Master Service Agreement

Accelerate Commerce Ltd trading as Magnet Monster. Last updated: 26/10/2026.

This Master Services Agreement (the "Agreement") sets out the terms on which Accelerate Commerce Ltd, a company registered in England and Wales with company number 12292469, whose registered office is at Marsland Chambers, 1A Marsland Road, Sale, Cheshire, M33 3HP, trading as Magnet Monster (the "Agency"), provides services to its clients. It applies to, and is incorporated by reference into, each Statement of Work executed between the Agency and a client (the "Client"). The Agency and the Client are each a "Party" and together the "Parties".

1. Definitions and interpretation

1.1 In this Agreement:

• "Agency Pre-Existing IP" means all Intellectual Property Rights owned by or licensed to the Agency before the commencement of this Agreement or developed independently of it (including methodologies, frameworks, tools, templates, technical know-how, and AI prompts and workflows).
• "Business Day" means any day from Monday to Friday other than a public holiday in England.
• "Client Data" means all data, including Client Personal Data, that the Client provides to the Agency or that the Agency accesses in the Client's systems in providing the Services.
• "Client Personal Data" means personal data (as defined in the Data Protection Legislation) contained in Client Data.
• "Client Pre-Existing IP" means all Intellectual Property Rights owned by or licensed to the Client that are provided to the Agency for the Services.
• "Client Systems" means the Client's marketing, e-commerce, subscription, loyalty and analytics platforms and connected applications.
• "Confidential Information" means any information disclosed by one Party to the other that is designated as confidential or that reasonably should be understood to be confidential, including the financial terms of an engagement.
• "Data Protection Legislation" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and, where it applies, the EU GDPR, each as amended or replaced from time to time.
• "Deliverables" means the work product, materials, and outputs created by the Agency for the Client as described in a Statement of Work.
• "Engineering" or "Technical Build" means: template assembly; logic and trigger configuration; variable injection; deployment logistics; and standard integration support. It excludes: platform development (e.g. Shopify theme/code); custom API development; creation of raw creative assets (design files, UI/UX, copy) save where expressly included in a Statement of Work; and deliverability repair of pre-existing sender-reputation issues.
• "Fees" means the charges payable by the Client for the Services, as set out in the applicable Statement of Work.
• "Intellectual Property Rights" or "IPR" means all patents, copyright and related rights, trademarks, trade names, domain names, rights in designs, database rights, moral rights, rights in confidential information (including know-how), and all other intellectual property rights, whether registered or unregistered, anywhere in the world.
• "Services" means the services provided by the Agency as set out in a Statement of Work.
• "Statement of Work" or "SOW" means a document executed by both Parties describing the specific Services, Deliverables, timeline, and Fees for a project.
• "Sub-processor" means a third party engaged by the Agency that processes Client Personal Data on the Agency's behalf.

1.2 Headings do not affect interpretation. A reference to a person includes a natural person and a corporate or unincorporated body. The singular includes the plural and vice versa.

2. Scope, Statements of Work and version

2.1 This Agreement establishes a framework. Each engagement is detailed in a separate Statement of Work which, upon execution by both Parties, is incorporated by reference into this Agreement and forms a separate binding contract.

2.2 Order of precedence. In the event of any conflict between this Agreement and a Statement of Work, this Agreement prevails in all respects, except where a Statement of Work explicitly and specifically modifies, solely for the project described therein: (a) the description of Services and Deliverables; (b) the project timeline and milestones; (c) the Fees and payment schedule; and (d) the processing details, approved territories and security measures referred to in Schedule 1, which a Statement of Work may make more protective of Client Personal Data but not less. For the avoidance of doubt, this Agreement otherwise governs all matters of Intellectual Property, Confidentiality, Data Protection, Liability, Indemnification, Governing Law, and Dispute Resolution.

2.3 Client data processing agreement. Where the Parties sign a separate data processing agreement for an engagement, that agreement prevails over this Agreement and its Schedules in respect of the processing of Client Personal Data for that engagement.

