Subscription Terms and DPA

Last updated: 21 October 2026

Document version: 2026-10-21

Part A: customer terms

1. About these terms

These terms govern business use of the Business Made Simpler referral platform (the Service). The Service is supplied by Business Made Simpler Limited, a company registered in England and Wales under company number 17254146, whose registered office is at 8 Harebell Close, Highwoods, Colchester, England, CO4 9RX (BMS, we, us or our).

The customer named during registration is the Customer. The person creating the Business Workspace confirms that they have authority to accept these terms for the Customer.

The Service is for business use only. It is not intended for consumers or anyone under 18.

2. The Service

The Service helps businesses manage referral relationships, Partner Workspaces, referral agreements, potential clients, opportunities, outcomes and referral fees.

A subscription provides one Business Workspace and the number of Partner Workspaces shown at checkout. Additional Partner Workspaces may be purchased separately. Features, limits and prices shown at checkout or in the Customer's account form part of the order.

The Service is a record-keeping and workflow tool. BMS does not give legal, tax, accounting or financial advice and does not guarantee that an introduction will lead to business, income or payment. Customers should obtain professional advice on their own agreements and obligations.

3. Accounts and access

The Customer must:

• provide accurate registration and billing information;
• keep account and workspace information up to date;
• protect passwords, devices and access credentials;
• give access only to authorised people; and
• tell BMS promptly if it suspects unauthorised access or a security incident.

Each Account is for an individual person. The Customer is responsible for activity carried out through its Accounts and Partner Workspaces, except to the extent caused by BMS's breach of these terms.

A person accepting a free Partner Workspace agrees to the account-security, acceptable-use, confidentiality and permitted-use obligations in these terms for their own use. They must have authority to act for any business they represent. No subscription fee is payable by that person merely for accepting an invitation. The inviting Customer controls the restricted workspace and may withdraw access. Buying a separate Business Workspace creates a separate subscription and does not transfer ownership of the inviting Customer's records. The data processing agreement applies to processing instructed by the Customer; accepting a free invitation alone does not appoint BMS to process every record on behalf of the invited person's business.

4. Customer responsibilities

The Customer decides what referral information it enters, why it uses that information and who receives access. The Customer must:

• have a lawful basis for personal information it enters or shares;
• provide required privacy information to contacts, potential clients and Partner Workspace users;
• keep information accurate and proportionate;
• obtain any permission needed before sharing an opportunity or contact;
• respond to people exercising data protection rights;
• ensure its referral agreements and commercial activity comply with law; and
• avoid entering information that is unnecessary for the referral workflow.

Customers must provide their own controller privacy information to referred people. The BMS Privacy Notice explains BMS's role and does not replace that information. Where details come from another person, the Customer must normally provide its information within a reasonable period and no later than one month, or earlier at first communication or disclosure, subject to any applicable legal exception. A permission checkbox records a workflow confirmation; it does not by itself establish every lawful basis or fulfil every transparency duty. Electronic direct marketing must also comply with applicable PECR rules.

The Customer must not use the Service to store special-category information, criminal-offence information, children's information, payment-card details, bank credentials, passwords, identity documents or other highly sensitive information unless BMS has expressly agreed suitable controls in writing.

5. Acceptable use

The Customer must not:

• use the Service unlawfully, fraudulently or to harm another person;
• upload malicious code or attempt to bypass security or access controls;
• access another customer's information without permission;
• send spam or misleading communications;
• infringe intellectual-property, confidentiality, privacy or data protection rights;
• test the security of the Service without written permission; or
• resell or copy the Service except where BMS agrees in writing.

BMS may suspend access where reasonably necessary to investigate security, unlawful use, non-payment or a material breach. Where practical, BMS will give notice and an opportunity to remedy the issue.

6. Customer content

The Customer retains its rights in information and documents it enters into the Service (Customer Content). The Customer gives BMS permission to host, copy, transmit, back up and otherwise process Customer Content only as needed to provide, secure and support the Service and as set out in Part B.

The Customer is responsible for keeping any copies it needs for its own legal, tax or business records. BMS does not become a party to referral agreements created or stored in the Service.

Referral agreements are separate contracts between their named parties. Closing an Account or Business Workspace, cancelling a BMS subscription, losing Partner Workspace access, or deleting a record or stored document does not itself terminate, rescind or invalidate a referral agreement, release either party from it, or extinguish accrued or continuing payment obligations. The agreement ends or changes only in accordance with its own terms and applicable law. An app status or fee calculation is a workflow record and does not override the parties' contract.

BMS supplies software and storage. BMS is not an agent, guarantor, escrow provider, debt collector or adjudicator for either party, and does not ensure a referral agreement's suitability, enforceability, performance or payment. Each party is responsible for its agreement, notices, compliance, payments, disputes and keeping its own copy. To the extent permitted by law, BMS is not liable for another party's breach, non-payment or a dispute under a referral agreement. This does not exclude BMS's own obligations under these terms or liability that cannot lawfully be excluded.

Shared relationship records

Sharing a record provides authorised access; it does not give another business ownership of the originating workspace or an indefinite right to BMS storage. Each business remains responsible for its own processing purposes, lawful basis and privacy information. The businesses must determine any independent or joint-controller responsibilities from what they actually do, rather than from their workspace label.

Deleting the originating Business Workspace also deletes the records it owns after the recovery period, including records previously visible through its Partner Workspaces. Independently owned records in another Business Workspace remain separate. A paid subscription with BMS does not automatically create a permanent independent copy of a shared record. Each participant should download agreements and obtain any other records it lawfully needs while access is available; it may contact BMS for assistance before access ends. A deletion request by one business does not authorise BMS to erase records independently controlled by another business. BMS will route conflicting requests to the affected controllers and restrict disputed processing where appropriate while instructions are resolved.

7. Fees, trial and payment

The subscription price, Partner Workspace allowance, additional workspace charges, trial period, billing frequency and any minimum commitment are shown prominently before the Customer places its order. Payments are handled by Stripe. A monthly billing frequency does not mean a monthly cancellation right where the order expressly includes the 12-month initial commitment described below.

Unless the checkout says otherwise:

• the trial ends automatically on the date shown at checkout;
• the first subscription charge is taken when the trial ends unless the Customer cancels first;
• the main Business Workspace follows the commitment expressly accepted in its order, as set out below; and
• additional Partner Workspaces are charged monthly in addition to the main subscription.

Where a new Business Workspace order expressly offers a 12-month initial commitment, the Customer may cancel at any time before the stated trial end without subscription charges. If it does not cancel, the initial commitment starts when the trial ends and continues for 12 calendar months. Subscription fees are payable monthly during that commitment, subject to any agreed discount. The start date and earliest ordinary cancellation date will be confirmed to the Customer. After the initial commitment, the main subscription continues for successive monthly periods until cancelled; it does not automatically start another 12-month commitment.

This initial commitment applies only where it was prominently disclosed and expressly accepted as part of that Customer's order. Existing subscriptions and free Partner Workspace invitations do not acquire a new minimum term merely because these terms are updated or accepted. Additional Partner Workspaces remain monthly rolling and do not start, extend or restart the main Business Workspace's initial commitment.

The Customer authorises Stripe to collect charges using its selected payment method. BMS is not currently VAT registered, so VAT is not added to the displayed prices. If BMS becomes VAT registered, it may add VAT where legally required after giving appropriate notice. BMS may suspend access after a failed payment, taking reasonable account of any payment-recovery period shown in the account or Stripe billing portal.

BMS will give at least 30 days' notice of a subscription price increase. An increase to the main subscription price will not apply during an agreed initial commitment, except a tax change required by law. Otherwise an increase will apply only to a renewal on or after that notice period, and the Customer may cancel before it applies. Add-on quantity, billing frequency and any immediate or prorated charge must be shown before purchase confirmation.

8. Cancellation and ending the Service

The Customer may request cancellation through its account's cancellation controls or by contacting BMS at the contact address in these terms. BMS will confirm the effective date. Before a free trial ends, cancellation takes effect no later than the trial end and no subscription payment is due. During an expressly accepted 12-month initial commitment, an ordinary cancellation request may be submitted at any time and takes effect at the end of that commitment; the agreed monthly payments and service access continue until then. Once that commitment has ended, or where the order has no minimum commitment, ordinary cancellation takes effect at the end of the current monthly billing period. No additional notice period prevents cancellation at the initial commitment's end if the request was received before that date.

Cancellation of additional Partner Workspaces takes effect at the end of their applicable monthly billing period and does not extend the main commitment. Cancelling the main subscription must also end its paid add-ons no later than the main subscription's effective end, so paid add-ons do not continue without a main subscription. The confirmation must state any resulting allowance reduction. A customer-requested reduction must not silently delete partner records.

The minimum commitment does not restrict an applicable statutory termination or refund right, the material-breach rights below, or a termination right expressly given elsewhere in these terms. Fees already paid are not refundable except where required by law or expressly agreed by BMS. An ordinary cancellation request does not itself make all future monthly instalments immediately payable as a lump sum. Any exceptional request to end access early during the initial commitment will be considered by BMS and confirmed in writing; this does not remove rights arising from BMS's breach or applicable law.

After access ends:

1. the workspace enters a 30-day recovery and export period;
2. the Customer may ask BMS for an export during that period;
3. BMS then deletes or irreversibly anonymises Customer Content, subject to Part B and any legal requirement to retain limited records; and
4. residual copies in rolling backups are put beyond normal use and age out under the backup cycle.

