1. About us and these Terms
1.1 Compliance Tools is a brand of Smo & Co Technology Ltd
In these Terms, “we”, “us” and “our” mean Smo & Co Technology Ltd
1.2 Our contact details are:
Website: www.compliance-tools.co.uk
General enquiries and contractual notices: admin@smoandco.uk
Technical support: support@smoandco.uk
Privacy enquiries: admin@smoandco.uk
1.3 These Terms govern business subscriptions to all products and services supplied under the Compliance Tools brand, including DLP Shield, Injection Shield, our customer portal, browser extensions, applications, documentation, updates and future products made available under these Terms. Together, these are the “Services”.
1.4 “You” and “your” mean the business, organisation or person acting for business purposes identified as the customer in the accepted order. “Users” means the individuals you authorise to use the Services.
1.5 The Services are supplied for business and professional use only. They are not offered to consumers purchasing for personal purposes.
1.6 The Services are designed to reduce security and data-protection risks. They do not eliminate those risks or guarantee compliance. Clause 7 explains these limitations, and clause 21 limits our liability. Please read both carefully.
2. Your agreement with us
2.1 An “Order” is an online subscription order, order form or other written order that we accept. It identifies your selected products, licence quantities, prices and any agreed commercial details.
2.2 Your agreement with us consists of the accepted Order, these Terms, any expressly agreed product-specific terms and, where we process personal data on your behalf, a Data Processing Agreement made available to you before that processing begins. Together, these documents form the “Agreement”.
2.3 The Agreement starts when we confirm acceptance of your Order electronically or in writing. Submitting an Order does not itself require us to accept it.
2.4 The person placing an Order or accepting the Agreement confirms that they have authority to bind the customer identified in it.
2.5 We will make the applicable contractual documents available before acceptance. You should retain a copy for your records.
2.6 Your subscription covers only the products, features and licence quantities included in your Order. References to future products or features do not mean they are included in your existing subscription.
2.7 No free trial is included unless we expressly offer one under separate written terms.
3. Direct customers, MSPs and resellers
3.1 The Order must identify the customer contracting with us. A managed service provider or reseller is referred to in these Terms as an “MSP”.
3.2 Direct purchase with MSP management. If your organisation is the customer and an MSP administers the Services for you, the Agreement is between your organisation and us. You authorise the MSP to act within the permissions you give it and remain responsible for your obligations under the Agreement. You must promptly remove access when that authority ends.
3.3 MSP purchase in its own name. If an MSP purchases subscriptions in its own name for use by its business customers, the MSP is our customer. It is responsible for payment, licence allocation and ensuring that its customers and their Users comply with the applicable use restrictions and responsibilities in the Agreement.
3.4 An MSP may purchase licences for its customers, manage their environments and policies, and include the Services within its own managed service, where the Order or our written authorisation permits this.
3.5 The MSP must:
Have authority to deploy the Services, administer customer accounts and provide relevant information to us.
Explain the applicable product limitations, customer responsibilities and suspension risks to its customers.
Put appropriate terms in place with its customers to give effect to these requirements.
Keep customer environments and access permissions appropriately separated.
Establish the necessary data-protection agreements and instructions throughout the supply chain.
3.6 An MSP is an independent business. It is not our agent and cannot bind us or make additional warranties, guarantees, service commitments or representations on our behalf without our express written authority. In particular, it must not represent that the Services guarantee prevention of data disclosure, prompt injection, security incidents or regulatory non-compliance.
3.7 An MSP is responsible for its own advice, deployment work, support and additional commitments. We are responsible for our obligations under the Agreement.
3.8 Where an MSP is our contracting customer, its customer’s payment and cancellation arrangements are with that MSP. Our monthly billing and cancellation provisions govern the MSP’s subscription with us. If the end customer contracts directly with us through an authorised sales agent, those provisions apply directly to that end customer.