2.4 Version. This Agreement is published at magnetmonster.com and carries a "last updated" date. The version that applies to a Statement of Work is the version in force on the date that Statement of Work is signed, and the Agency will supply a dated copy on request or attach one to the Statement of Work. A later version applies to that Statement of Work only if both Parties agree in writing.

3. Agency's obligations

3.1 The Agency shall perform the Services and deliver the Deliverables with reasonable care and skill, in accordance with the applicable Statement of Work in all material respects.

3.2 The Agency shall use reasonable endeavours to meet performance dates, but such dates are estimates only and time shall not be of the essence.

3.3 The Agency shall comply with all applicable laws and regulations in performing its obligations.

4. Client's obligations and dependencies

4.1 The Client shall cooperate with the Agency and appoint a designated representative with authority to provide instructions and approvals.

4.2 The Client shall provide, in a timely manner, all materials, data, assets, copy, designs, approvals, and information reasonably required by the Agency (together "Client Dependencies"), and ensure they are accurate and complete in all material respects.

4.3 Client Delay. Where a Statement of Work requires the Client to provide Client Dependencies, the Client shall do so within 5 Business Days of the Agency's request unless the Statement of Work states otherwise. If the Client fails to do so, or otherwise delays or prevents the Agency's performance by any act or omission (a "Client Delay"): (a) the Agency's affected timelines are extended on a day-for-day basis; (b) the Agency is not in breach and is not liable for any resulting costs or losses; and (c) the Client's payment obligations are unaffected.

4.4 The Client shall obtain and maintain all licences, permissions, and consents required for the Services before they start, including any consents required from data subjects for the marketing the Services support.

4.5 During this Agreement and for 12 months after the last Statement of Work is completed, the Client shall not, without the Agency's prior written consent, solicit or employ any person engaged by the Agency in providing the Services.

4.6 Access to Client Systems. The Client authorises the Agency to access and configure the Client Systems to the extent reasonably required to provide the Services, including creating API credentials where a Statement of Work requires it. Access is given to named individuals, each with their own login, at the lowest role that allows the Services to be performed. The Client controls these logins and may remove any of them at any time. The Agency shall use the access solely to provide the Services, keep credentials secure, not share a login between individuals, and on termination stop using all access and return or destroy all credentials.

5. Fees and payment

5.1 In consideration for the Services, the Client shall pay the Fees set out in the applicable Statement of Work.

5.2 All Fees are exclusive of VAT (or applicable sales/use tax), which is added at the appropriate rate.

5.3 Late payment. Without prejudice to any other remedy, if the Client fails to pay an undisputed invoice by the due date, the Agency may: (a) charge interest on the overdue sum from the due date at 8% per annum above the base rate from time to time of the Bank of England, or the maximum rate permitted by applicable law, whichever is lower, accruing daily until payment; and/or (b) suspend all Services until payment is made in full. Non-payment of an undisputed invoice is a material breach.

6. Intellectual property rights

6.1 Agency Pre-Existing IP. The Agency retains all right, title, and interest in its Agency Pre-Existing IP. Nothing transfers ownership of it to the Client.

6.2 Client Pre-Existing IP. The Client retains all right, title, and interest in its Client Pre-Existing IP and grants the Agency a limited, non-exclusive, worldwide, royalty-free licence to use it solely to perform the Services.

6.3 Assignment of Deliverables. Upon the Client's payment in full of all sums then due to the Agency under this Agreement and all Statements of Work, the Agency irrevocably assigns to the Client all right, title, and interest in the final, approved Deliverables created specifically for the Client.

6.4 Licence of embedded Agency IP. To the extent Agency Pre-Existing IP is incorporated into and necessary for the intended use of a Deliverable, the Agency grants the Client a perpetual, worldwide, royalty-free, non-exclusive licence to use it solely as part of that Deliverable in the Client's business, with no right to extract, reverse-engineer, or use it standalone.

