Terms and conditions

Issuer: Kualo Limited, a company incorporated in England and Wales (company number 04004280) with registered office at 20–22 Wenlock Road, London, N1 7GU, United Kingdom. VAT registration number GB879440088. ICO registration number Z115828X.

These Terms and Conditions, together with the Schedules and Annexes listed in the table of contents, govern the supply of hosting, domain, email, migration, support and related services by Kualo Limited to its customers. They apply:

(a) to every Order placed on or after the date shown as "Last updated" at the top of these Terms and Conditions; and

(b) to every other Service the Customer has with the Provider, however and whenever it was ordered, and including one supplied under earlier terms and conditions or under terms agreed specifically with the Customer, from the date given in the notice of these Terms and Conditions that the Provider sends to the Customer, or from the day the Customer accepts them in the Client Area or in writing, if sooner.

Until then, each Service continues under the terms it was supplied under. A Customer who does not want to continue under these Terms and Conditions may end the affected Service before that date, as the notice explains, or ask the Provider to agree different terms. Terms the Provider agrees in writing in reply apply only as and to the extent they say. Later changes are made under Clause 31.

Table of contents

Main body

1. 1. Definitions
2. 2. Eligibility
3. 3. Term
4. 4. Services
5. 5. Delays
6. 6. Customer obligations
7. 7. Charges
8. 8. Payments
9. 9. Consequences of non-payment
10. 10. Reversion of assignments and licences
11. 11. Software licences and rights
12. 12. Third-Party Software
13. 13. Right to re-sale or sub-license
14. 14. Confidentiality obligations
15. 15. Data protection
16. 16. Cookies and similar technologies
17. 17. Warranties
18. 18. Online Safety Act 2023
19. 19. Indemnities
20. 20. Limitation of liability
21. 21. Force Majeure
22. 22. Termination
23. 23. Effects of termination
24. 24. Non-solicitation of personnel
25. 25. Notices
26. 26. Subcontracting
27. 27. Assignment
28. 28. No waivers
29. 29. Severability
30. 30. Third party rights
31. 31. Variation
32. 32. Consumers
33. 33. Subscription information and automatic renewals
34. 34. Dispute resolution
35. 35. Entire agreement
36. 36. Law and jurisdiction
37. 37. Interpretation and construction

Schedules and Annexes

• Schedule 1: Hosting Services
• Annex 1: Availability Service Level Agreement
• Annex 2: Email Services Service Level Agreement
• Annex 3: Complex Managed Hosting Service Level Agreement
• Annex 4: Acceptable Use Policy
• Schedule 2: Domain Name Services
• Schedule 3: SSL Certificate Services
• Schedule 4: Web Support and Maintenance Services
• Schedule 5: Data Processing
• Schedule 6: Model Cancellation Form
• Schedule 7: Website Migration Services

1. Definitions

1.1 In these Terms and Conditions, except to the extent expressly provided otherwise:

"Affiliate" means an entity that Controls, is Controlled by, or is under common Control with the relevant entity.

"Annex" means any annex to a Schedule.

"Basic Managed" means a Managed Service Level identified as such in the Order or in the Provider's published description of the applicable Service.

"Business Day" means any weekday other than a bank or public holiday in England.

"Business Hours" means the hours of 09:00 to 17:00 GMT/BST on a Business Day.

"Charges" means the following amounts:

(a) the amounts specified in the Order or otherwise agreed in writing;

(b) such amounts as may be agreed in writing by the parties from time to time; and

(c) amounts calculated by multiplying the Provider's standard time-based charging rates (as notified by the Provider to the Customer before the date of the Contract) by the time spent by the Provider's personnel performing the Services (rounded down by the Provider to the nearest quarter hour).

"Client" means a client of the Customer.

"Client Area" means the authenticated administrative interface at MyKualo accessible by the Customer using the Customer's Client Area Credentials, through which the Customer may manage all Hosting Accounts and Services associated with the Customer's billing relationship with the Provider.

"Client Area Credentials" means the username, password and any multi-factor authentication credentials issued or configured for the Customer's access to the Client Area.

"Confidential Information" means the Provider Confidential Information and the Customer Confidential Information.

"Contract" means a contract made under these Terms and Conditions between the Provider and the Customer.

"Control" means the legal power to control (directly or indirectly) the management of an entity (and "Controlled" is construed accordingly).

"Customer" means the individual or entity entering into the Contract by placing an Order for Services with the Provider.

