Customer Agreement

Parties

(1)Alder CRM Limited, a company registered in England and Wales with company number 17116559, whose registered office is at The Brew, 1st Floor, Eagle House, 163 City Road, London EC1V 1NR (Alder); and

(2)The organisation identified in the Order Form or which otherwise creates a Workspace and accepts this Agreement (the Customer).

Background

(A)Alder provides a hosted customer relationship management service designed for charities and other not-for-profit organisations in the United Kingdom.

(B)The Customer wishes to use the Service, on the Free Plan or on a Paid Plan, and Alder agrees to provide it on the terms of this Agreement.

(C)This Agreement governs the Service only. Any bespoke development, integration, consultancy or other work outside the standard Service must be agreed separately under a Professional Services Agreement.

1. Definitions and interpretation

1.1In this Agreement the following words and expressions have the following meanings:

Acceptable Use Policy the acceptable use policy set out in Schedule 3.

Affiliate in relation to a party, any entity that directly or indirectly controls, is controlled by, or is under common control with that party.

Agreement these terms and conditions, the Schedules and the Order Form, as varied from time to time in accordance with clause 22.

Alder Alder CRM Limited, a company registered in England and Wales with company number 17116559 whose registered office is at The Brew, 1st Floor, Eagle House, 163 City Road, London EC1V 1NR.

Alder IPR all Intellectual Property Rights in and to the Service, the Software, the Documentation, the Alder name and branding, and any improvements, modifications or derivative works of any of them, together with all Intellectual Property Rights in Usage Data and Feedback.

Applicable Law all laws, statutes, regulations and codes of practice from time to time in force in England and Wales which apply to a party or to the Service, including Data Protection Legislation, the Charities Act 2011 and (where applicable) the Online Safety Act 2023.

Authorised User an individual who is authorised by the Customer to use the Service on the Customer’s behalf and to whom the Customer (or Alder at the Customer’s request) has issued a login, being an employee, trustee, volunteer or contractor of the Customer.

Bespoke Work any work that is not part of the standard Service, including custom software development, custom integrations, custom reports or data models, configuration beyond that available to the Customer through the Service’s standard settings, consultancy, training beyond the Documentation and standard onboarding, and any other services described in clause 3.

Business Day a day other than a Saturday, Sunday or public holiday in England.

Confidential Information has the meaning given in clause 15.

Customer the charity, community interest company, unincorporated association or other organisation identified in the Order Form or which otherwise creates a Workspace and accepts this Agreement.

Customer Data all data, content and materials (including Personal Data) that the Customer or its Authorised Users upload to, enter into, generate within or otherwise make available through the Service, including records relating to donors, beneficiaries, volunteers, staff, cases, events and governance.

Data Processing Agreement or DPA the data processing terms set out in Schedule 2.

Data Protection Legislation the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 and all other Applicable Law relating to the processing of Personal Data and privacy, in each case as amended, replaced or supplemented from time to time.

Documentation the user guides, help articles and technical documentation for the Service that Alder makes available from time to time, including at aldercrm.com. The Documentation does not include the Website Terms.

Effective Date the date on which the Customer accepts this Agreement in accordance with clause 2.

Feedback any suggestion, idea, enhancement request, recommendation or other feedback relating to the Service provided by the Customer or an Authorised User.

Fees the subscription fees payable for a Paid Plan as set out in the Order Form or, where no Order Form exists, on the Pricing Page at the time of subscription, together with any other sums payable under this Agreement.

Free Plan the plan described on the Pricing Page as “Getting Started” (or any successor plan) for which no Fees are payable.

Intellectual Property Rights patents, rights to inventions, copyright and related rights, trade marks, business names and domain names, rights in get-up, goodwill and the right to sue for passing off, rights in designs, database rights, rights to use and protect the confidentiality of confidential information (including know-how), and all other intellectual property rights, in each case whether registered or unregistered and including all applications and rights to apply for and be granted renewals or extensions of, and rights to claim priority from, such rights, and all similar or equivalent rights or forms of protection which subsist now or in the future in any part of the world.

Order Form the record of the Customer’s subscription to a Plan, being either (a) the details submitted by the Customer through the online sign-up process at signup.aldercrm.com (or a successor page) together with Alder’s subscription confirmation, or (b) where Alder and the Customer agree, a written order form or quotation issued by Alder and accepted by the Customer, in each case identifying the Customer, the Plan, the Subscription Period, the Fees and any agreed variations to this Agreement.

Paid Plan any Plan for which Fees are payable, being at the Effective Date the plans described on the Pricing Page as “Grow”, “Pro” and “Scale” (or any successor plans).

Personal Data, Controller, Processor, Data Subject, Personal Data Breach and processing have the meanings given to them in the UK GDPR.

Plan the Free Plan or a Paid Plan, each having the Plan Limits, features and support levels described in Schedule 1 and on the Pricing Page.

Plan Limits the limits applicable to a Plan on the number of contact records, Authorised Users, emails and messages per month, storage and any other metered element, as set out in Schedule 1 and on the Pricing Page.

Pricing Page the page at aldercrm.com/pricing or any successor page.

Privacy Policy Alder’s privacy policy at aldercrm.com/privacy, as updated from time to time.

Professional Services Agreement a separate written agreement, statement of work or engagement letter between Alder and the Customer for Bespoke Work, entered into in accordance with clause 3.

Service the hosted, multi-tenant customer relationship management service for charities known as “Alder CRM” made available by Alder at *.aldercrm.com, together with the Software, the Documentation, any companion mobile applications and any support and standard onboarding services described in Schedule 1, in each case as made available under the Customer’s Plan.

Software the software applications, application programming interfaces and mobile applications owned or licensed by Alder and used to provide the Service.

Subscription Period for a Paid Plan, the monthly or annual billing period selected in the Order Form, and each successive renewal period under clause 6.2; for the Free Plan, the period during which the Customer’s Workspace remains active.

Third-Party Service any service, product, application or data source that is not provided by Alder but which the Customer elects to connect to or use with the Service, including identity providers, email delivery services, payment providers, AI services and any service listed in clause 13.

UK GDPR has the meaning given in section 3(10) (as supplemented by section 205(4)) of the Data Protection Act 2018.

Usage Data data generated by or derived from the operation and use of the Service that does not identify the Customer, any Data Subject or any Customer Data, including performance metrics, feature usage statistics and aggregated or anonymised statistical data.

Website Terms the terms of use for the aldercrm.com website and for individual users of the Service published at aldercrm.com/terms, which apply to individuals and website visitors and do not form part of this Agreement.

Workspace the logically separate tenant environment within the Service allocated to the Customer, typically at a subdomain of aldercrm.com.

1.2In this Agreement:

(a)clause, Schedule and paragraph headings do not affect interpretation;

(b)references to clauses and Schedules are to the clauses of and Schedules to this Agreement, and the Schedules form part of this Agreement;

(c)a reference to a statute or statutory provision includes any subordinate legislation made under it and any amendment or re-enactment of it;

(d)words in the singular include the plural and vice versa;

(e)“including”, “include”, “in particular” and similar expressions are illustrative and do not limit the sense of the preceding words;

(f)“writing” includes email and messages sent through the Service’s administrative interface, but not other messaging or chat services; and

(g)references to a “party” are to Alder or the Customer, and to the “parties” are to both of them.

1.3If there is any conflict or inconsistency between the documents forming this Agreement, the following order of precedence applies (highest first):

(a)any variation expressly agreed in writing and signed by both parties under clause 25.4;

(b)the Order Form;

(c)the Data Processing Agreement;

(d)these terms and conditions;

(e)Schedule 1;

(f)the Acceptable Use Policy; and

(g)the Documentation.

2. Formation of this Agreement

2.1This Agreement is a contract between Alder and the Customer. It applies to every Plan, including the Free Plan. It does not apply to Bespoke Work, which is governed exclusively by clause 3 and any Professional Services Agreement.

2.2The Customer accepts this Agreement, and this Agreement comes into force on the Effective Date, when the earliest of the following occurs:

(a)the Customer (acting through an individual with authority to bind it) completes the online sign-up process at signup.aldercrm.com and clicks to accept this Agreement;

(b)the Customer signs an Order Form, whether electronically or in hard copy;

(c)the Customer pays Fees for a Paid Plan; or

(d)the Customer or any Authorised User creates or first uses a Workspace.

