UK Mailing Terms

General Terms and Conditions

Value Added Services (Mailing)

Stord Europe Ltd · Version 1.0 · September 2026

1. Scope

1.1 These General Terms and Conditions for Value Added Services (the “VAS Terms”) govern the relationship between the Customer and Stord Europe Ltd (“Stord”) in relation to the value added services provided by Stord, including mailing, print, personalisation, lettershop, enclosing, data processing and related project-based fulfilment services (the “VAS”). The Data Processing Addendum at Appendix 1 forms part of these VAS Terms.

1.2 These VAS Terms do not apply to warehousing, freight, parcel or software services, which are governed by Stord’s Consolidated Terms and Conditions available at stord.com/legal/terms together with the applicable regional provisions. Where Stord provides both VAS and other services to the Customer, the terms applicable to each service apply respectively. Where the Customer has entered into a separate Service Agreement with Stord, these VAS Terms supplement that agreement in respect of VAS only and, to the extent of any conflict in respect of VAS, these VAS Terms prevail.

2. Definitions

In these VAS Terms:

“Carrier” means a postal operator, downstream access provider or other carrier nominated by Stord, or nominated by the Customer and agreed in writing by Stord, for the conveyance or delivery of Mail.

“Contract” means the contract for the provision of VAS formed in accordance with Section 3, comprising the accepted Quotation, these VAS Terms and Appendix 1.

“Dangerous Goods” means articles, materials, goods and liquids identified as dangerous goods under the Technical Instructions issued by the International Civil Aviation Organization (ICAO), the Dangerous Goods Regulations of the International Air Transport Association (IATA), the International Maritime Dangerous Goods (IMDG) Code, the Carriage of Dangerous Goods and Use of Transportable Pressure Equipment Regulations 2009, the European Agreement concerning the International Carriage of Dangerous Goods by Road (ADR), and the Universal Postal Union Convention and its regulations, each as amended from time to time.

“Excluded Mail” means Dangerous Goods, items subject to legal export restrictions or prohibitions, and items sent to or by a person subject to embargo rules or international sanctions imposed by the United Nations, the United Kingdom, the European Union or any other applicable authority.

“Mail” means letters, documents, goods, parcels and other items produced, packaged and addressed by Stord in the course of providing the VAS.

“Materials” means marketing, advertising, promotional, fulfilment, goods, data and other materials provided or approved by the Customer for the provision of the VAS, including printed matter produced by Stord on behalf of the Customer.

“Order” means a Quotation accepted by the Customer in accordance with Section 3.

“Quotation” means a written cost estimate issued by Stord for a specific VAS project, setting out the specification, quantity, timings and fees.

3. Quotations, Orders and Formation of the Contract

3.1 A Quotation is an offer by Stord to supply VAS. It is valid for thirty (30) days from its date and is exclusive of Value Added Tax, which is charged at the prevailing rate where applicable.

3.2 A Contract is formed, and the Quotation becomes an Order, upon the earlier of: (a) the Customer’s written acceptance of the Quotation, whether by signature or by email confirmation; or (b) the Customer, or a third party on the Customer’s behalf, handing over Mail or Materials to Stord for the provision of the VAS. Each Order constitutes a discrete Contract for the project described in it.

3.3 The Contract is made only on these VAS Terms. Deviations do not apply unless agreed in advance in writing between the Parties. The Customer’s own purchase conditions or general terms and conditions do not apply, and any additional or conflicting terms proposed by the Customer in a purchase order, invoice or other document are deemed rejected.

3.4 Where the Customer is new to Stord, the Customer shall complete Stord’s account application and satisfy Stord’s credit approval process before Stord commences work under the first Order. Once an account is established and remains in good standing, subsequent Orders require the Customer’s acceptance of the applicable Quotation but no further account documentation.

3.5 A Quotation is given subject to Stord’s sight of the Materials and confirmation that they are suitable for the VAS quoted. If Materials received after formation of the Contract are unsuitable, Stord may amend the fees or the delivery dates, or terminate the Contract.

3.6 The fees in a Quotation are based on a uniform run of the Materials in the quantity requested. Any variation in quantity will give rise to a variation in the fees in accordance with the rates set out in the Quotation or otherwise available from Stord.

4. Fees and Payment

4.1 Unless different payment terms have been agreed in writing, the Customer shall pay the fees in advance or, at the latest, on handing over the Mail or Materials to Stord. Where the Customer places Orders on a regular basis, the Parties may agree payment by invoice, in which case invoices are payable within seven (7) days of the invoice date. The Customer accepts Stord’s data as the basis for invoicing.

4.2 In the case of late payment, partial payment or rejection of a payment order, Stord may charge default interest at the rate of 1.5% per month or the maximum rate permitted by applicable law, whichever is lower, together with compensation for reasonable recovery costs including legal fees and debt collection costs. Nothing in this Section limits any entitlement to statutory interest and compensation under the Late Payment of Commercial Debts (Interest) Act 1998.

4.3 If the Customer’s open accounts receivable exceed £10,000 (the “Credit Limit”), Stord may suspend the VAS until the Customer’s balance is reduced to at least half of the Credit Limit. The Credit Limit may be increased by mutual written agreement where the Customer establishes a pattern of timely payment.

4.4 The Customer shall not set off any claim it may have against Stord against any sum due to Stord, unless the claim is undisputed or has been confirmed in a final, non-appealable judgment.

5. Materials and Data

5.1 The Customer shall, at its own expense, provide Materials of adequate quantity for the provision of the VAS, together with a delivery note describing each type of Materials and the quantities delivered. For fulfilment and printing services the Customer shall provide an excess of three per cent (3%) of Materials for machinery spoilage, unless otherwise agreed in writing.

5.2 Where Stord is to print any text or image, the Customer shall supply it in a medium agreed by the Parties and is responsible for its accuracy and its compliance with applicable law. Stord may, but is not obliged to, correct typographical or other errors in Materials it prints, without liability to the Customer.

5.3 Where the Customer supplies data in electronic format, the Customer warrants that the data is clean, unaltered, free of computer viruses and capable of being read and processed by Stord; that its format is unambiguous and is accompanied by written instructions for interpretation; that the Customer has retained a copy of the original file; and that the Customer has checked the accuracy of the data and its compliance with Section 10. Stord is not responsible for checking that accuracy or compliance unless otherwise agreed in writing, but will notify the Customer of any inaccuracy or non-compliance it discovers.

5.4 If data is supplied in breach of Section 5.3, Stord may in its discretion process the data as supplied, in which case the Customer accepts the results with any resulting defects; require the Customer to supply fresh data within a reasonable period; take corrective action at the Customer’s expense; or reject the data and terminate the Contract, in which case the Customer shall pay Stord’s costs incurred to the date of termination.

5.5 Stord may reject any Materials that appear to Stord to be unsuitable for the VAS, and shall reject any Materials constituting Excluded Mail. The Customer authorises Stord to return, remove, dispose of or destroy at the Customer’s cost any Dangerous Goods included in the Materials. The Customer remains responsible towards Stord and any third party where Excluded Mail is handed over, and shall indemnify Stord against any claim, damage, litigation, cost or expense arising from it, independently of any scanning or other security control carried out by Stord or its subcontractors.

5.6 Stord is not required to print, distribute or handle any Materials which in its reasonable opinion may be illegal, indecent or libellous, or which might infringe third party rights or expose Stord to criminal or tortious liability. The Customer warrants that the Materials do not infringe the copyright or other rights of any third party and are not counterfeit, and shall indemnify Stord against any losses, damages, costs, expenses or claims arising from any such infringement. Stord is under no obligation to examine Materials as to quality, quantity, accuracy, legality or suitability.

6. Proofs

6.1 Stord shall provide the Customer with a proof of any text to be printed and, on request, a first proof of the print run. The Customer shall amend the proof if necessary and sign, date and return it to confirm approval. The Customer understands that unreasonable delay in returning an approved proof may delay delivery.

6.2 If further amendments or proofs are required because of errors made by the Customer or a third party, or because the Customer requires changes including to style, type, ink or method of packaging, the Customer is liable for the costs incurred and the fees shall be amended accordingly.

6.3 Stord is not responsible for any error in a proof that the Customer has approved, and such an error does not entitle the Customer to reject the Materials or to terminate the Contract.

7. Storage and Disposal of Materials

7.1 As soon as practical after formation of the Contract, the Parties shall agree a date or dates for delivery of the Materials to Stord. If no date can be agreed, Stord shall notify the Customer of a delivery date enabling Stord to perform its obligations, and the Customer shall procure delivery accordingly.

7.2 Materials stored for mailings are subject to Stord’s then-current pallet-per-week storage rate from the date of receipt.

7.3 Following completion of an Order, Stord shall at the Customer’s expense return the remaining Materials to the Customer or its nominee or, if agreed with the Customer, dispose of or recycle them. If the Customer has not provided disposition instructions and has not collected its stock within twenty-one (21) days of completion, Stord may thereafter recycle or dispose of the remaining Materials and recharge its reasonable costs to the Customer.

7.4 Where postponement of delivery is agreed by the Parties, the Customer shall pay any resulting costs and expenses, including Stord’s storage charges, and the Materials are held at the Customer’s risk from the date of postponement.

7.5 When attending Stord’s facilities, the Customer shall ensure that its employees and subcontractors comply with the site’s health, safety and security regulations.

8. Delivery and Completion

8.1 Stord will use reasonable endeavours to deliver the VAS on or before the dates estimated in the Contract, but unless the Contract expressly provides otherwise those dates constitute statements of expectation only and are not binding on Stord. The date of delivery is not of the essence of the Contract unless otherwise expressly agreed in writing.

8.2 Any unforeseen overtime or waiting time costs incurred by Stord, or by a third party entrusted by the Customer, in seeking to achieve the delivery dates shall be paid by the Customer and shall not be subject to penalties.

8.3 In accordance with the custom and practice of fulfilment and printing services, Stord is deemed to have complied fully with its obligations under the Contract if it delivers a quantity of Materials within plus or minus three per cent (3%) of the quantity ordered. The fees shall reflect delivered quantities.

8.4 Where delivery is made in batches, each delivery constitutes a separate enforceable Contract for which Stord may issue and be paid a separate invoice. Failure to make one or more deliveries does not affect the enforceability of the Order as to the remaining deliveries.

9. Postal and Downstream Access Services

9.1 Where the VAS include the induction of Mail into a postal network, including by way of downstream access, the Customer accepts Stord’s delivery aims, process specifications and cut-off times as notified from time to time. Unless otherwise agreed between the Parties, the Carrier and the routing are chosen by Stord in its sole discretion.

9.2 Stord is not a carrier and does not assume carrier liability. Delivery aims quoted by Stord or by a Carrier, including any premium or timed service, are estimates only and are not guaranteed. Stord’s liability for loss, damage or delay to Mail arising after the Mail has been handed to a Carrier is limited to the amount actually recovered by Stord from the applicable Carrier, subject in all cases to Section 12. For international road transport, the CMR Convention applies to the extent mandated by law.

9.3 Stord does not screen the Mail entrusted to it and may pass that responsibility to a third party. Stord may charge the Customer for any screening service undertaken by a third party for security purposes.

10. Data Protection

10.1 Stord shall process any Personal Data provided by the Customer in accordance with the Data Processing Addendum at Appendix 1, which is incorporated into these VAS Terms. In relation to that Personal Data the Customer acts as controller and Stord acts as processor, and both Parties shall comply with the UK General Data Protection Regulation and the Data Protection Act 2018.

10.2 The Customer warrants that it has complied with all applicable laws and regulations relating to the protection of personal data, that those laws permit the provision of the Personal Data to Stord and its processing by Stord for the performance of the VAS, and that all necessary notices have been given and lawful bases established in respect of the individuals whose data is to be processed. The Customer shall indemnify and hold Stord harmless from any claims made against Stord by third parties arising from non-compliance.

