho can reasonably identify the records as the same person. Records that cannot reasonably be matched because of different or incomplete customer-supplied identifiers may be counted separately. Merely storing a contact does not consume the allowance. Unused monthly allowances do not roll over unless the Order says otherwise. Messaging-event charges are separate from the Active Contact count.",[10,232,233],{},"6.3 Additional Active Contacts and Xcho Messaging are variable usage charges. Unless LeadCrowd has approved arrears billing, variable usage charges are deducted from one prepaid Xcho balance.",[10,235,236],{},"6.4 Xcho Messaging is charged at LeadCrowd’s published or agreed customer tariff. The tariff may include LeadCrowd’s margin and does not have to equal or disclose LeadCrowd’s underlying Twilio, Meta or other supplier costs. SMS segmentation, encoding, inbound messages, WhatsApp charging events and other billing units are charged according to the tariff in force when the event occurs.",[10,238,239],{},"6.5 A message or delivery attempt may remain chargeable where LeadCrowd or its supplier incurs a charge even if the message is delayed, rejected, undelivered or ultimately unsuccessful. Xcho does not guarantee delivery, reply or conversion merely because a charge is incurred.",[10,241,242],{},"6.6 Paid prepaid credit does not expire while the account remains active. It is non-transferable between customers or accounts, does not earn interest and is not redeemable for cash except through the closure refund process in clause 10. Promotional, bonus or free credit is non-refundable and may have separate expiry or usage conditions disclosed when granted.",[10,244,245],{},"6.7 Auto top-up is strictly opt-in. Where enabled, the customer authorises Stripe to collect the selected top-up amount when the selected trigger is reached, subject to its selected monthly automatic top-up cap. That cap limits automatic top-up payments, not all possible usage, manual top-ups or previously committed charges. Any separate hard spending limit must be expressly identified as such in the account settings. The customer may disable auto top-up at any time; this does not reverse a payment already authorised or cancel usage already properly committed. Manual top-ups remain available subject to account status.",[10,247,248],{},"6.8 Where available prepaid funds are insufficient, Xcho will pause new chargeable outbound activity, subject to usage already properly committed before the pause. LeadCrowd may reserve a reasonable amount of the balance for such committed usage and will reconcile it against actual charges and release any excess. Properly authorised supplier charges reported later, and unavoidable supplier charges for essential inbound or opt-out processing, remain payable at the agreed tariff even if they are reported after a pause or closure. Any reconciled shortfall is payable within 7 days of an itemised invoice unless validly disputed. Reconciliation does not create a general credit facility or authorise unlimited new activity, circumvention of a hard spending limit or charges caused by LeadCrowd’s failure to apply an agreed control. Necessary opt-out and suppression processing will not be disabled merely because funds are exhausted.",[10,250,251],{},"6.9 Customers expressly approved for arrears billing may be invoiced weekly, monthly or at another agreed interval. Unless otherwise agreed, invoices are due within 7 days. LeadCrowd may charge statutory interest and recovery costs where available and, where they do not apply, interest at 4% above the Bank of England base rate on overdue undisputed sums. LeadCrowd may suspend further chargeable activity while an undisputed overdue amount remains unpaid.",[10,253,254],{},"6.10 A chargeback or payment-provider dispute does not, by itself, cancel the contract or finally determine the underlying contractual debt. LeadCrowd may pursue sums properly due through the applicable contractual or legal process, taking account of any binding determination, valid refund and amounts already recovered. It will not recover the same amount twice. LeadCrowd may proportionately pause further chargeable activity where a payment reversal leaves it unfunded, an undisputed debt is overdue or there is a reasonable fraud risk; a genuine good-faith query alone is not treated as proof of breach.",[10,256,257],{},"6.11 All prices exclude VAT or equivalent transaction taxes. LeadCrowd will charge UK VAT where required. An overseas business customer must provide accurate business location and tax information and a VAT or tax registration number where it has one or where LeadCrowd reasonably requires it. Where the supply is treated as outside the scope of UK VAT or a reverse-charge or similar mechanism applies, the customer is responsible for accounting for taxes in its jurisdiction. If the information supplied does not support the requested tax treatment, LeadCrowd may charge the tax it reasonably considers applicable and correct the treatment when sufficient evidence is provided.",[10,259,260],{},"6.12 LeadCrowd may change standard subscription fees, plan allowances, additional Active Contact rates or other standard commercial terms by giving at least 30 days’ notice, with the change taking effect on a future renewal after that notice. LeadCrowd may change usage or messaging tariffs on shorter reasonable notice where supplier, regulatory, carrier or network costs materially change. Changes do not retrospectively alter charges already incurred.",[10,262,263],{},"6.13 The customer should notify billing queries promptly and normally within 30 days after the relevant statement or invoice becomes available, identifying the disputed events and reasons. Undisputed sums remain due. LeadCrowd will reasonably investigate and correct substantiated errors. Platform and supplier records are evidence of usage, not conclusive proof immune from correction. A delay in raising a query does not waive mandatory rights or a claim for an error the customer could not reasonably have discovered earlier. Neither party is entitled to duplicate recovery.",[10,265,266],{},"6.14 Pausing or cancelling a campaign stops new activity not already irreversibly committed, subject to the relevant controls. Messages already accepted by a supplier may still be delivered or charged. Cancelling the subscription at month-end does not itself request an immediate campaign pause; the customer must use the pause control or give an express instruction to stop activity. LeadCrowd will apply such instructions without undue delay and will not use this clause to excuse further activity it should have prevented.",[14,268,270],{"id":269},"_7-integrations-suppliers-and-third-party-services","7. Integrations, suppliers and third-party services",[10,272,273],{},"7.1 Supported integrations operate only when enabled or authorised by the customer. The customer must maintain its own third-party accounts, licences, permissions and credentials where applicable.",[10,275,276],{},"7.2 Where the customer connects its own Twilio, Meta, CRM, calendar, external assistant or other third-party account or asset, the customer remains responsible for that provider relationship and charges unless the order says otherwise. LeadCrowd is responsible for Xcho’s integration and use of the connection within the agreed scope.",[10,278,279],{},"7.3 Xcho-provided UK numbers remain under LeadCrowd’s or its supplier’s control. The customer has no automatic ownership, retention or porting right when the service ends unless LeadCrowd expressly agrees otherwise.",[10,281,282],{},"7.4 LeadCrowd may change or discontinue an integration, messaging channel or third-party dependency where the provider changes its service, API, terms, pricing, availability or compliance requirements or where continued use creates a material risk. LeadCrowd will use reasonable efforts to minimise material disruption where practical, but the continued availability of every third-party service is not guaranteed.",[10,284,285],{},"7.5 A customer-selected external assistant connected through MCP or API is chosen by the customer and operates under that provider’s terms. The customer is responsible for assessing that provider’s data use, retention, security and international-transfer position. Xcho is responsible for the access controls and scopes it exposes. Revoking Xcho access prevents future authorised access but does not necessarily delete copies already received by the third party.",[10,287,288],{},"7.6 LeadCrowd may appoint, replace or remove subprocessors using the authorisation and notice process in Schedule 1. It will maintain a current subprocessor list and give notice of intended additions or replacements that will process customer personal data. The customer may object only on reasonable data-protection grounds. Where a valid objection cannot reasonably be resolved, LeadCrowd may offer an alternative or discontinue the affected service in accordance with Schedule 1 rather than remain bound to a particular supplier indefinitely.",[14,290,292],{"id":291},"_8-confidentiality-and-intellectual-property","8. Confidentiality and intellectual property",[10,294,295],{},"8.1 Each party must protect the other’s confidential information using reasonable care and disclose it only to people who need it for the agreement and are subject to appropriate confidentiality duties, or where disclosure is required by law.",[10,297,298],{},"8.2 Confidential information does not include information that is lawfully public, was already lawfully known without restriction, is lawfully obtained from another source without restriction or is independently developed without use of the other party’s confidential information.",[10,300,301],{},"8.3 LeadCrowd and its licensors retain all intellectual property rights in Xcho, including the platform, software, architecture, models selected or configured by LeadCrowd, prompts, workflows, logic, templates, documentation, branding, know-how and improvements.",[10,303,304],{},"8.4 During the contract, LeadCrowd grants the customer a limited, non-exclusive and non-transferable right to use Xcho for its internal business purposes in accordance with this agreement. That right may be suspended or terminated only under this agreement or applicable law; it is not an unrestricted right for LeadCrowd to withdraw a paid service arbitrarily.",[10,306,307],{},"8.5 The customer retains its rights in its own data and materials. Subject to third-party rights and applicable law, the customer may use AI-generated conversation content, summaries, classifications and booking notes created specifically from its own data for its business. That does not transfer any right in Xcho’s underlying prompts, workflows, models, logic, templates or technology.",[10,309,310],{},"8.6 LeadCrowd may use a customer’s name, logo, testimonial or case-study results in marketing only with that customer’s prior permission.",[10,312,313],{},"8.7 The customer grants LeadCrowd a perpetual, worldwide, non-exclusive, royalty-free right to use voluntary product suggestions and feedback to improve Xcho, without an obligation to implement them or pay compensation. This licence excludes customer personal data, campaign content and confidential business information and does not authorise publicity using the customer’s identity. Nothing promises that AI-generated content will be unique, copyright-protected or exclusive to the customer.",[14,315,317],{"id":316},"_9-support-security-and-suspension","9. Support, security and suspension",[10,319,320],{},"9.1 LeadCrowd will provide the service with reasonable care and skill. Standard support is available during the hours in Part A. No uptime commitment, guaranteed response time, guaranteed resolution time or service credit applies unless expressly agreed in an Enterprise order.",[10,322,323],{},"9.2 LeadCrowd will maintain technical and organisational measures appropriate to the nature and risk of the processing. No statement in this agreement is a warranty of absolute security or a representation that LeadCrowd holds a certification that it has not expressly identified as current.",[10,325,326],{},"9.3 LeadCrowd may immediately suspend or restrict affected activity where it reasonably believes this is necessary to address unlawful use, material security risk, abuse, an undisputed overdue payment, a serious supplier-policy risk, damage to deliverability or reputation, risk to other customers or a material breach. Prior notice will be given where reasonably practicable.",[10,328,329],{},"9.4 LeadCrowd may also suspend or refuse activity where the customer’s conduct threatens LeadCrowd’s or another customer’s access to Twilio, Meta, AWS, Stripe or another material supplier.",[10,331,332],{},"9.5 Suspension will be proportionate to the identified risk where practicable. LeadCrowd may require evidence, corrective action or changed configuration before restoration, will explain the reason and reasonable restoration requirements unless legally prohibited or doing so would compromise security and will review continuing restrictions as relevant information becomes available. It will restore affected activity when the grounds no longer reasonably justify suspension.",[10,334,335],{},"9.6 Subscription fees continue during a suspension caused by the customer’s breach, misuse or failure to pay, until cancellation or termination takes effect, subject to applicable law. Suspension does not extend the minimum term or remove the customer’s ordinary cancellation rights. LeadCrowd will not impose an indefinite paid suspension without a continuing reasonable basis. A suspension attributable to LeadCrowd’s material breach does not remove the customer’s termination or other remedies under this agreement.",[14,337,339],{"id":338},"_10-term-cancellation-termination-and-exit","10. Term, cancellation, termination and exit",[10,341,342,343,345],{},"10.1 Standard plans renew monthly until cancelled. The customer may cancel through the available in-app control or by emailing ",[25,344,28],{"href":27},". Cancellation takes effect at the end of the current paid billing month. The customer keeps ordinary access until then unless a suspension right applies. No pro-rata subscription refund is due for ordinary cancellation.",[10,347,348],{},"10.2 An upgrade may take effect immediately and may be charged on a pro-rata basis for the remainder of the current billing month. A downgrade takes effect at the end of the current paid billing month unless LeadCrowd agrees otherwise.",[10,350,351],{},"10.3 LeadCrowd may terminate or decline to renew a standard account without cause on at least 30 days’ notice. The effective date will not be earlier than the end of the customer’s current paid billing month.",[10,353,354],{},"10.4 Either party may terminate for a material breach that cannot be remedied or remains unremedied after a reasonable written opportunity to fix it. LeadCrowd may terminate or suspend immediately for unlawful use, deliberate abuse, serious security risk, sanctions\u002Fexport-control restrictions, material supplier