Legal Policies

These Terms and Conditions ("Terms") govern your access to and use of the Tandem Dots Platform and Services. Your use of our public website and social media channels, where you are not a registered User, is instead governed by our separate website terms of use, available at tandemdots.com/policies.

By subscribing to or using Tandem Dots ("we", "us", or "our"), you agree to be legally bound by these Terms, our Data Processing Agreement, and our Acceptable Use Policy. Our Privacy Policy is a transparency notice explaining how we handle personal data; it is not a contractual document and does not form part of this agreement.

You confirm your acceptance of these Terms by ticking the acceptance box at checkout; the checkout process cannot be completed unless this box is ticked. This applies to the version of the Terms in force at the date of your subscription or renewal, and we retain a record of the version you accepted.

If you do not agree to these Terms, you must not use our services or platform.

Tandem Dots services are for business users only and are not intended for individual consumers. By using the Platform or Services, you confirm that you are acting wholly or mainly for business purposes and not as a consumer under applicable consumer protection laws. If you are accepting these Terms on behalf of a company or other organisation, you confirm that you have the authority to bind that organisation to these Terms.

Tandem Dots Ltd is a company registered in Scotland under company number SC855230, with its registered office at:
2nd Floor, 48 West George Street
Glasgow, G2 1BP

1. Definitions

"User" means the individual (sole trader) or business that registers for a Tandem Dots account. Where an obligation in these Terms, such as payment, applies to the contracting party rather than an individual, it is an obligation of the User (the business or sole trader holding the account), not of any individual Authorised User personally. Users may also be referred to as "you".

"Active User" means a User who has been authorised by Tandem Dots to access the Platform or Services, has a current subscription or other valid access arrangement, is not in payment default, and whose account has not been suspended or terminated under these Terms.

"Authorised Users" means employees, contractors, agents, or other individuals permitted by the User to access the Platform under the User's account.

"Platform" refers to Tandem Dots' white-label software, provided under licence from HighLevel (also known as GHL or Go High Level), and associated services. "HighLevel" is used consistently throughout these documents to refer to that underlying technology provider.

"Services" means all SaaS platform access, onboarding, technical support, automation setup, done-for-you work, training, and consultancy delivered by Tandem Dots.

"Add-Ons" means optional features, integrations, or usage-based services that incur additional fees (e.g. SMS credits, WhatsApp templates).

"Data Protection Laws" means the UK GDPR (as amended, including by the Data (Use and Access) Act 2025), the Data Protection Act 2018 (as amended), the Privacy and Electronic Communications Regulations 2003 (as amended) ("PECR"), and all related laws applicable in Scotland.

"Third-Party Services" means external platforms that you choose to connect to the Platform, such as Meta, Google, Twilio, WhatsApp, and Stripe. These are distinct from the Sub-processors that Tandem Dots itself engages to deliver the core Platform, which are addressed in our Data Processing Agreement.

"Fees" means all amounts payable by you to Tandem Dots under these Terms or any Service Agreement, including subscription fees, done-for-you fees, implementation charges, consultancy fees, and Add-On charges, unless a specific clause states otherwise.

"Business Day" means a day other than a Saturday, Sunday, or public holiday in Scotland.

"Subscription Term" means the then-current period for which you have subscribed to the Services, whether monthly or annually.

"Order Form" means any order form, quote, or online checkout process through which you purchase Services.

"Service Agreement" means any separate written agreement governing done-for-you Services.

"Core Feature" means a feature identified as included within your specific plan description at the point of purchase, excluding beta, experimental, or clearly optional Add-On features.

2. Services and Subscription Plans

2.1 Core Services

Tandem Dots provides multiple types of services including but not limited to:

• SaaS access - Subscription to the Tandem Dots platform (powered by HighLevel) with CRM, funnels, automations, reporting, and client management tools.
• Done-for-You services - Setup, strategy, builds, email automations, integrations, and onboarding support.
• Educational resources - Events, masterclasses, courses, templates, etc.

Access to certain Services, features, educational resources, and support may be limited to Active Users depending on subscription tier and account status.

2.2 Membership Plans

Current allowances, usage limits, and inclusions for each plan are set out on our plans page at tandemdots.com, which forms part of your Order Form for the relevant Subscription Term. We retain an archived copy of the plan description that applied to you at the point of purchase or renewal, and that description governs your subscription for that term.

Certain features, integrations, support services, educational resources, and community access may vary by subscription tier and may be modified, replaced, or withdrawn from time to time. If a Core Feature is permanently withdrawn during your Subscription Term, see Clause 12.6 for your options.

Access to subscription features and Services is available only to Active Users. Plan limits typically include email allowance, number of business accounts, and Authorised User / team member limits. Users are responsible for any third-party integration costs or additional services beyond their plan.

Email allowances can be increased at the rate of £5 per 5,000 emails, charged separately to users where applicable.

Email allowance as of 14th July 2026 is 30,000 for Complete.

For usage limit increases or additional services, contact [email protected].

2.3 Third-Party Integrations

Our Platform may integrate with Third-Party Services that you choose to connect (e.g. WhatsApp, Facebook, Google). Provided you have chosen to enable these integrations, we are not responsible for their availability, security, pricing, or data handling, except to the extent such a service is also a Sub-processor engaged by us to deliver the core Platform, in which case our Data Processing Agreement governs our responsibility for it. This clause does not exclude or limit our own statutory or contractual responsibility for any Sub-processor we engage under our Data Processing Agreement. Users are responsible for reviewing and accepting the terms of any Third-Party Services they connect.

2.4 Beta and Experimental Features

From time to time, Tandem Dots may provide access to beta, experimental, early access, or pre-release features. Such features are provided on an "as is" basis and may be modified, suspended, or withdrawn at any time without notice.

Any personal data processed through a beta feature remains subject to our Data Processing Agreement. Where a beta feature is withdrawn, we will give reasonable notice where practical, and guidance on exporting any data created through it. A beta feature that processes live personal data will be clearly labelled as such before you activate it, together with any additional applicable terms.

3. Payment, Billing and Renewals

3.1 Fees

All Fees are displayed at checkout and on our website before you complete your purchase. Fees are payable monthly in advance, or annually in advance (if selected).

3.2 Automatic Renewal

Subscriptions automatically renew unless cancelled in line with Clause 12. To avoid renewal, cancellation must be submitted before 11:59pm (UK time) on the day before your renewal date. Renewal reminders will be sent to users on annual plans at least 30 days prior to their renewal date. It is your responsibility to keep your registered email address up to date; we are not responsible for a renewal reminder that is not received due to an incorrect, changed, or undelivered email address.

3.3 Payment Method

You authorise us to charge your nominated payment method on each billing date. It is the sole responsibility of the user to ensure that all payment methods are up to date.

3.4 Price Changes

We may update subscription fees or Add-On pricing by giving you at least 30 days' notice by email. If you are a monthly customer and do not wish to accept a price increase, you may cancel before the new price takes effect, in line with Clause 12.1. If you are an annual customer, your continued use during your current prepaid term is not treated as acceptance of a price increase; any increase applies only from your next renewal date.

3.5 Add-Ons & Usage-Based Billing

Some services including but not limited to email list verification, SMS, WhatsApp services, call forwarding, phone numbers, etc. are billed separately on a pre-paid credit wallet basis or per-use pricing, at the rates shown on our plans page.

Usage against your plan's email limits is measured within the Platform. Once a limit is reached, you may purchase additional usage at the rate set in section 2.2 of these terms. If users fail to purchase additional email allowances before exceeding their allowance, a bill will be produced the following month and shared with the User. Failure to settle this balance may result in email services being paused until the balance has been settled.

Users are responsible for all additional service costs and third-party integration fees. Contact [email protected] to increase usage limits or discuss additional services.

3.6 Refunds

Users are purchasing as business customers (i.e. not as a consumer), and therefore acknowledge that there is no statutory cooling-off period. Once payment is made, fees are non-refundable as standard unless we've agreed otherwise in writing, or as set out in Clauses 3.9 and 12.6, which take precedence over this general rule.

3.7 VAT Status

As of the publication date of these Terms, Tandem Dots Ltd is not registered for Value Added Tax (VAT). This means VAT is not currently added to your Fees. Should the company become VAT registered in future, we will:

• a) Notify users via email at least 30 days before VAT is applied;
• b) Honour any legacy subscription rates agreed before VAT registration, meaning your base subscription fee will remain the same; however, VAT will be added on top of your existing subscription fee where legally required.

3.8 Failed Payments and Non-Payment

• a) If any payment is not successfully processed on the due date, the outstanding amount shall become immediately due and payable.
• b) We, via our payment provider, will reattempt to charge your nominated payment method and you must ensure that valid and up-to-date payment details are provided at all times.
• c) Without prejudice to any other rights or remedies available to us, we reserve the right to suspend access to the Services (in whole or in part) if payment is not received within 7 days of the due date.
• d) Where suspension arises from your non-payment or breach, Fees continue to accrue as set out above. Where suspension arises solely from a security incident, prolonged platform failure, or other cause within Tandem Dots' control and unrelated to your own breach, Fees for the affected Services will not accrue during that suspension, without prejudice to Clause 3.9.
• e) If payment remains outstanding for more than 30 days after the due date, we may terminate this Agreement on written notice.

3.9 Extended Unavailability

For the purposes of this clause, the Platform is "wholly unavailable" when none of its core features (CRM, calendar, forms, or messaging) can be accessed by you, as evidenced by our system status records or equivalent monitoring data. This does not include planned maintenance windows notified in advance, or unavailability limited to a single Add-On or non-core integration.

This clause applies regardless of whether the unavailability originates in Tandem Dots' own systems or in HighLevel's underlying infrastructure, provided the cause is one a reasonably diligent SaaS provider in our position could have avoided or mitigated. Where the Platform is wholly unavailable for a continuous period of more than 14 days, you may request a pro-rated service credit for that period, notwithstanding Clause 3.6. Requests must be made within 30 days of the unavailability ending.

4. Affiliate Programme and Commission

4.1 Eligibility and Scope

The Affiliate Programme is available to approved Affiliates. We may decline an application to join at our discretion. Once approved, an Affiliate's continued participation is subject to compliance with this Clause 4, and may be suspended or removed only on the grounds in Clause 4.9.

By applying to and being approved for the Affiliate Programme, an Affiliate accepts this Clause 4 in full, including Clauses 4.6 to 4.10, whether or not they hold a separate Tandem Dots subscription.

Commission is payable in respect of subscription plans purchased through the Affiliate's unique tracking link, as recorded within the Platform. Commission is calculated on subscription payments successfully collected and retained by Tandem Dots, and is not payable on free trials, refunded transactions, reversed payments, chargebacks, failed payments, fraudulent activity, or misuse of the Affiliate Programme.

Commission applies to both initial subscription payments and renewal payments, provided such payments are successfully collected and retained in accordance with these Terms.

4.2 Approval and Holding Period

Commission relating to monthly subscription payments will be paid on or around the 15th day of the calendar month following the month in which the payment was successfully collected. Commission relating to annual subscription payments will be paid on or around the 15th day of the second calendar month following the month in which the payment was successfully collected.

By way of example only: a) monthly subscriptions generated in January will be paid on or around 15 February; b) annual subscriptions generated in January will be paid on or around 15 March.

No commission is payable in respect of free trials, refunded transactions, reversed payments, chargebacks, failed payments, fraudulent activity, or misuse of the Affiliate Programme. We reserve the right to reconcile commission prior to payment to account for these events.

4.3 Payment Method

Commission is paid by bank transfer only. Affiliates are responsible for providing accurate and complete bank details prior to the relevant payout processing date. Where payment cannot be processed due to incorrect or incomplete information, commission will be paid in the next available payout cycle once valid details have been received.

4.4 Adjustments and Withholding

We reserve the right to withhold, adjust, deduct, or reclaim commission where:

• a) A subscription payment is refunded, reversed, or subject to chargeback.
• b) There is evidence of self referral, misleading promotion, breach of these Terms, or misuse of the Affiliate Programme.
• c) The underlying customer account is suspended or terminated under Clause 12.

Any overpaid commission may be deducted from future payouts or invoiced for repayment.

4.5 No Guarantee

Participation in the Affiliate Programme does not guarantee any minimum income or volume of commission. Commission is contingent upon valid subscription payments retained by us in accordance with these Terms.

4.6 Affiliate Advertising and Disclosure

Affiliates must make clear, in every piece of content promoting Tandem Dots, that the content is advertising and that they may receive commission for signups made through their link. This must comply with the UK Advertising Codes (the CAP Code) and any other applicable advertising or consumer protection law. Affiliates must not make claims about Tandem Dots or its Services that are inaccurate, misleading, or that we have not approved in writing.

4.7 Brand and Trade Mark Use

Affiliates may only use Tandem Dots' name, logo, and trade marks in a manner we have approved in writing. Affiliates must not bid on Tandem Dots' brand terms in paid search advertising, register a domain name or social media account that could be mistaken for an official Tandem Dots account, or otherwise impersonate Tandem Dots.

4.8 Tracking and Data Protection

Affiliates are responsible for ensuring that any tracking technology they control on their own website or content, separate from the tracking mechanisms provided by Tandem Dots, complies with PECR and UK GDPR, including obtaining any necessary consent before non-essential tracking technology is activated.

Where Tandem Dots itself determines the tracking mechanism, for example our own referral links, cookies placed through the Affiliate Programme platform, tracking on our own landing pages, and attribution data we collect and combine with customer records to calculate commission, Tandem Dots acts as the Data Controller for that tracking. This is addressed in our Privacy Policy and Cookie Policy, not by the Affiliate.

4.9 Suspension and Termination of Affiliate Status

We may suspend or remove an Affiliate from the Programme, and require removal of related content or links, where we reasonably believe the Affiliate has breached this Clause 4, engaged in fraud or self-referral, or otherwise put Tandem Dots at legal or reputational risk. Commission already correctly earned and not subject to Clause 4.4 remains payable following removal, but no further commission accrues on renewals or new signups after the removal date, save where we agree otherwise in writing.

4.10 Tax

Affiliates are solely responsible for their own tax position in respect of commission earned and should seek their own accounting advice.

5. Support and Onboarding

5.1 Standard Support

Email Support – monitored Monday to Friday, 8:00 AM to 7:00 PM (excluding Scottish public holidays), with an aim to provide an initial response within 2 Business Days. This is a target response time, not a guaranteed service level, unless otherwise agreed in a Service Agreement.

Tandem Learning – a dedicated, on-demand video learning platform accessible to Active Users. We may modify, replace, or remove learning content from time to time.

Community & Events – supplementary educational resources, provided at Tandem Dots' discretion, which may be modified or withdrawn at any time and do not form part of the core subscription services.

5.2 Done-for-You Projects

Where we provide setup, builds, or automations, these are governed by a separate Service Agreement addressing scope, deliverables, client dependencies, change requests, acceptance, project timescales, intellectual property, and the treatment of incomplete work on termination. No done-for-you project will commence until the applicable Service Agreement has been signed by both parties.

5.3 Conduct Towards Our Support Team

Tandem Dots reserves the right to withdraw or suspend support services to any User or Authorised User who behaves towards our support team in a manner a reasonable person would consider abusive, threatening, or disrespectful (for example, repeated shouting, personal insults, or threats), or who makes an unreasonable volume of duplicate or excessive requests. Except where immediate action is necessary to protect our team's safety or wellbeing, we will give a warning and an opportunity to adjust that conduct before withdrawing support.

6. Your Responsibilities

6.1 Users must keep all login credentials secure and confidential. Login credentials may not be shared between individuals; each individual accessing the Platform must use their own unique login credentials and must be authorised by the User.

6.2 Users are responsible for all activities carried out under their account by Authorised Users, except to the extent that activity results from Tandem Dots' own negligence, security failure, or failure to apply agreed security controls.

6.3 Users are responsible for all personal data uploaded or processed through the Platform by them or Authorised Users, and must ensure they comply with these Terms, the Acceptable Use Policy, and all applicable laws.

6.4 Users must identify an appropriate lawful basis under UK GDPR, and, for special category data, an appropriate Article 9 condition, before uploading or processing personal data through the Platform.

6.5 Users must not use the Platform for any unlawful, abusive, or harmful purpose, including spam, fraudulent activity, or sending unauthorised marketing communications.

6.6 Users must not use the Platform to store clinical or medical records; see Clause 2.11 of our Acceptable Use Policy.

6.7 Authorised Users may open support tickets and discuss general account operation on behalf of Users. Billing changes, subscription cancellation, closing the account, and changes to the primary contact may only be actioned by Users, or by an Authorised User they have specifically designated in writing as having that authority.

6.8 Users are responsible for ensuring their account is set up with a dedicated email sending domain (guidance available via Tandem Learning or by emailing [email protected]) and for maintaining their email lists health. Failure to maintain email lists health can result in deliverability being negatively impacted and in extreme cases the domain being suspended by receiving email providers (Google, Microsoft etc).

6.9 Users are responsible for ensuring their account wallet is topped up sufficiently to enable any chargeable add-on services to be deducted from it. The minimum top up amount for the wallet is $10.

7. Data Protection and Privacy

7.1 Compliance

Both parties must comply with all applicable UK Data Protection Laws.

7.2 Controller vs Processor

Where Users control the data uploaded into the Tandem Dots platform, Users are the Data Controller, and Tandem Dots acts as a Data Processor, processing that data only under the Users' instructions. Tandem Dots separately acts as an independent Data Controller for its own account, billing, security, and support records; see our Privacy Policy.