6.5 Portfolio and marketing licence. The Client grants the Agency a non-exclusive, worldwide, royalty-free licence, without the need for further approval, to name the Client as a client of the Agency, to describe the project, and to display the Deliverables (including email, SMS and design work) in the Agency's portfolio, website, case studies, social media channels and other marketing. The Agency shall display a Deliverable only after the Client has itself published or sent it, and shall not disclose the Client's Confidential Information (including non-public performance data, customer data and pricing) without the Client's prior written consent. The Client may opt out of, or limit, this licence at any time by written notice to the Agency (email being sufficient); the Agency shall then make no new use and shall remove existing uses within its reasonable control within 10 Business Days. Unless the Client has opted out, this licence survives termination of this Agreement.

6.6 Moral rights. The Agency waives its moral rights in the Deliverables to the fullest extent permitted by applicable law.

7. Confidentiality

7.1 Each Party shall keep the other's Confidential Information confidential and not use it except to perform its obligations under this Agreement.

7.2 A Party may disclose the other's Confidential Information (a) to personnel and advisers who need to know it for this Agreement (ensuring they are bound by written confidentiality obligations no less protective than this clause); and (b) as required by law or a competent authority. Confidentiality does not apply to information that is or becomes public through no breach, was already known without restriction, or is independently developed.

7.3 Onward disclosure. The Agency shall not disclose Client Data to any third party other than: (a) a Sub-processor listed in Schedule 2, or added under paragraph 7 of Schedule 1, for the purpose of providing the Services; or (b) as permitted by clause 7.2. The Agency shall not sell, license, publish, or otherwise make Client Data available to any person for that person's own purposes.

7.4 Confidentiality obligations survive termination for 3 years.

8. Data protection

8.1 Each Party shall comply with the Data Protection Legislation.

8.2 Where the Agency processes Client Personal Data, the Client is the controller and the Agency is the processor, and the Agency's obligations are set out in Schedule 1 (Data Processing Addendum) and Schedule 2 (Sub-processors). For clients subject to US state privacy laws, a US data processing addendum is attached to the applicable Statement of Work.

9. Insurance

9.1 The Agency shall maintain, with reputable insurers, throughout the term of this Agreement and for 12 months after the last Statement of Work ends: (a) professional indemnity insurance with a limit of not less than £1,000,000 for each claim; and (b) cyber and data protection insurance with a limit of not less than £2,000,000 for each claim. The Agency shall provide evidence of this cover on request.

10. Limitation of liability

Your attention is particularly drawn to this clause.

10.1 Exclusion of indirect loss. Subject to 10.4, neither Party shall be liable for loss of profit, goodwill, business, business opportunity, anticipated savings, or data, or any special, indirect, or consequential loss, whether in contract, tort (including negligence), breach of statutory duty, or otherwise. This clause does not exclude the Agency's liability for the reasonable cost of investigating, notifying and remedying a personal data breach caused by the Agency's breach of Schedule 1, or for fines and compensation for which the Agency is responsible under clause 10.5.

10.2 General cap. Subject to 10.3 and 10.4, each Party's total aggregate liability under this Agreement shall be limited to the greater of: (a) £100,000; or (b) the total Fees paid and payable by the Client under the applicable Statement of Work in the 12 months immediately preceding the event giving rise to the claim.

10.3 Data protection cap. The Agency's total aggregate liability for breach of clause 8, Schedule 1 or Schedule 2, and under the indemnity at 10.5, shall be limited to £2,000,000 in total for all claims arising under this Agreement. This cap is separate from and in addition to the cap at 10.2.

10.4 Unlimited liability. Nothing limits liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; (c) gross negligence or wilful misconduct; or (d) any liability that cannot be limited by applicable law. The cap at 10.2 does not apply to breach of clause 7 (Confidentiality), which is instead subject to the cap at 10.3 where the breach concerns Client Personal Data.