11. Claims

11.1 The Customer shall notify Stord in writing of any loss of or damage to the Materials within one (1) month from the date on which the Materials were handed over to Stord.

11.2 Within fourteen (14) days of that notification, the Customer shall document the claim and provide Stord with all relevant information in support of it.

11.3 Stord will examine the claim provided that all fees due in connection with the affected Order have been paid in full.

11.4 Stord may request inspection of the damaged Materials and of the packaging in which they were handed over or delivered, and the Customer shall preserve them and make them available for that purpose.

11.5 No claim may be brought later than one (1) year from the date of completion of the Order or, where the Order was not completed, the date on which the Order should have been completed.

12. Liability

12.1 Stord has no liability to the Customer for any loss, damage, costs, expenses or claims arising from Materials which are incomplete or damaged on delivery to Stord, from instructions supplied by the Customer which are incomplete, incorrect, inaccurate, illegible or ambiguous, or from the late delivery or non-arrival of Materials or any other fault of the Customer or a third party.

12.2 Where the relevant VAS comprise Materials held in storage, Stord’s liability for any loss, damage or spoilage to those Materials is limited to the proven damage and shall not exceed the lower of: (a) £100 per kilo gross weight lost or damaged, up to a maximum of £1,000; (b) the purchase cost for a reseller or the production cost for a producer; (c) the repair cost where the item is damaged; or (d) the market value of the item, not including the market value of any message or information that it carries. The Customer is responsible for insuring the Materials for all risks exceeding these thresholds in accordance with Section 13.

12.3 Subject to Section 12.5, Stord is not liable for any loss of profit, loss of revenue, loss of business, loss of anticipated savings, loss of business opportunity, loss of goodwill, damage to reputation, wasted expenditure, or any indirect or consequential loss, damage, costs, expenses or claims, whether arising directly or indirectly and whether caused by the negligence of Stord, its employees or agents or otherwise, arising out of or in connection with the VAS. In any event, Stord’s entire liability under or in connection with a Contract is limited to the proven loss or damage and shall not exceed the lower of the total invoice value of the VAS for the work in question, excluding postage charges, or £5,000.

12.4 If, notwithstanding that Stord has used reasonable endeavours, Stord fails to despatch or deliver the Materials to the Carrier or to deliver Materials by the dates set out in the Contract, that failure does not constitute a breach of the Contract unless expressly agreed otherwise in writing, and the Customer is not entitled to rescind or repudiate the Contract or to claim compensation for it.

12.5 Nothing in these VAS Terms excludes or limits liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; or (c) any other liability that cannot be excluded or limited under applicable law, including under the Unfair Contract Terms Act 1977.

12.6 Each Party acknowledges that the limitations and exclusions in these VAS Terms are reasonable having regard to the circumstances and that they have been taken into account in determining the fees.

13. Insurance and Risk

13.1 The Customer is responsible for insuring the Materials whilst on Stord’s premises, for all risks including fire, spoilage, accidental loss or damage, and risks in transit. All Materials are delivered to and stored by Stord at the sole risk of the Customer, and Stord has no liability other than as set out in Section 12.

13.2 Stord shall maintain employer’s liability insurance with a limit of not less than £5,000,000 as required by the Employers’ Liability (Compulsory Insurance) Act 1969, and public liability insurance with limits of not less than £1,000,000 per occurrence and £2,000,000 in the aggregate.

14. Force Majeure

14.1 If Stord is prevented or hindered from providing the VAS by any circumstances beyond its reasonable control, including fire, flood, civil strife, legislation, delays in transit, shortages of or breakdown of plant, delay by suppliers, trade disputes or epidemic, further performance is suspended for so long as Stord is so prevented or hindered. If performance is suspended for more than thirty (30) days, either Party may terminate the Contract or cancel any outstanding part of it by written notice, in which case the Customer shall pay at the Contract rate for all Materials supplied and all work done to the date of termination.

