Data Sharing Terms

1. Scope and precedence

1.1 These Data Sharing Terms form part of our Terms and Conditions. They apply whenever you unlock, export, verify or receive business records through the website, the dashboard or the API, and whenever we process personal data on your behalf as part of the Service.

1.2 If these terms conflict with the Terms and Conditions on the protection of personal data, these terms apply. Words defined in the Terms and Conditions have the same meaning here. “Shared Data” means the personal data contained in Business Records you obtain from us. “Customer Personal Data” means personal data in Customer Content that we process on your behalf.

2. Roles of the parties

2.1 MIRA NOVUM LTD (company number 17465260, ICO registration number: registration in progress) is the controller of the business database it compiles from public business websites, the structured data published on those websites, official business registers and AI analysis. When you obtain Business Records, you become an independent controller of the Shared Data. We do not process Shared Data on your behalf and you do not process it on ours, so for Shared Data these are controller to controller terms, not an Article 28 processing agreement. We are not joint controllers.

2.2 Where we process Customer Personal Data to provide a service to you, such as verifying a list you upload, sending campaigns from mailboxes you connect, logging outcomes on the Outreach Desk, synchronising records to a CRM you connect or running AI features on your instructions, we act as your processor and the processor terms below apply.

2.3 Separately from that processing, we are an independent controller of the technical delivery results of campaigns sent through the Service (acceptance by the receiving side, bounce codes and short error excerpts, and whether a reply or automatic reply came back from an address, and where switched on the signature details of replies). We use them only to keep our business database accurate, as set out in our Privacy Policy, never to show your campaigns or replies to anyone else, and you agree that we may use them for that purpose.

3. Our responsibilities as controller

3.1 We will: compile only business-context information that businesses publish; give the transparency information required by Article 14 of the UK GDPR in our notice Data Sources and Your Rights; maintain a legitimate interests assessment and review it at least once a year; run a free removal, restriction and correction process verified through the business’s own email; keep a suppression list so removed records are not collected or supplied again; and exclude suppressed records, removed records and businesses whose verified owner chose a no-sales label from search, exports and the API.

3.2 We will mask contact details on public pages, ask every customer to confirm their obligations before they obtain data, keep records of those confirmations, keep the database secure and keep each record’s last checked date.

4. Your responsibilities as controller

4.1 You will: have your own lawful basis for each use of Shared Data and carry out your own legitimate interests assessment where you rely on legitimate interests; give the people concerned the information required by Article 14 of the UK GDPR, naming us as the source, at the latest in your first communication or within one month; identify yourself in every message; include a working opt-out; honour objections and keep them on your own suppression list; screen numbers against TPS and CTPS before marketing calls; respond to rights requests you receive; use Shared Data only for the purposes allowed by your licence; keep it accurate and secure; and delete it when you no longer need it.

4.2 You will not use Shared Data in a way that is incompatible with the purposes described in our notice Data Sources and Your Rights, in particular for consumer marketing, profiling individuals or decisions with legal or similarly significant effects on them.

5. Objections, removals and suppression

5.1 When a business or individual asks us to remove their details, we stop supplying them. If you hold an earlier copy, you must honour any objection the person sends you directly, and if we tell you that a person has objected or asked for erasure, you will consider their request promptly and act on it where the law requires.

5.2 Whether you export, unlock or use the API, you will apply every removal, objection and suppression we notify to you within 7 days, delete the records we tell you were removed, and pass the notice on to anyone you were allowed to share the data with. We notify you so that we meet our duties under Articles 17(2) and 19 of the UK GDPR.

5.3 You can upload your own suppression lists so those businesses are excluded from future exports and never charged. API customers must also pass suppression and opt-out requests on to their own end customers.

5.4 Prohibited purposes. You will not use Shared Data for marketing to consumers, people search or tracing, resale outside a data API licence, profiling of individuals, or any decision about a person’s eligibility for credit, employment, housing, insurance or a similar service. We are not a consumer reporting agency, and Shared Data must never be used as a consumer report.

5.5 Security, checks and misuse. You will keep exported and stored Shared Data secure, with access controls and never on a publicly accessible server or bucket. We may place in the data we supply control addresses that we own, to detect misuse; they are not real business contacts. On reasonable request you will tell us how you use and protect Shared Data. We may suspend supply if we reasonably suspect unlawful use, and we may report suspected unlawful use to the ICO or another regulator.

6. Rights requests and complaints

6.1 Each party is responsible for answering the rights requests and complaints it receives about its own processing. If a request or complaint received by one party concerns the other party’s processing, it will pass it on without undue delay, and in any case within 5 working days, to [email protected] or to the email address on your Account, and tell the person that it has done so where appropriate.