10.5 Data protection indemnity. Each Party shall indemnify the other against losses, fines, penalties, compensation and reasonable costs (including reasonable legal costs) arising from a claim or regulatory action to the extent caused by the indemnifying Party's breach of the Data Protection Legislation or, in the Agency's case, of Schedule 1 or Schedule 2. The indemnified Party shall notify the other promptly of any such claim, allow it reasonable conduct of the defence, and take reasonable steps to mitigate its loss.

11. Term, suspension and termination

11.1 This Agreement commences when first incorporated into a Statement of Work and continues until terminated. Project term and termination are set out in each Statement of Work.

11.2 Either Party may terminate immediately on written notice if the other: (a) commits a material breach not remedied within 30 days of written notice; or (b) becomes insolvent or unable to pay its debts as they fall due. Non-payment of an undisputed invoice is a material breach.

11.3 Data breach. The Client may suspend the Agency's access to the Client Systems immediately, without notice and without liability, if it reasonably believes a personal data breach or a material security failure has occurred in connection with the Agency. The Client may terminate the affected Statement of Work immediately on written notice if the Agency causes a personal data breach through its breach of Schedule 1, or commits a material security failure, without the cure period in 11.2(a). Suspension under this clause does not of itself relieve the Client of Fees for Services already performed.

11.4 On termination, all Statements of Work then in effect also terminate, and the Client shall immediately pay all of the Agency's outstanding unpaid invoices, accrued interest, and approved overage charges for Services performed up to termination.

12. Artificial intelligence

12.1 The Agency uses AI tools in service delivery across research, strategy assistance, analysis and reporting, design support, and deliverable drafting. All AI-assisted outputs forming part of a Deliverable are reviewed, edited, and approved by a qualified human before submission.

12.2 Approved AI tools. The Agency processes Client Data through AI tools only on business accounts held by the Agency, under the provider's commercial terms, and only through the AI providers listed in Schedule 2. Under those terms the provider does not use the Agency's inputs and outputs to train its models. The Agency does not submit Client Data to any consumer or personal AI account, and its personnel are bound by a written approved-tools policy to that effect. The Agency is moving all Client work onto these business accounts and will complete that move by 19 November 2026.

12.3 Retention. Content in the Agency's AI accounts is held by the provider for as long as the Agency keeps it, and is deleted from the provider's systems within the period stated in the provider's terms (at present, 30 days) after the Agency deletes it, save where the provider is required to keep it longer by law or for the enforcement of its usage policies. The Agency deletes Client Data from its AI accounts when it is no longer needed for the Services and in any event in accordance with paragraph 12 of Schedule 1.

12.4 Customer records. The Agency shall not export or submit bulk Client customer records to any AI tool. Client Data submitted to an AI tool in the ordinary course of the Services (for example performance reports, account structure and campaign content) is processed solely to produce the Deliverables. A Statement of Work may exclude Client Personal Data from AI tools altogether, and the Agency shall then comply with that exclusion.

12.5 The Agency will notify the Client of any change to its AI providers under paragraph 7 of Schedule 1. Nothing restricts the Client's own use of AI tools.

13. Dispute resolution

13.1 The Parties shall first attempt in good faith to resolve any dispute, controversy, or claim arising out of or in connection with this Agreement, including any question regarding its existence, validity, or termination (a "Dispute"), through discussions between senior representatives within 15 Business Days of written notice of the Dispute.

13.2 Arbitration. Any Dispute not so resolved shall be referred to and finally resolved by arbitration under the Rules of the London Court of International Arbitration (LCIA), which Rules are incorporated by reference. The tribunal shall be one arbitrator; the seat shall be London, England; the language shall be English.

13.3 Small claims. Notwithstanding clause 13.2, any Dispute in which the amount claimed is less than £25,000 may instead be brought in the courts of England and Wales, which shall have non-exclusive jurisdiction for that purpose.

13.4 Interim relief. Nothing in this clause prevents either Party from applying to any court of competent jurisdiction for urgent interim, injunctive, or other equitable relief; such application is not incompatible with, nor a waiver of, the agreement to arbitrate.

14. General

14.1 Force majeure. Neither Party is in breach or liable for delay or failure caused by events beyond its reasonable control. This does not excuse a failure to maintain the security measures in Schedule 1.