"Customer Confidential Information" means (a) any information disclosed by or on behalf of the Customer to the Provider at any time before the termination of the Contract (whether disclosed in writing, orally or otherwise) that at the time of disclosure was marked or described as "confidential" or should have been understood by the Provider (acting reasonably) to be confidential, and (b) the terms of the Contract.

"Customer Hosted Data" means all data, works and materials uploaded to or stored on the Hosting Platform by the Customer, or by any third party using any software made available by means of the Hosting Platform; transmitted by the Hosting Platform at the instigation of the Customer, or at the instigation of any third party using any software made available by means of the Hosting Platform; or supplied by the Customer to the Provider for uploading to, transmission by or storage on the Hosting Platform.

"Customer Indemnity Event" has the meaning given in Clause 19.1.

"Customer Personal Data" has the meaning given in Schedule 5.

"Data Protection Laws" means, in respect of any Personal Data processed under or in connection with this Contract:

(a) the UK General Data Protection Regulation, as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended from time to time (including by the Data (Use and Access) Act 2025);

(b) the Data Protection Act 2018;

(c) the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426);

(d) the Data (Use and Access) Act 2025 and any regulations or codes of practice issued under it;

(e) to the extent applicable to any processing of Personal Data of data subjects located in the European Economic Area, Regulation (EU) 2016/679 (the "EU GDPR") and any national implementing laws; and

(f) any statutory or regulatory guidance issued by the Information Commissioner's Office or any successor authority from time to time that has binding effect or that a reasonable data controller would follow.

References in this Contract to specific Articles of the UK GDPR are references to the Articles of the UK GDPR as in force from time to time (including as renumbered or replaced by the Data (Use and Access) Act 2025).

"Data Transfer" means the data transferred from or to the Provider's Servers.

"Dedicated Server" means a dedicated physical server supplied by the Provider to the Customer as part of the Services.

"Delivery Date" means the date on which the Services are made available for the Customer to use.

"Domain Auto Renewal" means the automatic renewal of a Domain Name in advance of expiration, as controlled by the Customer in the Client Area.

"Domain Name" means a domain name registered, renewed, transferred or administered for the Customer under the Domain Services.

"Domain Services" means the registration, renewal, transfer and administration of Domain Names supplied by the Provider to the Customer, whether the Provider acts as registrar directly or through a reseller relationship with a registrar. Domain Services are subject to Schedule 2 and to the applicable Registry and Registrar terms.

"Effective Date" means the date the Order is placed or the date Charges for Services are paid, whichever occurs first.

"Email Services" means any hosted email service supplied by the Provider to the Customer as a discrete service (including, at the date of the Contract, the Zimbra-based hosted email service), as distinct from mailbox functionality that is supplied as part of the Shared Hosting or Managed Server control panel.

"Force Majeure Event" means any event or circumstance beyond the reasonable control of the party affected, which could not reasonably have been foreseen or, if foreseen, could not reasonably have been avoided or overcome. Without limitation, Force Majeure Events include:

(a) acts of God, including severe weather events, floods, earthquakes, volcanic activity, storms and fires;

(b) epidemics, pandemics, quarantines, public health emergencies and any restrictions imposed by a competent authority in response to any of them;

(c) war (whether declared or not), armed conflict, invasion, acts of foreign enemies, hostilities, terrorism, civil war, riot, insurrection, civil commotion and revolution;

(d) acts of government, regulator or supervisory authority, including sanctions, export controls, trade embargoes, directions issued under the Office of Financial Sanctions Implementation regime, and changes to applicable law that prevent or substantially impede performance;

(e) cyber attacks, including denial-of-service or distributed denial-of-service attacks, ransomware events, malicious software events, compromise of authentication systems, and coordinated exploitation campaigns against the class of systems operated by the party affected;

(f) failure, latency or extended outage of any upstream provider of power, telecommunications, transit, cloud infrastructure, content delivery, or authentication services on which the party affected relies for the performance of its obligations;

(g) nationwide or regional industrial action, labour disputes (other than disputes involving the party's own workforce) and strikes; and

(h) any other event or circumstance of a similar nature.

A Force Majeure Event does not include (i) scheduled maintenance windows of the Provider or its suppliers communicated in accordance with this Contract; (ii) outages or degradations caused solely by the action or inaction of the party affected or its personnel where that action or inaction was within that party's reasonable control; or (iii) non-performance of obligations that are not directly prevented by the event.

"Fully Managed" means a Managed Service Level identified as such in the Order or in the Provider's published description of the applicable Service.

"Hosting Account" means an individual provisioned hosting environment (including a cPanel account, WHM reseller account, VPS instance or Dedicated Server) associated with the Customer, accessed using Hosting Account Credentials that are distinct from the Customer's Client Area Credentials.