7.3 Data Processing Agreement

Where we act as a Data Processor on the Users' behalf (as defined in Clause 7.2), our processing is governed by our Data Processing Agreement (DPA), which forms part of our agreement with Users and sets out the scope, nature, purpose, and duration of processing, the categories of data subjects and types of personal data, and our obligations under Data Protection Laws.

7.4 International Transfers

Where we transfer data outside the UK, appropriate safeguards apply, as set out in full in our Data Processing Agreement.

7.5 Data Breaches

We will notify Users without undue delay if we become aware of a personal data breach affecting personal data we process on your behalf as your Data Processor, in accordance with the notification process in our Data Processing Agreement.

7.6 Full Details

Our Privacy Policy is a transparency notice explaining how we handle personal data where we act as an independent Data Controller; it does not form part of the contractual promises in these Terms.

7.7 Your Data Rights

Where personal data is processed under your instructions as Controller, we will assist you in responding to data subject rights requests, as set out in our Data Processing Agreement. Where Tandem Dots is itself the Data Controller, we will respond to such requests directly; see our Privacy Policy.

7.8 Data Backup and Recovery

Users are responsible for maintaining appropriate independent backups of their data and content. While Tandem Dots may maintain system backups for business continuity and disaster recovery purposes, consistent with the retention periods in our Data Processing Agreement, we do not guarantee against data loss and recommend that Users regularly export and retain copies of important data.

8. Intellectual Property

8.1 Platform Ownership

All intellectual property rights in the Tandem Dots platform remain ours or our licensors'.

8.2 Licence

Subject to compliance with these Terms and payment of all applicable Fees, we grant the User a limited, non-exclusive, non-transferable, revocable licence to access and use the Platform for its legitimate internal business purposes during the applicable Subscription Term, including permitting its Authorised Users to do so on its behalf. Use of the Platform remains subject to the restrictions in the Acceptable Use Policy.

8.3 Content You Provide

You retain full ownership of your content. You grant us a limited licence to process and store it solely for delivering our services, including through the Sub-processors and integrations described in our Data Processing Agreement.

8.4 Done-for-You Deliverables

Tandem Dots retains ownership of its pre-existing methods, templates, frameworks, and generic reusable components ("Background IP"), whether created before or during your engagement with us. Any Service Agreement will identify material Background IP incorporated into your specific deliverables.

On payment in full for a done-for-you project, you receive a perpetual, non-exclusive licence to use the specific funnels, automations, workflows, and other bespoke deliverables built for you ("Deliverables") within the Platform, for your own business. This is a licence, not a transfer of ownership; Tandem Dots retains underlying ownership of the Deliverables and any Background IP within them, except where a Service Agreement expressly states that ownership transfers to you.

If your Platform subscription ends, you may continue to export and use a copy of your Deliverables for your own business outside the Platform, to the extent technically possible, provided you have paid for them in full. This does not extend to Background IP or third-party licensed components, which remain subject to their own terms.

Before full payment has been received, any Deliverables provided are for evaluation purposes only and must not be relied upon for production use. We may reuse generic, non-client-identifying components, templates, and know-how developed during your engagement in work for other clients.

You are responsible for ensuring that materials you supply to us for use in Deliverables do not infringe any third party's rights, and you indemnify us against any claim arising from materials you supplied, subject to the claims process in Clause 10.8 and the liability treatment in Clause 10.

Third-party materials incorporated into Deliverables, such as licensed fonts, stock imagery, or plugins, remain subject to their own licence terms. Unless a Service Agreement states otherwise, you are responsible for any ongoing fees needed to keep using those materials, including after termination.

Tandem Dots confirms it holds the necessary rights or licences from its own staff and contractors to grant the licence described in this Clause 8.4.

9. Third-Party Services

9.1

You acknowledge that Tandem Dots does not guarantee uninterrupted, secure, or error-free availability of the Platform or any Third-Party Services. Third-Party Services you have chosen to connect are governed by their own terms, and we are not liable for their downtime, pricing changes, or data handling, except to the extent such a service is also a Sub-processor engaged by us, in which case our Data Processing Agreement and Clause 3.9 apply.

Integrations are provided "as-is" and we make no warranties regarding their performance. Sometimes the Platform might go down for maintenance or experience technical issues; if this happens, some or all features might be temporarily unavailable.

Subject to Clauses 3.9, 9.2, 10.6, and 10.7, and without limiting our obligations under our Data Processing Agreement, we're not liable for any business losses, missed opportunities, or problems caused by platform downtime or technical issues. We work quickly to restore service when problems occur and will communicate with you about planned maintenance or unexpected outages.

9.2 Social Media Scheduler Disclaimer

Our social media scheduling tool integrates with third-party platforms. While we aim for all scheduled posts to publish as expected, we cannot guarantee exact timing due to third-party API delays, platform restrictions, or outages, and are not liable for loss arising from delayed, failed, or incorrectly published posts. This clause does not exclude or limit our liability for loss caused by our own negligence or failure to properly configure the relevant integration.

9.3 Account Access and Privacy

Tandem Dots will only access your account data to provide technical support at your request, where legally required by court order or regulatory authority, or as otherwise described in Clauses 2.7 and 2.10 of our Acceptable Use Policy. All access is logged, monitored, and subject to confidentiality obligations.

10. Limitation of Liability

10.1 No Warranty

Except as expressly stated in these Terms, including our specific commitments in Clauses 3.9, 9.2, and 10.7, the Platform and Services are provided on an "as is" and "as available" basis, and Tandem Dots makes no warranties regarding uninterrupted availability, fitness for a particular purpose, compatibility, or error-free operation.

10.2 Liabilities Not Subject to the Cap

The following are not subject to the cap in Clause 10.4: death or personal injury caused by our negligence, as per the Unfair Contract Terms Act 1977; fraud or fraudulent misrepresentation; and any other liability which cannot be excluded under Scots law.

10.3 Liabilities Subject to the Cap but Not Excluded

The following are subject to the cap in Clause 10.4, but are not excluded by Clause 10.5: breach of confidentiality under Clause 11; infringement of intellectual property rights caused by our Platform or Deliverables (excluding infringement caused by your own materials, modifications, or unauthorised combinations); and losses arising from a personal data breach caused by our failure to comply with Data Protection Laws.

10.4 Liability Cap

Our total liability under these Terms is limited to the total Fees paid by you in the 12 months preceding the claim. Where a claim relates to both these Terms and the Data Processing Agreement, this cap and the cap in DPA Clause 12.1 are treated as a single, combined cap, not applied cumulatively, except where a liability cannot lawfully be excluded or capped.

10.5 What We're Not Liable For

Subject to Clauses 3.9, 9.2, 10.2, 10.3, 10.6, and 10.7, and without limiting our obligations under our Data Processing Agreement, we are not liable for: loss of profits, revenue, contracts, or goodwill; business interruption or reputational damage; third-party service failures; or indirect, incidental, or consequential losses.

10.6 HighLevel Dependency

Tandem Dots platform is built on HighLevel's infrastructure. In the event of HighLevel service interruptions, outages, or discontinuation, our liability is limited to our own actions, omissions, and choices regarding our supply chain, including the selection, instruction, and configuration of HighLevel and other third-party infrastructure providers. This does not exclude our liability for our own negligence in that selection, instruction, or configuration, or for our obligations as Data Processor under our Data Processing Agreement. We will make reasonable commercial efforts to communicate known outages and estimated restoration times. No refunds, credits, or compensation will be provided for service interruptions caused by HighLevel or other third-party infrastructure providers, except as set out in Clause 3.9.

10.7 Data Sharing Risks (Screen-Sharing)

Where screen-sharing is used during support services, you acknowledge that any confidential or personal information visible or shared during that session is shared at your own risk, and we are not responsible for loss, misuse, or disclosure arising from screen-sharing sessions conducted by you or your Authorised Users. This clause does not exclude or limit our liability for loss caused by our own negligence, wilful default, or failure to maintain adequate security over the screen-sharing tools we provide.

10.8 Claims Process

Any party seeking to rely on an indemnity in these Terms must promptly notify the other party of the claim, allow that party to control its defence and settlement acting reasonably, and take reasonable steps to mitigate its loss.

11. Confidentiality

11.1 "Confidential Information" means any non-public information disclosed by one party to the other in connection with these Terms, including business, technical, financial, and personal data information, however disclosed or recorded.

11.2 Confidential Information does not include information that is or becomes publicly available other than through breach of this Clause, was already lawfully known to the receiving party, is independently developed without reference to it, or is lawfully received from a third party without restriction.

11.3 Each party must keep the other's Confidential Information secure and use it only for the purposes of these Terms. It may be disclosed to employees, contractors, and suppliers on a need-to-know basis, provided they are bound by confidentiality obligations at least as strict as those in this Clause.

11.4 Either party may disclose Confidential Information where required by law, regulation, or a competent court or regulator, giving the other party reasonable notice where lawfully possible.

11.5 On request following termination, each party will return or destroy the other's Confidential Information, except where retention is required by law or under Clause 10 of our Data Processing Agreement.

11.6 This Clause 11 survives termination for as long as the relevant information remains confidential.

12. Cancellation and Termination

12.1 Your Right to Cancel

You may cancel your subscription at any time by emailing [email protected]; see Clause 3.2 for the deadline to avoid being charged for the next renewal. Cancellation takes effect at the end of the current billing period, and does not entitle you to a refund of payments already made, except as set out in Clause 12.6.

12.2 Our Right to Suspend

We may suspend access to the Platform for the User and/or any Authorised Users:

• a) if you fail to pay any fees when due and payment remains outstanding for 7 days after the due date;
• b) if you materially breach these terms;
• c) if we reasonably believe you are misusing the platform;
• d) if you become insolvent or subject to any insolvency proceedings;
• e) where reasonably necessary to protect the Platform, our systems, other users, third-party providers, or Tandem Dots from security threats, abuse, fraud, excessive usage, or legal or regulatory risk;
• f) immediately and without the notice otherwise described in this Clause, where a breach is incapable of remedy, involves unlawful activity, or poses a serious and immediate security threat.

Fees during suspension are treated as set out in Clause 3.8. Suspensions under paragraph (c) are subject to the reasonable-assessment approach in Clause 12.7. During suspension, the User ceases to qualify as an Active User and may lose access to some or all Services, features, and support.

12.3 Our Right to Terminate

We may suspend or terminate your access immediately on written notice if a material breach is not remedied within 7 days of written notice, payment remains outstanding more than 30 days, or you become insolvent or cease trading. Where the material breach relates to our Data Processing Agreement, the 30-day period in DPA Clause 13 applies instead of the 7-day period above.

You may likewise terminate immediately on written notice if we materially breach these Terms and fail to remedy that breach within 7 days of your written notice requiring us to do so, or 30 days where the breach relates to our Data Processing Agreement.

12.4 Post-Termination

After termination, Active User status and all associated access rights immediately cease, and outstanding balances become immediately due and payable. You have 14 days from the date of termination both to export your data from the account and to tell us, under Clause 10 of our Data Processing Agreement, whether you would like your data deleted or returned. We will keep the account accessible for that 14-day period for these purposes, after which deletion processes may commence in accordance with our retention policies.

12.5 Survival

Provisions intended to survive termination continue in force, including those relating to payment obligations, intellectual property, confidentiality, liability limitations, data protection, dispute resolution, and accrued rights.

12.6 Material Adverse Change for Annual Customers

If you are on an annual prepaid plan and a Core Feature you materially rely on (meaning you use it on an ongoing, routine basis to deliver your own services to your customers, rather than as an occasional convenience) is permanently withdrawn during your term, you may terminate for convenience within 30 days of that change and receive a pro-rated refund for the unused portion of your prepayment. Monthly customers whose use of a Core Feature is materially reduced, rather than withdrawn entirely, may raise this with us for a proportionate resolution.

12.7 Reasonable Assessment

Any suspension or termination decision under Clause 12.2(c), or under any ground in the Acceptable Use Policy involving subjective judgement, such as reputational risk, the health data restriction, or the prohibited industries list, will be based on a reasonable assessment of the facts available to us. Where practical, and where urgent action is not necessary to prevent harm, we will give you an opportunity to explain or remedy the issue first.

13. Governing Law and Jurisdiction

13.1 These Terms are governed by and construed under the laws of Scotland.

13.2 Any disputes shall be subject to the exclusive jurisdiction of the Scottish courts.

14. Business Continuity and Data Portability

14.1 Service Discontinuation

If Tandem Dots Ltd ceases operations, we will use reasonable endeavours to provide at least 90 days' written notice, maintain platform access during that period, and provide technical documentation to facilitate transition, except where this is not reasonably possible due to insolvency, administration, or the abrupt discontinuation of underlying third-party infrastructure such as HighLevel.

14.2 Data Export Rights

You may export your data at any time, in whichever of CSV, XML, or JSON format is available for that data type at the time of export.

14.3 Force Majeure

Neither party shall be liable for delays or failures due to events beyond reasonable control, including natural disasters, government actions, or third-party service outages. The affected party must notify the other as soon as reasonably possible and take reasonable steps to mitigate the impact. If a force majeure event continues for more than 60 consecutive days, either party may terminate the affected Services on written notice.

15. Changes to These Terms

Tandem Dots may modify, update, suspend, replace, discontinue, or remove any aspect of the Platform, Services, or features from time to time for operational, legal, technical, security, or commercial reasons.

We will notify you of material changes by email (where possible) and/or a notice on our website or platform, giving at least 30 days' notice other than where urgent legal or security reasons require otherwise. Your continued use after a change takes effect constitutes acceptance of it, save that a material adverse change during a prepaid annual term is governed by Clause 12.6. If you do not agree to a revised Term, you should stop using our services.

16. Order of Precedence

If there is a conflict between our documents, the order of precedence is:

• a) any signed Service Agreement or Order Form;
• b) the Data Processing Agreement, to the extent the conflict concerns the processing of personal data;
• c) these Terms & Conditions;
• d) the Acceptable Use Policy.

Our Privacy Policy is a transparency notice, not a contractual document, and does not form part of this order of precedence.

17. Entire Agreement

These Terms, together with our Data Processing Agreement, Acceptable Use Policy, and any applicable Service Agreements, constitute the entire agreement between you and Tandem Dots Ltd. They supersede any prior agreements or communications relating to the subject matter. Our Privacy Policy is a transparency notice and does not form part of this entire agreement.

Nothing in this Clause limits or excludes either party's liability for fraud or fraudulent misrepresentation.

You confirm you have not relied on any statement not expressly set out in these Terms. Nothing in these Terms creates a partnership, joint venture, agency, employment, or fiduciary relationship between the parties.

Users may not assign, transfer, sublicense, or otherwise deal with their rights or obligations under these Terms without our prior written consent. We may assign, transfer, subcontract, or otherwise deal with our rights and obligations at any time, including as part of a merger, acquisition, restructure, or sale of assets. Where this involves the transfer of personal data we hold as your Data Processor, we will notify you in advance in accordance with our Data Processing Agreement.

18. Notices

Formal notices under these Terms must be sent by email to [email protected], and are treated as received on the next Business Day. Day-to-day support and billing queries go to [email protected]. Each party is responsible for keeping its notice email address up to date; neither party is responsible for a notice not received due to the other's outdated contact details. Termination and other legal notices to you will be sent to both your registered account email and, where different, your designated primary billing contact.

19. Contact Us

↑ Back to top

1. Introduction

Tandem Dots Ltd ("we", "us", "our") respects your privacy. This notice explains what personal data we collect, how we use it, your rights, and how we secure your data. It is a notice, not a contract: we are not asking you to sign or agree to it, other than where we separately ask for your specific agreement, such as marketing consent.

This notice applies to Users and Authorised Users of the Platform, done-for-you clients, prospective customers and enquirers, website visitors, newsletter and marketing subscribers, event and webinar attendees, Affiliates participating in our Affiliate Programme, our suppliers and business contacts, and individuals referred to us by existing customers.

2. Our Role: Controller and Processor

Tandem Dots acts as an independent Data Controller for personal data connected to our own business operations, including: account registration and administration, billing and payment records, security and access logs, customer support records, our own sales and marketing activity, website analytics, our Affiliate Programme, fraud prevention, legal claims and complaints, and any due diligence connected with a sale or restructure of our business. This Privacy Policy governs that processing.

Tandem Dots acts as a Data Processor for personal data that you, as a User, upload into the Platform about your own customers, clients, or contacts, for example CRM records, booking data, and message logs. That processing is governed by our Data Processing Agreement, not this Privacy Policy, and we only handle it on your documented instructions.

3. Data We Collect (as Controller)

3.1 Account & Contact Information: full name, email, phone number, company name, job title, and billing details. Where you pay by card, our payment provider holds your full card details directly; we hold only transaction references and payment status, not full card numbers.

3.2 Platform Usage Data: login times, feature usage, support tickets, and account configuration relating to your own use of the Platform, as distinct from the contact data you upload about your customers.

3.3 Technical Data: IP address, device type, operating system, browser details, and cookies (see our Cookies Policy).

3.4 Marketing Data: your preferences for marketing communications, and your interactions with our campaigns, emails, and social content.

3.5 Website Visitor and Enquiry Data: information submitted through contact forms, newsletter sign-ups, event registrations, or referrals.