2.3The individual accepting this Agreement on the Customer’s behalf warrants that they are authorised to do so. Where the Customer is an unincorporated association, the individuals who accept this Agreement and any trustees or committee members on whose behalf they act are jointly and severally responsible for the Customer’s obligations under it.

2.4Any terms which the Customer seeks to impose or incorporate, including terms contained in a purchase order, supplier onboarding form or vendor questionnaire, are excluded unless expressly agreed in a variation under clause 25.4.

2.5The Customer confirms that it is entering into this Agreement for the purposes of its charitable, community or business activities and not as a consumer. This Agreement is not available to individuals acting for purposes wholly or mainly outside their trade, business, craft or profession.

2.6Alder shall record the version of this Agreement accepted by the Customer, the date and time of acceptance, the identity of the individual who accepted it and the details submitted in the Order Form, and shall make that record available to the Customer on request. The Customer shall keep the details in its Order Form (including its legal name, registration number, administrator and billing contacts) accurate and up to date through the Service.

3. Bespoke Work and Professional Services

3.1Nothing in this Agreement obliges Alder to carry out any Bespoke Work, and the Fees do not include any Bespoke Work. Without limitation, the following are Bespoke Work and fall outside the Service:

(a)development of new features, workflows, forms, reports, integrations or data models specific to the Customer;

(b)integration of the Service with any Third-Party Service or system beyond the integrations made generally available within the Service;

(c)data migration other than the standard onboarding migration described in Schedule 1, including migration of data requiring cleansing, transformation or de-duplication beyond that which the standard migration tooling supports;

(d)configuration, set-up or administration of the Customer’s Workspace beyond the standard onboarding described in Schedule 1;

(e)consultancy, advice, training or documentation specific to the Customer;

(f)the provision of enhanced service levels, security controls, hosting arrangements or reporting beyond those described in Schedule 1 and Schedule 2; and

(g)any assistance in responding to regulatory enquiries, audits, subject access requests or litigation beyond the assistance required of Alder as a Processor under the Data Processing Agreement.

3.2Alder may agree to carry out Bespoke Work only under a separate Professional Services Agreement which shall set out, as a minimum, the scope of the Bespoke Work, the fees and payment terms, the acceptance criteria, the ownership of any Intellectual Property Rights created, and any limitation of liability applicable to that work. Alder is under no obligation to agree to any Bespoke Work and may decline any request without giving reasons.

3.3Unless the relevant Professional Services Agreement expressly provides otherwise:

(a)this Agreement continues to govern the Customer’s use of the Service, and the Professional Services Agreement governs only the Bespoke Work;

(b)any deliverables of Bespoke Work that are incorporated into the Service, or that comprise generic improvements to the Service, become Alder IPR;

(c)the limitations and exclusions of liability in clause 18 apply to any liability arising in connection with the Bespoke Work, with the Fees paid under the Professional Services Agreement counting towards the relevant cap; and

(d)the Data Processing Agreement applies to any processing of Personal Data carried out in the course of the Bespoke Work.

3.4Any informal request for Bespoke Work, including a request made by email, through support channels or in a call, and any informal response by Alder, does not create a binding commitment on either party until a Professional Services Agreement has been agreed in writing. Alder may charge for time spent scoping Bespoke Work only where it has told the Customer in advance that it will do so.

4. The Service

4.1Subject to the Customer’s compliance with this Agreement and (for Paid Plans) payment of the Fees, Alder grants the Customer a non-exclusive, non-transferable, non-sublicensable right during the Subscription Period to permit its Authorised Users to access and use the Service, within the Plan Limits, solely for the Customer’s internal charitable, community or organisational purposes.

4.2Alder shall provide the Service with reasonable skill and care and substantially in accordance with the Documentation and Schedule 1.

4.3Alder may make changes to the Service from time to time, including adding, modifying, replacing or withdrawing features, provided that Alder shall not materially reduce the overall functionality of a Paid Plan during a Subscription Period that has already been paid for without giving the Customer at least 30 days’ notice and the right to terminate under clause 20.5.

4.4The Service may be accessed through a web browser and, where Alder makes one available, through a companion mobile application. Mobile applications are subject to the terms of the relevant app store in addition to this Agreement, and do not offer the purchase of Plans. Alder does not warrant that a mobile application will be maintained or remain available for any particular operating system or version.

4.5The Service is provided on a multi-tenant basis. Each Customer’s Workspace is logically separated from other customers’ Workspaces. The Customer shall not attempt to access any Workspace other than its own.

4.6Alder may use subcontractors and sub-processors to provide the Service, subject to the Data Processing Agreement. Alder remains responsible for the acts and omissions of its subcontractors as if they were its own.

5. Free Plan

5.1This clause 5 applies where the Customer is on the Free Plan. Where this clause conflicts with any other provision of this Agreement, this clause prevails in respect of the Free Plan.

5.2The Free Plan is provided free of charge to enable charities and community organisations to evaluate and make limited use of the Service. In consideration of the Customer entering into this Agreement and complying with it, and in recognition that no Fees are paid, the Customer acknowledges and agrees that in respect of the Free Plan:

(a)the Service is provided “as is” and “as available”, and the availability target, support response targets and standard onboarding services in Schedule 1 do not apply;

(b)Alder provides support on a reasonable-endeavours basis only, by email, and does not commit to any response time;

(c)Alder may change, restrict, suspend or withdraw the Free Plan, or any feature or Plan Limit of it, at any time on giving 30 days’ notice through the Service or by email to the Workspace administrator, or without notice where required for legal, security or operational reasons;

(d)Alder may terminate the Customer’s Free Plan and this Agreement at any time on 30 days’ written notice;

(e)if no Authorised User has logged in to the Workspace for a continuous period of three months, Alder may treat the Workspace as dormant and, after giving at least 30 days’ notice to the last known email address of the Workspace administrator, delete the Workspace and all Customer Data in it;

(f)Alder’s liability is limited in accordance with clause 18.5;

(g)the Customer is not entitled to any data migration assistance, and may import data only using the self-service import tools within the Service;

(h)the Customer is not entitled to any credits, refunds or compensation of any kind; and

(i)Alder may display notices within the Workspace inviting the Customer to upgrade to a Paid Plan.

5.3The Free Plan may not be used:

(a)by a Customer that has, or has had within the preceding 12 months, a Paid Plan for the same organisation, unless Alder agrees otherwise;

(b)to operate more than one Workspace for the same organisation;

(c)by any organisation that is not a charity, community interest company, community group or other not-for-profit body; or

(d)to provide services to third parties, or otherwise to circumvent the Plan Limits.

5.4Except as expressly set out in this clause 5, the Customer on the Free Plan has all the obligations of a Customer under this Agreement, including under clauses 8, 11, 14, 15 and the Acceptable Use Policy, and the Data Processing Agreement applies in full.

5.5The Customer may upgrade from the Free Plan to a Paid Plan at any time through the Service or by agreeing an Order Form. On upgrade, the Paid Plan provisions of this Agreement apply from the start of the first Subscription Period of the Paid Plan.

6. Paid Plans: term, renewal and Plan Limits

6.1A Paid Plan begins on the date stated in the Order Form (or, if none, the date on which the first payment of Fees is received) and continues for the initial Subscription Period selected in the Order Form.

6.2At the end of each Subscription Period, the Paid Plan renews automatically for a further Subscription Period of the same length at the Fees then applicable under clause 7.7, unless either party gives notice of termination in accordance with clause 20.2.

6.3The Customer shall ensure that its use of the Service remains within the Plan Limits. Where Alder reasonably determines that the Customer has exceeded a Plan Limit, Alder shall notify the Customer, and the Customer shall within 30 days either

(a)upgrade to a Plan whose Plan Limits accommodate its usage, or

(b)reduce its usage to within the Plan Limits.

If the Customer does neither, Alder may, in addition to any other remedy, restrict the creation of new records, the addition of Authorised Users or the sending of emails and messages until the Customer has complied, and may charge the Customer for the higher Plan from the date on which the Plan Limit was first exceeded. Where the Plan Limit exceeded is the monthly allowance of emails and messages, the Customer may instead purchase additional capacity in accordance with paragraph 1.4 of Schedule 1.

6.4The Customer may upgrade its Plan at any time. Upgrades take effect immediately. Alder shall charge the difference in Fees for the remainder of the current Subscription Period on a pro rata basis, and the higher Fees shall apply from the next Subscription Period.

6.5The Customer may downgrade its Plan (including to the Free Plan) with effect from the start of the next Subscription Period by giving notice in accordance with clause 20.2. No refund is payable in respect of a downgrade. Where the Customer’s usage exceeds the Plan Limits of the lower Plan at the time the downgrade takes effect, clause 6.3 applies and Alder may, after notice, archive or restrict access to records exceeding the lower Plan’s limits.

6.6Plan Limits, features and support levels are as published on the Pricing Page at the start of the relevant Subscription Period and are summarised in Schedule 1. Where an Order Form specifies different limits, features or support levels, the Order Form prevails.

7. Fees and payment

7.1The Customer shall pay the Fees for a Paid Plan in advance for each Subscription Period. Unless the Order Form provides otherwise, Fees are payable by card or direct debit through Alder’s payment provider (currently Stripe), and the Customer authorises Alder and its payment provider to take recurring payments of the Fees on each renewal.

7.2Where Alder agrees in an Order Form to invoice the Customer, invoices are payable within 7 days of the invoice date by bank transfer, without deduction or set-off.

7.3All Fees are stated exclusive of value added tax, which (where applicable) shall be added at the prevailing rate. The Customer is responsible for determining whether any VAT relief available to charities applies to it and for providing any declaration required.

7.4Fees are non-refundable and non-cancellable once a Subscription Period has begun, except:

(a)where this Agreement is terminated by the Customer under clause 20.4 or clause 20.5, or by Alder under clause 20.3, in which case Alder shall refund pro rata any Fees paid in advance for the unexpired part of the Subscription Period;

(b)where the Customer ends an annual Paid Plan early in accordance with clause 7.5; and

(c)as otherwise expressly provided in this Agreement.

No refund is payable in respect of a monthly Subscription Period.

7.5A Customer on an annual Paid Plan may end its Plan before the end of the Subscription Period and receive a refund of the Fees paid in advance for each full calendar month of the Subscription Period remaining after the Exit Date, on the following terms:

(a)the Customer gives Alder written notice that it wishes to end the Plan early;

(b)the Customer exports the Customer Data it requires using the export tools in the Service and confirms to Alder in writing that it has received all of the Customer Data it requires;

(c)Alder then deletes the Customer Data from the live Service and confirms the deletion to the Customer in writing, and the Customer’s Workspace is closed;

(d)the “Exit Date” is the date of Alder’s confirmation under paragraph (c);

(e)no refund is payable for the calendar month in which the Exit Date falls, for any earlier month, or for any period during which the Customer retained access to the Service or the Customer Data; and

(f)Alder shall pay the refund within 30 days after the Exit Date by the method used for the original payment.

The Retrieval Period in clause 21.2 does not apply where the Customer has confirmed receipt of its data under this clause, and clause 21.3 applies from the Exit Date.

7.6If any sum payable under this Agreement is not paid by the due date, then without prejudice to Alder’s other rights:

(a)Alder may charge interest on the overdue amount at 8% a year above the Bank of England base rate from time to time, accruing daily from the due date until payment, whether before or after judgment;

(b)Alder may claim the fixed sum of £40, £70 or £100 (according to the size of the debt) as compensation under the Late Payment of Commercial Debts (Interest) Act 1998;

(c)the Customer shall reimburse Alder’s reasonable costs of recovering the overdue amount, including debt collection agency fees and legal costs, to the extent they exceed the fixed sum in (b); and

(d)if the sum remains unpaid 14 days after Alder has given the Customer written notice of non-payment, Alder may suspend the Customer’s access to the Service under clause 19 and, after a further 30 days, terminate this Agreement under clause 20.4.

7.7Alder may increase the Fees for a Paid Plan with effect from the start of the Customer’s next Subscription Period by giving the Customer at least 30 days’ written notice before the renewal date (or, for annual Subscription Periods, at least 60 days’ notice). If the Customer does not wish to pay the increased Fees it may terminate under clause 20.2 with effect from the end of the current Subscription Period. Continued use of the Service after the renewal date constitutes acceptance of the increased Fees.

7.8The Customer shall keep its billing details accurate and up to date and shall notify Alder promptly of any change in the organisation’s legal status, name or registered details.

8. Customer obligations

8.1The Customer shall:

(a)comply, and ensure that its Authorised Users comply, with this Agreement and the Acceptable Use Policy;

(b)be responsible for all acts and omissions of its Authorised Users and of any person who accesses the Service using an Authorised User’s credentials, whether or not authorised;

(c)ensure that each Authorised User keeps their credentials secure and does not share them, and promptly remove access for any individual who ceases to be an Authorised User;

(d)use the Service only within the scope of the rights granted in clause 4.1 and the Plan Limits;

(e)obtain and maintain all licences, consents and permissions necessary for Alder to perform its obligations under this Agreement, including any consents required for the sending of marketing communications through the Service;

(f)ensure that Customer Data is accurate, lawfully obtained and lawfully processed, and that the Customer has a lawful basis under Data Protection Legislation for every category of processing that it instructs Alder to carry out;

(g)be responsible for the configuration of its Workspace, including user roles and permissions, retention settings, and the classification of sensitive records; and

(h)maintain its own policies for safeguarding, data retention, records management and incident response, and comply with them.

8.2The Customer acknowledges that the Service is a tool to support the Customer’s operations and does not replace the Customer’s own legal, regulatory, safeguarding, financial or professional judgement. In particular, the Customer remains solely responsible for:

(a)its obligations to the Charity Commission for England and Wales, the Office of the Scottish Charity Regulator, the Charity Commission for Northern Ireland or any other regulator;

(b)the accuracy of any Gift Aid claim, donation record, financial record or report generated using the Service, and for verifying such information before submitting it to HM Revenue & Customs or any other body;

(c)safeguarding decisions and the handling of safeguarding records; and

(d)compliance with fundraising regulation, including the Code of Fundraising Practice.

8.3The Customer shall not, and shall ensure that its Authorised Users do not:

(a)copy, modify, translate, adapt, reverse engineer, decompile or disassemble the Software except to the extent permitted by law;

(b)access the Service in order to build a competing product or service, or copy any of its features, functions or graphics;

(c)sell, resell, rent, lease, sublicense or otherwise make the Service available to any third party other than Authorised Users;

(d)use automated means (including scraping, bots or scripts) to access the Service other than through any API made available under the Customer’s Plan and in accordance with the Documentation;

(e)introduce or permit the introduction of any virus, malware or other harmful code;

(f)circumvent or attempt to circumvent any security control, authentication mechanism, rate limit or Plan Limit; or

(g)use the Service in breach of Applicable Law.

8.4The Customer shall notify Alder without undue delay, and in any event within 24 hours, on becoming aware of any actual or suspected unauthorised access to the Service, compromise of an Authorised User’s credentials, or Personal Data Breach affecting Customer Data.

9. Availability, support and maintenance

9.1For Paid Plans, Alder shall use reasonable endeavours to make the Service available in accordance with the availability target in Schedule 1. The availability target is a target and not a warranty. Failure to meet the availability target does not of itself constitute a breach of this Agreement, and no service credits, refunds or other compensation are payable in respect of it, save that persistent failure to meet the target may be evidence of a failure to provide the Service with reasonable skill and care.

9.2Alder shall provide the support services applicable to the Customer’s Plan as described in Schedule 1. Support is provided in English during Alder’s support hours as set out in Schedule 1, to the Customer’s designated administrators, and covers the use of the Service and the reporting of faults. Support does not include training, Bespoke Work, support for Third-Party Services, or assistance with matters within the Customer’s responsibility under clause 8.

9.3Alder may suspend the Service for planned maintenance in accordance with Schedule 1, and for emergency maintenance at any time. Alder shall use reasonable endeavours to give advance notice of planned maintenance and to schedule it outside Business Days where practicable.

9.4The availability target and support commitments in this clause and Schedule 1 do not apply to the Free Plan, to which clause 5 applies instead.

10. Security

10.1Alder shall implement and maintain appropriate technical and organisational measures to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, as described in Annex C to the Data Processing Agreement. These measures include, as at the Effective Date, hosting in data centres located in the United Kingdom, encryption of Customer Data in transit and at rest, role-based access controls, logical tenant isolation, audit logging of key actions, and regular backups.

10.2Alder shall arrange for an independent penetration test of the Service to be carried out at least annually and shall make a summary of the results available to Customers on a Paid Plan on request, subject to clause 15.

10.3Alder makes no representation that the Service will be free from vulnerabilities or that any security measure will prevent every attack. The Customer acknowledges that security is a shared responsibility and that Alder’s measures depend on the Customer configuring and using the Service appropriately, including through the selection of user permissions, the use of multi-factor authentication where offered by the Customer’s identity provider, and the prompt removal of departing Authorised Users.

10.4Alder shall notify the Customer of any Personal Data Breach affecting Customer Data in accordance with the Data Processing Agreement.

11. Data protection

11.1The parties acknowledge that, in respect of Personal Data contained in Customer Data, the Customer is the Controller and Alder is the Processor. The Data Processing Agreement in Schedule 2 applies to all processing of that Personal Data by Alder and is incorporated into this Agreement.

11.2In respect of Personal Data relating to the Customer’s Authorised Users which Alder processes for its own purposes (including account administration, authentication, billing, service communications, security monitoring and product analytics), Alder is an independent Controller and processes that data in accordance with the Privacy Policy.

11.3Each party shall comply with its obligations under Data Protection Legislation. Nothing in this Agreement relieves either party of its own obligations under Data Protection Legislation.

12. Customer Data

12.1As between the parties, the Customer owns all right, title and interest in and to the Customer Data. The Customer grants Alder a non-exclusive, royalty-free, worldwide licence during the term of this Agreement and any retention period under clause 21.2 to host, copy, transmit, process, back up, display and otherwise use the Customer Data solely to the extent necessary to provide the Service, to comply with this Agreement and Applicable Law, and to protect the security and integrity of the Service.

12.2The Customer is solely responsible for the content, accuracy, quality, legality and integrity of the Customer Data and for the means by which the Customer acquired it. Alder does not monitor Customer Data and has no obligation to do so, but may remove or disable access to any Customer Data which it reasonably believes breaches the Acceptable Use Policy or Applicable Law, giving the Customer notice where lawful and practicable.

12.3Alder shall maintain backups of Customer Data in accordance with Schedule 1 and Annex C to the Data Processing Agreement. Backups are maintained for the purpose of restoring the Service following a failure affecting the platform as a whole, and not for the restoration of individual records deleted by the Customer or its Authorised Users. Alder may, at its discretion and subject to a reasonable charge, assist with the restoration of individual records where a backup containing them is available.

12.4The Customer may export Customer Data at any time during the term of this Agreement using the export tools within the Service. The formats available are as described in the Documentation. Alder shall not be obliged to provide Customer Data in any other format except as Bespoke Work.

12.5Alder may collect and use Usage Data for the purposes of operating, securing, improving and developing the Service, benchmarking, and producing statistical or sector reports, provided that Usage Data is not disclosed to any third party in a form that identifies the Customer or any Data Subject.

13. Third-Party Services and optional AI features

13.1The Service depends on certain Third-Party Services for its operation, including third-party identity providers (such as Google, Microsoft and Apple) for sign-in and third-party providers of email and messaging delivery, payment processing and hosting. Where such providers process Customer Data on Alder’s behalf they are sub-processors under the Data Processing Agreement.

13.2The Service may allow the Customer to connect its own accounts with Third-Party Services, including AI assistants (such as Claude or ChatGPT), email service providers, messaging services, payment services and other integrations. Where the Customer connects such a service:

(a)the Customer does so at its own election and on the terms of its own contract with the relevant provider;

(b)Alder acts only as a conduit for the transfer of Customer Data to and from that service in accordance with the Customer’s configuration, and the provider is not a sub-processor of Alder;

(c)the Customer is responsible for ensuring that it has a lawful basis for any disclosure of Personal Data to the provider, for any international transfer that results, and for the provider’s handling of Customer Data;

(d)Alder does not warrant that any Third-Party Service will remain available, compatible with the Service or fit for the Customer’s purposes, and may disable an integration on reasonable notice if the provider changes its terms or interfaces; and

(e)Alder has no liability for any act or omission of the provider or for any loss arising from the Customer’s use of the Third-Party Service.

13.3Where the Service provides features that generate content, suggestions or summaries using AI, whether through a Third-Party Service connected by the Customer or otherwise, the Customer acknowledges that such output may be inaccurate, incomplete or inappropriate and shall review any output before relying on it, in particular in relation to safeguarding, financial, regulatory or beneficiary-facing matters. Alder does not use Customer Data to train any AI model.

13.4Alder may from time to time make available features of the Service designated as beta, preview, early access or similar. Such features are provided for evaluation purposes, may be modified or withdrawn at any time, are excluded from the availability target and support commitments in Schedule 1, and are used at the Customer’s own risk.

14. Intellectual Property Rights

14.1Alder and its licensors own all Alder IPR. Except for the rights expressly granted in clause 4.1, nothing in this Agreement transfers or licenses any Intellectual Property Rights to the Customer.

14.2The Customer grants Alder a perpetual, irrevocable, royalty-free licence to use and incorporate Feedback into the Service without obligation to the Customer, and waives any moral rights in Feedback to the extent permitted by law.

14.3Alder shall defend the Customer against any claim that the Customer’s use of the Service in accordance with this Agreement infringes a third party’s Intellectual Property Rights enforceable in the United Kingdom, and shall pay any damages finally awarded or agreed in settlement, provided that the Customer:

(a)notifies Alder promptly in writing of the claim;

(b)gives Alder sole control of the defence and settlement of the claim;

(c)provides reasonable assistance at Alder’s expense; and

(d)makes no admission or settlement without Alder’s prior written consent.

14.4Clause 14.3 does not apply to any claim arising from:

(a)Customer Data or any Third-Party Service;

(b)use of the Service in breach of this Agreement or other than in accordance with the Documentation;

(c)any modification of the Service not made by Alder; or

(d)the combination of the Service with any product, service or data not supplied by Alder, where the claim would not have arisen but for that combination.

14.5If a claim under clause 14.3 is made or is in Alder’s reasonable opinion likely to be made, Alder may at its option and expense:

(a)procure the right for the Customer to continue using the Service;

(b)modify or replace the affected part of the Service so that it is non-infringing without materially reducing its functionality; or

(c)if neither is reasonably achievable, terminate this Agreement on written notice and refund pro rata any Fees paid in advance for the unexpired part of the Subscription Period.

This clause 14 states the Customer’s sole and exclusive remedy, and Alder’s entire liability, for infringement of Intellectual Property Rights, and is subject to clause 18.

15. Confidentiality

15.1“Confidential Information” means all information of a confidential nature disclosed by one party to the other in connection with this Agreement, whether before or after the Effective Date and in whatever form, including (in Alder’s case) the non-public aspects of the Service, security information, pricing offered to the Customer and Alder’s business plans, and (in the Customer’s case) the Customer Data and the Customer’s non-public operational information. Confidential Information does not include information that:

(a)is or becomes publicly available other than through breach of this Agreement;

(b)was lawfully in the receiving party’s possession before disclosure;

(c)is lawfully obtained from a third party free of any duty of confidence; or

(d)is independently developed without reference to the disclosing party’s Confidential Information.

15.2Each party shall keep the other’s Confidential Information confidential, use it only for the purposes of this Agreement, and disclose it only to those of its employees, officers, trustees, volunteers, professional advisers and subcontractors who need to know it for those purposes and who are bound by obligations of confidentiality no less protective than this clause.

15.3A party may disclose Confidential Information to the extent required by law, court order, a regulator (including the Charity Commission or the Information Commissioner) or the rules of any recognised stock exchange, provided that (where lawful) it gives the other party as much notice as practicable and cooperates with any reasonable request to limit the disclosure.

15.4This clause survives termination of this Agreement for a period of five years, and indefinitely in respect of Customer Data and any trade secrets.

16. Warranties and disclaimers

16.1Each party warrants that it has full power and authority to enter into and perform this Agreement.

16.2Alder warrants that:

(a)it shall provide the Service with reasonable skill and care;

(b)the Service shall perform substantially in accordance with the Documentation; and

(c)it shall not knowingly introduce any virus or other malicious code into the Service.

If the Service does not conform with warranty (b), Alder shall at its expense use reasonable endeavours to correct the non-conformance or provide a workaround within a reasonable time. This is the Customer’s sole and exclusive remedy for breach of that warranty.

16.3The Customer warrants that:

(a)it is a charity, community interest company, not-for-profit organisation or other organisation of the kind for which the Service is intended, and that the details given in the Order Form are accurate;

(b)it has all rights, consents and lawful bases necessary to provide the Customer Data to Alder and to instruct Alder to process it as contemplated by this Agreement; and

(c)its use of the Service will comply with Applicable Law and the Acceptable Use Policy.

16.4Except as expressly set out in this Agreement, and to the fullest extent permitted by law, all warranties, conditions and other terms implied by statute or common law (including any implied terms as to satisfactory quality, fitness for a particular purpose and non-infringement) are excluded. In particular, Alder does not warrant that:

(a)the Service will be uninterrupted, error-free or free from vulnerabilities;

(b)the Service will meet the Customer’s requirements or produce any particular outcome;

(c)any data, report, calculation or output (including Gift Aid calculations and AI-generated content) will be accurate or complete; or

(d)the Service will be compatible with any Third-Party Service.

16.5The Customer acknowledges that the Service has not been designed to meet the Customer’s individual requirements, that it is the Customer’s responsibility to ensure that the Service meets its requirements, and that Alder is not providing legal, financial, regulatory or safeguarding advice.

17. Indemnity

17.1The Customer shall indemnify Alder against all liabilities, costs, expenses, damages and losses (including reasonable legal fees) suffered or incurred by Alder arising out of or in connection with any third-party claim, regulatory investigation or enforcement action resulting from:

(a)the Customer Data, including any claim that the Customer Data infringes a third party’s rights or has been processed unlawfully;

(b)the Customer’s or an Authorised User’s breach of the Acceptable Use Policy or clause 8; or

(c)the Customer’s use of any Third-Party Service.

17.2The indemnity in this clause is subject to Alder:

(a)notifying the Customer promptly of the claim;

(b)allowing the Customer, at the Customer’s expense, to conduct the defence of the claim, provided that Alder may participate at its own expense and that the Customer shall not settle any claim in a manner that imposes obligations on Alder or admits fault on Alder’s behalf without Alder’s consent; and

(c)taking reasonable steps to mitigate its losses.

18. Limitation of liability

18.1Nothing in this Agreement limits or excludes either party’s liability for:

(a)death or personal injury caused by negligence;

(b)fraud or fraudulent misrepresentation;

(c)breach of the terms implied by section 12 of the Sale of Goods Act 1979 or section 2 of the Supply of Goods and Services Act 1982;

(d)the Customer’s obligation to pay the Fees;

(e)the Customer’s liability under the indemnity in clause 17; or

(f)any other liability which cannot be limited or excluded by law.

18.2Subject to clause 18.1, neither party shall be liable to the other, whether in contract, tort (including negligence), breach of statutory duty, misrepresentation or otherwise, for any:

(a)loss of profits, revenue, income, donations, grants or anticipated savings;

(b)loss of business, contracts or opportunity;

(c)loss of or damage to goodwill or reputation;

(d)loss of, or corruption or damage to, data or information, save to the extent caused by Alder’s breach of the Data Processing Agreement or clause 10 and subject to clause 18.4;

(e)wasted expenditure or management time; or

(f)indirect, special or consequential loss or damage,

in each case whether or not foreseeable and whether or not the party had been advised of the possibility of such loss.

18.3Subject to clauses 18.1, 18.2, 18.4 and 18.5, Alder’s total aggregate liability to the Customer arising out of or in connection with this Agreement and the Service, whether in contract, tort (including negligence), breach of statutory duty, misrepresentation or otherwise, shall in respect of all claims arising in any Contract Year be limited to the greater of:

(a)the total Fees paid by the Customer to Alder under this Agreement in the twelve months immediately preceding the date on which the first claim in that Contract Year arose; and

(b)£1,000.

“Contract Year” means each successive period of twelve months from the Effective Date.

18.4Subject to clauses 18.1, 18.2 and 18.5, and notwithstanding clause 18.3, Alder’s total aggregate liability to the Customer for any breach of the Data Processing Agreement, clause 10 or Data Protection Legislation, including liability for loss of or damage to Customer Data resulting from such breach, shall in respect of all such claims arising in any Contract Year be limited to the greater of:

(a)two times the total Fees paid by the Customer to Alder under this Agreement in the twelve months immediately preceding the date on which the first such claim in that Contract Year arose; and

(b)£10,000.

Any amount paid under this clause counts towards, and is not in addition to, the cap in clause 18.3 to the extent that the same loss is claimed under both.

18.5Where the Customer is on the Free Plan, and subject to clause 18.1, Alder’s total aggregate liability to the Customer arising out of or in connection with this Agreement and the Service, including under clause 18.4, shall be limited to £100 in respect of all claims arising in any Contract Year, save that Alder’s liability for breach of the Data Processing Agreement or Data Protection Legislation shall be limited to £1,000 in any Contract Year. The Customer acknowledges that this limitation is reasonable given that the Free Plan is provided without charge.

18.6The caps in clauses 18.3, 18.4 and 18.5 apply to the aggregate of all claims in the relevant Contract Year, and an amount recovered in one Contract Year does not increase the cap for any later Contract Year. Where the Customer has moved between Plans during a Contract Year, the cap is determined by reference to the Plan in force when the relevant claim arose.

18.7Alder shall have no liability for any loss or damage to the extent caused by:

(a)the Customer’s failure to comply with this Agreement or the Documentation;

(b)any Third-Party Service;

(c)the Customer’s configuration of its Workspace, including user permissions and retention settings;

(d)any inaccuracy in Customer Data;

(e)the Customer’s failure to export or back up Customer Data where it had the opportunity to do so; or

(f)any use of the Service after Alder has notified the Customer of a defect and a workaround has been provided.

18.8The parties agree that the limitations and exclusions in this clause 18 are reasonable having regard to the nature of the Service, the Fees (or absence of Fees), the availability of insurance to each party, and the fact that the Customer is able to back up and export the Customer Data at any time. Each party acknowledges that it has had the opportunity to take independent legal advice before entering into this Agreement.

18.9No claim may be brought under this Agreement more than two years after the date on which the party bringing the claim became aware, or ought reasonably to have become aware, of the facts giving rise to it.

19. Suspension

19.1Alder may suspend the Customer’s or any Authorised User’s access to all or part of the Service, on notice where practicable, if:

(a)Fees remain unpaid 14 days after written notice of non-payment;

(b)the Customer or an Authorised User is in material breach of this Agreement or the Acceptable Use Policy;

(c)Alder reasonably believes that the Customer’s use of the Service presents a security risk to the Service, to other customers or to any third party, or that the Customer’s credentials have been compromised;

(d)Alder is required to do so by Applicable Law, a court or a regulator;

(e)the Customer’s use of the Service exceeds the Plan Limits and the Customer has not remedied this in accordance with clause 6.3; or

(f)the Customer asks Alder to disable a user or Workspace.

19.2Alder shall limit any suspension to what is reasonably necessary, shall inform the Customer of the reason for the suspension as soon as practicable (unless prohibited by law), and shall restore access promptly once the reason for the suspension has been resolved. Suspension does not relieve the Customer of its obligation to pay the Fees and does not extend the Subscription Period.

20. Term and termination

20.1This Agreement begins on the Effective Date and continues until terminated in accordance with this clause 20.

20.2Either party may terminate a Paid Plan for convenience with effect from the end of the current Subscription Period by giving the other party at least one month’s written notice expiring on or before the last day of that Subscription Period. Notice by the Customer may be given through the Service’s billing settings or by email to hello@aldercrm.com. Notice given later than one month before the end of a Subscription Period takes effect at the end of the following Subscription Period.

20.3Alder may terminate a Paid Plan for convenience on at least 90 days’ written notice, in which case Alder shall refund pro rata any Fees paid in advance for the period after termination.

20.4Either party may terminate this Agreement with immediate effect by written notice if the other party:

(a)commits a material breach of this Agreement which is irremediable or, if remediable, is not remedied within 30 days after written notice requiring it to be remedied;

(b)is unable to pay its debts as they fall due, enters into any arrangement with its creditors, has a receiver, administrator or liquidator appointed over any of its assets, is the subject of a winding-up petition or order, or (being a charity) is removed from the register of charities or has its assets transferred by order of the Charity Commission; or

(c)ceases or threatens to cease to carry on its activities.

20.5The Customer may terminate a Paid Plan by written notice given within 30 days of receiving notice from Alder under clause 4.3 (material reduction of functionality) or clause 22 (material adverse change to this Agreement), with effect from the date on which the change would take effect, and Alder shall refund pro rata any Fees paid in advance for the period after termination.

20.6The Customer may terminate the Free Plan at any time by deleting its Workspace through the Service or by written notice to Alder. Alder may terminate the Free Plan in accordance with clause 5.

21. Consequences of termination

21.1On termination or expiry of this Agreement for any reason:

(a)all rights granted to the Customer under this Agreement cease and the Customer and its Authorised Users shall stop using the Service;

(b)the Customer shall pay any Fees and other sums due to Alder up to the date of termination, and Alder may invoice for any Fees not previously invoiced;

(c)each party shall return or destroy the other party’s Confidential Information in its possession, subject to clause 21.2 and to any retention required by law; and

(d)any provision which expressly or by implication is intended to survive termination, including clauses 3, 12, 14, 15, 17, 18, 21, 25 and 26 and the Data Processing Agreement, continues in force.

21.2Following termination of a Paid Plan, Alder shall make the Customer Data available for export by the Customer through the Service’s export tools for a period of 30 days from the date of termination (the “Retrieval Period”). Following termination of the Free Plan, the Retrieval Period is 14 days. Alder may make access during the Retrieval Period read-only. Where termination is by Alder under clause 20.4 for non-payment, Alder may make the Retrieval Period conditional on payment of outstanding Fees.

21.3After the Retrieval Period (or, where clause 7.5 applies, from the Exit Date), Alder shall delete the Customer Data from the live Service within 30 days and from backups in the ordinary course of backup rotation within a further 90 days, except to the extent that Alder is required by Applicable Law to retain it, in which case Alder shall continue to protect it in accordance with the Data Processing Agreement and shall process it only for the purpose of complying with that law. Deletion is irreversible and the Customer is responsible for exporting any Customer Data it wishes to retain before the end of the Retrieval Period.

21.4Termination of this Agreement does not affect any Professional Services Agreement, which continues in accordance with its own terms, save that Alder may treat termination of this Agreement by Alder under clause 20.4 as grounds to terminate any Professional Services Agreement on written notice.

22. Changes to this Agreement

22.1Alder may amend this Agreement (including the Schedules) from time to time by publishing the amended version at aldercrm.com/legal/customer-agreement (or a successor page) and giving notice to the Customer’s Workspace administrators by email or through the Service. Amendments take effect:

(a)for the Free Plan, 30 days after notice; and

(b)for a Paid Plan, at the start of the Customer’s next Subscription Period beginning at least 30 days after notice, save that amendments required by Applicable Law, or which are not materially adverse to the Customer, may take effect on shorter notice.

22.2Where an amendment is materially adverse to the Customer on a Paid Plan, the Customer may terminate under clause 20.5. Continued use of the Service after an amendment takes effect constitutes acceptance of it.

22.3Alder may update the list of sub-processors, Annex C to the Data Processing Agreement and the Documentation in accordance with the procedures set out in the Data Processing Agreement without following the procedure in clause 22.1.

23. Force majeure

23.1Neither party shall be in breach of this Agreement or liable for any failure or delay in performing its obligations (other than payment obligations) to the extent that the failure or delay results from events, circumstances or causes beyond its reasonable control, including failure of a utility, telecommunications or hosting provider not caused by the affected party’s negligence, denial-of-service or other cyber attack that could not reasonably have been prevented, epidemic, governmental action, or industrial action. The affected party shall notify the other party as soon as practicable and use reasonable endeavours to mitigate the effect of the event. If the event continues for more than 60 days, either party may terminate this Agreement on written notice and Alder shall refund pro rata any Fees paid in advance for the period after termination.

24. Notices

24.1Any notice under this Agreement shall be in writing and sent:

(a)to Alder, by email to hello@aldercrm.com or such other address as Alder notifies through the Service, with a copy by post to its registered office for any notice of termination for breach or notice of a claim; and

(b)to the Customer, by email to the email address of the Customer’s Workspace administrator(s) or the billing contact given in the Order Form, or by notice displayed within the Service to administrators.

24.2A notice sent by email is deemed received at the time of transmission, or, if sent outside 9.00 am to 5.00 pm on a Business Day, at 9.00 am on the next Business Day, provided no delivery failure notification is received. A notice sent by first-class post is deemed received at 9.00 am on the second Business Day after posting. Notices displayed within the Service are deemed received when first displayed to an administrator.

24.3This clause does not apply to the service of proceedings or other documents in any legal action.

25. General

25.1Assignment. The Customer may not assign, novate or otherwise transfer any of its rights or obligations under this Agreement without Alder’s prior written consent, which shall not be unreasonably withheld where the transfer is to a successor organisation on a merger, incorporation or reorganisation of the Customer. Alder may assign or novate this Agreement to an Affiliate or to a purchaser of all or substantially all of its business or the Service, on written notice to the Customer.

25.2Subcontracting. Alder may subcontract the performance of any of its obligations, subject to the Data Processing Agreement, and remains responsible for its subcontractors.

25.3Entire agreement. This Agreement, together with any Order Form and (in respect of Bespoke Work only) any Professional Services Agreement, constitutes the entire agreement between the parties relating to its subject matter and supersedes all previous agreements, representations and understandings between them, whether written or oral. Each party acknowledges that it has not relied on any statement, representation, assurance or warranty not set out in this Agreement, and that it shall have no claim for innocent or negligent misrepresentation based on any statement in this Agreement. Descriptions of the Service on Alder’s website and marketing materials are illustrative and are not contractual unless incorporated in an Order Form. The Website Terms govern individual users and website visitors and do not form part of, and do not vary, this Agreement; in the event of any conflict, this Agreement prevails as between Alder and the Customer.

25.4Variation. No variation of this Agreement is effective unless it is in writing and signed (including electronically) by an authorised representative of each party, save for amendments made by Alder in accordance with clause 22.

25.5Waiver. A failure or delay by a party to exercise any right or remedy under this Agreement or by law does not constitute a waiver of that or any other right or remedy, and no single or partial exercise of any right or remedy precludes any further exercise of it.

25.6Severance. If any provision of this Agreement is or becomes invalid, illegal or unenforceable, it shall be deemed modified to the minimum extent necessary to make it valid, legal and enforceable, or if such modification is not possible, deleted, and the validity and enforceability of the other provisions shall not be affected.

25.7Third-party rights. Except as expressly provided, this Agreement does not give rise to any rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of this Agreement.

25.8No partnership. Nothing in this Agreement is intended to, or shall be deemed to, establish any partnership or joint venture between the parties, constitute either party the agent of the other, or authorise either party to make or enter into any commitments for or on behalf of the other.

25.9Publicity. The Customer grants Alder a non-exclusive, royalty-free licence during the term of this Agreement to use the Customer’s name, logo, trade marks and any images the Customer supplies for the purpose, to identify the Customer as a customer of Alder for promotional purposes, including on Alder’s website, in marketing materials, in sales presentations and on social media, provided that:

(a)Alder complies with any reasonable brand guidelines the Customer supplies;

(b)Alder does not state or imply that the Customer endorses the Service beyond the fact that the Customer uses it, and does not publish any testimonial, quotation or case study attributed to the Customer without the Customer’s prior written approval of its content; and

(c)if the Customer notifies Alder in writing at any time that it does not consent, or withdraws its consent, to such use, Alder shall cease new uses of the Customer’s name, logo, trade marks and images within 30 days of receipt of that notice and shall remove them from materials within Alder’s control within that period, save for printed materials already distributed.

Neither party shall make any public statement attributing views to the other without its prior written consent.

25.10Electronic acceptance and counterparts. This Agreement may be accepted electronically and executed in any number of counterparts. Electronic acceptance, including clicking to accept or an electronic signature, has the same effect as a signature in ink.

25.11Anti-bribery and modern slavery. Each party shall comply with the Bribery Act 2010 and the Modern Slavery Act 2015 in connection with this Agreement.

26. Governing law and jurisdiction

26.1This Agreement and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it or its subject matter or formation shall be governed by and construed in accordance with the law of England and Wales.

26.2Each party irrevocably agrees that the courts of England and Wales have exclusive jurisdiction to settle any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with this Agreement or its subject matter or formation, save that Alder may bring proceedings to recover unpaid Fees or to protect its Intellectual Property Rights in any court of competent jurisdiction.

26.3Before commencing proceedings (other than for injunctive relief or the recovery of unpaid Fees), the parties shall attempt in good faith to resolve any dispute by escalation to a senior representative of each party, who shall meet (in person or by video) within 14 days of a written request from either party. Nothing in this clause prevents either party from commencing proceedings where necessary to prevent a limitation period expiring.

1. Plans and Plan Limits

1.1The Plans available, their Fees, and their Plan Limits — the number of contact records and Authorised Users, and the monthly allowance of emails and messages — are those published on the Pricing Page. The Plan the Customer has subscribed to, and the Fees and Plan Limits applying to it, are recorded in the Order Form, which prevails over the Pricing Page where the two differ. All Fees exclude VAT.

1.2“Unlimited” and “fair use” mean that no fixed numerical limit applies, but Alder may treat usage that is materially out of proportion to the reasonable requirements of a charity of the Customer’s size, or that degrades the Service for other customers, as exceeding the Plan Limits under clause 6.3 of the main terms, after consultation with the Customer.

1.3An “email or message” is each individual email, SMS or other message sent from the Service to a recipient. A newsletter sent to 500 contacts counts as 500 emails. Messages sent through a Third-Party Service connected by the Customer under its own account do not count towards the Plan Limit but may be subject to the provider’s own limits and charges.

1.4Monthly allowances of emails and messages do not roll over between months. On any Plan the Customer may purchase additional email and message capacity without changing Plan, at the rates published on the Pricing Page (or otherwise notified by Alder) at the time of purchase. Additional capacity forms part of the Fees, is payable in accordance with clause 7 of the main terms, and applies to the month in which it is purchased unless Alder states otherwise at the time of purchase.

2. Availability target (Paid Plans only)

2.1Alder’s target is that the Service is Available for at least 99.5% of the minutes in each calendar month, excluding Excluded Downtime.

2.2“Available” means that the Service’s web application responds to requests at its primary URL such that Authorised Users are able to log in and access their Workspace. The Service is not treated as unavailable by reason of degraded performance, the unavailability of a single feature, or the unavailability of a Third-Party Service.

2.3“Excluded Downtime” means any period during which the Service is not Available as a result of:

(a)planned maintenance notified in accordance with paragraph 3;

(b)emergency maintenance reasonably required to address a security vulnerability or critical fault;

(c)a force majeure event under clause 23 of the main terms;

(d)failures of the internet, the Customer’s equipment or connectivity, or a Third-Party Service;

(e)suspension under clause 19 of the main terms; or

(f)the acts or omissions of the Customer or its Authorised Users.

2.4Alder shall measure availability using its own monitoring systems, whose records are conclusive absent manifest error. Alder shall publish or make available on request a summary of availability for each month to Customers on a Paid Plan.

2.5As set out in clause 9 of the main terms, the availability target is a target and not a warranty, and no service credits or other compensation are payable if it is not met.

3. Maintenance

3.1Alder shall use reasonable endeavours to carry out planned maintenance requiring downtime between 22:00 and 06:00 UK time or at weekends, and to give at least 48 hours’ notice of planned maintenance expected to exceed 30 minutes, by notice within the Service or by email to Workspace administrators.

3.2Routine deployments that do not require downtime may be made at any time without notice.

4. Support

4.1Support hours are 9.00 am to 5.30 pm UK time on Business Days. Requests received outside support hours are treated as received at the start of the next period of support hours.

4.2For Paid Plans, Alder shall use reasonable endeavours to respond to support requests within the following target response times. A response is an acknowledgement by a member of Alder’s team that the request is being investigated; it is not a resolution time.

4.3Alder determines the priority of each request acting reasonably. Alder shall use reasonable endeavours to resolve faults in a timely manner, having regard to their priority, but does not commit to resolution times.

4.4For the Free Plan, support is provided by email on a reasonable-endeavours basis with no target response time, in accordance with clause 5 of the main terms.

5. Standard onboarding and data migration (Paid Plans only)

5.1On subscribing to a Paid Plan, Alder shall provide the following standard onboarding services at no additional charge:

(a)creation and initial configuration of the Customer’s Workspace;

(b)one migration of the Customer’s existing contact, donation and related records from a spreadsheet (CSV or Excel) or from a supported source system listed in the Documentation, using Alder’s standard migration tooling and field mappings; and

(c)up to two hours of remote onboarding assistance by video call or screen-share within the first 60 days of the Paid Plan.

5.2The Customer shall provide its source data in a reasonably clean and consistent format, shall nominate a contact with authority to make decisions about field mapping, and shall review and confirm the migrated data within 14 days of Alder notifying it that the migration is complete. Alder shall correct any mapping errors notified within that period. After that period the migration is deemed accepted.

5.3The following are not part of standard onboarding and are Bespoke Work under clause 3 of the main terms: data cleansing, de-duplication or enrichment beyond that performed automatically by the migration tooling; migration from a source system not listed in the Documentation; migration of documents, attachments or email history; repeat or phased migrations; and any migration requiring custom scripting or transformation.

6. Backups

6.1Alder shall take backups of the production database at least hourly and shall retain daily backups for at least 30 days. Backups are encrypted and stored in the United Kingdom. Alder shall test the restoration of backups at least every two months. The recovery point objective for the platform is one hour and the recovery time objective is eight hours, in each case as targets and not warranties.

1. Definitions

1.1In this Data Processing Agreement, terms defined in the main terms have the same meaning, and: “Customer Personal Data” means Personal Data contained in Customer Data that Alder processes on behalf of the Customer in providing the Service; “Sub-processor” means any third party engaged by Alder to process Customer Personal Data; “ICO” means the Information Commissioner’s Office; and “Restricted Transfer” means a transfer of Customer Personal Data to a country outside the United Kingdom that is not the subject of adequacy regulations under section 17A of the Data Protection Act 2018.

1.2This Data Processing Agreement is intended to satisfy the requirements of Article 28(3) of the UK GDPR. In the event of conflict between this Schedule and the main terms in relation to the processing of Customer Personal Data, this Schedule prevails.

2. Roles and details of processing

2.1The Customer is the Controller and Alder is the Processor of Customer Personal Data. The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subjects are set out in Annex A.

2.2The Customer warrants that it has, and will maintain, a lawful basis for the processing of Customer Personal Data that it instructs Alder to carry out, that it has provided all necessary privacy information to Data Subjects, and that (where the Customer Personal Data includes special category data or criminal offence data, such as health information, safeguarding records or information about vulnerable persons) it has identified an appropriate condition under Article 9 or Article 10 of the UK GDPR and Schedule 1 to the Data Protection Act 2018 and, where required, has an appropriate policy document in place.

3. Alder’s obligations as Processor

3.1Alder shall, in relation to Customer Personal Data:

(a)process it only on the documented instructions of the Customer, which are set out in this Agreement, in the Customer’s configuration and use of the Service, and in any further written instructions the Customer gives that are consistent with the Service’s functionality, unless required to do otherwise by Applicable Law, in which case Alder shall (where legally permitted) inform the Customer of that legal requirement before processing;

(b)inform the Customer immediately if, in Alder’s opinion, an instruction infringes Data Protection Legislation, without obligation to carry out a legal review;

(c)ensure that persons authorised to process Customer Personal Data are bound by obligations of confidentiality and receive appropriate training;

(d)implement and maintain the technical and organisational measures described in Annex C, and such further measures as are appropriate to the risk, to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing;

(e)engage Sub-processors only in accordance with paragraph 5;

(f)taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer’s obligation to respond to requests by Data Subjects to exercise their rights, principally by providing the search, export, correction and deletion functionality within the Service;

(g)taking into account the nature of the processing and the information available to Alder, assist the Customer in ensuring compliance with its obligations under Articles 32 to 36 of the UK GDPR (security, breach notification, data protection impact assessments and prior consultation);

(h)at the Customer’s election, delete or return all Customer Personal Data at the end of the provision of the Service in accordance with clause 21 of the main terms, and delete existing copies unless Applicable Law requires storage of the Personal Data;

(i)make available to the Customer all information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR, and allow for and contribute to audits in accordance with paragraph 7; and

(j)maintain a record of the categories of processing carried out on behalf of the Customer as required by Article 30(2) of the UK GDPR.

3.2Where assistance under paragraphs 3.1(f) or (g) requires Alder to do more than make available the functionality of the Service, Alder may charge for its time at its then-current rates, save where the assistance is required as a result of Alder’s own breach.

3.3Alder shall not:

(a)process Customer Personal Data for its own purposes, other than the generation of Usage Data as permitted by clause 12 of the main terms;

(b)sell Customer Personal Data; or

(c)use Customer Personal Data to train any machine learning or AI model.

4. Personal Data Breach

4.1Alder shall notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification shall, so far as the information is available to Alder, describe the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects. Alder may provide the information in phases as it becomes available.

4.2Alder shall cooperate with the Customer and take such reasonable steps as the Customer directs to assist in the investigation, mitigation and remediation of the breach. The Customer is responsible for deciding whether to notify the ICO or Data Subjects and for making any such notification. Alder shall not notify the ICO or Data Subjects on the Customer’s behalf unless required by law or agreed in writing.

4.3Alder’s notification of or response to a Personal Data Breach under this paragraph is not an acknowledgement of fault or liability.

5. Sub-processors

5.1The Customer gives Alder general written authorisation to engage Sub-processors, subject to this paragraph. The current list of Sub-processors is published at aldercrm.com/subprocessors (or a successor page) as described in Annex B.

5.2Alder shall give the Customer at least 30 days’ notice of any intended addition or replacement of a Sub-processor, by updating the list at aldercrm.com/subprocessors and by email to Workspace administrators or notice within the Service. The Customer may object on reasonable grounds relating to data protection by written notice within that period. If the parties cannot resolve the objection in good faith within 30 days, the Customer may terminate the affected Plan on written notice and Alder shall refund pro rata any Fees paid in advance for the period after termination. This is the Customer’s sole remedy in respect of an objection.

5.3Alder shall impose on each Sub-processor, by written contract, data protection obligations that are substantially equivalent to those in this Data Processing Agreement, and shall remain fully liable to the Customer for the performance of each Sub-processor’s obligations.

5.4Third-Party Services connected by the Customer under its own account in accordance with clause 13 of the main terms are not Sub-processors and are outside the scope of this paragraph.

6. International transfers

6.1Alder shall store Customer Personal Data at rest in the United Kingdom and shall not make a Restricted Transfer of Customer Personal Data except:

(a)to a Sub-processor whose location outside the United Kingdom, together with the transfer mechanism relied upon, is identified in the list published under Annex B;

(b)where the Customer instructs it, including by connecting a Third-Party Service located outside the United Kingdom; or

(c)where required by Applicable Law.

6.2Where Alder makes a Restricted Transfer, it shall ensure that the transfer is subject to adequacy regulations, the International Data Transfer Agreement or Addendum issued by the ICO, binding corporate rules or another mechanism recognised under Chapter V of the UK GDPR, and that a transfer risk assessment has been carried out where required.

7. Audit

7.1Alder shall make available to the Customer on request, not more than once in any twelve-month period unless required by a regulator or following a Personal Data Breach:

(a)a copy of Alder’s then-current information security documentation summary;

(b)the most recent penetration test summary; and

(c)written responses to a reasonable security questionnaire.

The Customer shall treat such materials as Alder’s Confidential Information.

7.2Where the information provided under paragraph 7.1 is insufficient to demonstrate compliance with Article 28 of the UK GDPR, or where required by a regulator, the Customer (or an independent auditor bound by confidentiality and reasonably acceptable to Alder) may conduct an audit of Alder’s relevant processing activities, on at least 30 days’ written notice, during Business Days, not more than once in any twelve-month period (save following a Personal Data Breach), in a manner that does not unreasonably disrupt Alder’s business or compromise the security or confidentiality of other customers’ data. Given the multi-tenant nature of the Service, audits shall not include physical access to data centres or direct access to production systems; Alder shall instead provide documentary evidence, screen-shared demonstrations and interviews with relevant personnel. The Customer shall bear its own costs and shall reimburse Alder’s reasonable personnel costs of an audit, save where the audit reveals a material breach by Alder.

8. Data Subject requests and regulatory enquiries

8.1If Alder receives a request from a Data Subject, the ICO or any other regulator or third party relating to Customer Personal Data, Alder shall (where legally permitted) promptly refer the request to the Customer and shall not respond except on the Customer’s instructions or as required by law.

9. Term and deletion

9.1This Data Processing Agreement continues for as long as Alder processes Customer Personal Data, including during the Retrieval Period and any period of retention required by law, notwithstanding termination of the main terms.

10. Liability

10.1Each party’s liability under or in connection with this Data Processing Agreement is subject to the limitations and exclusions of liability in clause 18 of the main terms, including clause 18.4. Nothing in this Data Processing Agreement limits the rights of Data Subjects under Data Protection Legislation.

Annex A – Details of processing

Annex B – Sub-processors

Alder’s Sub-processors, their purpose, their location and (where applicable) the transfer mechanism relied upon are published at aldercrm.com/subprocessors (or a successor page). That list forms part of this Data Processing Agreement and is updated in accordance with paragraph 5.2.

Annex C – Technical and organisational measures

Alder maintains the following measures as at the version date of this Agreement, and may update them from time to time provided the overall level of protection is not materially reduced.

1. Purpose and scope

1.1This Acceptable Use Policy sets out what the Customer and its Authorised Users may and may not do when using the Service. It forms part of the Agreement. The Customer is responsible for ensuring that its Authorised Users comply with it. Breach of this policy is a breach of the Agreement and may result in suspension under clause 19 or termination under clause 20.4 of the main terms.

2. Permitted use

2.1The Customer may use the Service for lawful charitable, community and organisational purposes, including managing contacts, donations, Gift Aid, cases, volunteers, safeguarding records, events, governance and communications that the Customer is entitled to process.

3. Prohibited use

3.1The Customer shall not, and shall ensure that its Authorised Users do not, use the Service:

(a)in any way that breaches Applicable Law, including Data Protection Legislation, the Privacy and Electronic Communications Regulations, fundraising regulation, charity law, equality law and the Online Safety Act 2023;

(b)to send unsolicited marketing communications, or any communication to a recipient who has not consented or objected, or otherwise in breach of the Privacy and Electronic Communications Regulations or the Code of Fundraising Practice;

(c)to send, store or process any material that is defamatory, obscene, discriminatory, harassing, threatening, extremist, or which promotes violence or hatred, or which is otherwise unlawful or objectionable;

(d)to send, store or process any material that infringes the Intellectual Property Rights, privacy or other rights of any person;

(e)to process Personal Data for which the Customer has no lawful basis, or in a manner incompatible with the purposes for which it was collected;

(f)to store payment card numbers, security codes or full bank account details in free-text or unstructured fields, or otherwise in breach of the Payment Card Industry Data Security Standard;

(g)to share Authorised User credentials, to permit any person who is not an Authorised User to access the Service, or to access or attempt to access any Workspace other than the Customer’s own;

(h)to probe, scan or test the vulnerability of the Service, or to breach or circumvent any security or authentication measure, without Alder’s prior written consent other than through any responsible disclosure programme Alder publishes;

(i)to introduce viruses, malware, or other harmful code, or to overload, flood or otherwise interfere with the proper working of the Service;

(j)to access the Service by automated means other than through an API made available under the Customer’s Plan, or to scrape, harvest or extract data from the Service other than the Customer’s own Customer Data through the export tools;

(k)to resell, sublicense or provide the Service to any third party, or to operate the Service on behalf of any organisation other than the Customer;

(l)to impersonate any person or organisation, or misrepresent an affiliation with any person or organisation, including in the sender details of any communication sent through the Service;

(m)to send communications to, or process data about, children or vulnerable persons other than in accordance with the Customer’s safeguarding policies and Applicable Law; or

(n)in any way that damages or is likely to damage Alder’s reputation or the operation of the Service for other customers.

4. Communications standards

4.1Every marketing email sent through the Service must identify the Customer as the sender, include a functioning unsubscribe mechanism and the Customer’s postal address, and be sent only to recipients who have consented or in respect of whom the Customer is otherwise lawfully entitled to send it. The Customer shall promptly honour unsubscribe requests and shall configure its sending domain (including SPF, DKIM and DMARC records where instructed in the Documentation) before sending bulk email.

4.2Alder may monitor aggregate sending metrics, including bounce, complaint and unsubscribe rates, and may throttle or suspend sending from a Workspace whose metrics indicate abuse or a risk to the deliverability of the Service for other customers, giving notice to the Customer as soon as practicable.

5. Reporting and enforcement

5.1The Customer shall notify Alder promptly at hello@aldercrm.com if it becomes aware of any breach of this policy. Alder may investigate any suspected breach, may remove or disable access to content in breach, and may take any of the steps set out in clause 19 of the main terms. Alder may report unlawful activity to law enforcement or regulators and cooperate with them, including by disclosing the identity of the Customer and relevant Authorised Users where required by law.

5.2Alder may update this policy from time to time in accordance with clause 22 of the main terms.