risk or other circumstances where continued service would expose LeadCrowd or others to material legal or operational harm.",[10,356,357],{},"10.5 If LeadCrowd suspends or terminates because of the customer’s material breach, unlawful use or abuse, the customer is not entitled to a refund of the current subscription period, subject to rights that cannot lawfully be excluded.",[10,359,360],{},"10.6 On account closure, LeadCrowd will send notice of the closure date, any recorded paid credit balance and the refund-request deadline to the current account contact. The customer may request a refund of unused paid prepaid credit within 90 days after the later of account closure and the date that notice is deemed received under clause 12.3. Refunds are manually reconciled against valid outstanding and genuinely pending supplier charges, with set-off limited to undisputed sums owed. The undisputed refundable balance will normally be processed within 30 days of a valid request. Any reasonable reserve for specifically identified pending charges will be explained and reconciled promptly when those charges are established, with any remaining refund paid within 30 days thereafter. Refunds normally return to the original payment method or another appropriately verified method if necessary. Promotional, bonus and free credit is not refundable. If no valid request is made within that 90-day period, unused paid credit may expire to the extent permitted by law. LeadCrowd will not rely on expiry before the customer has been given the closure notice and a full 90-day opportunity to claim.",[10,362,363],{},"10.7 At closure, the customer may choose return or deletion of personal data processed on its behalf. Unless it instructs earlier deletion, LeadCrowd will make that data available for secure return or export during a 30-day retrieval period and then delete live copies in accordance with Schedule 1. A completed export is a return of the exported data. Where no further instruction is received, the customer instructs return through that retrieval process followed by deletion. Schedule 3 or a mandatory legal requirement takes priority where it requires a different retrieval or deletion arrangement. Security restrictions may require a verified alternative return method, but a payment dispute will not by itself extinguish mandatory data-return rights.",[10,365,366],{},"10.8 Backups exist for resilience and disaster recovery, not as a permanent customer archive. The customer is responsible for exporting records it is legally or commercially required to retain and for maintaining appropriate copies of source data. LeadCrowd does not guarantee restoration of an individual record that the customer deleted or failed to export.",[10,368,369],{},"10.9 LeadCrowd may retain limited account, billing, security, contract-acceptance, permission-confirmation and compliance audit records for up to six years after account closure where reasonably necessary for legal obligations or to establish, exercise or defend legal claims. This does not mean full campaign conversations are retained for six years.",[10,371,372],{},"10.10 Clauses concerning accrued charges, confidentiality, intellectual property, liability, data return\u002Fdeletion, audit evidence, governing law and any provision intended by its nature to survive continue after termination.",[10,374,375],{},"10.11 Where LeadCrowd terminates an affected service without customer fault, or the customer validly terminates it for LeadCrowd’s material breach, LeadCrowd will repay subscription fees paid in advance for the unused period after effective termination. Properly incurred usage, completed setup work and other charges earned before termination remain payable. Unused paid usage credit is dealt with separately under clause 10.6. This repayment is not compensation for lost business and does not create an uptime guarantee or service-credit scheme. Other remedies remain subject to clause 11 and applicable law.",[10,377,378],{},"10.12 LeadCrowd may provide reasonable standard exit information and assistance. Bespoke migration, conversion or consultancy beyond the agreed service may be separately scoped and charged only where lawful and agreed in advance. Such charges must not obstruct mandatory return, deletion or switching rights, including Schedule 3.",[14,380,382],{"id":381},"_11-liability-and-indemnity","11. Liability and indemnity",[10,384,385],{},"11.1 Nothing in this agreement excludes or limits liability for fraud or fraudulent misrepresentation, death or personal injury caused by negligence or any other liability to the extent it cannot lawfully be excluded or limited.",[10,387,388],{},"11.2 Subject to clause 11.1, LeadCrowd’s total aggregate liability arising out of or in connection with this agreement, whether in contract, tort including negligence, misrepresentation, breach of statutory duty or otherwise, is limited to the subscription and additional Active Contact fees paid or payable for the 12 months immediately before the event first giving rise to liability. If the contract has existed for less than 12 months, the calculation runs from commencement to that event. Claims arising from the same or related events are treated as one event at the earliest relevant date. Where separate events produce separate calculations, liability for each event is limited to its calculated cap and total liability for all claims under this agreement cannot exceed the highest applicable cap, rather than the sum of the caps. Separate users, contacts, campaigns, channels, Orders, renewals or legal causes of action do not create additional caps.",[10,390,391],{},"For a free trial or pilot for which no subscription or additional Active Contact fee is payable, the aggregate trial cap is one month’s undiscounted subscription fee for Xcho’s lowest-priced standard paid plan generally offered at the trial’s commencement. The reference plan and fee must be identified in the trial Order before acceptance and remain fixed for that trial. This is a liability reference only and does not require the customer to buy the plan. For trial-only claims, this trial cap replaces the paid-fee calculation. Where both trial and paid-service claims arise, each is subject to its applicable cap and combined liability cannot exceed the greater of those caps, not their sum. The cap remains subject to clause 11.1 and applicable law; a zero-fee formula is not used to imply that all trial liability disappears.",[10,393,394],{},"11.3 VAT, prepaid balances, messaging usage charges and pure third-party pass-through amounts do not increase the liability cap. The same aggregate cap applies to contractual confidentiality, security and data-protection claims between the parties to the extent permitted by law; no separate higher cap applies unless an Enterprise order expressly states one.",[10,396,397],{},"11.4 Subject to clause 11.1, LeadCrowd is not liable for loss of profit, revenue, commission, sales, business, contracts, opportunity, anticipated savings, goodwill or reputation, whether claimed as direct or indirect loss, or for indirect, special or consequential loss. LeadCrowd is not liable for the alleged value of a lost mortgage, insurance policy, sale, appointment, lead or other commercial opportunity arising from an AI response, missed message, delay, booking outcome or service interruption.",[10,399,400],{},"11.5 LeadCrowd is not liable for loss caused by the customer’s unlawful or inaccurate instructions, lack of permissions, failure to maintain suppression data, unauthorised