Terms & Conditions

1. About Minutes Agency

Minutes Agency Ltd (company number 13948866) is registered in England and Wales. Our registered office is 103 Goldhawk House, 10 Beaufort Square, London, England, NW9 5SW. In these Terms, ‘Minutes’, ‘we’, ‘us’ and ‘our’ mean Minutes Agency Ltd. ‘You’ means the business purchasing our services or its authorised representative.

These Terms cover our business services, including TheMinutes App. Our Privacy Policy explains how we handle personal information for our own business. The Data Processing Agreement in section 12 covers personal data we process for clients.

2. Agreeing a contract

A service contract is formed when we and you accept an order, proposal or other written agreement that identifies the services and incorporates these Terms. Acceptance may be recorded electronically, including by an express email agreement or an acceptance step that clearly refers to these Terms. Anyone accepting for a business must have authority to bind it. The accepted version and any agreed variations form the contract.

Publishing these Terms or visiting our website does not, by itself, create a client service contract or constitute acceptance of the Data Processing Agreement. Existing clients must agree its incorporation into their contract before it governs their processing arrangement. A separate signature on the DPA is unnecessary if the agreement incorporating it is validly accepted and recorded.

3. Products and services

Our services include CRM access through TheMinutes App, smart websites, content creation, social media management, paid advertising, and agreed automation services. TheMinutes App uses the HighLevel platform, also known as GoHighLevel or GHL. We use Notion for project information and collaboration, and self-hosted n8n on UK-based hosting for automation. The tools and features used for your account depend on your agreed services and instructions.

The accepted order or proposal sets the scope, deliverables, fees, billing arrangements, subscription period and cancellation terms. Changes to that scope or charges require agreement. Third-party platform availability, permitted uses and feature restrictions may affect delivery; we will identify applicable requirements when arranging the service.

4. Access and lawful use

• Keep account credentials confidential, use available security controls, give access only to authorised users and tell us promptly about suspected unauthorised access.
• Use the services lawfully and provide accurate instructions, necessary permissions and content you are entitled to use. Do not resell or share account access without our written agreement.
• For customer data, determine and document the lawful basis, provide required privacy information, respect objections and suppression lists, and obtain consent where required for marketing, cookies, recordings or other activities.
• Agree any additional integration or AI processing with us before sending personal data to it. A UK-hosted workflow can still transfer data to an external service.

We may restrict access where reasonably necessary to address unlawful use, a material breach or a security threat. We will explain the reason and steps to resolve it where lawful and practicable. Each party remains responsible for its own legal obligations; your responsibilities do not remove our obligations as a processor.

5. Payments

Pay invoices and subscription charges under the agreed payment terms. Any third-party usage charges must be identified in the agreed service arrangements. We may suspend or stop services for overdue invoices in accordance with the contract, following reasonable notice where practicable. Data protection, confidentiality and agreed offboarding duties continue during a suspension.

6. Intellectual property and confidentiality

Unless agreed otherwise in writing, intellectual property in materials, designs and content we create remains with Minutes. Once the relevant invoices are paid, you receive a licence to use the agreed deliverables for your business. Your existing materials and rights remain yours. HighLevel, Notion, n8n and other third-party software remain subject to their owners’ rights and applicable licences. This clause does not give us ownership of client personal data or permission to use it for our own purposes.

Each party must protect the other’s confidential information, use it only to perform the contract or meet legal duties, and disclose it only to people who need it and are bound by appropriate confidentiality obligations. These duties continue after the contract ends. Section 12 adds specific requirements for client personal data.

7. Delivery and availability

We will provide services with reasonable care and skill. We do not guarantee particular revenue, lead volumes, search rankings or other business outcomes. Availability can be affected by maintenance and third-party services. Any specific service levels or support commitments must be agreed in writing.

8. Ending services

Either party may end services using the notice and cancellation provisions in the accepted contract. We may suspend or end services for a material breach, subject to any agreed opportunity to remedy it. Ending or suspending services does not remove accrued payment obligations or the duties that are intended to continue. We will handle client data on exit under section 12.10, including your choice of return or deletion.

9. Liability

Subject to any different limit expressly agreed in writing and to the following paragraph, our total contractual liability for a service is limited to the amount paid for the service in question, and we exclude liability for indirect or consequential loss to the extent permitted by law.

Nothing in these Terms excludes or limits liability for fraud, fraudulent misrepresentation, death or personal injury caused by negligence, or any liability that cannot lawfully be limited. These Terms do not restrict an individual’s data protection rights, statutory compensation rights, the powers of a regulator, or obligations and rights under mandatory international transfer clauses. Any limit between the parties applies only to the extent permitted by applicable law.

10. Updates and order of priority

We may publish a revised version with a new date. For an existing service contract, changes take effect only through its agreed variation process or a further recorded agreement. Posting a new version alone does not change an existing client’s contract or authorise new uses of their personal data. We will give appropriate notice of proposed material changes.

An expressly agreed service order takes priority over the general commercial provisions of these Terms. The Data Processing Agreement takes priority for client personal data unless an expressly agreed data protection variation provides at least the protection required by law. Mandatory transfer clauses take priority over any conflicting contractual provision.

11. Governing law

These Terms are governed by the laws of England and Wales, and disputes between the parties are subject to the courts of England and Wales. This does not affect mandatory rights, an individual’s right to complain to a competent regulator, or jurisdiction and rights under applicable data protection law or mandatory transfer clauses.

12. Data Processing Agreement

This Data Processing Agreement (DPA) forms part of a service contract when accepted as described in section 2. It applies whenever Minutes processes personal data on your behalf in providing the agreed services. It continues for as long as we or our subprocessors hold that data for you, including during offboarding.

12.1 Roles and applicable law

‘Client Personal Data’ means personal data processed by Minutes on your behalf. ‘Data Protection Law’ means the UK GDPR, the Data Protection Act 2018 as amended, and other data protection and electronic communications laws applicable to the processing, including the EU GDPR where it applies. Controller, processor, personal data, processing, subprocessor and personal data breach have the meanings given by that law.

You normally act as controller and Minutes as processor. If you are processing for another controller, you act as processor and Minutes as your subprocessor; you must have authority from that controller to appoint us and give the agreed instructions. Each party must meet the legal obligations applying to its role. Minutes acts separately as controller for its own enquiries, account administration, billing, security and legal records as explained in the Privacy Policy.

12.2 Processing details and instructions

• Subject matter and purpose: delivering the CRM, project, marketing, website, support and automation services you order, solely for the purposes you instruct.
• Nature of processing: collecting or receiving, recording, organising, storing, accessing, updating, retrieving, transmitting, exporting and deleting data, including running the communications and workflows you instruct.
• Duration: the agreed service period and the time needed to return or delete data under section 12.10, with continued protection for any lawful retention.
• Data subjects: your prospects, leads, customers, website visitors, suppliers, staff, contractors and other business contacts whose data you lawfully provide or instruct us to collect.
• Data types: names, business and contact details, account identifiers, correspondence, appointment and enquiry records, purchases and transaction references, campaign preferences, consent and objection records, website or CRM activity and other ordinary personal data specified in your written instructions.
• Your rights and obligations: determine the purposes and lawful basis, give lawful documented instructions, provide required notices and permissions, keep data accurate and proportionate, set retention periods, respond to individuals, and exercise the information, audit, objection and return or deletion rights in this DPA.

The accepted service order, this DPA and your recorded configuration choices and written directions, including email, define the instructions. We will process Client Personal Data only on documented instructions, including for international transfers, unless UK law requires otherwise (or applicable EU or Member State law where the EU GDPR applies). If such law requires processing outside those instructions, we will inform you before processing unless that law prohibits this on important public interest grounds. We will tell you immediately if, in our opinion, an instruction infringes Data Protection Law and pause the affected processing while it is resolved.

Special category data, such as health information, criminal offence data and processing specifically involving children require a separate, express written scope and appropriate legal conditions and safeguards before they are included. Do not upload these as part of the standard service. Any proposed significant decision about a person made solely by automated means also requires a separate lawful instruction and the safeguards required by applicable law.

We will not sell Client Personal Data, use it for our own advertising, or use it to train a general-purpose AI model. Sending it to an AI service or another connected service requires the documented purpose, authorised recipient, appropriate contractual protections and any necessary transfer safeguards to be established first.

12.3 Confidentiality and security

We will limit access to authorised people who need it to provide the services and ensure they are bound by confidentiality commitments or an appropriate statutory duty. We will implement and maintain technical and organisational measures appropriate to the risks, as required by Article 32, taking account of the nature, scope, context and purposes of processing, the state of the art and implementation costs.

Those measures must address access control and account authentication; appropriate encryption or pseudonymisation; secure configuration and updates; confidentiality, integrity, availability and resilience; backup and restoration; incident handling; personnel awareness; and regular testing and assessment. Their application must reflect the service and the sensitivity of the data. We will make information about the measures applicable to your service available on request and review them as risks change.

12.4 Subprocessors

By accepting this DPA you give general written authorisation for the following providers, limited to the services you order and the processing you instruct. We must assess their safeguards, enter binding processor terms imposing equivalent Article 28 obligations, and remain responsible to you for their performance of those obligations.

• HighLevel Inc. (GoHighLevel or GHL), for TheMinutes App, CRM records and the communications and related features you enable. Its downstream providers and processing locations are described in the HighLevel subprocessor list.
• Notion Labs, Inc., for project records, collaboration and information needed to deliver your services. Its privacy and data processing information includes links to its DPA and downstream subprocessor list.
• UK infrastructure providers hosting our self-hosted n8n service, selected only where the contracted hosting and storage are in the UK and the provider offers suitable security, confidentiality, deletion and Article 28 contractual protections. We must provide you with the provider’s legal identity, processing locations and role before it processes your data under this authorisation. n8n is software we operate; self-hosting does not by itself appoint n8n’s software developer to process your workflow data.

Our team accesses client data from the UK. Suppliers may use infrastructure or support teams elsewhere, subject to section 12.5. Ask us for the current register relevant to your account, including legal identities, purposes, locations and applicable downstream providers. A vendor’s public list supplies information and does not, by itself, authorise a change to your processing arrangement.

We will notify you in writing before adding or replacing a subprocessor or making a relevant downstream change, giving its identity, purpose, location and safeguards and reasonable time to object before the change. You may object on reasonable data protection grounds. We will work with you on an alternative or a resolution; if none is available, the affected processing must not proceed and the affected service can be ended under the contract. An additional n8n connection, AI provider or other recipient outside the authorised arrangement needs prior written authorisation. Enabling a feature does not remove these requirements.

12.5 International transfers

UK hosting of n8n does not mean all service data stays in the UK. HighLevel, Notion, their authorised suppliers and any agreed connections may involve processing outside the UK. We will make a restricted transfer only on your documented instructions and where the applicable legal requirements are met. This includes an applicable UK adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with the required transfer risk assessment and supplementary measures. EU GDPR transfer requirements also apply where relevant. We will provide information about the mechanism and relevant safeguards on request.

12.6 Requests from individuals

Taking account of the nature of the processing, we will assist you through appropriate technical and organisational measures, insofar as possible, to meet requests to exercise data protection rights. We will forward requests about Client Personal Data to you without undue delay. We will not respond on your behalf without your instructions, except to identify you as the relevant organisation or where legally required. We will cooperate in locating, exporting, correcting, restricting or deleting relevant data so you can meet applicable deadlines.

12.7 Personal data breaches

We will notify your nominated contact without undue delay after becoming aware of a personal data breach affecting Client Personal Data. We will provide the information available about its nature, affected data and people, likely consequences, contact point and measures taken or proposed. Information may be provided in stages without undue further delay. We will take appropriate steps to contain and address the breach, preserve relevant evidence and cooperate with your investigation and notifications. This duty does not depend on the breach meeting a regulator’s reporting threshold.

12.8 Compliance assistance

Taking account of the processing and the information available to us, we will assist you with security obligations, breach assessment and notifications to regulators and affected people, data protection impact assessments, and any required prior consultation with a regulator under Articles 32 to 36. Tell us about relevant risks, deadlines and required assistance promptly. Each party remains responsible for its own reporting duties.

12.9 Records, information and audits

We will maintain records required by Data Protection Law, make available all information necessary to demonstrate compliance with this DPA and Article 28, and allow and contribute to audits and inspections by you or an independent auditor you appoint. Reasonable arrangements may protect confidentiality, other customers’ data and service security, but must not prevent a required audit or delay urgent action after an incident or a regulator’s request. We will address identified failures and cooperate with competent supervisory authorities.

12.10 Return, deletion and retention

You set the retention instructions for Client Personal Data. When the processing services end, at your choice we will return the data to you in an agreed usable format or securely delete it, and delete existing copies, unless UK law requires storage (or applicable EU or Member State law where the EU GDPR applies). We will arrange the export or deletion process with you before closing access. If you do not give a choice, we will request instructions and give reasonable written notice before deletion. Ask us for the retention and deletion arrangements applicable to your account.

Where data remains in backups pending scheduled secure deletion, it must be isolated from ordinary use, remain protected by this DPA and be erased through the applicable backup cycle. We will disclose the relevant cycle on request and reapply deletions if a backup is restored. Data retained because of a legal requirement must be limited to that requirement, protected and deleted when the requirement ends. We will require equivalent steps from subprocessors and confirm completion on request. Separate billing or legal records that Minutes holds as controller are governed by the Privacy Policy.

13. Contact

For service terms, processing instructions, subprocessor information or privacy questions, email [email protected], call +44 161 524 2122, or write to Minutes Agency Ltd at the registered office in section 1. Please identify your business and the relevant service. Never send passwords or unnecessary sensitive personal data in an enquiry.