Data Licence and Sharing Agreement

Version 1.0, effective 1 November 2026

Published by Emailmovers Limited, company 05046417, registered office 33-35 Exchange Street, Driffield YO25 6LL. ICO registration Z9714386.

This version lives at emailmovers.com/data-licence/ and, once a later version replaces it, at emailmovers.com/data-licence/v1/.

The agreement in brief

1. About this agreement

1.1 This agreement is between Emailmovers Limited (“we”, “us”) and the organisation that holds the MyDataHub account (“you”).

1.2 You accept it by ticking an unticked box before every order, and when you make an agent key that can order. An agent key’s acceptance covers the orders that key places. Your account records the version you accepted and when.

1.3 It applies to every record we supply to you, whether you paid for it with bought credits, free credits or a subscription, and to any sample we send you that shows a person’s details.

1.4 It sits beside the MyDataHub Terms of Sale. If they differ about how you may use records, this agreement wins.

1.5 It follows the ICO’s data sharing code of practice.

2. Definitions

2.1 In this agreement:

• data protection law means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended, including by the Data (Use and Access) Act 2025;
• record means the data about one business contact that we supply to you;
• order date means the date we deliver an order;
• licence period means, for each record, the 12 months from its order date;
• people working for you means your employees and any processor that acts only on your instructions for your own marketing, such as your email sending service, your CRM provider or a call centre making calls in your name;
• responded record means a record whose person, during the licence period, has replied to you (other than by an automatic reply, or to object or ask you to stop), asked you for information, accepted a call or a meeting, or become your customer. Opening an email or clicking a link is not a response.
• suppression means a notice from either of us that a person must not be marketed to, for example because they objected, left the company or died.

3. Our roles

3.1 We are the controller of our database. When we supply a record to you, you become a controller of your copy of it.

3.2 Each of us is responsible for meeting data protection law in our own processing. We are not joint controllers, and neither of us is the other’s processor.

3.3 You must be registered with the Information Commission (the ICO) and pay the data protection fee, unless you are exempt.

3.4 Give us the name and email address of a person who handles data protection for you. Keep them up to date in your account. Our contact is [email protected].

3.5 Keep a record of your processing of the data, as UK GDPR Article 30 requires. We can give you a paragraph for it on request; ask [email protected].

4. The licence

4.1 For each record, we grant you a non-exclusive, non-transferable licence for its licence period to use it for business-to-business direct marketing of your own products and services to that person in their business role, by email, telephone and post.

4.2 During the licence period you may download a record again, refresh it and push it to your own CRM, at no extra charge.

4.3 You may not:

• resell, sub-license, lend or give the data to anyone;
• share it with anyone except people working for you;
• build it into a product, list, database or service that you sell or give to others, or use it to enrich data for others;
• use it to market to people as consumers, rather than in their business roles;
• use it to make decisions about a person’s credit, employment, insurance or eligibility for anything;
• use it beyond its licence period, except for responded records under clause 11.

4.4 The database and the records are our property and that of our suppliers. This agreement gives you a licence, not ownership.

4.5 We may include seed records in what we supply, so we can see how the data is used. A seed record’s use outside this agreement is evidence of a breach of it.

5. The data we share

5.1 A record can include a person’s name, job title, job function and level, business email address, business telephone numbers, business postal address, and details of their company, such as its name, Companies House number, industry code and size.

5.2 Each record also carries compliance fields: our lawful basis, the subscriber class, whether and when we sent our own notice to the person, the TPS and CTPS status of each telephone number with its screen date, and the suppression status.

5.3 We do not supply special category data or data about criminal offences. Do not use the data to infer such data.

6. Lawful basis and your assessment

6.1 We rely on legitimate interests (UK GDPR Article 6(1)(f)) to compile the database and supply it to you. We have assessed those interests against the rights of the people in it.

6.2 You must have your own lawful basis for your use. For business-to-business marketing this is normally legitimate interests. Before you first use the data, carry out and record your own legitimate interests assessment. We can give you a draft to adapt on request; ask [email protected].

6.3 You must also keep to PECR:

• email and text messages: by default an order delivers corporate subscribers only, and each record carries its subscriber class. Do not send marketing email or text messages to an individual subscriber, such as a sole trader or an ordinary partnership, without their consent. Treat a record whose subscriber class is unknown as an individual subscriber unless you have checked it;
• every marketing email: identify yourself, give a valid address for replies, and offer a simple way to opt out;
• automated calls: do not make them without the person’s consent;
• live calls: see clause 9.

7. Telling people about your use

7.1 We tell people about our processing in our privacy notice, and we email each person in our database a notice that explains it and how to object. Each record shows whether and when we sent that notice.

7.2 You must give each person your own privacy information: at the latest when you first contact them, and in any case within one month of receiving their record. Say that you obtained their details from Emailmovers Limited and link to our privacy notice at emailmovers.com/privacy/.

7.3 We can give you wording that meets this, for your first email, on request; ask [email protected].

8. Objections, suppressions and other rights

8.1 Anyone may object to direct marketing at any time. If a person objects to you, stop marketing to them straight away and add them to your own suppression list.

8.2 Tell us about every objection you receive to a record we supplied, as soon as you can and within 28 days at the latest, so we can suppress the person for everyone. Use report_objection in the MCP server, POST /v1/objections in the API, the app, or email [email protected].

8.3 We tell you about suppressions that affect records you hold under licence: by signed webhook and through the API (GET /v1/suppressions) if you use them, and by email to your data protection contact. Apply each one before your next marketing contact with that person, and within 28 days at the latest.

8.4 We also pass on corrections, and requests to erase or restrict a person’s data, that affect records you hold. Apply them within the same time.