account access attributable to the customer, customer systems or third-party services outside LeadCrowd’s reasonable control, or the customer’s failure to keep records it is responsible for retaining.",[10,402,403],{},"11.6 The customer must take reasonable steps to mitigate loss. The limitations do not remove either party’s direct statutory obligations, bind a regulator or exclude an individual’s statutory rights. They do not reduce LeadCrowd’s obligation to repay a valid unused paid balance or prepaid subscription fees expressly refundable under clause 10. No party may recover the same loss more than once.",[10,405,406],{},"11.7 The customer indemnifies LeadCrowd, its officers and employees against third-party claims, damages, liabilities and reasonable legal or professional costs to the extent arising from: customer data or leads the customer was not entitled to use or contact; missing or invalid recipient\u002Fchannel permissions; customer failure to respect suppression or opt-out requirements; unlawful or non-compliant customer instructions; customer-supplied content, promotions, offers or claims; infringement caused by customer-supplied materials; or misuse of Xcho in breach of this agreement. The indemnity does not cover loss to the extent caused by LeadCrowd’s own breach, negligence or unlawful conduct, and does not require payment of a regulatory fine where such an indemnity is prohibited by law.",[10,408,409],{},"11.8 LeadCrowd will give prompt notice of an indemnified third-party claim where legally permitted and allow reasonable customer participation. Delayed notice reduces recovery only to the extent it materially prejudices the defence. LeadCrowd may control the defence and select appropriate advisers, acting reasonably and taking account of applicable insurance conditions, conflicts and the customer’s legitimate interests. The customer must provide reasonable cooperation and must not admit liability or settle on LeadCrowd’s behalf. LeadCrowd will consult the customer before a settlement for which reimbursement is sought and will not agree an unreasonable settlement. No settlement may impose an admission, non-monetary obligation or uninsured commitment on LeadCrowd without its prior written consent.",[10,411,412],{},"11.9 The provider liability cap does not limit the customer’s obligation to pay properly accrued charges or its liability under clauses 11.7 and 11.10. No provision requires payment of a regulatory fine or other amount where that obligation is prohibited by law.",[10,414,415],{},"11.10 The customer must reimburse LeadCrowd for reasonable, documented direct costs actually and necessarily incurred because of the customer’s material breach or misuse, including supplier abuse assessments, additional investigation and necessary containment or remediation. Recovery is limited to costs causally attributable to that breach, excludes ordinary overhead and costs caused by LeadCrowd’s own breach, negligence or unlawful conduct and is subject to reasonable mitigation. No arbitrary penalty, profit mark-up or duplicate recovery may be imposed. A reasoned itemisation must be provided and genuinely disputed amounts are subject to the billing-dispute process.",[10,417,418],{},"11.11 Each exclusion, limitation and category of excluded loss is intended to operate independently to the extent lawful. If an exclusion is ineffective, an otherwise valid monetary cap still applies; an invalid cap does not automatically invalidate a separate valid exclusion. Nothing in this agreement excludes a term, duty or remedy that cannot lawfully be excluded. The customer may request bespoke risk allocation before contracting, which applies only if expressly agreed in an Order.",[14,420,422],{"id":421},"_12-changes-notices-and-complaints","12. Changes, notices and complaints",[10,424,425],{},"12.1 LeadCrowd may update this agreement from time to time. It will give at least 30 days’ notice of a material contractual change unless a shorter period is reasonably necessary for law, security, fraud prevention or a supplier requirement. A materially adverse change to a standard plan will normally take effect on a future renewal or stated effective date, giving the customer an opportunity to cancel before it applies.",[10,427,428],{},"12.2 Minor drafting, clarification, technical, non-material or legally required changes may take effect on shorter notice where appropriate. No change retrospectively creates recipient consent, expands LeadCrowd’s rights to customer data or weakens the mandatory no-advice restriction.",[10,430,431,432,434],{},"12.3 Contractual notices to LeadCrowd may be emailed to ",[25,433,28],{"href":27}," and notices to the customer to its current account contact. The customer must keep that address current. An email is treated as received when it reaches the recipient’s mail system without a delivery-failure notice, or at 09:00 on the next Business Day if outside normal support hours. A sender aware of failure must use another reasonable notified method. Material price changes, termination and refund-deadline notices will also be sent by email rather than relying only on an unseen dashboard message. A cancellation received before renewal is effective for that renewal even if processed later. These rules do not postpone mandatory incident notifications or rights-request deadlines and do not constitute consent to service of court proceedings by email.",[10,436,437],{},"12.4 The customer must promptly notify LeadCrowd of complaints, regulator enquiries, data-rights requests or legal claims relating to campaigns run through Xcho where LeadCrowd’s assistance may reasonably be required and must cooperate reasonably with LeadCrowd’s response.",[14,439,441],{"id":440},"_13-general","13. General",[10,443,444],{},"13.1 This agreement, including its applicable Schedules and each accepted Order incorporated under clause 1.1, is the entire agreement concerning the service and supersedes prior discussions, proposals and representations concerning the same subject matter. The precedence provisions in clause 1 apply. Nothing in this clause excludes liability for fraud or fraudulent misrepresentation or any right that cannot lawfully be excluded.",[10,446,447],{},"13.2 The customer acknowledges that it has not relied on a statement, promise, forecast, roadmap item, demonstration or marketing example that is not expressly included in the agreement or order, subject to rights that cannot lawfully be excluded.",[10,449,450],{},"13.3 LeadCrowd may assign, transfer or novate this agreement to a group company, purchaser of all or substantially all of the Xcho business or successor in a corporate reorganisation without the customer’s consent, provided this does not materially reduce the customer’s contractual rights. The customer may not assign or transfer the agreement without LeadCrowd’s prior written consent.",[10,452,453],{},"13.4 Neither party is liable for delay or failure caused by events beyond its reasonable control, including material failures of telecommunications, internet, cloud, messaging or payment providers, cyber incidents not caused by that party’s breach, natural disasters, industrial disputes, war, civil disorder, government action or similar events, provided the affected party takes reasonable steps to mitigate the impact. This clause does not excuse obligations that applicable law does not permit to be excluded.",[10,455,456],{},"13.5 No partnership, agency, employment relationship or personal guarantee is created. A delay in enforcing a right is not a