3.6 Affiliate Data: name, contact details, payment details, and tracking link activity for individuals participating in our Affiliate Programme. We act as the Data Controller for tracking activity generated through our own referral links, Affiliate Programme cookies, and attribution data we collect and combine with customer records to calculate commission. Where an Affiliate places their own separate tracking technology on their own website or content, they act as an independent Controller of that data, not us.

We do not, as Controller, seek to collect special category data about you. Our Users, as independent Controllers of their own customers' data, may upload limited special category data into the Platform, for example basic health-related booking information described in our Acceptable Use Policy. Where we process that data, we do so only as a Processor, on the User's instructions, under our Data Processing Agreement.

4. How We Collect Your Data

We collect data when you create an account, purchase a subscription or done-for-you package, interact with our emails, support systems, or live chat, browse our website, sign up to our newsletter, register for an event, or join our Affiliate Programme.

Where you are referred to us by an existing customer, we rely on our legitimate interest in following up a business enquiry, and we will tell you, at first contact, that you were referred and by whom, in line with our transparency obligations for data collected indirectly.

5. How We Use Your Data, and Our Lawful Basis

• Providing and managing your subscription, and delivering done-for-you services and onboarding: performance of a contract.
• Processing payments and sending invoices: performance of a contract, and legal obligation for the tax records this creates.
• Sending service updates and security notifications, and responding to support requests: performance of a contract, and legitimate interests where the communication sits outside the strict contract itself.
• Preventing fraud and protecting account security: legitimate interests.
• Improving our platform and client experience: legitimate interests.
• Handling legal claims, complaints, and regulatory enquiries: legitimate interests, and legal obligation where relevant.
• Administering our Affiliate Programme: performance of a contract with the Affiliate.
• Running events, webinars, and masterclasses: performance of a contract or legitimate interests, depending on context.
• Corporate transactions, such as a sale or restructure of our business: legitimate interests.
• Marketing communications: consent; or legitimate interests, where electronic marketing is instead sent under the PECR soft opt-in or corporate-subscriber provisions described in Clause 8.

Where we rely on legitimate interests, the specific interest is the one named against each purpose above, and we only rely on this basis where the processing is proportionate, has minimal privacy impact, and is aligned with your rights and expectations.

5.1 Automated Decision-Making and Profiling

Where Tandem Dots, as Controller, uses automation or profiling, for example to score the quality of a sales enquiry to us, or personalise our own marketing to you, this is based on your interactions with us and does not result in decisions made without human involvement.

Any lead scoring, campaign triggers, or automated features used by our Users within their own CRM data is processing carried out by us as Processor, on the User's instructions, and is addressed in our Data Processing Agreement, not this notice.

We do not currently carry out automated decision-making that produces legal effects concerning you, or similarly significantly affects you, without appropriate safeguards. If this changes, the safeguards required under UK GDPR (as amended by the Data (Use and Access) Act 2025) will apply, including your right to be given information about the decision, to make representations about it, to obtain meaningful human intervention, and to contest the decision. You may object to profiling at any time by contacting [email protected].

6. Our Providers

Where we engage a supplier as an independent recipient of data for our own purposes as Controller (for example, our accounting, email, event, or website hosting providers), we refer to them as our processors or recipients, distinct from the Sub-processors engaged by Tandem Dots to deliver the core Platform to our Users, who are addressed in our Data Processing Agreement.

A current list of Platform Sub-processors, including their country and role, is available at gohighlevel.com/sub-processors. We also maintain our own record of the other providers we use for our own business functions, and the countries and mechanisms involved, available on request.

We carry out due diligence and put contractual protections in place with each provider we use, but we cannot independently guarantee every third party's complete compliance with UK GDPR; we remain responsible for our own compliance obligations in respect of them.

7. International Data Transfers

Where we or our providers transfer personal data outside the UK, we rely on one of the following, as appropriate:

• a) UK adequacy regulations, made by the Secretary of State following consultation with the Information Commissioner's Office;
• b) the UK Extension to the EU-US Data Privacy Framework, used only where the US recipient is currently self-certified for that framework and for the relevant category of data, which we check, and periodically re-check, against the official Data Privacy Framework list; or
• c) the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, accompanied in each case by a Transfer Risk Assessment.

You can request further information about, or a copy of, the relevant safeguard for a specific transfer by contacting [email protected], subject to appropriate redactions of confidential or security-sensitive information.

8. Marketing Communications

Using your personal data for marketing requires two separate things to be right: a UK GDPR lawful basis, and, for electronic marketing (email, SMS, WhatsApp), compliance with PECR.

Our UK GDPR basis is typically your consent, or our legitimate interest in telling existing customers about similar services.

Our PECR position is:

• Consent – where you've actively opted in via our website forms, pop-ups, or sign-up processes.
• Soft opt-in – available only where you are an individual subscriber (broadly, a sole trader, or an ordinary, non-LLP partnership), we obtained your details during a sale or negotiation for a sale, we are marketing similar products or services, and you were given a clear opt-out at collection and in every message since. The soft opt-in is not itself a UK GDPR lawful basis; it is solely a PECR exemption from needing separate consent for the electronic communication channel, and our UK GDPR basis in that case is legitimate interests, as described in Clause 5.
• Corporate subscribers – if you subscribe to us as a limited company, LLP, or Scottish partnership, PECR's consent and soft opt-in rules do not apply to that corporate mailbox, though you can still opt out at any time, and UK GDPR obligations continue to apply to any named individual within it.

You can update your preferences or withdraw consent at any time via the unsubscribe link in our emails or by contacting [email protected]. You have an absolute right to object to direct marketing at any time, and we will stop upon request. We do not sell your marketing data; it is shared only with the email, SMS, and CRM providers we use to deliver that marketing on our behalf.

9. Data Retention

• Active account and CRM configuration data: retained for the term of your subscription.
• Closed Platform accounts: deleted within 30 days, with encrypted backups retained for up to 90 days.
• Security and access logs: retained for 12 months from creation, the period we judge necessary to detect, investigate, and respond to security incidents.
• Support tickets and related correspondence: retained for 2 years after the ticket is resolved, so we can handle follow-up queries and review service quality.
• Prospective-customer enquiries that do not convert to a subscription: retained for 24 months from your last contact with us, after which the data is deleted or anonymised, unless you ask us to do so sooner.
• Event and webinar registration data: retained for 12 months after the event, for post-event follow-up and reporting.
• Marketing interaction data (such as email opens or campaign engagement): retained for as long as you remain subscribed to our marketing, and thereafter in line with the marketing suppression period below.
• Website analytics and cookie data: retained in line with the standard settings of the analytics and cookie tools we use, typically no longer than 26 months; see our Cookie Policy for tool-specific detail.
• Supplier and business-contact records: retained for the duration of our business relationship and for 6 years afterwards, for contractual and accounting purposes.
• General technical data (such as IP address, device, or browser information) is retained alongside the account or enquiry it relates to, and deleted on the same schedule as that record.
• Financial and tax records: retained for six years, to comply with UK tax law (subject to separate accounting confirmation).
• Legal claims and complaint records: retained for the period necessary to handle the claim or complaint, and for the applicable statutory prescription or limitation period afterwards.
• Marketing suppression records (i.e., a record that you have opted out): retained indefinitely, so that we can honour your objection and avoid contacting you again.
• Affiliate records: retained for the duration of the Affiliate relationship and for six years afterwards, for accounting and commission-dispute purposes.

Where you close your Platform account, this retention schedule governs our own Controller records; it does not affect the separate deletion and return process for your customers' CRM data, which is addressed in our Data Processing Agreement.

10. Your Rights

Under the UK GDPR, you have the right to: access your personal data; correct inaccurate or incomplete information; request deletion of your data (subject to legal retention obligations); restrict processing of your data; object to processing based on legitimate interests; object to direct marketing at any time, which is an absolute right; withdraw consent at any time; request data portability; and, where a significant decision about you is ever based solely on automated processing, to be given information about it, to make representations, to obtain meaningful human intervention, and to contest it. To exercise any of these rights, contact [email protected].

11. Data Protection Complaints

If you're unhappy with how we've handled your personal data, please tell us first, at [email protected] or by post to the address in Clause 17. Where you do, we will:

• acknowledge your complaint within 30 days of receiving it;
• verify the authority of anyone complaining on your behalf, where the complaint is not made by the individual directly;
• where a complaint is made by or on behalf of a child, consider whether they have sufficient understanding to exercise this right themselves, and respond in clear, age-appropriate language;
• investigate your complaint appropriately and keep you informed of progress; and
• communicate the outcome to you without undue delay.

Email and post are our reliable, monitored complaint channels. While you are welcome to raise a concern via our social media accounts, we recommend email or post for anything you want us to formally acknowledge and track under this process.

If you're not satisfied with our response, or wish to complain directly, you also have the right to contact the ICO at ico.org.uk or by calling 0303 123 1113.

12. Cookies and Tracking Technologies

Our website uses cookies to deliver essential features and analyse traffic and performance. Non-essential cookies are only set after you provide consent via our cookie banner, and withdrawing that consent is as easy as giving it. See our Cookie Policy for full detail, or contact [email protected].

13. Data Security

We apply technical and organisational measures appropriate to the risk, including encrypted data storage and transmission, role-based access controls, multi-factor authentication for admin accounts, and regular security testing, covering both our own systems and, in respect of the underlying Platform infrastructure, HighLevel's security programme. You are responsible for keeping your own login credentials secure.

14. Acting as a Data Processor

When you upload your customers' data into the Platform, you are the Data Controller for that data, and Tandem Dots is your Processor, acting strictly on your instructions. See our Data Processing Agreement.

15. Children's Data

Our own website and account registration are intended for individuals aged 18 and over, and we do not knowingly collect children's data as Controller.

Our Users may, in running their own business, upload personal data relating to individuals under 18, for example if a User's own customers include minors booking a service through the Platform. This is permitted, provided the User, as Data Controller for that data, identifies the correct lawful basis for their own circumstances and applies extra care to data minimisation. Where a User's own service is offered directly to a child as an online or "information society" service, and the User is relying on consent as the lawful basis, UK GDPR permits a child aged 13 or over to consent for themselves, with parental or guardian authorisation required below that age. Where a User relies on a different lawful basis, or the processing is not of this kind, this specific rule does not apply, and the User is responsible for identifying the correct lawful basis and safeguards for their own circumstances.

If you believe we have inadvertently collected data from a person under 18 in our own capacity as Controller, contact [email protected] so we can delete it.

16. Changes to This Policy

We may update this Privacy Policy to reflect changes in our services, legal obligations, or data processing practices, and will notify you of material changes by email or platform notice. The effective date above will be updated whenever changes are made.

17. Contact Us

↑ Back to top

This Data Processing Agreement ("DPA") forms part of the Terms & Conditions between Tandem Dots Ltd ("Processor", "we", "us", "our") and the User named on the relevant Order Form or account registration ("Controller", "you").

1. Definitions

"Controller" means you, the User, who determines the purposes and means of processing personal data uploaded to the Platform.

"Processor" means Tandem Dots Ltd, which processes personal data on your behalf strictly as set out in this DPA.

"HighLevel" means the technology provider (also known as GHL or Go High Level) whose infrastructure underlies the Platform.

"Data Protection Laws" means the UK GDPR (as amended, including by the Data (Use and Access) Act 2025), the Data Protection Act 2018 (as amended), PECR, and any other applicable Scottish or UK data privacy legislation.

"Controller Personal Data" means the personal data described in Clause 3 that Tandem Dots processes on your documented instructions.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Controller Personal Data.

"Restricted Transfer" means a transfer of Controller Personal Data to a country or organisation outside the UK that is not otherwise permitted under UK Data Protection Laws without an appropriate safeguard.

"Sub-processor" means any third party engaged in processing Controller Personal Data on Tandem Dots' behalf, including HighLevel and the sub-processors it in turn engages.

"Services" means the Tandem Dots SaaS platform (powered by HighLevel) and any associated onboarding, automation setup, or done-for-you services.

2. Scope of This DPA

This DPA applies only to personal data that Tandem Dots processes as your Processor, meaning data you or your Authorised Users upload about your own customers, clients, or contacts. It does not apply to personal data that Tandem Dots processes as an independent Data Controller in its own right, such as your account, billing, security, and support records, which is addressed in our Privacy Policy.

3. The Processing Schedule

3.1 Subject matter of processing: the provision of the Tandem Dots SaaS platform and associated Services to you.

3.2 Nature of processing: collection, storage, organisation, retrieval, use, transmission, and deletion of personal data you upload to or generate within the Platform.

3.3 Purpose of processing: to provide the CRM, funnels, automations, scheduling, messaging, invoicing, and reporting functionality you have subscribed to, strictly as instructed by you.

3.4 Duration of processing: for the term of your subscription, and thereafter for the retention and deletion periods in Clause 10.

3.5 Categories of data subjects: your customers, clients, leads, and prospects, including, where applicable, individuals under 18 (see our Privacy Policy for the safeguards that apply to that data); your own employees, contractors, and suppliers where their data is uploaded to the Platform; and your own Authorised Users.

3.6 Types of personal data: names, contact details, communication history, booking and appointment information, payment references, and other personal data you upload consistent with the purpose in Clause 3.3, subject to Clause 5 (Special Category Data). You must not upload data about criminal allegations, charges, or convictions unless we have agreed this with you in writing in advance.

4. Roles and Responsibilities

4.1 Your Role as Controller

You are responsible for ensuring that any personal data uploaded into the platform has a valid lawful basis for processing under UK GDPR, and, where relevant, a valid Article 9 condition for any special category data.

4.2 Our Role as Processor

Tandem Dots will process Controller Personal Data only on your documented instructions, except where required by law, in which case, unless the law prohibits it, we will inform you of that legal requirement before processing.

Tandem Dots does not process Controller Personal Data for its own independent purposes. Where Tandem Dots determines the purposes and means of processing, such as its own account, billing, or marketing data, it acts as an independent Controller of that separate data, addressed in our Privacy Policy, and no customer authorisation is sought or required for it.

4.3 Instructions from the Controller

Your initial instructions are set out in this DPA and our main Service Agreement, and include the Restricted Transfers described in Clause 7. Additional instructions must be in writing, lawful, and within the scope of the agreed Services. If we believe an instruction infringes Data Protection Laws or is unclear, we will notify you without undue delay and may suspend the affected processing until resolved. We are not responsible for delay caused by incomplete, ambiguous, or unlawful instructions.

4.4 Confidentiality

Tandem Dots will ensure that any person authorised to process Controller Personal Data on its behalf, including its own staff, contractors, agency workers, and temporary staff, and the staff of any Sub-processor, is subject to a binding obligation of confidentiality, whether contractual or statutory, before that person accesses the data.

5. Special Category Data

5.1 You must not upload or instruct us to process any special category personal data (as defined in Article 9 of UK GDPR) except as permitted under Clause 5.2.

5.2 As a limited exception to Clause 5.1, you may collect and store special category data that is reasonably necessary to book or deliver a specific service, such as basic allergy or dietary information collected on a booking form, provided you comply with Clause 2.11 of our Acceptable Use Policy. This exception does not require our prior written agreement on a case-by-case basis, provided you stay within the boundaries of Clause 2.11.

5.3 Any special category data outside the limited exception in Clause 5.2, including clinical or medical records, requires our prior written agreement, an appropriate lawful basis and Article 9 condition on your part, and any additional security measures we reasonably require.

6. Sub-processors

6.1 Authorisation

By entering into this DPA, you give Tandem Dots your general written authorisation, for the purposes of Article 28(2) of the UK GDPR, to engage HighLevel as a Sub-processor, together with the sub-processors currently listed on HighLevel's published sub-processor page at gohighlevel.com/sub-processors, and any future replacement or additional sub-processors engaged by HighLevel or directly by Tandem Dots, subject to the notification and objection process in Clause 6.3.

HighLevel contracts directly with the sub-processors it uses to provide the core platform infrastructure, and, to the extent applicable to the nature of their processing, imposes on them the same data protection obligations set out in this DPA, consistent with Article 28(4) of the UK GDPR. Tandem Dots relies on HighLevel's own contractual flow-down of these obligations, and maintains its own due diligence records, beyond HighLevel's public sub-processor page, confirming that this flow-down is in place. These records are available to you on request, subject to confidentiality restrictions.

Tandem Dots maintains an internal record identifying the exact legal entity with which it contracts for the provision of HighLevel's technology, distinct from the trading names (HighLevel, GHL, Go High Level) used throughout this DPA for readability. That record, and the corresponding entity details for HighLevel's own sub-processors where available to us, will be provided to you on request.

6.2 Sub-processor Obligations and Liability

Tandem Dots remains liable to you for the compliance of any Sub-processor with the data protection obligations in this DPA, regardless of where that Sub-processor is based, subject to the liability cap in Clause 12.1. Where a Sub-processor causes a compliance failure, we remain responsible to you for it, and may pursue our own remedies against that Sub-processor or against HighLevel.

6.3 Notification of Changes

Where HighLevel notifies us of a change to its own sub-processors, or where we intend to engage a new Sub-processor directly, we will notify you directly, for example by email, within 5 Business Days of receiving or making that decision. You will have 14 days from our notification to object on reasonable data protection grounds, and we will work with you in good faith to resolve any objection before the change takes effect.

If we cannot resolve your objection within that period, we will, at your choice and where reasonably practicable: engage an alternative Sub-processor in place of the one you object to; disable the specific Platform feature that relies on that Sub-processor for your account; or permit you to terminate the affected Service without the notice otherwise required under Clause 12 of the Terms & Conditions, and without penalty for that specific termination.

