Terms of Service
XMD Ltd - Digital Design, Development & Software Services - Last Updated: 13 June 2026
1. Introduction & Acceptance
These Terms of Service (“Terms”) constitute a legally binding agreement between XMD Ltd (“we”, “us”, “our”), operated by Xavaiyar Chaudry and Mutahir Khan, and you (“the Client”) in relation to the services and products we provide, including website design and development, search engine optimisation, our DirectServe online ordering platform, and our Lynx AI receptionist service.
By engaging our services, paying a deposit or full project fee, or instructing us to commence work, you confirm that you have read, understood, and agree to be bound by these Terms in their entirety. If you do not agree with any part of these Terms, you must not engage our services.
2. Services
XMD Ltd provides digital design, development, and software services including, but not limited to:
- Custom website design, development, and hosting
- Search engine optimisation (SEO) and SEO audits
- DirectServe - our online ordering platform for hospitality businesses, comprising the branded customer-facing ordering site, supporting software and dashboard, and associated ordering hardware
- Lynx - our AI receptionist service, providing automated call answering, appointment booking, and related customer communications
- Post-delivery amendments, maintenance, and ongoing support upon request
The specific scope of work, deliverables, fees, and any additional terms for a particular project or product will be agreed with the Client in writing prior to commencement. Any services not expressly agreed in writing are not included.
3. Payment Terms
All fees are due as set out in the written quotation or agreement provided to the Client. Unless otherwise agreed in writing, fees are payable prior to commencement of any work.
Fees vary according to the scope and complexity of the project or product selected, and may be adjusted by region. The exact fees - together with any deposit, setup fee, recurring subscription, hosting, support, or hardware charges - will be confirmed to the Client in writing prior to commencement.
Where a project or product includes recurring charges (such as monthly hosting, support, software, or subscription fees), these are payable on a recurring basis as set out in the written agreement. Failure to pay a recurring fee within 14 days of the due date may result in suspension of the affected services without further notice.
All fees are quoted and payable in Pounds Sterling (GBP) unless otherwise agreed in writing. For international clients, any currency conversion costs, bank charges, or transfer fees are the sole responsibility of the Client.
We reserve the right to withhold delivery of completed work, or to suspend access to any ongoing service, until all due payments have been received and cleared.
4. Revisions & Amendments
We offer unlimited revisions during the first 14 days following delivery of the completed website (the “Revision Period”). Revisions requested during this period are included at no additional cost.
Following the expiry of the Revision Period, all amendments, changes, or additions will be subject to a fee, which will be quoted to the Client before any chargeable work is undertaken. An amendment request constitutes each distinct set of changes submitted in a single instruction.
The following are not considered revisions and will be quoted separately: structural redesigns, addition of entirely new pages, integration of third-party systems not included in the original scope, or any work materially outside the original project specification.
5. DirectServe - Additional Terms
The following additional terms apply where the Client subscribes to DirectServe, our online ordering platform for hospitality businesses.
Payments. Customer payments for orders placed through the DirectServe ordering site are processed directly into the Client’s own nominated payment account (for example, Stripe). XMD Ltd does not receive, hold, or handle funds belonging to the Client or the Client’s customers, and is not a party to any transaction between the Client and their customers. The Client is responsible for their own payment provider account, its fees, and compliance with that provider’s terms.
Ordering hardware. Where DirectServe includes ordering hardware (the “DirectServe Till”), the terms of supply - including whether the hardware is sold outright or leased, ownership, and any deposit - will be set out in writing. Any leased hardware remains the property of XMD Ltd and must be returned in good condition (fair wear and tear excepted) upon termination. The Client is responsible for loss of or damage to leased hardware beyond fair wear and tear.
Subscription & cancellation. DirectServe is provided on an ongoing subscription basis. Either party may cancel in accordance with the notice terms set out in the written agreement. Upon cancellation, the Client’s access to the DirectServe platform will cease and any leased hardware must be returned.
Customer data. In operating DirectServe on the Client’s behalf, XMD Ltd processes personal data relating to the Client’s customers (such as names, contact details, and order history) as a data processor acting on the Client’s instructions, with the Client as data controller. Each party shall comply with applicable data protection law, and the parties shall enter into a data processing agreement where required.
Availability. Whilst we aim for high availability, the DirectServe platform relies on third-party services (including hosting, payment, and messaging providers) and we do not guarantee uninterrupted or error-free operation.
6. Lynx - Additional Terms
The following additional terms apply where the Client subscribes to Lynx, our AI receptionist service.
Nature of the service. Lynx uses automated voice and artificial intelligence technology to answer calls, handle enquiries, and take bookings. Whilst designed to handle interactions accurately, automated systems may occasionally misinterpret a caller or be temporarily unavailable. Lynx is not intended for emergency or time-critical communications, and the Client is responsible for ensuring it is appropriate for their intended use.
Bookings & calendars. Lynx integrates with the Client’s nominated calendar or booking system to create appointments. XMD Ltd is not liable for booking errors arising from inaccurate information provided by callers, or from the Client’s own calendar configuration or third-party booking systems.
