These Terms of Service (the Terms) govern access to and use of the Heading platform, the Heading API, our documentation and any related services (together, the Services) provided by Heading AI Limited, a company registered in England and Wales with company number 17241813 whose registered office is at 124-128 City Road, London, England, EC1V 2NX (Heading, we, us or our).
Please read these Terms carefully. By creating an account, clicking to accept these Terms, or accessing or using the Services, you agree to be bound by them. If you are accepting on behalf of a company or other organisation, you confirm that you have authority to bind that organisation, and you and Customer in these Terms refer to that organisation.
The Services are provided for business use only. We do not offer the Services to consumers, and you confirm that you are using the Services in the course of a business, trade or profession.
If you do not agree to these Terms, you must not use the Services.
1. The agreement between us
1.1 The agreement between you and Heading (the Agreement) consists of: (a) any order form, online plan selection or checkout page that identifies the Plan you have purchased (an Order); (b) these Terms; (c) our Data Processing Terms in Schedule 1; (d) our AI Policy; and (e) our Privacy Policy, each as updated from time to time.
1.2 If there is any conflict between those documents, they apply in the order listed above, except that Schedule 1 takes precedence over these Terms in relation to the processing of personal data.
1.3 Our Documentation describes how the Services work and what each Plan includes. The Documentation is available at docs.useheading.com and forms part of the Agreement to the extent it describes features, usage limits and technical requirements.
2. Definitions
In these Terms the following words have the following meanings:
Account means the Heading account created for you and your Authorised Users.
Authorised User means an employee, contractor or agent of yours whom you allow to use the Services through your Account.
Beta Services means any feature, product or version of the Services that we identify as beta, preview, early access, pilot, trial or similar, including the private and public beta of the Heading platform.
Client means, where you are an agency or consultancy, a client of yours on whose behalf you use the Services.
Connected Data means data that we obtain from a third-party source you connect to the Services, such as a Google Analytics 4 property, a server log stream or another integration.
Customer Data means the data, content and materials that you or your Authorised Users submit to the Services, including brand names, competitor names, domains, prompt portfolios, objectives, tasks and any documents or messages you upload or enter, together with Connected Data.
Documentation means the user documentation for the Services that we publish from time to time.
Fees means the fees payable for the Services as set out in an Order or on our pricing pages.
Outputs means the results, analyses, visibility scores, reports, summaries, recommendations, agent responses and other material generated by the Services for you, including AI Answers.
AI Answers means the responses, citations and related metadata that the Services collect from Third-Party Platforms (whether directly or through third-party data providers) when running the prompts in your portfolio.
Plan means the subscription plan and any add-ons you have selected, together with the associated usage limits.
Property means a website, domain or brand that you register in the Services for tracking and analysis.
Subscription Term means the period of your subscription set out in an Order, including any renewal periods.
Third-Party Platforms means the AI assistants, AI search engines and other services operated by third parties whose responses the Services track, monitor or integrate with, such as ChatGPT, Perplexity, Google AI Overviews, Google AI Mode, Gemini and Microsoft Copilot. The Third-Party Platforms we support may change from time to time.
Usage Data means data about how the Services are accessed and used, including feature usage, performance metrics and technical logs, but excluding the content of Customer Data.
4. Beta Services
4.1 During the beta period, and in relation to any other Beta Services, you acknowledge that the Services are still in development. Beta Services may contain errors, may be incomplete, may change materially or be withdrawn without notice, and may not operate with the reliability, availability or security of a generally available service.
4.2 Beta Services are provided on an "as is" and "as available" basis, without any warranty of any kind, and we may limit, suspend or end your access to Beta Services at any time.
4.3 We may reset, delete or migrate Customer Data and Outputs held in Beta Services at the end of the beta period or on moving to a generally available version, and we are not obliged to retain that data. You should export anything you wish to keep.
4.4 If you give us feedback, suggestions or ideas about the Beta Services or any other part of the Services (Feedback), you agree that we may use that Feedback freely and without obligation to you, and you assign to us all rights in the Feedback.
4.5 Unless an Order states otherwise, no Fees are payable for Beta Services. Where Beta Services are provided free of charge, our total liability to you in relation to them is limited as set out in clause 18.
5. Plans, Fees and payment
5.1 The Services are provided under the Plan set out in your Order. Plans are priced per Property (for brands) or per Client (for agencies), and may include add-ons such as Agency Ops. The features and usage limits included in each Plan (including the number of tracked prompts, models and Properties) are described on our pricing pages and in the Documentation.
5.2 Unless an Order states otherwise, Fees are stated in US dollars, are exclusive of VAT and other applicable taxes, and are payable annually in advance. Fees are collected through our third-party payment processor (Stripe) and you authorise us to charge the payment method you provide for all Fees due.
5.3 Your subscription will renew automatically at the end of each Subscription Term for a further period of the same length, unless you cancel it before the renewal date or we give you at least 30 days' notice of non-renewal before the end of the current Subscription Term. You can cancel at any time before the renewal date through your Account settings or by emailing us at support@useheading.com, and cancellation will take effect at the end of the current Subscription Term.
5.4 We may change the Fees for a Plan with effect from the start of the next Subscription Term by giving you at least 30 days' notice before renewal. If you do not accept the new Fees you may cancel before the renewal date.
5.5 If you upgrade your Plan or add Properties, Clients or add-ons during a Subscription Term, the additional Fees will be charged on a pro rata basis for the remainder of that Subscription Term. Downgrades take effect from the start of the next Subscription Term.
5.6 If you exceed the usage limits of your Plan, we may ask you to upgrade, may charge for the excess at our then-current rates, or may limit the excess usage.
5.7 Except where these Terms expressly say otherwise or the law requires, Fees are non-refundable and Subscription Terms cannot be cancelled early.
5.8 If any Fees are not paid when due we may, after giving you notice, charge interest at 4% a year above the Bank of England base rate from the due date until payment and suspend the Services until all outstanding Fees are paid. Suspension does not relieve you of your obligation to pay.
5.9 You are responsible for any taxes, currency conversion charges or bank fees that apply to your payment, other than taxes on our income.
6. Agencies and Clients
6.1 If you are an agency or consultancy, you may use the Services to provide AI search services to your Clients, including by setting up a separate Plan, workspace or Property for each Client and sharing Outputs and reports with them.
6.2 You confirm that you have authority from each Client to register its Properties, connect its Connected Data (including any Google Analytics 4 property or server log stream) and use its Customer Data in the Services, and that you have given each Client any notices and obtained any consents required by law.
6.3 You are responsible for your Clients' access to and use of the Services and Outputs, and for any Client personnel you invite into your workspace as Authorised Users.
6.4 Where your Plan includes white-labelling functionality, you may apply your own branding and domain to the Services and to Outputs, remove or replace Heading branding, and make the Services, client dashboards and reports available to your Clients under your own brand (White-Label Use). Otherwise, you may not resell, sublicense or provide access to the Services on a standalone basis, other than as part of the services you provide to your Clients under this clause 6.
6.5 If your relationship with a Client ends, you may ask us to transfer that Client's Property and associated Customer Data to a separate Account controlled by the Client. We will use reasonable efforts to do so, subject to the Client accepting these Terms and any Fees due.
6.6 Where you make White-Label Use of the Services: (a) you are solely responsible for your relationship with your Clients and for any commitments, service levels, warranties or representations you make to them about the Services, none of which bind us; (b) you must ensure that your Clients, and any Client personnel given access to the Services, use the Services in accordance with clause 10; (c) you are responsible for providing support to your Clients, and we will provide support to you only; (d) you warrant that you have the right to use any branding, domains and content you apply to the Services, and that they do not infringe any third party's rights; (e) you are responsible for giving your Clients and their personnel any privacy information required by law in relation to their use of the Services; and (f) White-Label Use does not transfer to you or your Clients any rights in the Services, which remain ours under clause 13.
7. The Services
7.1 We will provide the Services in accordance with the Documentation, using reasonable skill and care.
7.2 The Services work by running the prompts in your portfolio against Third-Party Platforms (whether directly or through third-party data providers), collecting AI Answers, identifying brands, citations and sources within them, and analysing that information over time. We do not own, operate or control any Third-Party Platform or any such data provider. AI Answers reflect what a Third-Party Platform returned at a particular time and place and may not be reproducible, may differ from what an individual user would see, and may change without notice.
7.3 Third-Party Platforms may change their models, interfaces, terms or availability at any time. Where that affects the Services, we may change the models or platforms we support, adjust how we collect AI Answers or withdraw a feature, and we will not be in breach of the Agreement as a result. We will tell you about material changes where reasonably practicable.
7.4 Crawler analytics and traffic analytics depend on the Connected Data you supply. A crawler request or a referral is an observation about access or traffic. It is not evidence that your content appeared in an AI answer, was cited, or led to a sale.
7.5 We may change, improve or discontinue features of the Services from time to time, provided that we do not materially reduce the core functionality of your Plan during a paid Subscription Term without giving you the right to terminate under clause 20.5.
7.6 We will use reasonable efforts to keep the Services available, but we do not guarantee any particular level of availability unless an Order includes a service level commitment. The Services may be unavailable during maintenance, because of problems with Third-Party Platforms or hosting providers, or for reasons outside our control.
7.7 Support is available by email at support@useheading.com and through the Documentation. We aim to provide an initial response to support requests within three business days, unless otherwise agreed in an Order.
8. Connected Data and integrations
8.1 The Services allow you to connect third-party accounts and data sources, such as a Google Analytics 4 property or a server log stream. When you connect a source, you authorise us to access, retrieve and process the relevant Connected Data for the purpose of providing the Services to you.
8.2 You are responsible for making sure you have the right to connect each source and share the Connected Data with us, including any rights required from your Clients, your hosting or CDN provider, or the operator of the third-party service.
8.3 Our use of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. We use Google Analytics data only to provide and improve the traffic analytics features you have requested.
8.4 Server log data may include the IP addresses and other technical data of visitors to your website. We process that data only to identify and report on crawler and referral activity, in accordance with Schedule 1.
8.5 You may disconnect a source at any time from your Account. We may suspend or remove an integration if the third-party service changes, if we reasonably believe the connection breaches these Terms or the third party's terms, or for security reasons.
9. Customer Data and Usage Data
9.1 You retain all rights in your Customer Data. You grant us a non-exclusive, worldwide, royalty-free licence to host, copy, process, transmit and display Customer Data as necessary to provide, secure, support and improve the Services and to comply with the law, subject always to clause 9.4.
9.2 You are responsible for the accuracy, quality and legality of your Customer Data and for the means by which you acquired it. You confirm that your Customer Data does not infringe any third party's rights and that you have the right to track the brands, competitors and domains you enter into the Services.
9.3 We may collect and use Usage Data, and may create aggregated or anonymised statistics, benchmarks and insights derived from Customer Data, AI Answers and Outputs, provided that they do not identify you, your Clients or any individual. We own that aggregated and anonymised material and may use it for any purpose, including to improve the Services and publish industry insights.
9.4 We will maintain appropriate administrative, physical and technical safeguards to protect Customer Data, as described in Schedule 1. We do not sell Customer Data and we do not use Customer Data to train or fine-tune general-purpose AI models, including large language models.
9.5 You are responsible for maintaining your own backups of Customer Data and Outputs. The Services allow you to export reports and data, and you should do so regularly.
10. Acceptable use
10.1 You must not, and must not allow anyone else to:
use the Services in breach of any law, regulation or third party right, including data protection, privacy, competition and intellectual property laws;
use the Services to monitor, profile or track individual people, rather than brands, products, organisations and topics;
upload or enter any Customer Data that is unlawful, defamatory, infringing or harmful, or that contains special category personal data or financial account details;
access or use the Services by any automated means other than through the Heading API in accordance with clause 11, or scrape, crawl or harvest data from the Services;
copy, modify, adapt, translate, reverse engineer, decompile or disassemble any part of the Services, or attempt to discover their source code or underlying models, prompts or methods, except to the extent permitted by law;
use the Services or Outputs to build, train or improve a product or service that competes with the Services;
rent, lease, sell, sublicense or otherwise make the Services available to third parties, except as permitted under clause 6;
circumvent or interfere with any usage limit, security feature or access control of the Services;
introduce any virus, malware or other harmful code into the Services, or attempt to gain unauthorised access to the Services or our systems;
use the Services in a way that places an unreasonable load on our infrastructure or on any Third-Party Platform, or that would cause us to breach the terms of a Third-Party Platform;
use the Services to generate or distribute spam, deceptive content or manipulative content intended to mislead Third-Party Platforms or their users; or
remove or alter any proprietary notice, branding or attribution in the Services or Outputs, except as permitted by White-Label Use under clause 6.4.