8.5 Each of us answers requests from people about our own processing, including access requests. If you receive a request that concerns our processing, send it to [email protected] within 5 working days. We will help you answer requests about records we supplied, for example by confirming where a record came from.

9. Telephone calls

9.1 We screen every telephone number against the TPS and the CTPS each night through a licensed UK screening service. Each number carries its status and the date of that screen. This is a service that helps you; it does not move your legal duties to us.

9.2 Do not call a number that is registered on the TPS or the CTPS unless that subscriber has told you they do not object to your calls.

9.3 PECR regulation 21(3) protects a caller only where a number has been on the register for less than 28 days before the call. So rely on a clear result only for calls made within 27 days after its screen date. To call later, refresh the record in MyDataHub, free during the licence period, or screen the number yourself.

9.4 Keep your own list of people who have asked you not to call them, and screen against it.

10. Post

10.1 Do not send direct mail to an address registered on the Mail Preference Service.

11. When the licence ends

11.1 When a record’s licence period ends, refreshes stop and you may no longer use it, unless it is a responded record.

11.2 You may keep responded records. From the end of the licence period you hold them as your own contacts, and you are responsible for them as their controller. Keep honouring any objection or suppression you received for them.

11.3 For every other record, stop using it at the end of its licence period and delete or destroy it within 30 days, including copies held by people working for you and in your CRM. Copies in backups may stay until the backup is overwritten in its normal cycle, but you must not restore them for use.

11.4 If we ask, confirm the deletion in writing within 20 days, using the destroyed data declaration in the appendix.

11.5 If you use a record after its licence period other than as allowed here, you must pay for a new licence for it, at 1 credit a record at our price on the date of use, and our reasonable costs of finding and enforcing the breach.

11.6 To keep using a record lawfully, order it again. It costs 1 credit and starts a new 12-month licence.

11.7 You must also delete a record before its licence period ends if the person asks you to erase it and the law requires you to, or if we tell you we can no longer license it, for example because the law requires it.

12. Security

12.1 Keep the data secure with technical and organisational measures that suit the risk, as UK GDPR Article 32 requires. At least:

• give access only to people who need it, and keep a record of who has it;
• protect accounts that hold the data with strong passwords and, where offered, multi-factor sign-in;
• encrypt the data when you send it and where you store it;
• make sure people working for you are bound by confidentiality and by a written contract that meets UK GDPR Article 28.

12.2 If people working for you process the data outside the UK, make sure the transfer meets the UK GDPR’s rules on international transfers.

13. Breaches

13.1 Tell us within 24 hours of becoming aware of a personal data breach affecting data we supplied, at [email protected], with what you know. Send more detail as you learn it.

13.2 Each of us is responsible for reporting a breach in our own systems to the Information Commission and to the people affected where the law requires. Help each other to manage the consequences.

13.3 We tell you without undue delay if a breach in our systems affects data we have supplied to you.

14. Your content and conduct

14.1 You are responsible for the content of your messages and calls. Do not send anything unlawful, misleading, harassing, defamatory, obscene or otherwise objectionable, or anything that encourages a crime.

14.2 Follow the guidance of the Information Commission on direct marketing, and relevant industry codes.

15. What we do

15.1 We compile the database in line with data protection law.

15.2 We send each person our notice, and we publish our privacy notice.

15.3 We apply our master suppression file before every data build and keep it up to date each night. Suppressed records never appear in counts or orders.

15.4 We screen telephone numbers each night, as clause 9 says.

15.5 We pass on objections and other suppressions to every licensee holding the record, as clause 8 says.

15.6 Each record shows where its data came from and when it was last confirmed, so you can answer the Information Commission’s due diligence questions about bought data.

16. Checks and audit

16.1 We may ask you to show that you keep to this agreement, for example by sending your legitimate interests assessment, your privacy information, your suppression process, or a list of people working for you who hold the data. Reply within 14 days.

16.2 If we have reasonable grounds to believe you have broken this agreement, we may audit your use of the data, ourselves or through an independent auditor, on 14 days’ written notice, during working hours. We pay for the audit unless it shows a material breach.

16.3 Carry out your own checks of your compliance with this agreement, including of people working for you.

17. Liability

17.1 The liability terms in the MyDataHub Terms of Sale apply to this agreement, including the limit for data protection claims and your responsibility for your use of the data.

17.2 Nothing in this agreement limits what either of us owes to a person under UK GDPR Article 82.

18. Suspension and ending

18.1 If you break this agreement, we may stop deliveries and refreshes, suspend your account, and require you to delete the records concerned.

18.2 This agreement continues for each record until your duties under clause 11 have been met for it.

19. Review

19.1 We review this agreement at least once a year, and when the law or the Information Commission’s guidance changes.

20. Changes to this agreement

20.1 We may change this agreement. For a material change, we email the account holders of every account at least 30 days before it takes effect.

20.2 Each version has its own URL. Earlier versions stay at stable archive URLs.

20.3 A new version applies to orders placed on or after its effective date. Records already ordered stay under the version you accepted for them, unless the law requires a change sooner.

21. Law and courts

21.1 English law governs this agreement and any dispute about it, including a non-contractual dispute.

21.2 The courts of England and Wales have exclusive jurisdiction.

Appendix: destroyed data declaration

Use this declaration when we ask you to confirm deletion under clause 11.4.

We, the organisation named above, confirm that:

1. we have deleted or destroyed all records supplied under the orders above, except responded records, including copies held by people working for us, partial copies, reproductions and cached copies, and copies in backups as they are overwritten;
2. we will not restore any of them from a backup for use;
3. our rights to use those records under the Data Licence and Sharing Agreement have ended;
4. we understand that the data contains seed records, and that if we use it again we must pay for a new licence under clause 11.5.

Signed:

Name:

Position:

Date: