Terms and conditions

These terms position our partners and suppliers to be fully responsible for their operational risks and personnel. By aligning on these global standards—ranging from data privacy to ethical sourcing—we create a robust, transparent, and secure environment for international procurement. This consistency ensures that our fundamental expectations of transparency, security, and legal accountability are met in every partnership.

Contractual Governance

Our engagements are governed by a clear Order of Precedence. These are generic terms of our transaction. However, if you have entered into a separate, written, and signed agreement with [Company Name] for specific services or products (a “Signed Contract”), the terms of that Signed Contract shall take precedence. In the event of any direct conflict between these Terms of Use and the Signed Contract, the provisions of the Signed Contract shall govern and control.

Financial & Invoicing Standards

Payment Cycles: We commit to settling undisputed, valid invoices within agreed terms of receipt.
Accuracy Requirements: To facilitate prompt payment, all invoices must be accurate and clearly reference the relevant Purchase Order number.
Pricing Stability: Agreed fees are fixed for the duration of the contract term and are inclusive of all expenses unless expressly authorized in writing.

Operational Integrity & Security

Professionalism: Suppliers are expected to perform with the high level of skill, care, and diligence defined as Good Industry Practice.
Data Protection: All Suppliers who access, handle, or process personal data on behalf of Williams Lea must comply with the data protection obligations set out in Section 7 below.
Access Controls: Access to personal data and Williams Lea systems must be granted on a strictly need-to-know basis and managed through appropriate authentication mechanisms, including role-based access controls. Access must be promptly revoked upon termination of a Supplier’s engagement or the departure of any individual from the Supplier’s organisation.
Resilience: We require suppliers to maintain verified Disaster Recovery and Business Continuity plans to ensure service stability. We reserve the right to perform periodic security audits to verify compliance.

Intellectual Property & Confidentiality

Ownership: Unless otherwise specified, all Intellectual Property created during the provision of services vests in our company.
Confidentiality: Suppliers must protect all technical, commercial, and financial information disclosed during the partnership. This obligation of secrecy typically extends for five years following the disclosure.

Risk Management & Insurance

Indemnification: Suppliers are responsible for ensuring their deliverables do not infringe upon third-party intellectual property rights and must indemnify us against such claims.
Insurance Coverage: We require our partners to maintain adequate Public Liability, Products Liability, and Professional Indemnity insurance.
Liability Framework: While we utilize liability caps based on contract value, these limits are designed to balance risk and encourage responsible service delivery.

Ethical Standards & Global Compliance

Human Rights: We maintain a zero-tolerance policy toward forced labor, child labor, and discrimination. All suppliers must adhere to our Supplier Code of Conduct.
Anti-Corruption: Partners must comply with all international anti-bribery regulations, ensuring that all business dealings are conducted with the highest level of integrity.

Data Protection

This Section sets out Williams Lea’s baseline data protection requirements. Where a full Data Processing Agreement exists between the parties, that agreement governs in place of this Section. Jurisdiction-specific obligations, including those arising under the GDPR, UK GDPR, CCPA, PIPEDA, DPDPA, PDPA, APPI, PIPA, PIPL, and other applicable laws, are addressed in the local terms linked at the foot of this page.

Role Identification: Where a Supplier processes personal data solely on behalf of and in accordance with the instructions of Williams Lea, the Supplier acts as a data processor and Williams Lea acts as the data controller. Suppliers must not process personal data for any purpose beyond the fulfilment of the relevant Purchase Order or Signed Contract. Where the nature of the data relationship is unclear, the parties must agree roles in writing before processing commences.
Documented Instructions & Purpose Limitation: Suppliers must process personal data only in accordance with Williams Lea’s documented written instructions. If a Supplier considers that any instruction would require it to act in breach of applicable data protection law, it must notify Williams Lea immediately in writing before acting on that instruction.
Personnel Confidentiality: Suppliers must ensure that all individuals authorised to access or process personal data on behalf of Williams Lea are bound by enforceable confidentiality obligations, whether contractual or statutory, prior to being granted such access.
Security Measures: Suppliers must implement and maintain technical and organisational measures appropriate to the risk, including as a minimum: encryption in transit and at rest; pseudonymisation where appropriate; controls ensuring ongoing confidentiality, integrity, availability, and resilience of processing systems; the ability to restore timely access to personal data following an incident; and a process for regularly testing and evaluating the effectiveness of those measures.
Sub-Processors: Suppliers must not engage any sub-processor to process personal data on behalf of Williams Lea without prior written authorisation. Where general authorisation has been granted, Suppliers must provide advance notice of any intended changes, giving Williams Lea a reasonable opportunity to object. All sub-processors must be bound to obligations no less protective than those in these Terms, and Suppliers remain fully liable for their sub-processors’ performance.
Data Subject Rights: Suppliers must assist Williams Lea, by appropriate technical and organisational measures, in fulfilling obligations to respond to individuals exercising their rights under applicable law, including rights of access, rectification, erasure, restriction, portability, and objection. Any data subject rights request received that relates to Williams Lea-held data must be promptly forwarded to Williams Lea.
Breach Notification: Suppliers must notify Williams Lea without undue delay, and in any event within 24 hours of becoming aware, of any confirmed or reasonably suspected personal data breach. Notification must include, to the extent then known, the nature of the breach, categories and volume of data and individuals affected, likely consequences, and steps taken or proposed. Suppliers must cooperate fully with any investigation and must not make any public statement or regulatory notification in respect of the breach without Williams Lea’s prior written consent, except where required by law.
Compliance Assistance: Suppliers must provide Williams Lea with all reasonable assistance to meet its obligations under applicable data protection law, including in respect of security, breach notification, Data Protection Impact Assessments (DPIAs), and any required consultation with supervisory authorities. Suppliers must proactively flag any processing activity that may give rise to a high risk to individuals’ rights and freedoms.
Data Protection by Design & Default: Suppliers must embed data protection by design and by default into all systems, services, and processes used to deliver services to Williams Lea, ensuring that only personal data necessary for each defined purpose is processed.
Retention, Return & Deletion: Upon expiry or termination of the relevant Purchase Order, Signed Contract, or written instruction, or upon Williams Lea’s earlier request , Suppliers must within 30 days either securely return all personal data in a machine-readable format or securely and irreversibly delete it, and provide written certification confirming this has been done. Retention beyond this period is only permissible where required by applicable law, and Suppliers must notify Williams Lea of any such obligation.
Records of Processing: Suppliers must maintain accurate and up-to-date records of all processing activities carried out on behalf of Williams Lea, as required by applicable law, and make these available to Williams Lea or any competent supervisory authority upon request.
International Transfers: Suppliers must not transfer personal data to any country or territory outside the jurisdiction in which it was collected without Williams Lea’s prior written consent and unless an appropriate lawful transfer mechanism is in place, such as an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or equivalent. Jurisdiction-specific transfer requirements are addressed in the local terms linked below.
Audit Rights: Suppliers must make available all information necessary to demonstrate compliance with these Terms and must permit and contribute to audits or inspections conducted by Williams Lea or a mandated third-party auditor, at reasonable intervals or where there are reasonable grounds to suspect non-compliance. Williams Lea may take into account relevant certifications or approved codes of conduct held by the Supplier in lieu of or alongside a direct audit.