waiver. If a provision is unenforceable, it is modified or severed to the minimum extent necessary and the remaining provisions continue.",[10,458,459],{},"13.6 LeadCrowd’s officers and employees may enforce the protections expressly given to them by clause 11.7 under the Contracts (Rights of Third Parties) Act 1999, subject to the same defences, exclusions and prohibition on double recovery. No other person may enforce this agreement under that Act. The parties may vary or end the agreement without a beneficiary’s consent, subject to applicable law and accrued rights. This clause does not restrict independent statutory rights.",[10,461,462],{},"13.7 This agreement is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction, subject to any jurisdictional rule that cannot lawfully be excluded.",[14,464,466],{"id":465},"_14-electronic-acceptance","14. Electronic acceptance",[10,468,469],{},"14.1 Before electronic acceptance, LeadCrowd will make the agreement and Order available in a form the customer can retain and will draw reasonable attention to the liability limits, customer indemnity, usage charging and cancellation terms. It will retain the exact accepted versions, business identity, accepting user and timestamp as evidence and make the customer’s accepted record available on reasonable request. A later website or document update does not overwrite that historical acceptance record.",[10,471,472],{},"14.2 Enterprise or bespoke arrangements may use a signed order form, electronic signature or other written acceptance process agreed by LeadCrowd.",[14,474,476],{"id":475},"schedule-1-data-processing-agreement","Schedule 1. Data Processing Agreement",[478,479,481],"h3",{"id":480},"_1-scope-and-roles","1. Scope and roles",[10,483,484],{},"This Schedule applies where LeadCrowd processes personal data on behalf of the customer. The customer is the controller or an authorised processor appointing LeadCrowd as its subprocessor. If the customer is itself a processor, it warrants that it has its controller’s authority to appoint LeadCrowd.",[10,486,487],{},"In this Schedule, applicable data-protection law means the UK GDPR and Data Protection Act 2018 and, to the extent applicable to the processing, the EU GDPR and relevant national implementing law. Controller, processor, personal data, processing and personal-data breach have their statutory meanings. The customer retains the rights and responsibilities of the controller or instructing processor, including lawful instructions, lawful bases, transparency, accuracy, minimisation and retention. Nothing in this Schedule permits either party to avoid a mandatory legal obligation.",[10,489,490],{},"LeadCrowd acts separately as controller for its own account administration, billing, fraud prevention, security, support, legal obligations and business relationship activities described in the Xcho Privacy Policy. That separate role does not permit unrelated reuse of customer campaign data.",[478,492,494],{"id":493},"_2-subject-matter-nature-and-purpose","2. Subject matter, nature and purpose",[10,496,497],{},"The processing covers receiving and storing customer contacts, permission and suppression records; running instructed SMS and WhatsApp conversations; analysing replies; screening proposed AI messages; generating summaries and classifications; routing human follow-up; arranging bookings; synchronising authorised CRM, calendar, form or webhook fields; enabling authorised account access through integrations; producing reports; and returning, restricting or deleting data under instruction.",[10,499,500],{},"Processing may include collection, recording, organisation, structuring, storage, retrieval, consultation, analysis, use, transmission, restriction, export and deletion. It excludes independent lead generation, sale or resale of customer campaign data, unrelated marketing and training or fine-tuning general AI models on customer contacts or conversations.",[478,502,504],{"id":503},"_3-data-subjects-and-data-types","3. Data subjects and data types",[10,506,507],{},"Data subjects may include the customer’s prospects, leads, customers, clients and relevant representatives. Personal data may include names, telephone numbers, email addresses, source and permission records, suppression and opt-out records, messages and replies, relevant information extracted from conversations, summaries, delivery records, campaign activity and appointment details.",[10,509,510],{},"Intentional special-category or criminal-offence data is excluded unless separately approved in writing with the applicable lawful conditions and safeguards.",[478,512,514],{"id":513},"_4-duration-and-instructions","4. Duration and instructions",[10,516,517],{},"Processing continues for the contract term and the limited period required to complete return, export, deletion, backup expiry and lawful retention.",[10,519,520],{},"Documented instructions comprise this agreement, the accepted order, authorised account and campaign configurations, enabled integrations and written instructions within the agreed scope. Content supplied by a campaign recipient is data to process and is not authority to change the customer’s instructions or bypass controls.",[10,522,523],{},"LeadCrowd will process personal data only on documented instructions, including in relation to restricted international transfers, unless UK law or, where applicable, Union or Member State law to which it is subject requires otherwise. In that case it will inform the customer of the legal requirement before processing unless the law prohibits that information on important grounds of public interest. LeadCrowd will immediately inform the customer if, in its opinion, an instruction infringes applicable data-protection law and may suspend the affected instruction pending clarification or a lawful alternative. This is not a general obligation to provide legal advice or independently audit every customer instruction.",[478,525,527],{"id":526},"_5-confidentiality-and-security","5. Confidentiality and security",[10,529,530],{},"LeadCrowd will ensure that people authorised to process customer personal data are bound by confidentiality or an appropriate statutory duty. It will implement all technical and organisational measures required by Article 32 of the applicable GDPR, taking account of the processing risk, including the measures in Schedule 2. Controls will be reviewed and tested as appropriate to that risk. Changes may improve or replace controls without materially reducing the agreed level of protection.",[478,532,534],{"id":533},"_6-assistance-and-personal-data-breaches","6. Assistance and personal-data breaches",[10,536,537],{},"Taking account of the nature of the processing, LeadCrowd will assist the customer through appropriate technical and organisational measures, insofar as possible, to respond to data-subject rights requests. It will promptly pass on a request concerning customer-controlled data and will not independently decide the customer’s response unless instructed or required by law. Taking account of the processing and information available, it will assist with security, notifications to regulators and affected individuals, impact assessments and prior consultation under Articles 32 to 36 of the applicable GDPR. Standard assistance is included; exceptional bespoke work may be reasonably charged only where lawful and agreed in advance, not to delay urgent assistance or remedy LeadCrowd’s own breach.",[10,539,540],{},"LeadCrowd will notify the customer without undue delay after becoming