"Hosting Account Credentials" means the username, password and any multi-factor authentication credentials issued by or configured in the relevant Hosting Account (including cPanel, WHM, SSH, FTP, SFTP and database user credentials).

"Hosting Platform" means the platform managed by the Provider and used by the Provider to provide the Hosting Services, including the application, database, system and server software used to provide the Hosting Services, and the computer hardware on which that software is installed or operates.

"Hosting Services" means the hosting services supplied by the Provider to the Customer under the Contract, comprising (as applicable) Shared Hosting and Servers (including Managed Servers and Unmanaged Servers). Reseller Hosting is a form of Shared Hosting in which the Customer's account is configured to permit the Customer to provision hosting for end users and is treated as Shared Hosting for the purposes of the Contract unless expressly stated otherwise.

"ICANN" means the Internet Corporation for Assigned Names and Numbers, or any successor organisation responsible for coordinating the global domain name system.

"Intellectual Property Rights" means all intellectual property rights wherever in the world, whether registrable or unregistrable, registered or unregistered, including any application or right of application for such rights (and these "intellectual property rights" include copyright and related rights, database rights, confidential information, trade secrets, know-how, business names, trade names, trade marks, service marks, passing off rights, unfair competition rights, patents, petty patents, utility models, semi-conductor topography rights and rights in designs).

"Maintained Software" means software that the Provider runs on the Server(s) used within the Hosting Platform to provision the Customer's Services.

"Maintenance Services" means the supply to the Customer of Updates and Upgrades.

"Managed Server" means a Server provided at a Managed Service Level.

"Managed Service Level" means a service level at which the Provider takes on defined ongoing responsibility for aspects of the operating-system, control-panel and application-layer configuration of a Server. The Managed Service Levels currently offered are Basic Managed and Fully Managed, as further described in the Order or on the Provider's website from time to time.

"Migration Services" means the website and email migration services supplied by the Provider under Schedule 7.

"Minimum Term" means, in respect of the Contract, the period specified in the order confirmation email sent from the Provider to the Customer, in other written communication from the Provider to the Customer, or where unspecified, one (1) month.

"Network" means telecommunication hardware installed and operated by the Provider which is used to facilitate the transfer of data from or between the Hosting Platform and the internet.

"Order" means an online or offline request by the Customer for Services provided by the Provider, the specifications of which may be amended from time to time by the Customer via the Client Area or upon written request.

"Personal Data" has the meaning given to it in the Data Protection Laws applicable in the United Kingdom from time to time.

"Provider" means Kualo Limited, a company incorporated in England and Wales (company number 04004280) having its registered office at 20–22 Wenlock Road, London, N1 7GU, United Kingdom.

"Provider Confidential Information" means any information disclosed by or on behalf of the Provider to the Customer at any time before the termination of the Contract (whether disclosed in writing, orally or otherwise) that at the time of disclosure was marked or described as "confidential" or should have been understood by the Customer (acting reasonably) to be confidential.

"Provider Indemnity Event" has the meaning given in Clause 19.3.

"Registrar" means an ICANN- or Registry-accredited registrar of domain names, including the Provider when it is acting as registrar of record for a Customer Domain Name.

"Registry" means the operator of a top-level domain registry (for example, Nominet for ".uk" domains or Verisign for ".com" domains).

"Reseller Hosting" means Hosting Accounts served from the Provider's reseller Hosting Platform which the Provider has authorised for reselling purposes, subject to Clause 13.

"Resource Usage Policy" means the Provider's policy on how the Resources of a shared server are allocated and fairly used, so that every account on it stays fast, stable and secure. It applies to Shared Hosting (including Reseller Hosting), is published on the Provider's website, forms part of these Terms and Conditions, and may be updated under Clause 31.

"Resources" means the server processing capacity, memory, storage, bandwidth, file count, process count, input/output operations and other finite computing resources allocated to the Services from time to time, including the specific limits set out in the Resource Usage Policy (including its reseller section).

"Schedule" means any schedule attached to the main body of these Terms and Conditions.

"Server" means a VPS or a Dedicated Server supplied by the Provider to the Customer as part of the Services. References to a Server apply equally to a VPS and to a Dedicated Server unless the Contract expressly distinguishes between them.

"Services" means all of the services supplied by the Provider to the Customer from time to time under the Contract, and comprises (as applicable to the Customer's Order) the Hosting Services, Domain Services, Email Services, Migration Services, Support Services and any Third-Party Software licences supplied in connection with any of the foregoing.