14.2 Stord has no liability to the Customer for any direct or consequential loss or damage suffered as a result of such suspension, and may make a reasonable charge for any expenses it incurs as a result.

15. Confidentiality

15.1 Each Party shall keep in strict confidence all technical, financial and commercial information, specifications, inventions, processes and information relating to strategy disclosed, or collected incidentally, in connection with the Contract (“Confidential Information”), and shall restrict disclosure to those of its employees, agents and subcontractors who need to know it for the purposes of the VAS.

15.2 Confidential Information does not include information that is or becomes generally available to the public other than through a disclosure in breach of the Contract, that is received on a non-confidential basis from a source authorised to disclose it, or that is required to be disclosed by applicable law or by a competent jurisdiction or authority, in which case the recipient Party shall inform the other Party as soon as practically and legally possible.

15.3 Each Party shall protect the other’s Confidential Information in the same manner and to the same degree as it protects its own, and in any event with reasonable care. These obligations remain in effect for three (3) years after the expiry or termination of the Contract.

16. Lien

Without prejudice to other remedies, Stord has a general and particular lien over all Mail and Materials in its possession, whether worked upon or not, in respect of all unpaid sums due from the Customer. If any amount remains unpaid for more than sixty (60) days after the due date, Stord may, after giving the Customer not less than fourteen (14) days’ written notice, sell or dispose of all or part of the Mail and Materials and apply the proceeds towards the sums due, in accordance with the Torts (Interference with Goods) Act 1977. Any surplus shall be paid to the Customer. Unless expressly stated otherwise in writing, Stord will not subordinate its lien to any lender, financial institution or other third party.

17. Termination

17.1 Either Party may terminate a Contract by written notice if the other Party commits a breach of these VAS Terms and, where the breach is capable of remedy, fails to remedy it within fifteen (15) days after being required by written notice to do so. Either Party may also terminate by written notice if the other Party goes into liquidation, has a receiver or administrator appointed, becomes bankrupt or makes a voluntary arrangement with its creditors.

17.2 An Order completes on delivery and payment in full, and neither Party is required to give notice to bring a completed Order to an end. Nothing in these VAS Terms obliges the Customer to place, or Stord to accept, any further Order. On termination, the Customer shall arrange removal of any Materials stored by Stord within fifteen (15) days, failing which Section 7.3 applies.

18. Subcontracting

Stord may subcontract part or all of the provision of the VAS without affecting its liability to the Customer, and may process the Materials at premises other than those at which they were handed over. Stord shall inform the Customer of the processing location on request.

19. General

19.1 These VAS Terms, together with the applicable Quotation and Appendix 1, constitute the entire agreement between the Parties in respect of the VAS and supersede any previous contract, understanding or practice in respect of the VAS.

19.2 Stord may change these VAS Terms from time to time in its sole discretion. Any changes are effective immediately upon publication at the applicable website location, or as otherwise mutually agreed by the Parties in writing, and apply to any Order accepted after publication. The version of these VAS Terms applicable to an Order is the version published at the time the Quotation for that Order was issued.

19.3 Each Party shall comply with all applicable laws, statutes and regulations relating to anti-bribery and anti-corruption, including the Bribery Act 2010, and with all applicable trade sanctions and export control laws. The Customer shall not hand over to Stord any Mail or Materials sent to or by a person subject to embargo rules or international sanctions.

19.4 Any invoice, notice or other document given under the Contract is deemed duly served if delivered by hand or sent by first class post to Stord at its registered office or to the Customer at the address set out in the Contract.

19.5 No failure or delay by either Party in exercising its rights under the Contract is a waiver of those rights, and no waiver of any breach is a waiver of any subsequent breach of the same or any other provision.

19.6 If any provision of these VAS Terms is held by a competent authority to be invalid or unenforceable in whole or in part, the validity of the remaining provisions and of the remainder of that provision is not affected.

19.7 The Contract may be executed or accepted in any number of counterparts, including by electronically transmitted or electronically accepted versions.