aware of a personal-data breach affecting customer campaign data. Initial notification need not await a completed investigation. LeadCrowd will provide information reasonably available about the nature of the incident, affected data and individuals where known, likely consequences and containment or remediation measures and will provide reasonable updates.",[478,542,544],{"id":543},"_7-subprocessors","7. Subprocessors",[10,546,547],{},"The customer gives general written authorisation for LeadCrowd to use the subprocessors on its current subprocessor list and those identified in Schedule 2.",[10,549,550],{},"LeadCrowd will give the customer at least 14 days’ advance notice of any intended addition or replacement of a subprocessor that will process customer personal data, identifying its legal identity, purpose and relevant locations and transfer arrangements. A shorter advance period may be used only where necessary for an urgent legal, security or service-continuity reason and legally permitted while preserving a meaningful opportunity to object; otherwise prior specific written authorisation is required. The customer must keep its notification contact current. Mere publication of a changed list without the required notice is not a substitute for this process.",[10,552,553],{},"The customer may object within the notified period on reasonable, specific data-protection grounds. The parties will work in good faith to resolve a valid objection. LeadCrowd may offer a reasonable alternative or disable or terminate the affected service if resolution is not reasonably possible, with the no-fault refund treatment in clause 10.11 where applicable. It will not transfer the customer’s data to an objected-to new subprocessor while a valid timely objection remains unresolved. An objection is not a general supplier veto unrelated to data protection, and unrelated services may continue.",[10,555,556],{},"LeadCrowd will bind each subprocessor by a written contract imposing the data-protection obligations required by Article 28, including sufficient guarantees of appropriate security and equivalent protection for the relevant processing. LeadCrowd remains fully liable to the customer for performance of the subprocessor’s obligations as required by Article 28(4), subject to any lawful contractual allocation of monetary liability between the parties.",[10,558,559],{},"A provider independently selected and contracted by the customer, including an external assistant, is not made LeadCrowd’s subprocessor merely because Xcho enables the connection.",[478,561,563],{"id":562},"_8-audit-and-compliance-information","8. Audit and compliance information",[10,565,566],{},"LeadCrowd will make available all information necessary to demonstrate compliance with Article 28 and this Schedule and allow and contribute to audits and inspections by the customer or an independent auditor it appoints. The parties will normally first use existing compliance information and a proportionate written questionnaire to avoid unnecessary disruption. Auditors must be appropriately qualified and bound by confidentiality; LeadCrowd may object on reasonable conflict-of-interest or security grounds, but not prevent an effective audit.",[10,568,569],{},"Routine audits will normally be limited to once in 12 months on at least 30 days’ notice during normal business hours. Those limits do not prevent an audit or shorter notice required by a competent authority, applicable law, a material incident or a reasonable need to verify Article 28 compliance that cannot adequately be met otherwise. Scope and access will be proportionate and protect other customers’ information, privileged material, security and trade secrets. LeadCrowd may use redaction, independent assurance or controlled access where sufficient, but not withhold information necessary for a legally required effective audit merely by labelling it confidential.",[10,571,572],{},"A deeper audit is at the customer’s cost unless it identifies a material breach by LeadCrowd of this Schedule, in which case reasonable audit costs may be allocated as required by law or agreed between the parties.",[478,574,576],{"id":575},"_9-return-deletion-and-backups","9. Return, deletion and backups",[10,578,579],{},"During an active account, customer contacts, conversations and campaign history may be retained until the customer deletes them or instructs LeadCrowd to do so, subject to legal retention.",[10,581,582],{},"At the end of the service, LeadCrowd will, at the customer’s choice, return or securely delete all personal data processed on its behalf and delete existing copies unless applicable UK law or, where applicable, Union or Member State law requires storage. The default instruction is secure return\u002Fexport availability during the 30-day retrieval period followed by deletion, as described in clause 10.7. Earlier deletion may be requested. A longer period required by Schedule 3 takes priority. LeadCrowd will require its subprocessors to follow the corresponding return or deletion instruction. It will confirm completion on reasonable request, identifying any legally required retention and the remaining backup-expiry timetable.",[10,584,585],{},"Where immediate selective deletion from a backup is not technically practicable, the affected data will immediately be put beyond ordinary use, protected by restricted access and deleted or overwritten as soon as practicable through the backup cycle and no later than 90 days after deletion from the live service. Restored backups must not reintroduce deleted or suppressed data into ordinary processing; relevant instructions will be reapplied before ordinary processing resumes. Where Schedule 3 requires earlier full erasure, its rule prevails and any later backup-expiry period requires a legally valid agreement as described there.",[10,587,588],{},"Limited records lawfully held by LeadCrowd as a separate controller for the purposes described in the Privacy Policy and clause 10.9 are distinct from general copies of campaign data held on the customer’s behalf. Their retention must remain necessary, lawful and proportionate and does not permit retaining complete campaign conversations as a general archive. Personal data held solely as processor remains subject to the return\u002Fdeletion rule above. Minimal suppression records may be retained under lawful instructions or a separate lawful obligation to prevent renewed unwanted contact.",[478,590,592],{"id":591},"_10-international-transfers","10. International transfers",[10,594,595],{},"LeadCrowd’s primary hosting and built-in AI processing are configured for UK\u002FEU processing where technically configurable at launch. This does not mean every messaging, payment, support or customer-enabled integration provider processes all data only in the UK or EEA.",[10,597,598],{},"Where a restricted transfer occurs, LeadCrowd will use an applicable lawful transfer mechanism and appropriate safeguards. Customer-selected external providers are subject to the customer’s provider relationship and transfer assessment.",[14,600,602],{"id":601},"schedule-2-suppliers-processing-locations-and-security-controls","Schedule 2. Suppliers, processing locations and security controls",[478,604,606],{"id":605},"_1-principal-service-providers","1. Principal service providers",[10,608,609],{},"Amazon Web Services: cloud hosting, database, storage and Amazon Bedrock AI processing. Primary Xcho hosting is configured in the London AWS region. Built-in AI processing is configured to remain within UK\u002FEU