Where HighLevel makes a change to its own sub-processors on shorter notice than 14 days, including where the change is urgent or immediate, we will notify you as soon as reasonably possible, which may be after the change has already taken effect. Your right to object under this Clause still applies in that case; the remedy will be one of the three options above, rather than a guarantee that the change is held back before it happens.

7. International Data Transfers

7.1 Your documented instructions under Clause 4.3 include authorisation for Tandem Dots to make the Restricted Transfers reasonably necessary to deliver the Services, using one of the following safeguards:

• a) UK adequacy regulations, made by the Secretary of State following consultation with the ICO;
• b) the UK Extension to the EU-US Data Privacy Framework, used only where the US recipient is currently self-certified for that framework and for the relevant category of data, verified, and periodically re-verified, against the official Data Privacy Framework list; or
• c) the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, accompanied by a Transfer Risk Assessment.

7.2 We maintain our own current record of the countries, entities, and transfer mechanisms involved in processing Controller Personal Data, in addition to HighLevel's published Sub-processor list, and will provide this on reasonable request.

8. Security Measures

8.1 Technical & Organisational Measures

HighLevel applies measures to the underlying Platform infrastructure, including data encryption in transit and at rest, role-based access controls, multi-factor authentication for admin accounts, and regular vulnerability scanning and monitoring.

In addition, Tandem Dots applies its own organisational measures, including restricting our staff's access to Controller Personal Data on a need-to-know basis, requiring strong unique passwords and multi-factor authentication for our own administrative tools, and providing data protection awareness guidance to our team.

8.2 Your Security Obligations

You are responsible for maintaining secure account credentials and restricting Platform access to authorised users only. Where required under the Data Protection (Charges and Information) Regulations 2018, you must pay the applicable data protection fee to the ICO and maintain your registration.

9. Assistance, Data Subject Rights, and Breach Notification

9.1 Taking into account the nature of processing and the information available to us, Tandem Dots will provide reasonable assistance to you with the security of processing, Personal Data Breach notification, data protection impact assessments, and, where required, prior consultation with the ICO, in relation to processing under this DPA.

9.2 Tandem Dots will assist you, as far as reasonably possible, in responding to data subject requests. You remain responsible for verifying the identity of the data subject and the validity and scope of any request. Requests received directly by Tandem Dots will be promptly forwarded to you, unless we are legally required to respond independently.

9.3 If we become aware of a Personal Data Breach affecting Controller Personal Data, we will notify you without undue delay, including the nature and scope of the breach, its likely consequences, and steps taken to mitigate it, with continuing updates as further information becomes available. We will provide a named contact point for the incident and preserve relevant records and evidence. You are responsible for notifying affected data subjects and the ICO where required by law, unless agreed otherwise.

10. Data Retention and Deletion

On termination of your account, you have 14 days from the date of termination to choose, in writing, whether we delete or return all Controller Personal Data processed on your behalf; this is the same 14-day period in which Terms & Conditions Clause 12.4 keeps your account accessible for data export. If you do not tell us your choice within that period, we will delete the data. Deletion or return will be completed within 30 days of your instruction, or of the 14-day period expiring, unless we are required by law to retain it longer.

Deleted data is permanently removed from active systems, though encrypted backup copies may remain for up to 90 days, securely stored and not actively processed except for system integrity, legal compliance, or disaster recovery.

You may request early deletion during your active subscription by writing to [email protected]; we will discuss with you any effect this may have on your ability to continue using the affected Services, and action the request within a reasonable period unless legal retention requirements apply.

11. Audit Rights

Tandem Dots will make available all information reasonably necessary to demonstrate compliance with this DPA and applicable Data Protection Laws.

Subject to reasonable advance notice (minimum 14 days) and appropriate confidentiality undertakings, you may audit our data processing activities, yourself or through an auditor of your own choosing, not more than once per 12-month period, unless required by a data protection authority, following a material breach, or where you reasonably require an additional audit to establish our compliance. We may reasonably object to a proposed auditor only on genuine confidentiality or conflict-of-interest grounds, such as the auditor being a direct competitor of ours, and not as a general veto. Audits will be conducted during business hours in a manner that minimises disruption.

12. Liability

12.1 Tandem Dots' total aggregate liability under this DPA, including for any breach of Clause 6.2, is limited to the total Fees paid by you in the 12 months prior to the claim. This cap is combined with, and not in addition to, the cap in Clause 10.4 of the Terms & Conditions, and does not apply to any liability that cannot lawfully be excluded or limited.

12.2 Clause 12.1 limits the quantum of our liability; it does not exclude our liability altogether for a breach of Clause 6.2 or any other obligation in this DPA.

12.3 Mutual Indemnity

Each party shall indemnify the other against losses, liabilities, damages, costs, or expenses (including reasonable legal fees) arising from: a) any breach by the indemnifying party of its obligations under this DPA or applicable Data Protection Laws; b) any processing outside the scope of lawful instructions (in the case of Tandem Dots); or c) the provision of unlawful, inaccurate, or unauthorised instructions (in the case of the Controller). A party seeking to rely on this indemnity must promptly notify the other of the claim, allow that party to control its defence and settlement acting reasonably, and take reasonable steps to mitigate its loss. This indemnity is subject to the combined cap in Clause 12.1, save for losses that cannot lawfully be capped, and does not apply where the claim arises from the indemnified party's own negligence or breach of this Agreement.

13. Term and Termination

This DPA remains in effect for as long as Tandem Dots processes Controller Personal Data on your behalf, and cannot be terminated by either party while such processing continues, save as set out below. It terminates automatically on expiry or termination of your wider Agreement with us, once the process in Clause 10 is complete.

Where a breach of this DPA also constitutes a material breach of the Terms & Conditions, the other party must give written notice, the breaching party has up to 30 days to remedy it, and if not remedied, the non-breaching party may terminate. This 30-day period applies instead of the shorter period in Terms & Conditions Clause 12.3. However, where a breach of this DPA involves unlawful processing, is incapable of remedy, or poses an urgent security risk, the affected party may suspend the relevant processing or terminate immediately on written notice, instead of following this 30-day process.

14. Cooperation with Supervisory Authorities

Tandem Dots will cooperate, on request, with the ICO or any other competent UK supervisory authority in relation to its data processing obligations under this Agreement.

15. Governing Law and Jurisdiction

This DPA is governed by the laws of Scotland, and any disputes are subject to the exclusive jurisdiction of the Scottish courts.

16. Entire Agreement and Precedence

This DPA constitutes the entire agreement between the parties on its subject matter. Where there is a conflict between this DPA and the Terms & Conditions concerning the processing of personal data, this DPA prevails, consistent with Terms & Conditions Clause 16.

17. Contact

↑ Back to top

This Acceptable Use Policy ("Policy") forms part of your agreement with Tandem Dots Ltd and applies when using the Tandem Dots SaaS platform (powered by HighLevel) and related services ("Platform"). It applies to Users and all Authorised Users. The version of this Policy in force at checkout is recorded alongside your acceptance of our Terms & Conditions.

Failure to comply may result in suspension or termination in line with our Terms & Conditions.

1. Purpose of This Policy

This Policy exists to protect Tandem Dots, our clients, and their end-users; ensure compliance with UK law, UK GDPR, and third-party provider terms; and prevent misuse of the Platform that could result in reputational damage or service disruption.

2. Prohibited Activities

Users and Authorised Users must not:

2.1 Unlawful or Harmful Use

Use the Platform for any illegal, fraudulent, or harmful activity, send or store content that is obscene, defamatory, threatening, abusive, discriminatory, or otherwise unlawful, or upload, distribute, or link to malicious software.

2.2 Email, SMS, and WhatsApp Messaging

You must identify an appropriate UK GDPR lawful basis for using personal data for marketing purposes, such as legitimate interests or consent, and separately ensure your electronic marketing complies with PECR. PECR generally requires the recipient's consent for electronic marketing, unless the soft opt-in exemption applies, or the recipient is a corporate subscriber (a company, LLP, or Scottish partnership, as described in our Privacy Policy) not covered by PECR's consent rules, in which case UK GDPR obligations still apply to any named individual within that mailbox.

You must not send unsolicited bulk emails, misleading or deceptive content, use unauthorised sender IDs, or impersonate another business or individual. Every marketing message must clearly identify the sender and provide a working opt-out. You must implement opt-out and unsubscribe requests promptly. If we reasonably assess that a high volume of complaints has been received against your account, we may suspend your messaging capabilities immediately, pending review.

The soft opt-in is not itself a lawful basis under UK GDPR; it is a PECR exemption from needing separate consent for electronic marketing to an individual subscriber. It may only be used where you obtained the contact details during a sale or negotiation for a sale, you're marketing similar products or services, and the recipient had a clear opportunity to opt out at collection and in every message since.