10.2 We may investigate any suspected breach of this clause and may suspend or terminate access as set out in clause 20.
11. The Heading API
11.1 Where your Plan includes API access, we grant you a non-exclusive, non-transferable licence to use the Heading API to access your Customer Data and Outputs and to integrate the Services with your own systems, in accordance with the API documentation.
11.2 You are responsible for keeping your API keys secure. We may apply rate limits and other usage limits to the API and may change the API from time to time. We will give reasonable notice of changes that are likely to break existing integrations, where practicable.
11.3 You must not use the API to circumvent your Plan limits, to provide the Services to third parties in breach of clause 6 or clause 10, or in a way that we reasonably consider abusive.
12. AI features and Outputs
12.1 The Services use artificial intelligence, including large language models provided by third parties, to analyse AI Answers, assess sentiment and brand perception, classify crawler activity, generate summaries and recommendations, and power the Heading Agent. Our AI Policy explains how we use AI and what data is involved. It forms part of the Agreement.
12.2 Outputs are generated automatically and may be inaccurate, incomplete or out of date. Outputs are provided to help you investigate and decide; they are not a substitute for your own judgement or for professional advice, and you should review Outputs before relying on them or acting on them.
12.3 We do not guarantee that use of the Services will cause your brand to appear in, be recommended by or be cited by any Third-Party Platform, or will improve your visibility, traffic, conversions or revenue. Visibility in AI answers depends on factors outside our control.
12.4 Outputs may be similar or identical to outputs generated for other customers, and we do not warrant that Outputs are unique. Outputs may reproduce or summarise content from Third-Party Platforms and third-party websites, and you are responsible for your use of that content.
12.5 Where the Services produce content for you to publish, you are responsible for reviewing it, for its accuracy, and for complying with any disclosure or labelling requirements that apply to AI-generated content in your jurisdiction.
13. Intellectual property
13.1 We and our licensors own all intellectual property rights in the Services, the Documentation, our models, prompts, methods, software, designs and branding, and any improvements to them. Apart from the rights expressly granted in the Agreement, you acquire no rights in the Services.
13.2 Subject to your compliance with the Agreement and payment of the Fees, we grant you a non-exclusive, non-transferable licence during the Subscription Term to access and use the Services and the Documentation for your internal business purposes and, where clause 6 applies, to provide services to your Clients.
13.3 You may use, copy and share Outputs for your own business purposes and those of your Clients, including in reports and presentations. We do not claim ownership of Outputs, but you acknowledge that Outputs may include material owned by third parties and material that we use across the Services.
13.4 You may not use our name, logo or trade marks without our prior written consent. We may identify you as a customer, using your name and logo, in our marketing materials, unless you ask us not to. We will not identify any of your Clients as our customer in our marketing materials without your consent.
14. Confidentiality
14.1 Each of us will keep the other's Confidential Information confidential, use it only for the purposes of the Agreement, and not disclose it to anyone other than its employees, advisers and contractors who need to know it and are bound by equivalent obligations. Confidential Information means information disclosed by one party to the other that is marked as confidential or that a reasonable person would consider confidential, and includes Customer Data, the non-public parts of the Services, and the commercial terms of an Order.
14.2 Confidential Information does not include information that is or becomes public through no fault of the recipient, that the recipient already knew, that is independently developed, or that is received from a third party free of any duty of confidence. A party may disclose Confidential Information where required by law or a court, after giving the other party notice where lawful.
14.3 This clause continues for three years after the end of the Agreement.
15. Data protection
15.1 Each of us will comply with applicable data protection law, including the UK General Data Protection Regulation, the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation.
15.2 Where we process personal data on your behalf as part of the Customer Data (for example, IP addresses in server logs, or personal data that appears incidentally in AI Answers), you are the controller and we are your processor, and Schedule 1 applies.
15.3 We are the controller of personal data relating to you and your Authorised Users that we collect for our own purposes, such as account, billing, support and marketing data. Our Privacy Policy explains how we handle that data.
16. Third-party services
16.1 The Services rely on Third-Party Platforms, hosting providers, payment processors and other third-party services. We are not responsible for the availability, accuracy, content, terms or conduct of any third-party service, and your use of a third-party service is subject to that third party's terms.
16.2 The Services may contain links to third-party websites, including the sources cited in AI Answers. We do not control or endorse those websites and are not responsible for their content.
17. Warranties and disclaimers
17.1 Each party warrants that it has the authority to enter into the Agreement.
17.2 We warrant that the Services will perform materially in accordance with the Documentation during a paid Subscription Term. If they do not, your remedy is for us to use reasonable efforts to correct the non-conformity and, if we cannot do so within a reasonable time, for you to terminate the affected Plan and receive a pro rata refund of prepaid Fees for the remainder of the Subscription Term. This warranty does not apply to Beta Services.
17.3 Except as expressly set out in the Agreement, and to the fullest extent permitted by law, the Services and Outputs are provided without any warranty, condition or representation, whether express or implied, including any implied terms of satisfactory quality, fitness for a particular purpose or non-infringement. We do not warrant that the Services will be uninterrupted, error-free or secure, that Outputs will be accurate or complete, or that the Services will meet your requirements.
18. Limitation of liability
18.1 Nothing in the Agreement limits or excludes either party's liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot be limited or excluded by law.
18.2 Subject to clause 18.1, neither party will be liable to the other, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for any: (a) loss of profit, revenue, business, contracts or anticipated savings; (b) loss of or damage to goodwill or reputation; (c) loss or corruption of data, other than as provided in Schedule 1; (d) costs of substitute services; or (e) indirect, special or consequential loss, in each case even if the party was aware of the possibility of such loss.
18.3 Subject to clauses 18.1 and 18.2, each party's total aggregate liability arising out of or in connection with the Agreement in any 12-month period will not exceed the greater of (a) the total Fees paid or payable by you to us in the 12 months immediately before the event giving rise to the claim; and (b) USD 1,000.
18.4 Subject to clause 18.1, our total aggregate liability arising out of or in connection with any Beta Services provided free of charge will not exceed USD 500.
18.5 The limits in this clause 18 do not apply to your obligation to pay Fees or to your liability under clause 19.
18.6 You acknowledge that the Fees reflect this allocation of risk and that we would not provide the Services on these terms without it.
19. Indemnity
19.1 You will indemnify us and our officers, employees and contractors against all liabilities, costs, damages and expenses (including reasonable legal fees) arising out of or in connection with any third-party claim relating to (a) your Customer Data or Connected Data, including any claim that we did not have the right to receive or process it; (b) your use of the Services or Outputs in breach of the Agreement or applicable law; or (c) a claim by any of your Clients relating to the services you provide to them, including through White-Label Use.
19.2 We will indemnify you against all liabilities, costs, damages and expenses (including reasonable legal fees) arising out of any third-party claim that your use of the Services in accordance with the Agreement infringes that third party's intellectual property rights in the United Kingdom, provided that you notify us promptly, give us sole control of the defence and settlement, and give us reasonable assistance. This indemnity does not apply to claims arising from Customer Data, Connected Data, Outputs, Third-Party Platforms or Beta Services, or from your modification of the Services or use in breach of the Agreement. If a claim is made or likely, we may modify or replace the Services to avoid the infringement or, if that is not reasonably possible, terminate the affected Plan and refund prepaid Fees for the remainder of the Subscription Term. This clause states your sole remedy for infringement claims.
20. Term, suspension and termination
20.1 The Agreement starts when you first accept these Terms and continues until all your Plans have expired or been terminated.
20.2 Either party may terminate the Agreement or any Plan immediately by written notice if the other party commits a material breach which is not remedied within 30 days of notice requiring it to be remedied, or becomes insolvent, enters administration or liquidation, or ceases to carry on business.
20.3 We may suspend your access to the Services, or to part of them, on notice if: (a) you fail to pay Fees when due; (b) we reasonably believe you or an Authorised User have breached clause 10; (c) your use presents a security risk or threatens the integrity of the Services or a Third-Party Platform; or (d) we are required to do so by law. We will restore access once the issue is resolved.
20.4 You may cancel a Plan at any time with effect from the end of the current Subscription Term. You may close your Account at any time, but Fees for the remainder of the Subscription Term remain payable unless the Agreement provides otherwise.
20.5 If we make a change to the Services or these Terms that materially reduces the core functionality of your Plan or materially disadvantages you during a paid Subscription Term, you may terminate the affected Plan on written notice within 30 days of the change and we will refund the prepaid Fees for the remainder of the Subscription Term.
20.6 On termination or expiry: (a) your right to use the Services ends; (b) you must pay any Fees that are outstanding; (c) you may export your Customer Data and Outputs for 30 days, after which we may delete them, subject to Schedule 1 and our retention obligations; and (d) any clause which is intended to survive, including clauses 4.4, 9.3, 13, 14, 15, 18, 19, 20.6 and 22, will continue to apply.
21. Changes to these Terms
21.1 We may update these Terms from time to time, for example to reflect changes in the Services, the law or our business. We will post the updated Terms on our website and, for material changes, notify you by email or through the Services at least 30 days before they take effect.
21.2 Your continued use of the Services after the changes take effect constitutes acceptance of the updated Terms. If you do not agree, you may terminate under clause 20.5.
22. General
22.1 Assignment. You may not assign or transfer the Agreement without our prior written consent. We may assign or transfer the Agreement to an affiliate or to a purchaser of our business, and may subcontract our obligations, provided we remain responsible for our subcontractors.
22.2 Force majeure. Neither party is liable for any failure or delay caused by events outside its reasonable control, including failures of Third-Party Platforms, hosting providers or the internet, provided it takes reasonable steps to mitigate the effect.
22.3 Notices. Notices must be in writing. Notices to us should be sent to support@useheading.com or such other address as we notify to you. Notices to you will be sent to the email address on your Account. Notices are treated as received when sent by email to the correct address, unless a bounce or error message is received.
22.4 Entire agreement. The Agreement is the entire agreement between us in relation to its subject matter and supersedes any previous discussions, arrangements or agreements. Each party acknowledges that it has not relied on any statement or representation not set out in the Agreement.
22.5 Waiver and severance. A failure or delay in exercising any right is not a waiver of it. If any part of the Agreement is found to be invalid or unenforceable, the rest continues in force.
22.6 Third parties. Except as expressly stated, no one other than you and Heading has any right to enforce any term of the Agreement.
22.7 Relationship. Nothing in the Agreement creates a partnership, joint venture, agency or employment relationship between us.
22.8 Governing law and jurisdiction. The Agreement, and any dispute or claim arising out of or in connection with it, is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
23. Contact
If you have any questions about these Terms, please contact us at support@useheading.com or write to Heading AI Limited, 124-128 City Road, London, England, EC1V 2NX.
Schedule 1: Data Processing Terms
These Data Processing Terms apply where Heading processes personal data on behalf of the Customer in the course of providing the Services. Terms defined in the Terms of Service have the same meaning here. Data Protection Law means the UK GDPR, the Data Protection Act 2018 and, where applicable, the EU GDPR and any laws implementing or supplementing them. Sub-processor means a third party engaged by Heading to process Customer Personal Data.