7. Security

7.1 Each party will protect the Shared Data it holds with appropriate technical and organisational measures, considering the nature of the data and the risks, including access controls, encryption where appropriate, staff confidentiality and secure deletion. You will not store Shared Data in publicly accessible places or share login details or API keys.

8. Personal data breaches

8.1 If either party becomes aware of a personal data breach affecting Shared Data that is relevant to the other party, it will tell the other without undue delay, give the information reasonably needed for the other to meet its own obligations, and cooperate in limiting the effects. Each party is responsible for its own notifications to regulators and individuals.

9. International transfers

9.1 If you are outside the UK, or transfer Shared Data outside the UK, you are responsible for the transfer mechanism your use requires and for complying with the law of your country. Where we transfer personal data outside the UK, we rely on UK adequacy regulations or on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, with any additional measures the transfer needs.

9.2 By obtaining Shared Data from outside the UK you agree that, where a transfer mechanism is required, the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses (controller to controller) is incorporated by reference, with us as exporter, you as importer, the details in these terms completing its tables and the law of England and Wales governing it.

10. Onward sharing

10.1 You may not disclose Shared Data to anyone else except your own employees and contractors acting for you, your processors under a written contract that meets Article 28 of the UK GDPR, and, for API plans that allow it, your own end customers inside your product under terms at least as protective as these. Agencies acting for clients remain responsible for all use of the data as described in the Terms and Conditions.

11. Processor terms

11.1 This section applies when we process Customer Personal Data as your processor. The subject matter is the provision of the feature you use; the duration is the term of your Account; the nature and purposes are storage, verification, transmission, synchronisation and analysis needed for that feature; the types of personal data are contact details, message content (including the replies and social inbox messages that reach the accounts you connect, and the labels and snippets we keep for them), call outcomes and similar business contact data in your Customer Content; and the data subjects are the people in your lists, campaigns and connected systems.

11.2 We will: process Customer Personal Data only on your documented instructions, which are these Terms and your use of the features, unless the law requires otherwise, in which case we will tell you unless the law prevents it; make sure people authorised to process it are bound by confidentiality; apply appropriate security measures under Article 32 of the UK GDPR; give you reasonable help with rights requests, security, breach notification, impact assessments and consultations with the ICO, considering the information available to us; notify you without undue delay after becoming aware of a personal data breach affecting it; and make available the information reasonably needed to show compliance with this section.

11.3 At the end of the Service, or when you delete the relevant content, we will delete Customer Personal Data under our retention periods, unless the law requires us to keep it. You can download your content before you close your Account.

11.4 You are responsible for having a lawful basis for the Customer Personal Data you give us and for your instructions being lawful. If we believe an instruction breaks Data Protection Laws, we will tell you.

12. Sub-processors

12.1 You give us general authorisation to use sub-processors (for example hosting, storage, email delivery and email verification providers) to process Customer Personal Data. We will impose on them data protection obligations that are no less protective than these terms and remain responsible for them. We will make our current list of sub-processors available on request to [email protected] and tell you of any intended change by email or in the dashboard. You can object on reasonable data protection grounds within 14 days, and if we cannot address your objection you may stop using the affected feature or close your Account.

12.2 Our sub-processors at the date of these terms: the servers we run ourselves for hosting, the database and processing, and the object storage we configure for files; and, only where a feature runs on Mira Novum AI rather than your own AI key, the AI model services of Groq and Cloudflare (Workers AI), and of Google (the Gemini API) only on Google’s paid terms, under which Google does not use the content to improve its products. We do not send Customer Personal Data to any AI service whose terms let it use that content to train or improve its models. The United States providers are covered by the transfer safeguards in the section on international transfers. We will publish changes to this list as described above before they take effect.

12.3 Where you connect your own mailbox, CRM, messaging account or AI provider, that provider is engaged by you, not by us, and is not our sub-processor. Meta provides the Messenger, Instagram and WhatsApp services you connect under its own terms with you and with us, and is not our sub-processor for them.

13. Audits and information

13.1 On reasonable written notice, and no more than once a year unless a regulator requires it or there has been a personal data breach, we will answer a reasonable written questionnaire about our compliance with these terms. Any further audit must be agreed in advance, carried out at your cost, during business hours, without access to other customers’ data and under confidentiality.

14. Cooperation and regulators

14.1 Each party will give the other reasonable help with regulator enquiries and complaints that concern Shared Data, and will keep the records needed to show that it complies with these terms. Contact [email protected].

15. Liability and duration

15.1 Each party’s liability under these terms is subject to the limits and exclusions in the Terms and Conditions, except that nothing limits your obligations under the indemnity in the Terms and Conditions for your own use of Shared Data. These terms continue for as long as either party holds Shared Data or we process Customer Personal Data for you.