20. Governing Law and Jurisdiction

The Contract between the Customer and Stord is governed by the laws of England and Wales. The Parties submit to the exclusive jurisdiction of the courts of England and Wales in respect of all disputes arising from or in any way connected with the contractual relationship between them.

Appendix 1 Data Processing Addendum (Value Added Services — Mailing), set out below and incorporated into these VAS Terms.

Data Processing Addendum

Value Added Services (Mailing)

Appendix 1 to the Stord Europe Ltd General Terms and Conditions for Value Added Services · Version 1.0 · September 2026

This Data Processing Addendum (“DPA”) is entered into as part of the Contract between Stord Europe Ltd (“Processor”) and the Customer identified in the applicable Quotation (“Controller”), and forms Appendix 1 to Stord’s General Terms and Conditions for Value Added Services (the “VAS Terms”).

1. Definitions

Capitalised terms not defined in this DPA have the meanings given in the VAS Terms. “Data Protection Laws” means the UK General Data Protection Regulation (as defined in section 3(10) of the Data Protection Act 2018), the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003, and any legislation that replaces or supplements them. “Personal Data”, “Data Subject”, “processing”, “controller”, “processor” and “personal data breach” have the meanings given in the Data Protection Laws.

2. Scope and Roles

Controller determines the purposes and means of processing Personal Data in connection with the VAS. Processor processes Personal Data solely on behalf of Controller in accordance with Controller’s documented instructions and this DPA. The details of processing are set out in Schedule 1.

3. Controller Obligations

Controller shall: (a) comply with its obligations under Data Protection Laws with respect to the Personal Data it provides to Processor; (b) ensure it has a lawful basis for providing Personal Data to Processor and for the processing contemplated by the Contract, including, where the VAS comprise direct marketing mailings, ensuring that all necessary notices have been given and any required consents or lawful bases are in place in respect of the Data Subjects; and (c) inform Processor without undue delay of any changes that may affect Processor’s processing obligations.

4. Processor Obligations

Processor shall:

(a) process Personal Data only on Controller’s documented instructions, unless required to do so by applicable law, in which case Processor shall (to the extent permitted by law) inform Controller before processing. Controller’s documented instructions include Processor’s right to anonymise Personal Data. Data that has been anonymised such that it cannot reasonably be used to identify or re-identify a natural person does not constitute Personal Data for the purposes of this DPA or the Data Protection Laws, and Processor may retain and use such anonymised data;

(b) ensure that persons authorised to process Personal Data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality;

(c) implement and maintain appropriate technical and organisational measures as described in Schedule 2 to protect Personal Data against unauthorised or unlawful processing and against accidental loss, destruction or damage, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing;

(d) not engage another processor (sub-processor) without Controller’s prior general written authorisation. Controller authorises the sub-processors and categories of sub-processor identified in Schedule 3. Processor shall maintain a current list of sub-processors and shall notify Controller of any intended changes at least 30 days in advance. If Controller objects on reasonable grounds within 15 days of notification, the parties shall discuss the objection in good faith. If the objection cannot be resolved, Controller may terminate the affected VAS on 30 days’ written notice. Processor shall impose on each sub-processor data protection obligations no less protective than those in this DPA;

(e) taking into account the nature of the processing, assist Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of Controller’s obligation to respond to requests from Data Subjects exercising their rights under Data Protection Laws;

(f) assist Controller in ensuring compliance with its obligations under Articles 32 to 36 of the UK GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of processing and the information available to Processor;

(g) notify Controller without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting Controller’s Personal Data. The notification shall include: (i) a description of the nature of the breach, including where possible the categories and approximate number of Data Subjects and Personal Data records concerned; (ii) the likely consequences of the breach; and (iii) the measures taken or proposed to address the breach and mitigate its possible adverse effects;

(h) at Controller’s choice, delete or return all Personal Data to Controller after the end of the provision of the VAS, and delete existing copies unless applicable law requires storage; and

(i) make available to Controller all information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by Controller or a qualified third-party auditor mandated by Controller (at Controller’s cost), subject to reasonable advance notice and conducted no more than once per calendar year (unless a personal data breach has occurred or a supervisory authority requires an additional audit). Processor may satisfy this obligation by providing a current third-party certification or audit report covering the requested scope.

