Legal · v1.1

Terms & Conditions

GTM Intelligence Ltd · Registered in England & Wales · Company no. 16414756

Effective date: 1 October 2025 · Revision date: 21 December 2025

These Terms & Conditions (“Terms”) govern access to and use of the GTM Intelligence platform and related services (the “Services”) provided by GTM Intelligence Ltd (“GTM”, “we”, “us”), registered in England & Wales (No. 16414756). By executing an Order Form or otherwise using the Services, the Client agrees to be bound by these Terms.

1. Definitions

  • Client: The entity identified in an Order Form, SOW, or other agreement referencing these Terms.
  • GTM Data: Professional contact and account data that GTM collects or enriches from public sources (e.g. name, job title, employer, work e-mail/phone, LinkedIn URL, business-profile notes).
  • User Data: Any data uploaded by the Client to the Services, including CRM records, contact lists, notes, and any other content submitted by Users.
  • Customer Data: GTM Data and User Data collectively.
  • Tenant: A logically separated Client workspace/environment within the Services.
  • Region: The geographic data hosting location allocated to a Tenant (e.g. UK, EU, US).
  • Controller / Processor: As defined in UK GDPR and EU GDPR.
  • Subscription Term: The period stated in the Order Form.

2. Right of use

2.1 Licence. GTM grants the Client a non-exclusive, non-transferable licence to access the Services and use GTM Data solely for the Client’s internal B2B sales and marketing during the Subscription Term.

2.2 No resale. The Client must not sell, sublicense or redistribute GTM Data without GTM’s prior written consent.

2.3 Use restrictions. The Client shall not (a) build or market a competing service; (b) attempt to extract source code or algorithms; (c) upload special-category or sensitive personal data unless agreed in writing.

3. Compliance responsibilities

3.1 Independent controllers. Each party acts as an independent Controller for the personal data it holds unless the Client uploads User Data, in which case Section 9 applies.

3.2 Client outreach compliance. The Client is solely responsible for ensuring its outreach (e-mail campaigns, unsubscribe handling, direct-marketing compliance, etc.) complies with all applicable laws in the jurisdictions where it operates (including UK PECR, CAN-SPAM, CASL, ePrivacy, and KVKK).

3.3 GTM legal basis. GTM collects only publicly available professional data and processes it under Legitimate Interests (Article 6(1)(f)). See the Privacy Notice for further details.

3.4 International use. The Client is responsible for configuring and using the Services in accordance with applicable local requirements (including consent, notice, and opt-out rules) in the jurisdictions where the Client conducts outreach or otherwise processes Customer Data.

4. Data collection, accuracy & retention

4.1 Retention. GTM keeps GTM Data until it becomes inaccurate or a data subject objects, after which the record is updated or suppressed.

4.2 Accuracy. GTM will use commercially reasonable efforts to update or suppress records when roles change.

5. Service delivery model, data residency & security

5.1 Service delivery model (high level). The Services are provided as a hosted SaaS offering. As of the Revision Date, the Services are delivered using:

  • (i) a web frontend hosted via Cloudflare Pages and related edge services;
  • (ii) server-side application services running on Google Cloud Run; and
  • (iii) long-running background processing and procurement agents running on Google Cloud Run Jobs.

5.2 System of record and tenant isolation. Customer Data is stored within a Tenant-specific environment. As of the Revision Date, each Tenant’s primary database, authentication, and file storage are provided via a dedicated Supabase project allocated to that Tenant.

5.3 Data residency (per tenant / region).

(a) Default region. Unless otherwise stated in the Order Form, the default Region is the United Kingdom.

(b) Optional regions. Where the Client requires a specific residency, GTM will provision the Tenant in the agreed Region (UK, EU, or US), and the Tenant’s primary Customer Data will be stored in that Region.

(c) Operational data. Limited operational data (including billing records, customer support communications, security logs, service telemetry, and configuration metadata) may be processed outside the Tenant’s primary Region. GTM will minimise such data and apply appropriate safeguards as described in the Privacy Notice and, where applicable, the DPA.

5.4 Tenant routing and access. Users access the Services via a single URL. After authentication, Users are routed to the correct Tenant environment and may access only Customer Data stored in that Tenant’s allocated Region.

5.5 Security. GTM applies industry-standard technical and organisational measures (TOMs), including:

  • TLS encryption in transit
  • Encryption at rest
  • Least-privilege, role-based access controls
  • Enforced two-factor authentication (2FA)
  • Quarterly access reviews
  • Regular backups

Further details are described in the TOMs documentation.

5.6 Security incidents. GTM maintains processes to detect, investigate, and respond to security incidents. Where GTM acts as a Processor for User Data, incident notification obligations and timelines are governed by the DPA.

6. Sub-processors

6.1 Use of sub-processors. GTM may engage third-party service providers to support the Services, including cloud infrastructure and hosting providers. As of the Revision Date, this includes Cloudflare, Google Cloud, and Supabase, along with other supporting vendors listed in the Privacy Notice.

6.2 List and changes. The current list of sub-processors, hosting regions, and safeguards is provided in the Privacy Notice. GTM will provide at least thirty (30) days’ prior notice of any material addition or replacement. Where the Client has executed a DPA, the objection procedure in the DPA applies.

7. Intellectual property

GTM retains all right, title and interest in the Services, proprietary enrichment methodologies, models and GTM Data. No ownership rights are transferred.

8. Confidentiality

Each party must keep the other’s non-public information confidential for two (2) years after expiry or termination, except where disclosure is required by law.

9. Optional data-processing add-on (User Data)

If the Client uploads User Data:

  • (a) the parties shall execute GTM’s Data Processing Agreement (DPA);
  • (b) GTM acts as Processor and processes User Data only on the Client’s documented instructions;
  • (c) User Data will be deleted or returned within thirty (30) days of termination unless retention is required by law.

For clarity, GTM may retain limited operational records required for legitimate business purposes (including billing, audit, dispute resolution, and security logs) in accordance with applicable law and the Privacy Notice.

10. Support & updates

10.1 Support. E-mail support is provided Monday to Friday, 09:00–17:30 UK time, excluding UK public holidays.

10.2 Updates. GTM may enhance or update the platform and GTM Data provided that core functionality is not materially degraded. Maintenance may be performed with commercially reasonable notice where practicable.

11. Indemnification

The Client will indemnify GTM against third-party claims arising from:

  • (a) the Client’s misuse of the Services or GTM Data; or
  • (b) the Client’s breach of Sections 3 or 2.3.

12. Term & termination

12.1 Termination for breach. Either party may terminate these Terms for material breach with thirty (30) days’ written notice if the breach is not cured within that period.

12.2 Effects of termination. Upon termination:

  • (a) access to the Services ends;
  • (b) the licence in Section 2 terminates;
  • (c) GTM may delete Client-specific workspaces and any User Data, subject to Section 9.

12.3 Data portability. Upon request before termination takes effect, GTM will provide an export of Client-specific User Data in a commonly used format.

13. Payment terms

Invoices are issued upon execution of the Order Form and are payable within the period specified therein. Unless otherwise stated in the Order Form, payment for the Services is due in full before platform activation or provision of access credentials. GTM may suspend or withhold access to the Services for overdue amounts after seven (7) days’ written notice. All fees paid are non-refundable unless expressly stated otherwise in the Order Form.

14. Client reference rights

Unless the Client opts out in writing, GTM may use the Client’s name and logo in marketing materials and disclose the existence (but not the substance) of the engagement.

15. Warranties & disclaimers

15.1 Warranty. GTM warrants that it has the right to license the Services.

15.2 Disclaimer. Except as expressly stated, the Services and GTM Data are provided “as-is” and without warranties of accuracy, completeness, or fitness for a particular purpose.

16. Limitation of liability

GTM’s aggregate liability arising out of or related to these Terms is limited to the total fees paid by the Client in the twelve (12) months preceding the claim. GTM is not liable for indirect, incidental, or consequential losses.

17. Changes to terms

GTM may revise these Terms by providing written notice (via e-mail or in-product notification). Continued use of the Services after the effective date constitutes acceptance of the revised Terms.

18. Governing law & jurisdiction

These Terms are governed by the laws of England and Wales. The parties submit to the exclusive jurisdiction of the courts of London, United Kingdom.

19. Entire agreement

These Terms, together with the Order Form, any SOW, and (if executed) the DPA, constitute the entire agreement between the parties and supersede all prior discussions or representations.

20. Service levels (SLA)

20.1 Scope. This SLA covers production availability of:

  • (a) the web application user interface;
  • (b) GTM request-serving API endpoints; and
  • (c) core data services used to store and retrieve Customer Data.

Asynchronous or background processing (including long-running procurement agents and batch jobs) is excluded unless expressly stated in an Order Form.

20.2 Back-to-back infrastructure dependency. The Services rely on third-party infrastructure providers. Availability may be impacted by outages attributable to those providers. Nothing in this SLA creates obligations beyond what is commercially reasonable given these dependencies.

20.3 Availability objective. GTM will use commercially reasonable efforts to achieve 99.5% Monthly Availability for in-scope Services during each calendar month of the Subscription Term.

20.4 Measurement.

  • (a) Monthly Availability = (Total Minutes in Month − Downtime Minutes) ÷ Total Minutes in Month × 100
  • (b) Downtime means at least five (5) consecutive minutes during which the in-scope Services are unavailable, excluding periods described in Section 20.7.
  • (c) Availability may be measured using GTM monitoring systems and corroborated by third-party monitoring where available.

20.5 Maintenance. Planned maintenance may be performed with advance notice where reasonably practicable. Planned maintenance windows are excluded from Downtime.

20.6 Incident communications. GTM will use commercially reasonable efforts to notify the Client of material service incidents and provide updates until resolution. Personal data breach obligations are governed by the DPA where applicable.

20.7 Exclusions. Downtime excludes issues caused by:

  • (a) events outside GTM’s reasonable control (force majeure);
  • (b) Client or User systems, misconfiguration, credentials, or misuse;
  • (c) third-party systems or integrations not provided by GTM;
  • (d) beta, trial, preview, or non-production features;
  • (e) suspension due to breach or non-payment;
  • (f) outages attributable to infrastructure providers or internet routing issues beyond GTM’s control.

20.8 No service credits. No service credits are provided. Remedies (if any) are limited to those expressly stated in these Terms and, where applicable, the DPA.

20.9 Customer responsibilities. The Client is responsible for:

  • (a) maintaining connectivity, supported browsers, and endpoint security;
  • (b) configuring outbound communications and compliance settings;
  • (c) promptly notifying GTM of suspected incidents and providing reasonable assistance.