"Shared Hosting" means hosting on Provider-controlled multi-tenant infrastructure under which the Provider supplies and operates the operating system, control panel and, except to the extent expressly reserved to the Customer, the application-layer configuration. The Provider provides Shared Hosting (including Reseller Hosting) at the Fully Managed Service Level.

"Software" means any software (whether open-source, proprietary, licensed or third-party) made available by the Provider to the Customer as part of or in connection with the Services, including any Maintained Software, any control-panel software, any Customer-facing web-server software, and any operating system supplied by the Provider.

"SSL Certificate Services" means the purchase of SSL certificates, the installation of SSL certificates and the maintenance of SSL certificates by the Provider on behalf of the Customer.

"Support Services" has the meaning given in Schedule 4.

"Term" means the term of the Contract, commencing in accordance with Clause 3.1 and ending in accordance with Clause 3.2.

"Terms and Conditions" means all the documentation containing the provisions of the Contract, namely the main body of these Terms and Conditions, the Schedules, the Annexes and the Order details, including any amendments to that documentation from time to time.

"Third-Party Software" means third-party software, operating-system, control-panel, security and platform software made available to the Customer as part of the Services, whether supplied at no additional charge as part of a Service, bundled within a Service, or charged as a separate licence on the Order. Third-Party Software at the date of this Contract includes (without limitation) cPanel / WHM, CloudLinux, LiteSpeed, KernelCare, Imunify360, ModSecurity, Softaculous, Patchman, JetBackup and SpamExperts.

"Unmanaged Server" means a Server provided at the Unmanaged Service Level.

"Unmanaged Service Level" means a service level at which a Server is supplied without a Managed Service Level, with defined operating-system-level and application-layer responsibility resting with the Customer and the Provider's responsibilities limited to the hardware, hypervisor, network and (unless the Customer elects otherwise) initial provisioning.

"Update" means a hotfix, patch or minor version update to the Maintained Software.

"Upgrade" means a major version upgrade of the Maintained Software.

"VPS" means a virtual private server supplied by the Provider to the Customer as part of the Services.

2. Eligibility

2.1 The Services are supplied to natural persons who are at least 18 years of age and to legal persons. By placing an Order, the Customer represents and warrants that, if the Customer is a natural person, the Customer is at least 18 years of age and has the legal capacity to enter into the Contract. Where the Customer places the Order on behalf of a legal person, the Customer represents and warrants that the Customer is authorised to bind that legal person.

2.2 The Provider may at any time request evidence of the Customer's age, identity or authority to contract. The Customer agrees to supply such evidence promptly on request. If the Provider reasonably concludes that the Customer does not meet the eligibility requirements in Clause 2.1, the Provider may suspend or terminate the Contract in accordance with Clause 22 and refund any Charges paid in respect of Services that have not yet been delivered, subject to deduction of reasonable costs already incurred.

3. Term

3.1 The Contract shall come into force on the Effective Date.

3.2 The Contract shall continue in force indefinitely, subject to termination in accordance with Clause 22 or any other provision of these Terms and Conditions.

3.3 Unless the parties expressly agree otherwise in writing, each Service within the Contract shall be provided during the Term for the Minimum Term specified for that Service and shall renew automatically for successive periods equal to the Minimum Term unless cancelled in accordance with these Terms and Conditions.

4. Services

4.1 The Provider shall provide the Services to the Customer in accordance with these Terms and Conditions.

4.2 The Provider shall use reasonable endeavours to ensure that the Services are available to the Customer in accordance with the Availability Service Level Agreement set out in Annex 1, in respect of Email Services the Email Services Service Level Agreement set out in Annex 2, and in respect of a Managed Environment the Complex Managed Hosting Service Level Agreement set out in Annex 3.

4.3 The Provider may from time to time amend the technical specifications, configuration, features and limits of the Services where such amendments are necessary to comply with applicable law or regulatory requirement, to address a security vulnerability or risk, to reflect changes in the underlying infrastructure, software or third-party dependencies, or otherwise to preserve or improve the quality, security or performance of the Services, provided that any such amendment shall not materially reduce the overall quality or functionality of the Services received by the Customer. Changes that amount to a variation of the commercial terms of the Contract (including changes to Charges) are governed by Clause 31 and, in the case of consumer Customers, by Clause 32.