5. International Transfers

Processor shall not transfer Personal Data outside the United Kingdom unless: (a) the transfer is to a country that the UK Secretary of State has determined provides an adequate level of protection; (b) the transfer is made in reliance on Processor’s certification under the UK Extension to the EU-U.S. Data Privacy Framework; or (c) appropriate safeguards are in place in accordance with Data Protection Laws, including the International Data Transfer Agreement issued by the Information Commissioner’s Office or the UK Addendum to the EU Standard Contractual Clauses, as applicable. The parties shall execute such additional transfer mechanism as may be required.

6. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions set out in the VAS Terms.

7. Precedence

In the event of any conflict between this DPA and the VAS Terms, this DPA shall prevail with respect to the processing of Personal Data.

Schedule 1: Details of Processing

Subject matter and duration: Processing of Personal Data in connection with the provision of Value Added Services (mailing) for the duration of the applicable Order and any agreed returns handling period.

Nature and purpose: Loading, converting and formatting address and personalisation data supplied by Controller; production of personalised printed matter; enclosing, sorting and despatch of Mail to recipients identified by Controller; and handling of returns and undeliverable items where instructed.

Categories of Data Subjects: Controller’s customers, prospects, members or other individuals who are the intended recipients of the Mail; and Controller’s employees and authorised contacts.

Personal Data, retention and access by service: The Personal Data processed, the applicable retention period and the persons having access depend on the services comprised in the applicable Order, as set out below.

Data processing and address cleansing. Personal Data: name, title and postal address; personalisation fields specified in the applicable Order. Retention: duration of the mailing. Access: Stord; data bureau sub-processors.

Printing and personalisation. Personal Data: name, title and postal address; personalisation fields specified in the applicable Order; customs information where the mailing is international. Retention: duration of the mailing. Access: Stord; print and print finishing sub-processors.

Lettershop, enclosing and finishing. Personal Data: name, title and postal address. Retention: duration of the mailing. Access: Stord; print finishing sub-processors.

Postal despatch and downstream access. Personal Data: name, title and postal address. Retention: duration of the mailing. Access: Stord; postal operators, downstream access providers and carriers.

Returns and undeliverables. Personal Data: name, title and postal address; email address or telephone number where Controller instructs Stord to contact the recipient. Retention: as agreed with Controller, and in any event no later than one month after the relevant mailing. Access: Stord; postal operators and carriers.

Where the applicable Order specifies narrower or additional categories of Personal Data for a particular job, the Order governs. Sub-processors referred to above are those identified in Schedule 3.

Obligations and rights of Controller: As set out in Section 3 of this DPA and as required by Data Protection Laws.

Schedule 2: Technical and Organisational Measures

Processor shall maintain at a minimum the following measures, updated from time to time to reflect the state of the art:

Access controls: role-based access, multi-factor authentication for administrative access, unique user credentials, principle of least privilege.

Encryption: encryption of Personal Data in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent).

Network security: firewalls, intrusion detection and prevention systems, regular vulnerability scanning and penetration testing.

Physical security: access controls at Facilities, CCTV monitoring, visitor logging.

Production environment: controlled access to print and mailing production areas, segregation of customer data files within the production workflow, and secure handling and destruction of physical media and surplus printed matter.

Business continuity: regular backups, disaster recovery procedures, documented incident response plan.

Personnel: background checks for personnel with access to Personal Data, regular data protection training.

Monitoring and logging: audit logging of access to systems containing Personal Data, regular review of logs.

Vendor management: due diligence and contractual protections for sub-processors.

Schedule 3: Approved Sub-Processors

A current list of Processor’s sub-processors is available at https://trust.stord.com/. For the provision of the VAS, Processor’s sub-processors additionally include printers and print finishing suppliers, data bureaux engaged for address cleansing or formatting, postal operators and downstream access providers, and carriers engaged for the transport of Materials and Mail between facilities.