routes where technically configurable. Exact support, backup and service-specific processing may vary under AWS terms and configuration.",[10,611,612],{},"Twilio: SMS delivery, WhatsApp connectivity where used and Xcho-provided telephone numbers. Messaging data may be processed outside the UK\u002FEEA under applicable supplier safeguards.",[10,614,615],{},"Meta\u002FWhatsApp: WhatsApp Business functionality when the customer enables WhatsApp. Meta may act in different legal roles for different activities.",[10,617,618],{},"Stripe: subscription collection, prepaid top-ups, authorised recurring payments, payment status, refunds and fraud\u002Fpayment administration. Full payment-card details are handled by Stripe and are not stored by Xcho. Xcho may receive limited payment metadata such as transaction status, payment reference, card brand and last four digits.",[10,620,621],{},"Postmark: Xcho account and service email such as sign-up, password reset, security and account alerts.",[10,623,624],{},"Google Calendar and HubSpot: optional customer-enabled integrations. Access is limited to scopes and data needed for the enabled function.",[10,626,627],{},"Website forms and webhooks: customer-enabled sources for incoming enquiries or system events. The customer is responsible for the lawful collection and permission applicable to data sent into a live campaign.",[10,629,630],{},"External assistants through MCP or API: customer-selected providers may receive data within the scope authorised by the customer. Their processing is governed by their own provider terms unless LeadCrowd separately appoints them as a subprocessor.",[10,632,633],{},"LeadCrowd will maintain a current public subprocessor list so that supplier identities, roles and material changes can be kept current without rewriting every customer agreement.",[478,635,637],{"id":636},"_2-security-controls","2. Security controls",[10,639,640],{},"LeadCrowd will maintain controls appropriate to the service and risk, which may include role-based access, authentication controls, encryption in transit and at rest where supported, logical tenant separation, logging and monitoring, supplier access controls, staff confidentiality, incident response, backup and recovery procedures and periodic security review.",[10,642,643],{},"Authorised Xcho personnel may access customer campaign data only where reasonably necessary for support, security, incident investigation, abuse prevention, maintenance or legal obligations. Access must be limited to the relevant purpose.",[10,645,646],{},"LeadCrowd does not warrant that any system is absolutely secure and does not claim a security certification unless it expressly identifies that certification as current.",[478,648,650],{"id":649},"_3-retention","3. Retention",[10,652,653],{},"Active customer campaign data: retained while the account is active unless the customer deletes it or instructs deletion, subject to legal requirements.",[10,655,656],{},"Post-closure export: 30 days, subject to the customer’s lawful deletion choice and the different retrieval rules where Schedule 3 or mandatory law applies.",[10,658,659],{},"Live customer campaign data after the retrieval window: securely deleted under Schedule 1, subject only to a lawful applicable retention requirement or a different valid instruction under Schedule 3.",[10,661,662],{},"Backups: put beyond ordinary use when corresponding live data is deleted and deleted or overwritten as soon as practicable, no later than 90 days afterwards. Earlier full-erasure requirements under Schedule 3 prevail unless a later expiry is expressly and lawfully agreed.",[10,664,665],{},"Key contract, billing, security, acceptance, permission-confirmation and compliance audit records: up to 6 years after account closure where reasonably necessary for legal obligations or legal claims.",[10,667,668],{},"Operational logs: retained for shorter periods appropriate to security, troubleshooting and service operation where longer retention is not necessary.",[478,670,672],{"id":671},"_4-audit-trail","4. Audit trail",[10,674,675],{},"Xcho may retain an audit trail of contract acceptance, campaign-level permission confirmations, key campaign approvals, opt-outs, suppression events, billing actions and material administrative actions. The audit trail is intended to evidence instructions and system events and does not transfer the customer’s underlying legal responsibility for its data or campaign permissions to LeadCrowd.",[14,677,679],{"id":678},"schedule-3-mandatory-switching-and-portability-rights","Schedule 3. Mandatory switching and portability rights",[478,681,683],{"id":682},"_1-application-and-priority","1. Application and priority",[10,685,686],{},"This Schedule applies only to the extent that Chapter VI of Regulation (EU) 2023\u002F2854 (the EU Data Act) mandatorily applies to the relevant Xcho data-processing service supplied to a customer in the Union. It does not voluntarily extend that regime to every customer or service. A genuinely non-production, time-limited testing or evaluation service benefits from an applicable statutory exception only where its conditions are met and the customer is told before contracting; a free price alone is not an exception. Mandatory law prevails over conflicting charges, notice periods, IP restrictions or exit provisions in the main agreement.",[478,688,690],{"id":689},"_2-request-notice-and-transition","2. Request, notice and transition",[10,692,693,694,696],{},"The customer may email ",[25,695,28],{"href":27}," to request switching to another provider of the same service type, porting to its own on-premises ICT infrastructure or erasure on termination. It must identify the affected service, an authorised contact, the intended destination where relevant and the requested date. LeadCrowd may verify authority and security details without using verification to obstruct the request. For rolling monthly plans the notice period is the remaining current paid billing month; for other plans it is the shorter of the agreed notice period and two months. A shorter period may be agreed.",[10,698,699],{},"After the notice period, switching will be completed without undue delay and within 30 calendar days. Where that is technically unfeasible, LeadCrowd will notify the customer within 14 working days of the switching request, explain the technical reasons and specify an alternative transitional period not exceeding seven months. The customer may extend the transitional period once for a period it considers more appropriate for its own purposes. LeadCrowd will act with due care to maintain business continuity, continue the contracted functions during transition, explain known risks within its control and maintain a high level of security during transfer and retrieval.",[10,701,702],{},"LeadCrowd will provide reasonable assistance to the customer and its authorised destination provider and support the customer’s exit strategy with relevant information. The parties and destination provider must cooperate in good faith. The customer is responsible for choosing and preparing its destination, obtaining necessary rights and credentials and checking the returned data; LeadCrowd is not responsible for the destination provider’s implementation or a failure caused by the customer’s non-cooperation, without prejudice to its own mandatory duties.",[478,704,706],{"id":705},"_3-exportable-data-and-protected-technology","3. Exportable data and protected technology",[10,708,709],{},"The export covers the customer’s data and digital