3.9 Any separate reseller agreement expressly agreed with us applies alongside these Terms, subject to clause 28.
4. Subscription and permitted use
4.1 Subject to the Agreement and payment of applicable fees, we grant you a limited, non-exclusive right during your subscription to access and use the subscribed Services and associated documentation for your business purposes. Authorised MSP use is permitted under clause 3.
4.2 You must stay within the licence quantities, user allocations and other limits specified in your Order. You must not share or reallocate licences in a way that avoids purchasing the required number.
4.3 Your subscription begins on the start date stated in the Order and renews monthly until cancelled or terminated under the Agreement. There is no minimum commitment beyond the current monthly billing period.
4.4 You may cancel at any time using the cancellation facility in your account or by emailing our contractual notices address. Cancellation takes effect at the end of the current paid billing period. No additional notice period applies.
4.5 Your access continues until that date unless the Services are suspended or the Agreement is terminated earlier under these Terms. Uninstalling software or stopping use does not cancel a subscription.
4.6 Changes to product selection or licence quantities take effect as shown in the portal or agreed in writing. Any additional charge must be disclosed before you confirm the change. Reductions do not create a refund for the current billing period.
5. Fees, payment and price changes
5.1 Subscription fees are billed monthly in advance unless the Order expressly states otherwise. Prices are exclusive of VAT and other applicable transaction taxes unless expressly stated otherwise.
5.2 You must provide accurate billing information and maintain a valid payment method. You authorise recurring collection of the agreed fees through our payment provider, Stripe.
5.3 Stripe processes payment and billing information in connection with collecting fees. Further information about the respective processing activities is provided in our Privacy Policy and Stripe’s applicable privacy information.
5.4 If payment fails or becomes overdue, we will notify you. You have seven days after that notice to pay the overdue amount before we may suspend for ordinary non-payment. We may act sooner where there is a separate genuine fraud, security or unlawful-use concern.
5.5 Suspension does not cancel your subscription or remove fees already due. Subscription fees continue during a suspension caused by your breach until cancellation or termination takes effect. We will not charge for subscription periods beginning after termination.
5.6 Please notify us promptly of any billing error. We will investigate genuine disputes reasonably, and you must pay any undisputed amount when due.
5.7 Fees for a billing period that has started are non-refundable. We do not provide refunds or credits for unused time, unused licences, cancellation part-way through a period or ordinary service interruptions. This does not permit us to retain duplicate or incorrectly collected payments, or remove any repayment or other remedy that cannot lawfully be excluded.
5.8 We may change subscription prices by giving at least 30 days’ notice by email. A new price will apply only from the start of a billing period beginning on or after the end of that notice period.
5.9 You may cancel before the new price applies. If you do not cancel, the subscription will renew at the notified price. Price changes do not apply retrospectively.
6. Our service commitments and support
6.1 We will provide the Services with reasonable care and skill. When used in supported environments and correctly deployed and configured, the Services will materially conform to their applicable published functional description, subject to the limitations in the Agreement.
6.2 We will use reasonable efforts to keep the Services available and maintain compatibility with environments we officially support.
6.3 We do not guarantee uninterrupted or error-free operation, any particular uptime percentage, or that all defects will be corrected. Maintenance, outages, updates, connectivity problems and third-party changes may affect availability or functionality.
6.4 We provide technical support on a reasonable-efforts basis through our designated support channels. Unless expressly agreed in writing, there is no service level agreement, guaranteed response or resolution time, continuous support coverage or entitlement to service credits.
6.5 You must provide the information and reasonable cooperation we need to investigate a support issue. Please do not send sensitive content unless it is necessary for the investigation and we have agreed a suitable secure way for you to share it.
6.6 If you buy through an MSP, your first point of support may be that MSP, as explained in your purchase arrangements. An MSP’s additional support commitments do not bind us unless we agree them in writing.
7. Security limitations and compliance
7.1 The Services reduce risk but cannot guarantee that every threat, disclosure, data loss event, prompt injection or other security incident will be detected, blocked or prevented.
7.2 DLP Shield’s detection depends on matters including supported input methods and attachments, enabled policies, detection capabilities and the environment in which it operates. Injection Shield cannot identify or prevent every prompt injection technique or harmful interaction with an AI system.
7.3 Detection can produce:
False positives, where legitimate or non-sensitive activity is flagged or blocked.
False negatives, where sensitive information, malicious content or other risks are not identified or blocked.
7.4 Detection may use rules, patterns, algorithms, artificial intelligence, machine learning or other automated techniques. Results may be incomplete or inaccurate, and performance may change as threats, data formats and third-party systems evolve.
7.5 You must use the Services as one part of a wider security and data-protection framework. You remain responsible for appropriate policies, training, access controls, device management, patching, backups, incident response and other technical and organisational measures.
7.6 You should assess and implement complementary controls appropriate to your risks, such as mobile device management, commonly called MDM, managed browser policies, application controls, restrictions on extension removal and controls over personal devices and accounts.
7.7 Users may deliberately or accidentally bypass protection by using unsupported browsers, native applications, personal devices, alternative accounts or services, disabled extensions or other ways of transferring information. The Services do not guarantee control over activity outside their supported and operating environment.
7.8 You must assess significant alerts and blocking decisions appropriately. Detection results should not be treated as conclusive evidence of wrongdoing or as the sole basis for decisions materially affecting a person.
7.9 Use of Compliance Tools does not itself establish compliance with UK GDPR, EU GDPR, Cyber Essentials, ISO 27001, ISO 42001 or any other law, regulation, certification or framework. We do not provide legal advice, certification or an independent compliance assessment under the Agreement.
7.10 These limitations do not remove our express commitments under clause 6, our data-protection obligations or liability that cannot lawfully be excluded.
8. Deployment and customer responsibilities
8.1 You are responsible for:
Assessing whether the subscribed Services are suitable for your intended use.
Correctly installing, deploying, configuring and maintaining them.
Selecting and maintaining appropriate policies, detection categories and exceptions.
Assigning licences correctly and ensuring that protection is enabled where required.
Maintaining supported browsers, operating systems, devices and other dependencies.
Applying necessary updates and permissions.
Testing deployment and checking that policies and protection operate as expected.
Investigating suspected gaps, disabling unnecessary access and responding to incidents.
8.2 Centrally setting a policy does not itself establish that every intended device has received or applied it. You must take reasonable steps to verify deployment and operation.
8.3 You are responsible for the accuracy and lawfulness of information, policies and instructions you supply, and for obtaining the rights and permissions needed for us to process them under the Agreement.
8.4 You must inform Users of applicable restrictions and take reasonable steps to ensure their compliance.
8.5 We are not responsible for a failure to the extent it is caused by your incorrect deployment, configuration, unsupported use or failure to meet these responsibilities. This does not excuse a separate failure by us to perform our own obligations.
9. Supported environments and third-party platforms
9.1 Supported environments and minimum requirements are published on our website. Support for one browser, application, platform, file type or input method does not imply support for another.
9.2 The Services may depend on third-party browsers, operating systems, websites, AI platforms, APIs, extension stores and infrastructure. Those providers may change or withdraw features, interfaces, permissions or access.
9.3 We will use reasonable efforts to maintain compatibility with officially supported environments, but cannot guarantee continued compatibility or restoration within a particular time.
9.4 You are responsible for your own third-party subscriptions, permissions and compliance with the terms governing services you choose to use.
9.5 Information submitted to a third-party AI platform is handled under the arrangements applicable to that platform. Local inspection by DLP Shield does not mean that a subsequent permitted submission remains on the device.
9.6 Our use of infrastructure providers and subprocessors does not remove responsibilities that the Agreement or applicable law places on us for their work.
10. Licence validation
10.1 The Services may periodically connect to our systems to validate licences and subscription status, authenticate Users and receive policy or software updates.
10.2 Functionality may be restricted or stop if a licence cannot be validated, a subscription expires, required connectivity is unavailable or the Services are suspended.
10.3 No particular offline operating period or licence-validation grace period is guaranteed. Local scanning does not mean the Services operate indefinitely without an internet connection.
10.4 You must not interfere with licence validation or bypass subscription limits.
11. Local scanning and service information
11.1 In the current DLP Shield architecture, policies are managed centrally through the portal and distributed to devices. Inspection of prompts and supported attachments takes place locally on the User’s device before submission through supported routes.
11.2 Content inspected in this process and the sensitive values detected are not sent to our systems for scanning and are not uploaded to or stored in the Compliance Tools customer database as part of that scanning process.
11.3 The current DLP Shield functionality does not report blocking or detection events back to the Compliance Tools portal.
11.4 This is separate from the account and operational information used to provide the Services. Depending on the relevant functionality, this includes company details, administrator names and email addresses, licensed User email addresses, device identifiers, licence status, policy configuration, billing records, IP addresses and login or audit logs.
11.5 Information you choose to provide when requesting support, or include in centrally stored configuration, is handled for that specific purpose. Please do not include sensitive content unless it is necessary.
11.6 The description in clauses 11.1 to 11.3 applies to the current DLP Shield functionality. The processing architecture of other products and future features will be described in their applicable documentation and privacy information.
11.7 Permission to use AI or machine learning detection does not itself authorise us to send locally inspected content to an external detection provider or use it to train models.
11.8 Before introducing processing that materially changes these arrangements, including remote content inspection or detection-event reporting, we will provide appropriate information and complete any required contractual, data-protection and authorisation steps. Any required agreement or lawful authority must be in place before the new processing begins.
12. Data protection, hosting and subprocessors
12.1 Each party must comply with the data-protection laws applicable to its activities under the Agreement, including the UK GDPR and Data Protection Act 2018 as amended, and EU GDPR where applicable.
12.2 Where we process personal data on your behalf, a separate Compliance Tools Data Processing Agreement will apply. We will make it available to you for review and agreement before that processing begins. It will govern matters including instructions, confidentiality, security, subprocessors, international transfers, incident notification, assistance, audits and the return or deletion of personal data.
12.3 Where you are a processor acting for another organisation, including under an MSP arrangement, you must have authority to appoint us as a subprocessor and give the relevant instructions.
12.4 Where we determine the purposes and means of processing for our own activities, such as applicable customer administration, billing or legal recordkeeping, our role and processing are explained in our Privacy Policy, available at www.compliance-tools.co.uk/privacy. The Privacy Policy provides privacy information and does not replace the DPA.
12.5 At the effective date, the infrastructure arrangements described for the Services are:
Customer database and authentication: hosted through a managed service in Frankfurt, Germany.
Portal hosting: provided through a managed cloud service, with server-side functions currently deployed in a North American region.
Payments: payment and related billing information is processed through our managed payment provider.
12.6 We plan to migrate the portal server-side functions to Frankfurt. This is a statement of current intention, not a completed migration or a contractual migration deadline.
12.7 We do not promise that all personal data is processed exclusively in the EU. An EU database location does not, by itself, mean that application processing, support access, logs or all provider activities occur only in the EU.
12.8 Relevant processing locations, provider roles and international-transfer arrangements will be described in the DPA, subprocessor information and Privacy Policy as appropriate. Restricted transfers must comply with applicable data-protection law and any required safeguards.
12.9 We may appoint and replace service providers as reasonably necessary to operate the Services. Where a provider is a subprocessor, appointment, notice, authorisation and objection procedures are governed by the DPA. This clause does not override those procedures.
12.10 We will maintain reasonable and appropriate technical and organisational measures to protect our systems and personal data we process. Further applicable commitments are set out in the DPA. No particular certification or security technology is promised unless expressly agreed in writing.
12.11 We will meet applicable personal-data breach notification obligations and the incident provisions of the DPA. The absence of a support SLA does not limit those obligations.
13. Lawful deployment and employee monitoring
13.1 You are responsible for ensuring that your deployment, policies and use of the Services comply with applicable privacy, employment, monitoring and communications laws.
13.2 This includes identifying an appropriate lawful basis, providing required notices, assessing necessity and proportionality, undertaking impact assessments where required, and completing any necessary employee or representative consultation.