The Customer should export signed agreements and other records it needs before the recovery period ends.

Either party may end the agreement immediately for a material breach that cannot be remedied, or is not remedied within 14 days after written notice. BMS may end the Service immediately where continued provision would be unlawful or create a material security risk.

Where BMS permanently ends paid service for its own convenience, rather than because of the Customer's breach, BMS will refund prepaid subscription fees for the unused period and release the Customer from future subscription payments for service it will not provide. Any access restriction needed for security or law does not remove applicable statutory rights or the return/deletion obligations in Part B.

9. Availability and changes

BMS will use reasonable care and skill to provide the Service and will take reasonable steps to maintain its availability and security. The Service may be interrupted for maintenance, provider outages, security work or circumstances outside BMS's reasonable control.

BMS may improve or change features. BMS will give reasonable notice of a change that materially reduces the core paid functionality, where practical.

10. Confidentiality

Each party must protect the other party's confidential information and use it only to perform this agreement. This does not apply to information that is public through no breach, was already lawfully known, is received lawfully from another source, or must be disclosed by law.

11. Intellectual property

BMS and its licensors own the Service, software, design and related intellectual property. BMS grants the Customer a limited, non-exclusive, non-transferable right to use the Service during the subscription for its internal business purposes.

If the Customer provides feedback, BMS may use it to improve the Service without identifying the Customer or disclosing its confidential information.

12. Data protection

Each party must comply with applicable data protection law. The parties' roles and processor obligations are set out in Part B, which forms part of these terms.

For Customer Content, the Customer is normally the controller and BMS is its processor. BMS is a separate controller for the account, billing, support, service-security and legal-compliance information it needs to operate its business.

13. Liability

Nothing in these terms excludes or limits liability that cannot lawfully be excluded, including liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation.

Subject to that:

• neither party is liable for indirect or consequential loss;
• BMS is not liable for lost referrals, lost profits, lost revenue, failure of a referral agreement, or another user's acts, except where such loss cannot lawfully be excluded; and
• BMS's total aggregate liability to each Customer for all claims arising in a Contract Year, whether in contract, negligence or otherwise, is limited to the higher of GBP 1,000 or the subscription fees paid or payable by that Customer for the Service in the 12 months immediately before the first event giving rise to a claim in that Contract Year.

A Contract Year is each successive 12-month period starting on the date the Customer first receives access to the Service. The cap is one combined limit for that Customer's claims in that Contract Year, not a separate allowance for each claim or incident. Claims arising from the same event or a connected series of events are treated as arising when the first such event occurred. The GBP 1,000 minimum also applies to trial and fully discounted access; it does not create an automatic entitlement to compensation.

Nothing in this clause restricts an individual's statutory data protection rights, a regulator's powers, or liability that cannot lawfully be limited. This contractual cap does not limit regulatory fines or bind an affected individual who is not a party to these terms. Exclusions and limitations apply only to the extent permitted by law, including applicable reasonableness requirements.

14. General

Neither party may transfer this agreement without the other's written consent, except that BMS may transfer it as part of a sale or reorganisation of the Service or business.

If a provision is unenforceable, the rest remains effective. A delay in enforcing a right is not a waiver. These terms and the order information form the entire agreement for the Service.

BMS may update these terms for legal, security or service reasons. BMS will normally give at least 30 days' notice of materially adverse changes and allow cancellation before they apply. Where law or an urgent security need requires earlier action, BMS will explain the reason and give as much notice as possible. Changes do not retrospectively remove accrued rights. BMS will record acceptance of the terms version presented at registration; existing customers will be notified of material revisions and asked to accept where necessary.

These terms are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.

Notices to BMS must be sent to sarah@businessmadesimpler.co.uk or Business Made Simpler Limited, 8 Harebell Close, Highwoods, Colchester, England, CO4 9RX.

Part B: data processing agreement

1. Scope and roles

This Part B applies when BMS processes personal data in Customer Content on behalf of the Customer.

• The Customer is the controller.
• BMS is the processor.
• Each party is an independent controller for personal data it determines the purposes and means of processing for itself.

If the Customer acts as a processor for another controller, BMS acts as the Customer's subprocessor and the Customer confirms that it has authority to appoint BMS.

2. Processing details

3. Documented instructions

BMS will process Customer Content only on the Customer's documented instructions, including these terms, the Customer's use and configuration of the Service, support requests and other written instructions.

BMS will inform the Customer if it believes an instruction infringes data protection law. If law requires BMS to process Customer Content outside the Customer's instructions, BMS will inform the Customer before doing so unless the law prohibits that notice.

4. Confidentiality

BMS will ensure that people authorised to process Customer Content are subject to an appropriate duty of confidentiality and receive access only where needed for their role.

5. Security

BMS will maintain measures appropriate to the risk, including those in Annex 1. The Customer acknowledges that security evolves and BMS may replace a measure with an equally or more protective measure.

