1. Parties
Data Controller:
FormationData Systems Ltd
10 Brooklands Court,
Kettering Venture Park,
Kettering
Northamptonshire
NN15 6FD
Company number: 16398949
Email: support@threepipers.com
Data Processor / Joint Controller (as applicable):
The Agent accepting this DPA ("Agent").
2. Purpose of Processing
The purpose of processing personal data under this DPA is to:
- Capture, qualify, track, and introduce leads
- Attribute introductions and commissions
- Communicate with leads in connection with services requested
Processing shall be limited strictly to IntroAgents-related activities.
3. Data Protection Roles
Unless otherwise agreed in writing:
- FormationData Systems Ltd acts as the primary Data Controller
- The Agent acts as:
- A Data Processor where acting on instructions from IntroAgents, or
- A Joint Controller where independently collecting lead data before submission
Nothing in this DPA permits the Agent to act as an independent controller for reuse of lead data.
4. Categories of Data
Personal data may include:
- Name
- Email address
- Telephone number
- Business details
- Enquiry details
- IP address and submission metadata
Special category data must not be submitted.
5. Lawful Basis & Consent
The Agent confirms and warrants that:
- All submitted leads have provided explicit, informed consent
- Consent covers:
- Contact by FormationData Systems Ltd
- Sharing data with trusted third-party service providers
- Where manual lead entry is enabled, the Agent will affirm consent via a mandatory declaration
IntroAgents may request evidence of consent at any time.
6. Agent Obligations
The Agent agrees to:
- Process personal data only for authorised purposes
- Follow IntroAgents' written instructions
- Maintain appropriate technical and organisational security measures
- Ensure staff and contractors are bound by confidentiality
- Not copy, export, sell, retain, or reuse lead data
- Not contact leads outside the IntroAgents platform unless authorised
7. Sub-Processing
Agents may not appoint sub-processors without prior written approval from IntroAgents.
8. Data Security
Agents must implement reasonable security measures including:
- Secure devices and passwords
- Restricted access
- Protection against unauthorised disclosure
Any suspected or actual data breach must be reported to IntroAgents within 24 hours.
9. ICO Registration
Where required by law, the Agent must:
- Hold a valid ICO registration
- Provide their ICO registration number on request
IntroAgents reserves the right to:
- Verify ICO status
- Suspend processing where ICO requirements are not met
10. Audits & Compliance
IntroAgents may:
- Conduct audits or compliance checks
- Request evidence of consent or processing practices
- Suspend or restrict access during investigations
Failure to cooperate may result in termination.
11. International Transfers
Agents must not transfer personal data outside the UK without prior written approval and appropriate safeguards.
12. Data Retention & Deletion
Upon:
- Termination of agent status, or
- Instruction from IntroAgents
The Agent must:
- Immediately cease processing
- Delete all personal data relating to IntroAgents leads
- Confirm deletion in writing if requested
13. Liability & Indemnity
The Agent agrees to indemnify IntroAgents Ltd against:
- GDPR fines or penalties
- Claims arising from unauthorised processing
- Breaches of this DPA
This includes legal costs.
14. Term & Termination
This DPA remains in force:
- While the Agent processes personal data on behalf of IntroAgents
- Termination of the Agent Terms automatically terminates this DPA.
15. Governing Law
This DPA is governed by the laws of England and Wales.
16. Acceptance
By registering as an Agent, ticking acceptance boxes, or submitting leads via the platform, the Agent confirms acceptance of this Data Processing Addendum.