13.3 You must have appropriate authority over the devices, accounts and environments in which you deploy the Services. You must not use them for unlawful surveillance or unauthorised interception.
13.4 Any reporting or monitoring features must be configured with appropriate access restrictions, retention settings and safeguards.
13.5 These responsibilities do not transfer our own legal obligations to you.
14. Account security
14.1 You must protect account credentials, authentication methods and administrator access, use available security controls appropriately, and promptly remove access that is no longer required.
14.2 You must keep account contact information accurate and tell us promptly if you suspect unauthorised access or account compromise.
14.3 You are responsible for the actions of authorised Users and administrators within the authority you give them. You are not responsible under this clause for unauthorised activity to the extent it results from a security failure for which we are responsible.
14.4 Both parties will cooperate reasonably to investigate and contain relevant account-security incidents.
15. Acceptable use
15.1 You must not, and must not authorise others to:
Use the Services unlawfully or in violation of another person’s rights.
Introduce malware or deliberately disrupt the Services.
Access another customer’s information or systems without authority.
Circumvent authentication, licensing or other access controls.
Use the Services to facilitate fraud, unlawful monitoring or other unlawful activity.
Copy, modify, distribute or exploit our software or documentation except as the Agreement or applicable law permits.
Reverse engineer, decompile or attempt to extract source code, models or detection methods, except to the extent a restriction is prohibited by law.
Use non-public access to the Services or our confidential information to copy functionality or develop a competing product.
15.2 You must not conduct penetration testing, vulnerability scanning, security probing or similar testing against our infrastructure without prior written permission specifying the agreed scope.
15.3 Ordinary use of documented features and checking your own deployment are permitted, provided this does not involve attacks on our infrastructure or other prohibited activity.
15.4 You may evaluate the Services internally for procurement and operational purposes. You must not use access primarily to conduct competitive benchmarking for a competing supplier or disclose our confidential information through published testing without permission.
15.5 These restrictions do not limit rights that cannot lawfully be restricted, legally protected reporting or use of an expressly authorised vulnerability disclosure process.
16. Intellectual property and feedback
16.1 We and our licensors retain all intellectual property rights in the Services, including software, detection methods, portal, designs, documentation and improvements. The Agreement grants rights of use, not ownership.
16.2 You retain ownership of your data, content and other materials. You grant us only the rights needed to provide the Services and perform the Agreement, subject to the DPA where applicable.
16.3 If you voluntarily provide product feedback or suggestions, you permit us to use them to develop and improve our products without payment or any obligation to implement them.
16.4 That permission does not transfer ownership of your existing intellectual property or allow us to disclose your confidential information or process personal data outside the Agreement.
16.5 Third-party components remain subject to their applicable licence terms. Nothing in the Agreement restricts rights granted directly to you under an applicable open-source licence.
17. Confidentiality and publicity
17.1 Each party must protect the other’s confidential information and use it only to perform the Agreement or exercise rights under it.
17.2 Confidential information includes information marked confidential or which should reasonably be understood to be confidential, including non-public product and security information, business information and customer information.
17.3 A receiving party may disclose confidential information to personnel, professional advisers and permitted providers who need it for those purposes and are subject to appropriate confidentiality obligations.
17.4 These duties do not apply to information the receiving party can demonstrate was already lawfully known without restriction, becomes public without breach, is independently developed, or is lawfully obtained from another source without restriction.
17.5 Disclosure required by law, a court or a regulator is permitted. Where lawful and reasonably practicable, the receiving party will give advance notice and limit disclosure to what is required.
17.6 Confidentiality obligations continue after termination while the information remains confidential.
17.7 We will use your name, logo or testimonial in publicity only with your prior permission and within the scope of that permission.
18. Backups and recovery
18.1 We will maintain reasonable backup and recovery arrangements for the service data we hold.
18.2 Unless expressly agreed in writing, we do not guarantee a particular backup frequency, retention period, recovery point, recovery time or successful recovery of every item.