6. Subprocessors

The Customer gives BMS general written authorisation to use the subprocessors in the current subprocessor register. BMS will:

• impose written data-protection obligations offering an equivalent level of protection;
• remain responsible for its subprocessors' performance of those obligations;
• keep the register current; and
• give at least 30 days' notice before a new subprocessor begins processing Customer Content, where reasonably possible.

The notice must identify intended additions or replacements and provide a meaningful opportunity to object before they take effect. If an urgent change makes 30 days impracticable, BMS must still obtain the necessary authorisation or provide advance notice and an opportunity to object under the general authorisation; urgency does not remove Article 28 requirements.

The Customer may object on reasonable data-protection grounds during that period. The parties will try to resolve the objection. If no reasonable alternative is available, either party may end the affected Service.

7. International transfers

BMS will not make a restricted transfer of Customer Content unless it is permitted by data protection law and protected by an applicable UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful safeguard. BMS will complete any required data protection test or transfer risk assessment for transfers it initiates.

8. Individual rights

Taking account of the nature of the processing, BMS will provide reasonable technical and organisational assistance to help the Customer respond to requests for access, correction, erasure, restriction, objection or portability.

If BMS receives a request concerning Customer Content, it will normally direct the person to the Customer and notify the Customer, unless prohibited by law. BMS will not respond substantively without the Customer's instructions, except where legally required.

9. Compliance assistance

Taking account of the nature of processing and information available, BMS will reasonably assist the Customer with:

• security obligations;
• personal-data-breach assessment and notification;
• data protection impact assessments; and
• consultation with the ICO where legally required.

10. Personal-data breaches

BMS will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Content and will provide information reasonably available about its nature, likely consequences, affected data and people, containment and remediation. Information may be supplied in phases as it becomes available.

BMS will send an initial notification promptly after awareness, using the information then available, and will not wait for a completed investigation or use a 48-hour target as a waiting period. BMS will provide updates without undue delay. The Customer remains responsible for its own reporting duties; BMS separately assesses any duties it has as controller.

11. Return and deletion

At the end of the Service, the Customer may request an export during the 30-day recovery period. At the Customer's choice, BMS will return or delete Customer Content, unless UK law requires continued storage.

After the recovery period BMS will delete or irreversibly anonymise Customer Content in the live system. Residual backup copies will be isolated from ordinary use and deleted through the documented rolling backup cycle. BMS may retain limited controller records, such as invoices, payment records, support correspondence and security evidence, under its own retention schedule.

Returning or exporting data does not permit BMS to keep ordinary working copies indefinitely: remaining copies must also be deleted unless law requires retention. The Customer may instruct earlier deletion, subject to identity, authority and lawful-retention checks. Backup restoration must reapply prior deletion instructions before ordinary use resumes. Shared records follow the originating-workspace rules in Part A.

12. Information and audits

BMS will provide all information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits and inspections by the Customer or its appointed auditor. Routine audits should normally be consolidated to once per year on reasonable notice, subject to proportionate confidentiality and security arrangements. This does not limit additional audits reasonably necessary to meet legal obligations, address evidence of non-compliance or investigate an incident. Cost arrangements must not obstruct statutory audit rights. Audits must protect other customers' information.

Annex 1: security measures

BMS currently maintains measures including:

• HTTPS encryption in transit and provider encryption at rest;
• secure, HttpOnly production session cookies and server-side session expiry;
• password hashing and rate limits on authentication and public links;
• workspace-level access boundaries and Partner Workspace role restrictions;
• expiring and revocable invitation, agreement and opportunity links;
• origin checks for unsafe cookie-authenticated requests;
• authenticated, non-cacheable agreement-document access;
• restricted production administration and private database networking;
• MFA on key infrastructure, source-code, payment and business-email accounts;
• webhook-signature verification for Stripe and enabled integrations;
• encrypted integration credentials;
• audit events for important workflow and account actions;
• dependency and security-header checks; and
• documented incident, retention and access-control procedures.

BMS also maintains backup and restoration procedures and periodically tests restoration and access controls. This is not a guarantee of uninterrupted service or loss-free recovery. The selected infrastructure plan and actual tests must support the measures stated here.

Annex 2: current subprocessors

The customer-facing supplier list is available at https://app.businessmadesimpler.co.uk/subprocessors and forms part of this agreement for the Customer Content processing it identifies. BMS keeps supporting contracts and transfer assessments privately. Planned integrations are not authorised for live use merely by being mentioned in internal records.

Annex 3: contact

Data protection contact: sarah@businessmadesimpler.co.uk Legal notices: sarah@businessmadesimpler.co.uk, or Business Made Simpler Limited, 8 Harebell Close, Highwoods, Colchester, England, CO4 9RX.