Terms & Data Processing Agreement

Your agreement

These terms cover the Trails relationship-intelligence service provided by Ramzi Hajaj, trading as Trails, to business customers. They apply when incorporated into an order or other written agreement accepted by you and Trails. That agreement identifies the customer, service and effective date. Publishing this page does not change an existing customer agreement.

You must be authorised to bind the business you represent. The agreed order or written proposal controls the services, price and pilot period where it differs from these standard terms. The Data Processing Agreement takes precedence for processor obligations.

Requesting an invitation does not create a paid subscription or an immediately usable account. Paid services and any additional work require agreement.

1. What Trails provides

Trails combines public market research with permitted information about professional relationships to help businesses identify relevant projects, firms and possible routes to new work.

Depending on the agreed service, this can include research, briefings, suggested contacts and next steps, draft approaches, feedback and outcome tracking. Delivery frequency, included searches and any managed work are as agreed; there is no general promise of weekly delivery.

Content production, managed outreach, pipeline management and optional integrations are included only where agreed or enabled. Cross-customer private graph sharing is not an active feature. Trails does not guarantee responses, introductions, tenders, contracts or revenue.

2. Fees and cancellation

Fees, billing frequency, minimum commitments, included services, trial arrangements and cancellation terms are set out in the agreed order or written proposal. Prices exclude VAT where applicable. Additional services require separate agreement.

We may change prices on at least 30 days’ notice, taking effect only after any agreed fixed-price period. You may cancel before a new price takes effect. We may suspend service for overdue payment after reasonable notice and an opportunity to resolve it.

3. Your private relationship data

“Customer Private Data” includes contact lists, CRM exports, work communications, relationship histories, notes and project information supplied by or obtained for your account. You retain your rights in that material.

You grant Trails a limited, non-exclusive right to process it to provide, secure, troubleshoot and improve the service for your account, within your documented instructions and the DPA. This does not authorise reuse of private information to improve another customer’s recommendations or train a general-purpose model.

Your private relationships, communications and confidential project histories are account-restricted. Derived relationship paths, scores and inferences remain private too, even when they refer to publicly known firms. Account users and authorised suppliers receive only the access applicable to their role and the agreed service.

Another customer gains no right to browse your private graph just because it contains the same company. Any future collaboration feature would require separate permission controls and an appropriate agreement.

4. Independently sourced public intelligence

Trails maintains a shared market graph from lawfully accessible public information and appropriately licensed sources, including planning records, company websites, published project credits, tender awards, press coverage and public posts.

We may use firms in your network as starting points for research. Independently evidenced public facts about those firms, projects or collaborators may enter the shared graph where lawful and consistent with confidentiality and source restrictions.

• Your private contact list does not become a shared list.
• A private relationship is not promoted to a public connection without independent, attributable public evidence.
• We do not disclose that a firm was researched because it appeared in your private graph.
• Routes and opportunities inferred from private context remain restricted to your account.
• Restricted third-party API data and its derivatives, including Google user data, remain within the provider’s permitted uses.

We retain public-source evidence supporting shared facts. Finding a business name in public does not give us permission to publish your confidential information.

5. Imports and connected services

You may provide information manually or export it from tools you use, including email, calendars, CRMs or AI assistants. Only provide information you are authorised to disclose. An export does not give Trails continuing access to the original service.

Direct connections are available for some accounts, including Google Workspace, SmartSuite and Discord. They are optional and depend on the enabled feature and authorisation from you or your organisation. Applicable provider permissions and restrictions govern the data accessed and how it may be used.

Disconnecting stops future access through that connection but does not automatically remove previously imported records. For deletion, use the relevant account controls or contact us. Imported data, private inferences and separately authorised account copies remain subject to their permissions and the agreed retention schedule.

6. AI and third-party suppliers

Trails uses third-party services for AI research and analysis, hosting, databases, email and other agreed functions. Inputs and outputs can include business contact information and private customer context.

Trails does not itself use Customer Private Data to train a general-purpose model. AI suppliers’ use and retention of inputs and outputs depend on the applicable service terms and settings. The DPA governs which sub-processors may receive your private data; naming a service below does not itself authorise its use.

AI-generated research and recommendations can be inaccurate or incomplete. You remain responsible for checking important facts before acting. Our suppliers are described in Schedule B.

7. Communications and acceptable use

Unless separately authorised, Trails suggests approaches and drafts but does not send them on your behalf. Automated or managed outreach requires express instructions, an agreed approval process and compliance with applicable direct-marketing rules.

You must not use Trails to spam or harass people, infringe intellectual-property or confidentiality rights, collect personal data unlawfully, scrape restricted networks, impersonate others or access another customer’s information without permission.

8. Confidentiality and security

Each party will protect the other’s non-public information, use it for the agreed purpose and disclose it only to personnel and authorised suppliers who need it and have appropriate confidentiality obligations. This does not cover information independently developed or lawfully public without breach.

Trails will apply appropriate technical and organisational measures proportionate to the data and risk. Schedule C sets out the account controls and the handling of export and deletion requests.

9. Ownership and use of outputs

Trails owns its underlying software, methods, database design, branding and platform content, subject to third-party rights. You retain your rights in the material you provide.

The subscribing business receives a non-exclusive right to use delivered briefs internally for its own legitimate business development. Resale, republication of substantial parts of the shared database or redistribution to unrelated parties requires written permission.

10. Export and deletion

At the end of the service, you may request an export of your Customer Private Data. At your choice, Trails will return or delete processor-held personal data and its copies, unless law requires retention. Contact us to arrange the scope and format of the export before deletion. Schedule C explains how requests are handled.

Controller records follow the Privacy Notice. Independently acquired public records may be retained where lawful; private graph records and derived private paths do not become public data when an account closes.

11. Accuracy and liability

Trails will perform agreed services with reasonable care and skill. We cannot promise that research is complete or current, or that a suggested route will lead to paid work.

Nothing in these terms excludes liability for fraud, death or personal injury caused by negligence, or other liability that cannot lawfully be excluded.

A contractual limit between Trails and its customer does not remove either party’s statutory data-protection duties, an individual’s rights against them or a regulator’s powers.

These standard terms do not set a financial liability cap or a general exclusion of commercial losses. Any such limit must be expressly agreed in writing and is subject to applicable law.

12. Changes, law and contact

We will give reasonable notice of material changes. Changes during an agreed fixed-term pilot do not override its agreed commercial terms without the customer’s acceptance.

The laws of England and Wales govern these terms, and disputes are subject to its courts. Contact ramzi@trytrails.co.uk or write to the business address above.

Schedule A. Data Processing Agreement

This schedule forms part of the customer agreement when these terms are accepted. It covers personal data processed by Trails on the business customer’s documented instructions, with Trails acting as processor and the customer as controller. Independent controller processing, such as billing and separately collected public research, is described in the Privacy Notice. Roles follow actual purposes and control.

A1. Processing particulars

Subject matter

Customer-supplied or customer-connected professional network information used to prepare personalised Trails intelligence.

Duration

The agreed service term and the period needed to return or delete data under the customer’s instructions, including retained copies covered by Schedule C.

Nature and purpose

Import, host, match, classify, research for the account, analyse, prepare briefings, suggest actions, track agreed outcomes, and return or delete data.

People concerned

Customer personnel, business contacts, collaborators, consultants, clients and project participants.

Data categories

Names, roles, business email addresses and phone numbers, organisations, professional relationships, project histories, work communications and metadata, CRM notes, and recommended actions.

Instructions

The customer agreement, agreed order, account settings and other lawful documented instructions. The order identifies the customer’s legal name, effective date and service reference.

A2. Instructions and confidentiality

Trails will process personal data only on documented customer instructions, including for international transfers, unless UK law requires otherwise. Where law requires processing contrary to instructions, Trails will notify the customer beforehand unless prohibited. Trails will promptly inform the customer if it believes an instruction infringes applicable data protection law. Authorised personnel must be bound by confidentiality obligations.

A3. The private-data boundary

Customer Private Data and its derived private insights remain within instructed processing. This DPA does not authorise extraction of private CRM or email relationships for a shared database. Where Trails separately determines purposes for independently collected public facts, it acts as controller and must establish its own lawful sourcing, transparency and legal basis. Provider restrictions on API data and derivatives continue to apply.

A4. Security

Trails will implement appropriate measures for confidentiality, integrity, availability and resilience, and periodically evaluate their effectiveness. Schedule C describes the account controls and data-handling arrangements.

A5. Sub-processors

Trails must obtain the customer’s written authorisation before appointing a sub-processor. The customer agreement records the approved providers and whether authorisation is specific or general. Trails will impose equivalent applicable data-protection duties and remain responsible for its sub-processors’ performance.

Where general authorisation is agreed, Trails will give advance written notice of additions or replacements and a reasonable opportunity to object before the change takes effect. A specific notice period may be agreed in the customer agreement. If an objection cannot be resolved, the customer may terminate the affected service before the change takes effect. Specific authorisation requires written approval of the new provider.

A6. International transfers

Restricted transfers require documented instructions and an applicable UK transfer mechanism, such as adequacy regulations, an International Data Transfer Agreement or appropriate UK Addendum, together with any required assessment and supplementary measures. The customer’s processing agreement must identify the relevant transfer arrangements.

A7. Assistance and breaches

Taking account of the processing and information available, Trails will assist with individual rights requests, security obligations, breach notifications, data-protection impact assessments and regulator consultations. Trails will notify the customer without undue delay after becoming aware of a personal data breach affecting processor-held data and provide available information to support the customer’s response.

A8. Return, deletion and backups

At the end of the service, Trails will return or securely delete personal data at the customer’s choice, and delete copies unless UK law requires retention. This includes private relationship inferences. Backups awaiting scheduled deletion must be kept outside active use; restoration must reapply relevant deletions. Trails will confirm the scope and timetable for completion, including any copies retained under a legal obligation. Schedule C describes the process.

A9. Demonstrating compliance

Trails will make available information reasonably needed to demonstrate Article 28 compliance and allow or contribute to lawful audits and inspections by the customer or its auditor, on reasonable notice and with suitable confidentiality and security safeguards.

A10. Responsibilities and precedence

The customer is responsible for the lawfulness and transparency of its controlled processing, the accuracy of its instructions and authority to supply the data. This does not remove Trails’ own processor duties. This DPA takes precedence over conflicting customer terms for processor obligations.

Schedule B. Suppliers and connected services

We use the following types of service to operate Trails. The customer agreement must identify the authorised sub-processors for that service, including their legal entities, purposes and relevant transfer arrangements. This summary does not authorise a provider to receive customer data.

Hosting and business operations

Providers of application hosting, databases, file storage, backups, sign-in and email delivery process the information needed to run the service.

AI research and analysis

AI providers process relevant public information and private customer context to support research and recommendations, including manual customer work. They may store inputs and outputs for service delivery or safety monitoring. Turning off model training does not necessarily prevent that storage.

Search and enrichment

Research services receive queries and relevant firm or website information to help us find public evidence.

Optional website analytics

PostHog receives usage events with your consent, excluding the contents of your invitation form and private relationship graph. See the cookie and analytics information for details and controls.

Services you connect

Optional email, calendar, CRM and messaging connections can provide work records or receive research and messages, within the permissions you grant. Your provider’s own terms also apply; disconnecting Trails does not delete its copies.

For the providers handling your information and their transfer arrangements, contact ramzi@trytrails.co.uk. Sub-processor authorisation and changes follow Schedule A.

Schedule C. Security, export and retention

Account controls

Private information is restricted to authorised users and services. Access to invitation requests is limited to authorised Trails administrators. Your private relationships are kept separate from our shared public research.

Disconnecting a service or removing an import does not delete all related records, such as saved briefings. Contact us for an export or a broader deletion request.

Request an export or deletion

Email ramzi@trytrails.co.uk with the account and information concerned. We may check your identity and authority. We will confirm the scope, an appropriate export format, the completion timetable and any information that must be retained by law. Individual data-protection requests remain subject to the statutory deadlines described in the Privacy Notice.

A deletion instruction covers eligible source data, derived private information and retained copies. Backups awaiting deletion must remain outside ordinary use, and relevant deletions must be reapplied before restored data is used. Public-source records are assessed separately; private information does not become public when your account closes.