GDPR Terms & Conditions

1. Definitions

• "Company" refers to Cox Impact Marketing Ltd.
• "Client" refers to any business or individual who engages the Company's services.
• "Data Subject" refers to any individual whose personal data is processed.
• "Personal Data" means any information relating to an identified or identifiable individual.
• "Processing" means any operation performed on personal data including collection, storage, use, or disclosure.

2. Scope of Data Use

Cox Impact Marketing Ltd exclusively processes personal data provided by the Client for the purpose of B2C lead generation and telesales campaigns. The Company does not independently source or collect personal data.

3. Client Obligations

By engaging our services, the Client confirms and warrants that:

• All personal data provided has been collected lawfully and ethically.
• Each Data Subject has given informed, affirmative consent for direct marketing.
• Privacy notices have been issued to all Data Subjects in line with GDPR.
• Data is accurate, up-to-date, and relevant for the intended campaign.

The Client assumes full legal responsibility for the GDPR compliance of the data provided and agrees to indemnify the Company against any related claims or regulatory action.

4. Company Responsibilities

Cox Impact Marketing Ltd shall:

• Only process data based on written instructions from the Client.
• Not use, share, or sell any data for unauthorised purposes.
• Maintain secure storage and access protocols for all personal data.
• Ensure all employees handling data are trained in GDPR compliance.
• Not subcontract data processing without prior written Client approval.

5. Data Retention & Deletion

• Personal data will only be retained for the duration of the campaign.
• All data will be securely deleted within 30 days of contract termination, unless otherwise instructed.

6. Data Subject Rights

The Company assists Clients in complying with the rights of Data Subjects under GDPR, including:

• Right of access
• Right to rectification
• Right to erasure (right to be forgotten)
• Right to restrict processing
• Right to object
• Right to data portability

Any direct requests received from Data Subjects will be forwarded immediately to the Client.

7. Breach Notification

In the event of a data breach involving personal data:

• The Company will notify the Client without undue delay.
• We will assist in investigation, mitigation, and resolution.
• All necessary documentation will be provided to support regulatory reporting.

8. International Data Transfers

No data will be transferred outside the UK or EEA unless:

• The Client provides written consent, and
• The recipient country provides adequate data protection measures under GDPR.

9. Audit Rights

The Client may request an audit of the Company's data protection procedures, subject to:

• Minimum 10 business days' notice
• Reasonable scope and timing
• Execution during normal business hours

10. Amendments

These Terms may be updated to reflect changes in legal, regulatory, or internal policy requirements. The Client will be notified of any material changes in writing.

11. Governing Law

These Terms are governed by the laws of England and Wales. Any disputes will be subject to the exclusive jurisdiction of the courts of England and Wales.

12. Contact

For all GDPR-related inquiries or concerns, please contact: