Acceptable Use Policy

This Acceptable Use Policy (the “Policy”) sets out what you may and may not do with the Services provided by WREN TECHNOLOGIES LTD (“Wren”, “we”, “us”). It forms part of our Website and Platform Terms and uses the definitions in those Terms. A breach of this Policy is a breach of the Terms.

This Policy applies to you and to every Authorised User you permit to use the Services. You are responsible for their compliance.

1. General principles

You must use the Services lawfully, honestly, and only for the internal business purposes permitted by the Terms and your Data Licence. You must not use the Services in a way that harms another person, damages the Services, or puts us in breach of a law or of an agreement with a third party.

You must not use the Services, Platform content or Wren Data for fraud, phishing, impersonation, scams, credential harvesting, malware distribution, harassment, threats, hate content, unlawful tracking, unlawful surveillance, or to promote, facilitate or sell illegal goods, illegal services or unlawful activity.

2. Platform and technical use

You must not:

• bypass or attempt to bypass access controls, authentication, usage limits, rate limits, credit deductions or other technical protections;
• share a personal login between users, or allow access by anyone who is not an Authorised User;
• scrape, crawl, harvest or use automated means to extract data or content, except through an API or automation method we expressly make available to you;
• use the Services, Platform content, website content or Wren Data to create datasets, train, fine-tune, evaluate or improve artificial-intelligence or machine-learning systems, except where we have expressly permitted that use in writing;
• use the Services in a way that places an unreasonable or disproportionate load on our infrastructure, or that degrades the service available to other customers;
• introduce malware, harmful code, or material designed to damage, disrupt or gain unauthorised access to any system;
• probe, scan or test the vulnerability of the Services, or attempt to breach security or authentication measures, without our prior written permission;
• reverse engineer, decompile or attempt to derive the source code, database structure or matching methods of the Platform, except where applicable law does not allow that restriction; or
• misrepresent your identity, your organisation or your affiliation when registering for or using the Services.

Nothing in this Policy prevents ordinary indexing of publicly available website pages by recognised search engines for search-result purposes, provided they comply with our robots.txt and do not extract, republish, train on, or build datasets from Wren Data or Platform content.

3. Use of Wren Data

The Data Licence and Customer Suppression Schedule and section 8 of the Terms govern what you may do with Wren Data. In summary, and without limiting those documents, you must not:

• use Wren Data after the Data Licence ends, or beyond the permitted number of campaign or operational uses;
• sell, license, publish, disclose or otherwise supply Wren Data to another organisation, or allow an affiliate or client to use it for its own purposes;
• use Wren Data to provide list rental, data brokerage, directory, lookup, automated matching, verification, append, cleansing or enrichment services to third parties, except where we have expressly approved that data-brokerage or resale use in writing;
• use the Services or Wren Data to build or improve a competing database, directory or data product;
• upload, submit or otherwise make Wren Data available to an external artificial-intelligence, machine-learning or automated decisioning tool for enrichment, scoring, profiling, automation, training, testing, evaluation, fine-tuning or model improvement without our written permission; or
• use Wren Data for unlawful discrimination, harassment, fraud, surveillance, tracing individuals for personal reasons, law-enforcement or investigatory purposes, or any high-risk decision-making, profiling or eligibility assessment, including in relation to credit, insurance, employment, housing, healthcare, education, benefits or access to essential services.

4. Marketing and communications

You are responsible for the lawfulness of every communication you send using Wren Data. You must not use the Services or Wren Data to:

• send consumer, household or personal marketing; Wren Data is supplied for B2B and business-contact use only;
• send campaigns about regulated, sensitive or higher-risk products or services without our prior written permission, including financial products, medical or health products, gambling, adult services, political campaigning, debt recovery, legal claims, or any substantially similar activity;
• send communications without an appropriate lawful basis, or in breach of the UK GDPR, the Data Protection Act 2018 or the Privacy and Electronic Communications Regulations 2003;
• send communications to a contact who has objected, opted out or asked to be suppressed, or without carrying out the preference-service and suppression checks required by section 8 of the Terms;
• evade, disable or work around suppression, opt-out, unsubscribe, data-subject-rights, preference-service or compliance controls, or configure campaigns, exports or integrations for that purpose;
• send communications that conceal or misrepresent the identity of the sender, or that omit a valid means of opting out where one is required;
• send spam, mail-bombing, excessive, repetitive or harassing communications, use misleading subject lines, spoof sender details, or continue contacting a person after an objection, opt-out or clear request to stop;
• use Wren Data in a way that is likely to damage Wren’s sender reputation, domain reputation, brand reputation, infrastructure, data-source relationships or deliverability;
• send unsolicited communications of a kind that the recipient is entitled to refuse; or
• send content that is unlawful, defamatory, obscene, deceptive, fraudulent, or that promotes unlawful activity.

Where you use Wren Data for outreach, you must keep reasonable records showing your lawful basis, suppression checks, preference-service screening, campaign configuration and opt-out handling. We may ask for reasonable evidence of those records where we receive a complaint, need to investigate suspected misuse, or need to protect Wren, a data subject, a data source, or the Services.

5. Customer Data you upload

When you upload Customer Data to Pulse or any other feature, you must not upload:

• data you do not have the right or lawful basis to provide to us;
• third-party purchased lists, rented lists, scraped datasets or brokered data unless you have confirmed that you have a lawful basis and the right to provide that data to Wren for the requested processing;
• special category data (UK GDPR Article 9), criminal-offence data, payment-card data, passwords or authentication secrets, medical information, or data concerning children, unless we have agreed in writing in advance;
• data subject to a confidentiality duty owed to a third party that would be breached by providing it to us; or
• unlawful material, or data that the Services are not designed to handle.

Pulse is not an archival or backup service. You are responsible for keeping your own source and backup copies.

6. Outbound integrations and connected accounts

This section applies where you ask us to send Wren Data to a third-party platform or account that you select and control. Section 15 of the Terms sets out the full position; the following are use rules. Integrations are not a route for uploading Customer Data to Wren.

You must not:

• connect a third-party account that you do not own or are not authorised by its owner to connect;
• connect an account, or configure an integration, in a way that breaches your agreement with that provider or a duty you owe to another person;
• use an integration to extract, copy or route Wren Data to an organisation, account or purpose not permitted by your Data Licence;
• grant an integration a level of access materially wider than the integration needs to function, or continue to allow access after you no longer use the integration;
• share, reuse or embed integration credentials or tokens outside the integration they were issued for; or
• enable an integration against a production environment without first satisfying yourself that the configuration behaves as you intend.

You must tell us promptly if you believe an integration credential has been compromised, or if an integration is writing data in a way you did not intend.

7. Security and responsible disclosure

You must keep Account credentials secure, apply the security controls we reasonably require, and tell us promptly if you know or suspect that an Account has been compromised.

If you discover a security vulnerability in the Services, please report it to security@wren-data.co.uk rather than disclosing it publicly or exploiting it. We will not pursue a claim under this Policy against someone who investigates and reports a vulnerability in good faith, without accessing or altering another customer’s data, and who gives us a reasonable opportunity to address the issue before disclosure.

8. Reporting a breach of this Policy

If you believe someone is using the Services in breach of this Policy, contact hello@wren-data.co.uk with enough detail for us to investigate. Concerns about how personal data has been used should be sent to dpo@wren-data.co.uk.

9. Enforcement

If we reasonably believe this Policy has been breached, we may investigate, and we may take any of the steps available to us under sections 21 and 22 of the Terms, including suspending an Account, feature or integration, and ending the contract.

The Terms also allow us to close or disable an Account, cancel a Subscription, refuse a new Order, or refuse future registration or access at our discretion, including where continuing to provide the Services would create an unacceptable commercial, operational, legal, security, compliance, reputational or conduct risk for Wren.

We may withhold, delay, suspend, reject or refuse an export, campaign, integration, upload, request or instruction where we reasonably believe it is unlawful, abusive, harmful, technically unsafe, outside the intended scope of the Services, outside your Data Licence, or likely to breach this Policy, the Terms, data protection law, marketing law, a regulator’s requirement, a third-party right, or an agreement we have with a third party.

Where practical and lawful, we will explain the reason and give you an opportunity to correct the problem first. We may act without prior notice where the breach presents an immediate security, legal or operational risk, involves suspected fraud or unauthorised access, or where a regulator, court or public authority requires it.

We may also preserve and disclose information where we are legally required to do so, or where it is reasonably necessary to investigate a suspected breach, protect our rights, or protect another person from harm.

10. Changes to this Policy

We may update this Policy in accordance with section 27 of the Terms. The current version is always published at this address, and the version history is recorded in the document header.

11. Contact

Questions about this Policy can be sent to hello@wren-data.co.uk.