14.2 Assignment and subcontracting. Neither Party may assign or transfer its rights or obligations without the other's prior written consent. The Agency may subcontract in the ordinary course (consent not to be unreasonably withheld), remains responsible for its subcontractors as for its own acts, and engages Sub-processors only under Schedule 1.

14.3 Variation. No variation is effective unless in writing and signed by both Parties. Each Statement of Work executed by both Parties is a binding variation of this Agreement to the extent permitted by clause 2.2, without need for a separate deed.

14.4 Entire agreement. This Agreement and the Statements of Work constitute the entire agreement and supersede all prior agreements and representations relating to their subject matter.

14.5 Waiver, severance, notices, third-party rights. A waiver is effective only in writing. If any provision is unenforceable it is modified to the minimum extent necessary or deemed deleted. Notices shall be in writing to the Parties' notified addresses; email is sufficient for notices under Schedule 1. A person who is not a party has no rights under the Contracts (Rights of Third Parties) Act 1999.

14.6 Governing law and jurisdiction. This Agreement and any dispute or claim (including non-contractual) arising out of or in connection with it is governed by the law of England and Wales, and dispute resolution is as set out in clause 13.

SCHEDULE 1 - Data Processing Addendum

This Addendum forms part of this Agreement and applies to all Client Personal Data the Agency processes on the Client's behalf. It is intended to meet Article 28 of the UK GDPR.

1. Roles. The Client is the controller and the Agency is the processor.

2. Processing details. Unless a Statement of Work sets out different details: - (a) Subject matter and purpose: email, SMS and retention marketing services, including strategy, audits, campaign and flow build, reporting and analysis. - (b) Duration: the term of the applicable Statement of Work and the deletion period in paragraph 12. - (c) Nature: viewing, analysing, segmenting and configuring data within the Client Systems; preparing aggregated reports. - (d) Data subjects: the Client's customers, subscribers and prospective customers; the Client's staff who instruct the Agency. - (e) Personal data: contact details, marketing preferences and consents, order, subscription and engagement history, and segment membership. - (f) Location: the Client Systems, which the Client controls, and the Agency's systems listed in Schedule 2.

A Statement of Work may add the Client Systems involved, record volumes, approved territories and any extra security measures.

3. Documented instructions. The Agency processes Client Personal Data only on the Client's documented instructions, which include this Agreement and each Statement of Work, including with regard to transfers outside the United Kingdom, unless required to do otherwise by law, in which case it will tell the Client first unless the law prohibits it.

4. Unlawful instructions. The Agency shall tell the Client immediately if, in its opinion, an instruction infringes the Data Protection Legislation.

5. Personnel. The Agency ensures that everyone authorised to process Client Personal Data is bound by written confidentiality obligations, is trained in its data handling rules, and has access only to the extent needed for the Services.

6. Security. The Agency implements appropriate technical and organisational measures under Article 32 of the UK GDPR, including: - (a) named, individual logins to Client Systems at the lowest role that allows the Services to be performed, never shared; - (b) multi-factor authentication on every account used to access Client Systems or Client Data, where the platform supports it; - (c) shared Agency credentials held in a business password manager; - (d) no export of customer-level records from Client Systems unless the Client instructs it in writing; any extract that is instructed is encrypted, kept only for the period instructed, and then destroyed; - (e) removal of a person's access on the day they leave the Agency or the Client's account; - (f) the AI controls in clause 12.

The Agency will keep these measures under review and will not reduce their overall level of protection.

7. Sub-processors. The Client gives general authorisation for the Agency to engage the Sub-processors listed in Schedule 2. The Agency shall give the Client at least 30 days' written notice before engaging a new or replacement Sub-processor. The Client may object on reasonable data protection grounds within that period; if the Parties cannot resolve the objection, the Client may terminate the affected Services without penalty. The Agency shall impose on each Sub-processor written data protection terms no less protective than this Schedule and remains fully liable to the Client for each Sub-processor's performance.

8. Data subject requests. The Agency shall promptly pass to the Client any request it receives from a data subject, and shall assist the Client in responding to data subject requests within 5 Business Days of the Client's request for assistance.

9. Assistance. Taking into account the nature of the processing and the information available to it, the Agency shall assist the Client with its obligations under Articles 32 to 36 of the UK GDPR, including security, breach notification, data protection impact assessments and prior consultation with the Information Commissioner.

10. Personal data breach. The Agency shall notify the Client without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Client Personal Data. The notice shall include, so far as then known, the information in Article 33(3) of the UK GDPR, with further information provided as it becomes available. The Agency shall cooperate with the Client and take reasonable steps to contain and remedy the breach, and shall not notify any regulator, data subject or third party about it without the Client's agreement unless the law requires it.

11. International transfers. The Agency shall not transfer Client Personal Data, or allow it to be accessed, outside the United Kingdom and the countries the United Kingdom recognises as adequate, unless an approved transfer mechanism (such as the ICO International Data Transfer Agreement or Addendum) and a transfer risk assessment are in place. Where a Statement of Work lists approved territories, the Agency shall not store, process or access Client Personal Data outside them without the Client's prior written consent.

12. Deletion and return. On termination, or earlier on the Client's request, the Agency shall at the Client's choice return or delete all Client Personal Data, including copies held by Sub-processors, in AI tools and in any local extract, save where the law requires it to be kept. The Agency shall confirm deletion in writing within 30 days.

13. Records. The Agency maintains a record of its processing activities carried out on the Client's behalf under Article 30(2) of the UK GDPR and will make it available to the Client or the Information Commissioner on request.

14. Information and audit. The Agency shall make available to the Client all information reasonably necessary to demonstrate compliance with this Schedule, and shall allow and contribute to audits and inspections by the Client or an auditor it mandates who is bound by confidentiality. Audits take place on at least 30 days' notice, no more than once in any 12 months (except after a personal data breach or where a regulator requires it), during business hours, at the Client's cost and without access to other clients' data.

15. Health-related data. Some purchases (for example of pregnancy, fertility or condition-specific products) can reveal information about a person's health. The Agency shall not create, extract or export segments based on such purchases unless the Client instructs it in writing, and shall handle any such data with the safeguards appropriate to special category data.

16. Privacy contact. The Agency's contact for data protection matters is Andrew Langhorn, Director, andrew@magnetmonster.co.uk.

17. Precedence. In the event of conflict between this Schedule and the main body of the Agreement or a Statement of Work, this Schedule prevails in respect of the processing of Client Personal Data, except where a Statement of Work makes the processing more protective under clause 2.2(d) or a separate data processing agreement applies under clause 2.3.

SCHEDULE 2 - Sub-processors

The Agency uses the following Sub-processors in providing the Services. The Client's own platforms (for example Klaviyo, Shopify, Skio, Recharge or a loyalty platform) are the Client's processors, which the Agency accesses on the Client's authority; they are not Agency Sub-processors.

• Anthropic (Claude) - AI support for analysis, reporting and drafting, through the Agency's business account; United States; Standard Contractual Clauses with the UK Addendum
• Google LLC (Google Workspace) - Email, documents and file storage; United States; UK Extension to the EU-US Data Privacy Framework
• Slack Technologies, LLC (Salesforce) - Team and client communication; United States; UK Extension to the EU-US Data Privacy Framework
• Mango Technologies, Inc. (ClickUp) - Project and task management; United States; Standard Contractual Clauses with the UK Addendum
• Figma, Inc. - Email design and creative review; United States; UK Extension to the EU-US Data Privacy Framework
• Canva - Design; Australia and United States; Standard Contractual Clauses with the UK Addendum
• Loom (Atlassian) - Recorded walkthroughs; United States; UK Extension to the EU-US Data Privacy Framework

Changes to this list are made under paragraph 7 of Schedule 1.

THESE CONDITIONS WERE LAST UPDATED ON 26/10/2026