18.3 Compliance Tools is not a backup service. You remain responsible for appropriate backups of your business information, systems and configurations.
18.4 We cannot restore locally inspected content that we do not receive or store.
19. Updates, product changes and beta features
19.1 We may update, modify, add or remove functionality, including detection methods and supported environments, as products and dependencies evolve.
19.2 We will give reasonable advance notice of material reductions in the core functionality of a paid product where practicable. Urgent security, legal or third-party changes may require earlier action, in which case we will explain the change as soon as reasonably practicable.
19.3 Product changes do not override clause 11.8, the DPA or the procedure for changing contractual terms in clause 24.
19.4 Future plans and roadmaps are not contractual delivery commitments unless expressly included in an agreed Order.
19.5 Features identified as beta, preview, experimental or early access may be incomplete, less reliable, changed or withdrawn. You should assess their suitability before relying on them for important operations.
19.6 Beta features do not carry the material-conformity commitment in clause 6.1 unless expressly stated. Our reasonable-care-and-skill, confidentiality, security and data-protection obligations continue to apply. Beta features remain subject to clause 21.
20. Suspension and termination
20.1 We may suspend affected access or functionality where reasonably necessary because of a material breach, misuse, suspected fraud, unlawful activity, a security threat or a material risk to the Services or other customers.
20.2 Suspension will be proportionate where reasonably practicable. We will give notice and an opportunity to resolve the issue where appropriate, but may act immediately for urgent security, legal or fraud concerns.
20.3 Suspension for ordinary non-payment is subject to the seven-day notice period in clause 5.4. We will restore access reasonably promptly once the relevant issue has been resolved and restoration is safe and lawful.
20.4 Either party may terminate for a material breach by the other which cannot reasonably be remedied, or which remains unremedied 14 days after written notice explaining the breach and requesting a remedy.
20.5 We may terminate for non-payment after the seven-day period in clause 5.4 expires. We may also terminate immediately for a serious breach requiring immediate action, including deliberate attacks, fraud, serious unlawful use or repeated material breaches after warning.
20.6 If we permanently discontinue a paid product, we will ordinarily give at least 30 days’ notice and arrange termination at the end of a paid billing period. If earlier discontinuation is unavoidable, any rights arising from our inability to provide the contracted Services remain subject to applicable law and clause 21.
20.7 When a subscription ends:
The relevant rights of access and use end.
You must stop using and uninstall the relevant software.
Outstanding fees remain payable.
You should arrange replacement controls because protection may stop.
Return or deletion of personal data processed on your behalf is governed by the DPA.
20.8 You should export available information and configurations you require before access ends. Other retention and deletion arrangements are explained in the Privacy Policy and applicable documentation. Nothing in this clause overrides the DPA’s return or deletion requirements.
20.9 Termination does not affect accrued rights or provisions intended to continue, including confidentiality, intellectual property, outstanding payment obligations, liability limitations and dispute provisions.
21. Liability
Please read this clause carefully. It limits the amounts recoverable from us.
21.1 Nothing in the Agreement excludes or limits either party’s liability for:
Death or personal injury caused by its negligence.
Fraud or fraudulent misrepresentation.
Any other liability that cannot lawfully be excluded or limited.
21.2 Subject to clause 21.1, we will not be liable for indirect or consequential loss. This includes loss of profit, revenue, business, goodwill or anticipated savings to the extent that the loss is indirect or consequential.
21.3 Subject to clause 21.1, our total aggregate liability arising out of or in connection with the Agreement will not exceed the subscription fees paid or payable to us under the Agreement for the 12 months immediately preceding the first event giving rise to liability.
21.4 If the Agreement has been in place for less than 12 months when that event occurs, the cap is the subscription fees paid or payable for the period from the start of the Agreement to that event, including the billing period in which the event occurs. It does not include future renewal periods. Fees exclude VAT, refunded sums and charges for an MSP’s separate services.
21.5 This is one aggregate cap for all claims under the Agreement. It is not a separate cap per claim, incident, product, Order, User, device or MSP customer, and it does not reset on monthly renewal. Amounts paid to satisfy liabilities subject to the cap reduce the remaining cap.