assets retained by the service and within the statutory scope: account and organisation settings; authorised-user and role records; contacts and supplied fields; source, permission and suppression records; customer-supplied campaign instructions, content, templates and configuration; sent and received messages and related attachments where held; customer-specific summaries, classifications and booking or handover records; reports, delivery and usage records; customer-related audit events and relevant metadata; and customer-supplied integration mappings and documents. Only categories actually held are returned. Data already lawfully deleted before the request need not be reconstructed.",[10,711,712],{},"Excluded internal categories are Xcho source and object code, model weights, proprietary system prompts, generic workflow engines and templates, internal service architecture, cross-customer security mechanisms, supplier credentials and secrets and proprietary operational information protected by IP rights or trade secrets. Customer-supplied material and customer-specific outputs are not excluded merely because they were processed by proprietary software. Exclusions must not impede or delay mandatory switching. Other customers’ personal data and secrets will not be disclosed. Where necessary, a secure reauthorisation method replaces transfer of credentials rather than exporting passwords or tokens.",[478,714,716],{"id":715},"_4-formats-interfaces-and-information","4. Formats, interfaces and information",[10,718,719],{},"LeadCrowd will provide exportable data in a structured, commonly used and machine-readable format appropriate to the data, with information needed to interpret it, and will make the open interfaces and documentation required by applicable law available without charge on an equal basis. It will maintain an up-to-date online register, accessible through Xcho’s website or account documentation, describing the supported structures, formats, relevant standards, methods and known restrictions, and provide its exact location to the customer before contracting. The register must not be used to remove a statutory category of exportable data.",[10,721,722],{},"These obligations do not require development of a new service or transfer of protected Xcho technology, a guarantee that another provider will reproduce Xcho’s AI behaviour or a guarantee of functional equivalence beyond the requirements applicable to the actual service. LeadCrowd will provide the switching capabilities and interoperability required by applicable law, without compromising lawful security protections.",[478,724,726],{"id":725},"_5-termination-retrieval-and-erasure","5. Termination, retrieval and erasure",[10,728,729],{},"LeadCrowd will notify the customer when switching is successfully completed, at which point the affected service contract terminates. Where the customer chooses erasure without switching, termination occurs at the end of the notice period. Accrued lawful charges remain due. Following the end of the applicable transitional period, exportable data and digital assets remain retrievable for at least 30 calendar days. The customer may expressly agree a later retrieval or erasure date.",[10,731,732],{},"After that retrieval period, or a later date expressly agreed with the customer, and once switching has completed successfully, LeadCrowd will fully erase the exportable data and digital assets generated directly by or relating directly to the customer, subject to mandatory legal retention. The general 90-day backup allowance does not automatically extend this full-erasure deadline. Where a later date is needed for backup expiry, it must be specifically disclosed and agreed with the customer as permitted by law. Data required by law to be retained will be isolated from ordinary use and erased when that requirement ends. The statutory erasure rule is not avoided by retaining the data in a backup. For an erasure-only request, Schedule 1 applies from termination subject to any stricter mandatory requirement; deletion is not conditional on completing a switch.",[478,734,736],{"id":735},"_6-charges","6. Charges",[10,738,739],{},"No separate switching charge is payable unless expressly disclosed and agreed before contracting and permitted by the Data Act. Until 12 January 2027, any permitted switching charge must not exceed costs directly linked to that switching process. From 12 January 2027, no switching charge, including necessary switching-related data-egress charges, will be imposed. Open interfaces required by law are provided without charge. Ordinary service fees for service actually supplied during notice and transition remain payable, with unused prepaid amounts reconciled at effective termination. There is no new early-exit penalty for a standard monthly plan. Any bespoke minimum-term charge must have been expressly agreed, lawfully recoverable and must not be a disguised prohibited switching charge.",[478,741,743],{"id":742},"_7-international-access-information","7. International access information",[10,745,746],{},"Before contracting, LeadCrowd will make available on Xcho’s website the infrastructure-jurisdiction and international governmental-access information required by Article 28 of the Data Act and provide the location with the Order. It will maintain the technical, organisational and contractual safeguards required to prevent unlawful international governmental access to non-personal data held in the Union and assess any request under applicable law. This does not promise that all suppliers are subject only to UK law or that no lawful governmental request can occur.",{"title":748,"searchDepth":749,"depth":749,"links":750},"",3,[751,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,779,785],{"id":16,"depth":752,"text":17},2,{"id":62,"depth":752,"text":63},{"id":87,"depth":752,"text":88},{"id":121,"depth":752,"text":122},{"id":158,"depth":752,"text":159},{"id":177,"depth":752,"text":178},{"id":223,"depth":752,"text":224},{"id":269,"depth":752,"text":270},{"id":291,"depth":752,"text":292},{"id":316,"depth":752,"text":317},{"id":338,"depth":752,"text":339},{"id":381,"depth":752,"text":382},{"id":421,"depth":752,"text":422},{"id":440,"depth":752,"text":441},{"id":465,"depth":752,"text":466},{"id":475,"depth":752,"text":476,"children":768},[769,770,771,772,773,774,775,776,777,778],{"id":480,"depth":749,"text":481},{"id":493,"depth":749,"text":494},{"id":503,"depth":749,"text":504},{"id":513,"depth":749,"text":514},{"id":526,"depth":749,"text":527},{"id":533,"depth":749,"text":534},{"id":543,"depth":749,"text":544},{"id":562,"depth":749,"text":563},{"id":575,"depth":749,"text":576},{"id":591,"depth":749,"text":592},{"id":601,"depth":752,"text":602,"children":780},[781,782,783,784],{"id":605,"depth":749,"text":606},{"id":636,"depth":749,"text":637},{"id":649,"depth":749,"text":650},{"id":671,"depth":749,"text":672},{"id":678,"depth":752,"text":679,"children":786},[787,788,789,790,791,792,793],{"id":682,"depth":749,"text":683},{"id":689,"depth":749,"text":690},{"id":705,"depth":749,"text":706},{"id":715,"depth":749,"text":716},{"id":725,"depth":749,"text":726},{"id":735,"depth":749,"text":736},{"id":742,"depth":749,"text":743},"The agreement between LeadCrowd Limited, trading as Xcho, and each business customer, with the Data Processing Agreement, suppliers and switching schedules.","md",{},true,"\u002Fbusiness-user-agreement",{"title":5,"description":794},"business-user-agreement","2026-10-01","1.1","wyDoxPLgOlva609Q-D_Aw8oXzY9OUM6754H0WP9sYYk",1792658338934]