2.3 Payment and Financial Services

You may use the Platform to process ordinary customer payments through Stripe or other connected payment gateways, but must not use it to provide regulated payment services, e-money services, or investment services yourselves. You are responsible for ensuring your own payment activities comply with relevant financial services law.

2.4 Third-Party Integrations

Integrations with Meta, Google, LinkedIn, TikTok, or other platforms must comply with those providers' API policies. We are not liable for account bans or restrictions resulting from your violation of external platform terms, except where the ban or restriction was caused by our own configuration error, instruction, or negligence.

2.5 Platform Performance and API Rate Limits

You must not engage in any activity that places excessive load on the Platform or interferes with its normal operation, and must comply with applicable rate limits and technical restrictions. We may monitor usage and take action, including rate limiting or temporary suspension, consistent with Clause 9.3 of our Terms & Conditions.

2.6 Single Business Use, Account Sharing, and Resale Restrictions

Each Tandem Dots account is licensed for use by a single User in connection with that User's own business only. This applies regardless of subscription tier; there is no plan or tier under which an account may be used to manage, deliver, or provide services in connection with a separate third party's own business.

Except where expressly authorised in writing by Tandem Dots, Users and Authorised Users must not:

• a) resell, sublicense, distribute, lease, or commercially exploit access to the Platform or Services;
• b) permit access to the Platform outside the scope of the applicable subscription tier or agreed usage limits;
• c) share login credentials between multiple individuals;
• d) use the Platform to provide outsourced hosted services, bureau services, agency services, consultancy services, or white-label services to, or on behalf of, any third party's own business, including managing a separate business's CRM, marketing, or client communications through the User's account;
• e) allow unauthorised third parties to access or use the Platform.

If you want to manage Tandem Dots for more than one separate business, whether that's your own multiple ventures or clients you work with, each business needs its own separate Tandem Dots account and subscription.

2.7 User-Generated Content

You are solely responsible for content uploaded or processed through the Platform by you or your Authorised Users, and must ensure it complies with applicable law and does not infringe others' rights. We do not routinely monitor user content; however, we may review, investigate, or remove content where necessary to detect abuse, respond to a report, comply with the law, or protect the Platform, our users, or third parties.

2.8 Prohibited Business Activities

We do not permit use of the Platform for alcohol, gambling, adult content, escort services, psychic mediumship services, unlicensed financial services, counterfeit goods, hate speech, violence, extremism, or illegal activity, or pyramid schemes and MLM schemes that do not clearly and prominently disclose their commission structure to participants.

This is a restriction purely on a category of commercial activity, not on individuals who hold particular spiritual or religious beliefs. The exclusion applies solely to psychic mediumship as a business activity, and does not extend to other spiritual, personal guidance, or wellbeing services such as tarot or spiritual and personal coaching. A business or individual offering those services is welcome to use the Platform for business activity that does not fall within this Clause, including where they personally identify as a psychic medium, provided the specific business activity conducted on the Platform is not psychic mediumship itself.

2.9 Intellectual Property and Platform Restrictions

Users and Authorised Users must not copy, reverse engineer, or use the Platform to build a competing product, except where a restriction is prohibited by law, or remove proprietary notices.

2.10 System Abuse and Security

You must not damage, disable, overburden, or attempt unauthorised access to any part of the Platform or its supporting infrastructure. We reserve the right to suspend or terminate access without notice if we detect system abuse or a security threat, and will notify you as soon as it is safe and lawful to do so.

2.11 Health, Medical and Clinical Records

Tandem Dots, and the underlying HighLevel platform, is a business and marketing system, not a clinical records system, and has not been designed, certified, or intended to hold medical or health records.

You may collect and store limited special category data where reasonably necessary to book, schedule, or deliver a specific service, for example known allergies, dietary requirements, or relevant physical measurements collected on an intake or booking form. Where you do this, you must: collect only the minimum information needed; identify an appropriate Article 6 lawful basis and Article 9 condition for your own circumstances (explicit consent is a common and straightforward choice for many businesses, but is not the only valid option, and you should tell the client why you need the information); and not use the Platform for detailed clinical notes, consultation records, diagnoses, treatment plans, health histories, referral letters, or any other formal clinical record. This limited exception does not require our prior written agreement on a case-by-case basis, provided you stay within these boundaries; anything beyond it requires our prior written agreement under DPA Clause 5.3.

This Platform must not be used to store data about criminal allegations, charges, or convictions relating to any individual, unless we have agreed this with you in writing in advance.

If you work in a regulated healthcare profession, you are responsible for identifying your own correct regulator and meeting its record-keeping requirements; the bodies named here (such as the HCPC, BDA, or BACP) are examples, not an exhaustive or confirmed list for every profession, and not every nutritionist, therapist, or counsellor is necessarily regulated by these specific bodies. Where professional record-keeping requirements apply, the relevant clinical records must be held in a dedicated clinical records system, not on Tandem Dots.

This restriction exists because health data is special category data under Article 9 of the UK GDPR, requiring stricter safeguards than a general business platform provides. See also DPA Clause 5.

3. Social Media Scheduler Disclaimer

Our Platform integrates with third-party APIs for scheduling social media posts. While we aim for accurate scheduling, we cannot guarantee exact timing due to third-party API delays, platform restrictions, or outages beyond our control, and are not liable for missed or delayed posts caused by these factors. This clause does not exclude or limit our liability for loss caused by our own negligence or failure to properly configure the relevant integration.

4. Data Protection Responsibilities

You must comply with all applicable data protection laws, identify and rely on an appropriate lawful basis under UK GDPR before processing your contacts' personal data, and an appropriate Article 9 condition for any special category data, and not upload personal data unless you have the legal right to do so.

5. Security and Account Responsibility

You are responsible for maintaining the confidentiality and security of all account credentials, ensuring only authorised individuals access the Platform, and managing the access levels of your Authorised Users. Login credentials must not be shared between individuals.

You must immediately notify Tandem Dots of any suspected unauthorised access or security breach. You are liable for all actions taken under your account unless you have informed us of a security breach, or unless the unauthorised activity resulted from our own negligence, security failure, or failure to apply agreed security controls. Your responsibility does not end merely on notifying us; both parties must cooperate promptly to secure the account and credentials.

6. Breach Reporting and Response

You must notify Tandem Dots immediately if you suspect unauthorised access to your account or personal data processed via the Platform. We will promptly investigate and may temporarily suspend access where necessary to prevent further harm, keeping you informed of our findings.

7. Enforcement

Tandem Dots may suspend or terminate access without notice if you breach this Policy or our Terms & Conditions, violate UK law or third-party provider policies, or put Tandem Dots, our platform, or other clients at risk. Immediate action without notice is reserved for urgent risk, illegality, or serious breach; other enforcement follows the reasonable-assessment approach in Terms & Conditions Clause 12.7.

8. Updates to This Policy

We may update this Policy to reflect changes in law, platform functionality, or business needs, and will take reasonable steps to notify you of material changes. Material changes that adversely affect an annual prepaid customer's use of a Core Feature are treated in line with Terms & Conditions Clause 12.6, rather than by continued use alone. The latest version is always available at tandemdots.com/policies.

9. Contact Us

↑ Back to top

Tandem Dots Ltd ("we", "us", or "our") uses cookies and similar technologies on our website and platform to deliver core functionality, enhance your experience, and analyse how visitors use our services.

By using our website, you consent to the use of cookies as described in this policy.

1. What Are Cookies?

Cookies are small text files placed on your device (computer, tablet, mobile) when you visit a website. They help us to recognise your device, store preferences, and improve your browsing experience.

2. Types of Cookies We Use

Cookie Type	Purpose
Essential Cookies	Required for the operation of our site (e.g. login, navigation, security).
Functional Cookies	Store your preferences (e.g. region, language, settings).
Analytics Cookies	Help us understand how users interact with our website (e.g. via Google Analytics).
Marketing Cookies	Track your browsing to show relevant advertising or content (e.g. Meta Pixel).

We do not use cookies to collect sensitive personal data or share personal data with third parties for resale.

3. Third-Party Cookies

Some cookies are set by third-party services integrated with our platform, including:

• Google Analytics – traffic and usage data
• Meta (Facebook Pixel) – marketing and conversion tracking
• HighLevel – platform functionality and session management

Please review the privacy and cookie policies of these third parties for more information.

4. Managing Your Cookie Preferences

You can control or disable cookies through:

• Our cookie banner, which appears when you first visit our site
• Your browser settings, where you can block or delete cookies
• Opt-out tools such as youronlinechoices.com/uk

Note: Disabling essential cookies may impact the functionality of our website or platform.

5. Changes to This Policy

We may update this Cookies Policy from time to time. If we make significant changes, we will notify you via a banner or email (where appropriate). The latest version will always be available on this page.

6. Contact Us

↑ Back to top