21.6 The exclusions and cap apply regardless of the legal basis of a claim, including contract, negligence, other tort, misrepresentation, breach of statutory duty or otherwise.
21.7 To the fullest extent permitted by law, the same cap applies to liabilities arising from security incidents, data breaches, loss or corruption of data, confidential information disclosures, failure to detect or block activity, privacy claims, regulatory investigations and other regulatory consequences. There is no separate higher cap for these matters.
21.8 The cap also applies to liabilities between the parties under the DPA, subject to clause 21.1 and any mandatory provisions of applicable transfer instruments. Recoverable investigation costs, restoration costs, third-party claim amounts and other incident-related losses fall within the same cap.
21.9 A regulatory fine or penalty is recoverable from us only if the law permits its recovery and we are otherwise legally liable for it. If recoverable and lawfully capable of limitation, it falls within the same cap.
21.10 This clause allocates liability between the parties. It does not bind a regulator, restrict an individual’s statutory rights against a controller or processor, or limit rights of contribution or other liabilities to the extent they cannot lawfully be limited.
21.11 A security incident does not by itself establish that we breached the Agreement. Equally, the fact that the Services cannot eliminate risk does not excuse our failure to meet an express obligation.
21.12 Each party must take reasonable steps to reduce losses arising from a breach. Neither party may recover more than once for the same loss.
21.13 Except for express commitments in the Agreement and terms that cannot lawfully be excluded, we exclude implied warranties, conditions and other terms to the fullest extent permitted by law. We do not guarantee that the Services will meet every business requirement or produce a particular security or compliance outcome.
21.14 The cap in clause 21.3 limits our liability. It does not cap your payment obligations or the targeted indemnity in clause 22.
22. Targeted customer indemnity
22.1 You will indemnify us against amounts awarded to a third party by a court, settlements approved under this clause, and reasonable legal defence costs, to the extent caused by:
Your unlawful use of the Services, including unlawful monitoring.
Customer-supplied materials infringing a third party’s intellectual property or privacy rights.
Your deliberate or reckless breach of the prohibitions on attacks, unauthorised access or licence circumvention.
If you are an MSP, unauthorised warranties or representations you make about the Services.
22.2 This indemnity does not cover losses to the extent caused by our breach, negligence or other wrongdoing. It does not apply merely because the Services failed to prevent an incident, and it does not require payment of a fine or penalty where that payment would be unlawful.
22.3 We must notify you promptly of a relevant claim, provide reasonable cooperation at your reasonable expense and allow you to control its defence using competent advisers. A delay in notification reduces your obligation only to the extent it materially prejudices the defence.
22.4 You must not settle a claim in a way that admits fault by us, imposes a non-financial obligation on us or fails to release us fully from the claim without our prior written consent, which we will not unreasonably withhold.
22.5 We must take reasonable steps to mitigate covered losses. This indemnity does not provide double recovery or cover our ordinary first-party losses from every breach of the Agreement.
23. Events outside reasonable control
23.1 Neither party is liable for delay or failure to perform an affected obligation to the extent caused by an event outside its reasonable control that it could not reasonably prevent or overcome.
23.2 Such events may include major internet or cloud outages, power failures, natural disasters, government action and cyberattacks. An event does not qualify merely because it involves a third party or cyberattack.
23.3 The affected party must take reasonable steps to limit the impact and resume performance, and notify the other party where the impact is material.
23.4 This clause does not excuse inadequate security measures, remove mandatory data-protection duties or cancel payment obligations already accrued.
23.5 If a material interruption continues for more than 30 days, either party may terminate the affected Services by written notice. Any repayment entitlement remains subject to clause 5.7 and applicable law.
24. Changes to these Terms
24.1 We may update these Terms to reflect changes in the Services, law, security requirements or business operations.
24.2 We will give at least 30 days’ notice by email of normal material changes and explain when they take effect. Normal material changes will take effect at a renewal date after that notice period, allowing you to cancel before they apply.
24.3 Changes urgently required for legal, regulatory or security reasons may take effect sooner. We will give as much notice as reasonably practicable and explain the reason.
24.4 If you do not agree to a notified change, you may cancel under clause 4. Continued use after the effective date constitutes acceptance, except to the extent the law requires express agreement.
24.5 Changes do not retrospectively alter accrued rights or liabilities. Price changes follow clause 5. Changes to processing arrangements must also comply with clause 11.8 and the DPA.
25. Notices
25.1 Contractual notices may be sent by email. Notices to us must be sent to the contractual notices address in clause 1.2. Notices to you may be sent to the current account contact email address.
25.2 You must keep that address up to date and monitor it. We may also display notices in the portal, but a portal notice alone does not replace email notice where email is required by the Agreement.
25.3 An email is treated as received when it reaches the recipient’s mail server, provided the sender does not receive a delivery-failure notification. If received outside 9am to 5pm on a business day in England, it is treated as received at 9am on the next business day.
25.4 A cancellation submitted through the portal takes effect according to its recorded submission time. A cancellation email received before renewal is treated as submitted before renewal even if it arrives outside business hours.
25.5 This clause does not govern formal service of court proceedings or documents for which the law requires a different method.
26. Assignment and general provisions
26.1 You may not transfer the Agreement or your subscription to another organisation without our prior written consent.
26.2 We may transfer the Agreement, including its rights and obligations, to a group company or as part of a sale, acquisition or restructuring of the relevant business, provided the recipient assumes our obligations and the transfer does not materially reduce your contractual protection. We will notify you.
26.3 We may subcontract performance, subject to our responsibilities under the Agreement and the DPA.
26.4 The Agreement does not create a partnership, employment relationship or agency between the parties.
26.5 A delay in exercising a right does not waive it. A waiver applies only to the circumstances for which it is given.
26.6 If a provision is unlawful or unenforceable, it will be severed to the extent necessary. The remaining provisions continue to apply.
26.7 Except where the DPA or a mandatory data-transfer instrument expressly provides otherwise, no person other than the parties may enforce the Agreement under the Contracts (Rights of Third Parties) Act 1999. This does not restrict independent statutory rights.
26.8 The Agreement makes no commitment to maintain a particular insurance policy or level of insurance cover.
27. Governing law and jurisdiction
27.1 The Agreement and any dispute or claim arising out of or in connection with it, including non-contractual disputes or claims, are governed by the law of England and Wales.
27.2 The courts of England and Wales have exclusive jurisdiction, subject to any mandatory rights or jurisdiction provisions that cannot lawfully be displaced.
28. Entire agreement and order of precedence
28.1 The Agreement is the entire agreement between the parties concerning the Services and replaces earlier discussions, proposals and understandings about the same subject matter.
28.2 Each party acknowledges that it has not relied on a statement, promise or representation that is not included in the Agreement. To the extent permitted by law, neither party has a remedy for innocent or negligent misrepresentation based on such a statement. Nothing excludes liability for fraud or fraudulent misrepresentation.
28.3 If contractual documents conflict:
Mandatory provisions of applicable data-transfer instruments prevail where required.
The DPA prevails for personal-data processing matters.
A separately signed agreement or expressly agreed Order variation prevails for matters it specifically addresses.
Expressly agreed product-specific terms apply next.
These Terms otherwise apply.
28.4 Despite the DPA’s priority on processing matters, clause 21 governs financial liability between the parties under the DPA unless an expressly agreed written variation identifies and changes that position, or applicable law or mandatory transfer provisions require otherwise.
28.5 An Order’s description of products, quantities, fees and dates controls those commercial details. It does not amend these Terms merely by attaching or referring to another document.
28.6 Terms in your purchase order, procurement portal, acknowledgement or other document do not apply unless we expressly agree to them in writing. Processing an Order, accepting payment or supplying the Services does not constitute acceptance of those terms.
28.7 Except for changes made under clause 24, a variation must be expressly agreed in writing by authorised representatives of both parties.