1. Details of the processing
| Subject matter | Processing of personal data contained in Customer Data and Connected Data to provide the Services. |
|---|---|
| Duration | The Subscription Term and the period after termination during which data is retained under the Terms. |
| Nature and purpose | Hosting, storing, analysing and reporting on Customer Data, including matching server log entries to crawler and referral activity, analysing GA4 data, collecting AI Answers from Third-Party Platforms (directly or through third-party data providers) and analysing them, and providing the Heading Agent and reporting features. |
| Types of personal data | IP addresses, user agents, request paths, referrers, timestamps and similar technical data from server logs; aggregated and event-level analytics data from Google Analytics 4 as configured by the Customer; names, roles and contact details of Customer and Client personnel entered into the Services; names of individuals that appear incidentally in AI Answers, cited web pages, prompts or documents entered by the Customer. |
| Categories of data subjects | Visitors to the Customer's and its Clients' websites; the Customer's and its Clients' personnel; individuals mentioned in AI Answers, web content or materials entered into the Services. |
2. Roles and instructions
2.1 The Customer is the controller (or, where it is an agency acting for a Client, a processor acting on the Client's instructions) and Heading is the processor of Customer Personal Data.
2.2 Heading will process Customer Personal Data only on the Customer's documented instructions, which are set out in the Agreement and in the Customer's configuration and use of the Services, unless required to do otherwise by law, in which case Heading will inform the Customer before processing unless the law prevents it. Heading will tell the Customer if it believes an instruction infringes Data Protection Law.
2.3 The Customer is responsible for ensuring it has a lawful basis for the processing, for giving any notices and obtaining any consents required, and for the accuracy and lawfulness of the Customer Personal Data it provides or connects. The Customer will not provide special category personal data to the Services.
3. Heading's obligations
3.1 Heading will ensure that persons authorised to process Customer Personal Data are bound by obligations of confidentiality.
3.2 Heading will implement appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, including encryption of data in transit and at rest, access controls, logging, backups and secure development practices, as described in the Documentation and updated from time to time.
3.3 Heading will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, and will provide the information reasonably required to enable the Customer to meet its own notification obligations.
3.4 Taking into account the nature of the processing, Heading will assist the Customer by appropriate technical and organisational measures in responding to data subject requests, and will assist the Customer with data protection impact assessments and consultations with supervisory authorities where required, taking into account the information available to Heading. Heading may charge reasonable fees for assistance that goes beyond the functionality of the Services.
3.5 On termination of the Agreement, Heading will delete or return Customer Personal Data in accordance with clause 20.6 of the Terms, unless retention is required by law.
3.6 Heading will make available the information reasonably necessary to demonstrate compliance with this Schedule and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, no more than once a year on at least 30 days' notice, during business hours, subject to reasonable confidentiality and security requirements. Heading may satisfy this obligation by providing a summary of a recent third-party audit or security assessment.
4. Sub-processors
4.1 The Customer authorises Heading to engage Sub-processors, including those listed in the sub-processor list published at docs.useheading.com/legal/sub-processors (the Sub-processor List), as at the date of the Agreement and as updated from time to time in accordance with paragraph 4.2. The Sub-processor List identifies each Sub-processor and the nature of its processing, and may include providers of hosting and infrastructure, databases and storage, AI models and AI gateway services, third-party data collection, payment processing, email and communications, background job processing, and product analytics and error monitoring.
4.2 Heading will give the Customer at least 14 days' notice (by email, through the Services or by updating the Sub-processor List) before adding or replacing a Sub-processor. If the Customer objects on reasonable data protection grounds within that period and the parties cannot resolve the objection, the Customer may terminate the affected Plan and Heading will refund prepaid Fees for the remainder of the Subscription Term.
4.3 Heading will impose data protection obligations on each Sub-processor that are no less protective than those in this Schedule and remains responsible for the acts and omissions of its Sub-processors.
5. International transfers
5.1 Heading may process Customer Personal Data outside the United Kingdom and the European Economic Area, including in the United States. Where it does so, Heading will ensure that the transfer is covered by an adequacy regulation or decision, the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or another transfer mechanism recognised under Data Protection Law, and will provide details on request.
6. Liability
6.1 Each party's liability under this Schedule is subject to the exclusions and limits in clause 18 of the Terms, except to the extent that Data Protection Law does not permit liability to be limited.