What a customer success software commercial contract means for UK buyers

What to take away

What to take away

Does the controller and processor split change your contract?

Read this clause first. The ICO's controllers and processors guidance explains that the controller decides why and how personal data is processed, while the processor acts on documented instructions. Under UK GDPR Article 28(3), the written contract must set out the subject matter and duration, nature and purpose, types of personal data and categories of people, and the controller's rights and obligations; it must also cover instructions, confidentiality, security, sub-processors, assistance, audits and return or deletion. The Data Protection Act 2018 supplements the UK GDPR.

A success platform usually processes contact records and support tickets for you. The contract needs a processing schedule, defined purposes, retention periods and breach notification duties.

Ask where the data sits as well. A transfer outside the UK may be a restricted transfer: use an appropriate safeguard, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and complete any required transfer risk assessment. The schedule should name each sub-processor rather than a category of them.

If the vendor wants your data for its own product development, that is a separate purpose with its own lawful basis. Our guide to customer success software data protection covers the records to keep.

Are auto-renewal and exit terms fair?

Not always. A rolling twelve-month renewal with a ninety-day notice window can lock a team into another year before the budget cycle starts. Check the notice period against your own calendar, not the vendor's.

Diarise that date on day one. Teams lose more money to a missed notice window than to any licence uplift.

Exit terms should cover export in a usable format, deletion confirmation and transition support. For example, a team paying £2,000 a month could face two extra payments if notice slips by a week. That figure is illustrative, not a market rate.

What does pricing structure tell you?

Pricing structure shows how the vendor expects you to grow. Seat-based pricing punishes wider adoption, while usage-based pricing punishes a quiet quarter.

A contract should state the charging metric, what each licence includes, any usage limits and overage rates, and when prices can change. Compare those terms with your expected headcount and usage over the full term.

Model the whole term, not the first year. Implementation fees, integration work and extra modules decide the real cost, while a first-year discount often masks a rise in year two.

How should AI features be disclosed?

Disclosure should be plain. Ask whether the tool suggests replies, routes tickets or makes decisions with legal or similarly significant effects. Where a decision is solely automated and has such effects, UK GDPR Articles 22A to 22D, which replaced Article 22 from 5 February 2026, may apply; the ICO's guidance on automated decision-making and profiling explains the safeguards.

HubSpot describes an AI customer agent for lead generation and ticket resolution. That shows how vendors frame these tools. Your contract should say whether models are trained on your data and whether the feature can be switched off.

Ask what testing the vendor runs on automated outputs, and how a customer reaches a human. A route to review matters more than an accuracy claim.

Decision table

What should you check before signing?

Check the term, notice period, price review clause and exit plan. Check who owns configuration data and custom objects, and whether the vendor can change terms unilaterally.

Limit your exposure too. Check the liability CAP, the service credit regime and how disputes escalate. A CAP set at twelve months of fees rarely covers a serious data incident.

For a wider view of how law and ethics shape buying, read the customer success software UK rules and compliance guide. It sets out the framework this list sits inside.

This is general guidance only, so take advice from a qualified solicitor before signing.

Common questions

Who is the controller in a customer success software contract?

Your organisation is normally the controller, because it decides why customer data is processed. The vendor is normally the processor, and the contract must record that split.

Can a vendor increase prices mid-term?

Only if the contract allows it. A price review clause may permit an annual increase tied to an index. Ask what happens if you refuse.

What happens to your data at the end of the term?

It depends on the exit clause. A good one gives you an export window, a defined format and written confirmation of deletion.

Does Scotland or Northern Ireland change the position?

Data protection law applies across the United Kingdom, but court procedures differ. Take advice in the jurisdiction where a dispute would be heard.