Communications. Lynx may send SMS or other messages to the Client’s customers (for example, booking confirmations). The Client is responsible for ensuring it has the necessary consent to contact its customers in this way, and for the accuracy of the contact details provided.
Subscription & cancellation. Lynx is provided on an ongoing subscription basis. Either party may cancel in accordance with the notice terms set out in the written agreement. Upon cancellation, call answering and related Lynx services will cease.
Customer data. In operating Lynx on the Client’s behalf, XMD Ltd processes personal data relating to the Client’s customers (such as names, contact details, and booking information) as a data processor acting on the Client’s instructions, with the Client as data controller. Each party shall comply with applicable data protection law, and the parties shall enter into a data processing agreement where required.
7. Delivery & Timelines
We will provide the Client with an estimated delivery timeline upon commencement of the project. Whilst we will make every reasonable effort to meet agreed timelines, delivery dates are estimates only and are not guaranteed.
We shall not be liable for any delays caused by the Client’s failure to provide required materials, content, feedback, or approvals in a timely manner. In such circumstances, the estimated delivery timeline shall be extended accordingly.
8. Client Responsibilities
The Client is responsible for:
- Providing all necessary content, images, copy, branding assets, and materials required for the project in a timely manner
- Ensuring all materials provided to us are owned by the Client or that the Client holds the necessary licences and permissions for their use
- Reviewing and providing feedback on designs and drafts within a reasonable timeframe
- Ensuring the accuracy and legality of all content provided
We accept no liability for any content provided by the Client that infringes the intellectual property rights of any third party, is unlawful, defamatory, or otherwise inappropriate.
9. Intellectual Property
Upon receipt of full and cleared payment of the agreed project fee, all intellectual property rights in the completed website design and associated materials produced specifically for the Client shall be assigned to the Client.
We retain the right to use the completed website in our portfolio and for promotional purposes unless the Client expressly requests otherwise in writing prior to commencement.
Any third-party assets, themes, plugins, stock images, fonts, or software incorporated into the website shall remain subject to their respective licence terms. We will advise the Client of any such assets used.
We retain all intellectual property rights in our working files, source code frameworks, design templates, and proprietary tools used in the course of delivering the services.
10. Confidentiality
Both parties agree to keep confidential any proprietary or sensitive information disclosed by the other party in connection with the project. This obligation shall survive the termination of any agreement between the parties.
11. Limitation of Liability
We will perform our services with reasonable care and skill. However, to the fullest extent permitted by applicable law, we shall not be liable to the Client for any:
- Loss of profit, revenue, business, data, or goodwill
- Indirect, consequential, incidental, or special loss or damage
- Loss arising from the Client’s use of or reliance upon the completed website
- Loss arising from third-party services, hosting outages, or events outside our reasonable control
Our total aggregate liability to the Client in connection with any project or product shall not exceed the total fees paid by the Client for that specific project or, in the case of an ongoing product or service, the fees paid by the Client for that product or service in the twelve (12) months preceding the event giving rise to the claim.
Nothing in these Terms excludes or limits our liability for death or personal injury caused by our negligence, fraud or fraudulent misrepresentation, or any other matter which cannot be excluded by law.
12. Termination
Either party may terminate the project engagement by providing written notice to the other party.
If the Client terminates the engagement after work has commenced, the Client shall remain liable for payment of a fair and reasonable proportion of the project fee reflecting the work completed to the date of termination. Any deposit paid is non-refundable.
If we terminate the engagement due to the Client’s material breach of these Terms (including non-payment), we shall be entitled to retain any fees paid and to invoice for all work completed to the date of termination.
Upon termination, the Client’s right to use any incomplete deliverables shall cease unless otherwise agreed in writing.
13. Governing Law & Jurisdiction
These Terms are governed by and shall be construed in accordance with the laws of England and Wales. Any dispute arising under or in connection with these Terms shall be subject to the exclusive jurisdiction of the courts of England and Wales.
For international clients, we note that these Terms are governed by English law regardless of the Client’s country of domicile or residence.
14. Amendments to These Terms
We reserve the right to amend these Terms at any time. Any amendments will take effect from the date of publication on our website or notification to the Client. Continued engagement of our services following notification of amendments constitutes acceptance of the revised Terms.
15. Entire Agreement
These Terms, together with any written project agreement or proposal, constitute the entire agreement between the parties in relation to the subject matter herein and supersede all prior representations, negotiations, and communications.
16. Contact
For any queries regarding these Terms, please contact us at:
XMD Ltd
Unit 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE
Email: [email protected]
Privacy Policy
XMD Ltd - Website Design & Development Services - Last Updated: 10 September 2026
1. Who We Are
XMD Ltd is a website design and development service operated by Xavaiyar Chaudry and Mutahir Khan, trading from Unit 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the data controller in respect of the personal data described in this policy, save where section 2 below applies.
2. Our Role: Controller and Processor
Our role in relation to personal data depends on how you interact with us.
As data controller. Where you contact us directly, request a quote, engage us to build your website, or otherwise deal with us as a client or prospective client, we act as the data controller for the personal data described in this policy.
As data processor (DirectServe and Lynx). Where we operate our DirectServe ordering platform or Lynx AI receptionist service on behalf of a client business (the “Client”), we process personal data relating to the Client’s own customers - such as names, contact details, order history, and booking information - strictly as a data processor acting on the Client’s documented instructions. In that context, the Client is the data controller for their end-customers’ personal data and remains responsible for having a lawful basis to collect and share it with us. We enter into a data processing agreement with each DirectServe and Lynx client where required, and process that data only to deliver the relevant service, not for our own purposes.
3. What Personal Data We Collect
We may collect and process the following categories of personal data:
- Name and contact details (email address, phone number, postal address)
- Business name and website details
- Payment information (processed securely via third-party payment providers; we do not store card details)
- Communications between us (emails, messages, project briefs)
- Information you provide in the course of receiving our services
We do not collect or process any special category data as defined under Article 9 of the UK GDPR.
Where we operate Lynx as a data processor for a client business (see section 2), we also process personal data contained in inbound telephone calls to that business on the client’s behalf - including call audio, call recordings and transcripts, the caller’s telephone number, and any name, contact details or booking information the caller provides during the call - strictly to deliver the service on the client’s documented instructions and not for our own purposes.
4. How We Collect Your Data
We collect personal data in the following ways:
- Directly from you when you contact us, request a quote, or engage our services
- Through our website contact forms or enquiry processes
- In the course of delivering our services to you
5. Lawful Basis for Processing
We process your personal data on the following lawful bases under UK GDPR:
- Contract: to fulfil our obligations under our agreement with you and to deliver the services you have requested
- Legitimate interests: to manage and administer our business, to respond to enquiries, and to maintain records of our client relationships
- Legal obligation: where we are required to retain data to comply with applicable law (e.g. financial and tax records)
6. How We Use Your Personal Data
We use your personal data for the following purposes:
- To provide, manage, and deliver our website design and development services
- To communicate with you about your project and any queries
- To process payments and manage invoicing
- To maintain accurate business and financial records
- To comply with our legal and regulatory obligations
We do not sell, rent, or trade your personal data to any third party.
7. Data Sharing
We may share your personal data with trusted third parties only where necessary, including:
- Payment processors, including Stripe, for the purpose of processing project fees and hosting subscriptions and, for DirectServe clients, the pass-through of their end-customers’ order payments directly into the Client’s own Stripe account
- Twilio, for sending SMS confirmations on behalf of DirectServe and Lynx clients
- Vapi, together with its underlying voice-AI providers, for operating the Lynx AI telephone receptionist on behalf of Lynx clients - including answering and handling calls, speech-to-text transcription, automated conversation, and voice synthesis
- Google, for the calendar and scheduling services used to create and manage bookings taken through DirectServe and Lynx on behalf of our clients
- Microsoft, for the email services used to send booking confirmations and notifications on behalf of DirectServe and Lynx clients
- Netlify, our website hosting and cloud service provider
- Professional advisers including accountants or legal advisers where necessary
Where we act as a data processor for DirectServe or Lynx (see section 2), the sub-processors listed above may also process the relevant Client’s end-customer data for the purposes described, under the terms of our data processing agreement with that Client.
All third parties with whom we share data are required to process personal data in compliance with applicable data protection law and only for the purposes specified.
We may also disclose personal data where required to do so by law or court order.
8. International Data Transfers
Where we work with international clients or use third-party service providers based outside the United Kingdom, your personal data may be transferred to and processed in countries outside the UK. Where such transfers occur, we will ensure appropriate safeguards are in place in accordance with UK GDPR requirements.
9. Data Retention
We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. In practice:
- Client contact and project data: retained for a minimum of 6 years following the conclusion of the project, in accordance with the Limitation Act 1980
- Financial and invoicing records: retained for a minimum of 6 years in accordance with HMRC requirements
Where data is no longer required, it will be securely deleted or anonymised.
10. Your Rights Under UK GDPR
Subject to applicable law, you have the following rights in relation to your personal data:
- Right of access: to request a copy of the personal data we hold about you
- Right to rectification: to request correction of inaccurate or incomplete data
- Right to erasure: to request deletion of your personal data in certain circumstances
- Right to restriction: to request that we restrict processing of your data in certain circumstances
- Right to data portability: to receive your data in a structured, machine-readable format
- Right to object: to object to processing based on legitimate interests
To exercise any of these rights, please contact us using the details below. We will respond within one calendar month of receiving your request.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113 if you believe we have not handled your personal data in accordance with applicable law.
11. Data Security
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, or alteration. However, no transmission over the internet is entirely secure and we cannot guarantee absolute security.
12. Cookies
Our website may use cookies to improve your browsing experience. Cookies are small text files stored on your device. We will seek your consent before placing any non-essential cookies. You can control and manage cookies through your browser settings at any time.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Any updates will be published on our website with a revised “Last Updated” date. We encourage you to review this policy periodically.
14. Contact Us
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at:
XMD Ltd
Unit 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE
Email: [email protected]
.