4.4 The consequences of non-payment of Charges (including suspension of Services) are set out in Clause 9.

4.5 The Provider may from time to time perform scheduled maintenance of the Hosting Platform, Network or Services. This Clause applies to maintenance the Provider carries out itself; maintenance by a supplier of a third-party platform is dealt with in the relevant Annex. Wherever reasonably practicable, the Provider shall give the Customer at least seventy-two (72) hours' advance notice of scheduled maintenance that is likely to affect the availability of the Services, shall carry it out outside Business Hours, and shall carry it out in a manner intended to minimise disruption to the Services. Emergency maintenance necessary to address a security vulnerability, imminent risk of loss of data, or Force Majeure Event may be performed without prior notice.

4.6 Where the Customer has ordered a Service that requires configuration, set-up or migration activity by the Provider, the Provider shall use reasonable endeavours to complete that activity promptly. The Provider does not commit to completing set-up or migration by any particular date unless expressly agreed in writing by the Provider, and time is not of the essence in relation to set-up or migration.

5. Delays

5.1 The Provider shall use reasonable endeavours to meet any performance dates indicated in the Order or otherwise communicated to the Customer, but any such dates shall be estimates only and time shall not be of the essence (subject to Clause 32 in respect of consumer Customers, and to the Customer's statutory rights).

5.2 If the Provider is delayed in the performance of its obligations under the Contract by any act or omission of the Customer, or by any failure by the Customer to perform any of the Customer's obligations under the Contract, the Provider shall not be liable for such delay and the Provider's time for performance shall be extended by a period equal to the period of the delay.

6. Customer obligations

6.1 The Customer shall provide to the Provider, promptly on request, all cooperation, information and materials reasonably required by the Provider to perform the Services, and shall ensure that such information is accurate, complete and up to date.

6.2 The Customer shall comply with the Acceptable Use Policy set out at Annex 4 and shall procure that all persons using the Services through the Customer's account or Client Area comply with the Acceptable Use Policy.

6.3 The Customer is solely responsible for the Customer Hosted Data and for its lawfulness, accuracy and integrity. The Provider does not review what the Customer hosts or publishes for its content or lawfulness, and does not warrant that Customer Hosted Data is free from viruses, malware or other harmful components.

6.4 To keep the Services secure and working, the Provider's systems check them automatically: they scan files for malware and for software with known vulnerabilities, record the software and versions installed, measure resource use and keep security and access logs. The Provider uses what these checks find to protect the Services and other customers, to support the Customer and to tell the Customer about risks, and may act on a finding under these Terms and Conditions (for example by quarantining a malicious file). The Provider looks at the content of Customer Hosted Data only to give support the Customer asks for or to deal with a problem the Customer reports, to keep the Services secure and working (including responding to a fault or a security incident), to investigate a suspected breach under Annex 4, or where the law requires it.

6.5 The Provider changes, deletes or restores Customer Hosted Data only on the instructions of the Customer or a person the Customer has authorised, after confirming exactly what is wanted and, where possible, with a way to reverse it. The exceptions are:

(a) the automatic security measures described in Schedule 1 (such as quarantining or cleaning malicious files and patching known vulnerabilities in website software);

(b) small, reversible steps taken to diagnose a fault;

(c) emptying a log file that threatens the operation of the server or its backups; and

(d) action needed urgently to stop an outage, data loss or harm to the Services or other customers, in which case the Provider moves data aside rather than deleting it where it can, and tells the Customer as soon as practicable what it did and how it can be reversed.

6.6 The Customer shall keep the Client Area Credentials and all Hosting Account Credentials confidential and secure, shall not disclose them to any person other than persons the Customer has authorised to access the relevant account, and shall ensure that any person to whom the Customer discloses credentials keeps them confidential and secure. The Customer shall use multi-factor authentication where the Provider makes it available for the Client Area and shall use multi-factor authentication at the Hosting Account layer where supported by the relevant Hosting Account software. The Customer is responsible for all acts and omissions carried out under the Customer's Client Area Credentials or any Hosting Account Credentials, save where the Customer has notified the Provider without undue delay of a suspected compromise and the relevant acts or omissions post-date that notification. The Provider shall not be liable for any loss arising from the Customer's failure to comply with this Clause 6.6, other than any loss that cannot lawfully be excluded by reason of Clause 20.1 or Clause 32.

6.7 The Customer shall cooperate with reasonable requests by the Provider relating to the security of the Services, including requests to apply patches, update passwords or authentication credentials, or disable or remove insecure components of the Customer's application or deployment.

7. Charges

7.1 The Customer shall pay the Charges to the Provider in accordance with these Terms and Conditions.

7.2 All Charges stated in the Order are exclusive of any applicable value added tax or equivalent sales tax, which shall be added to the Customer's invoice at the applicable rate in accordance with Clause 8.7 and Clause 8.8.

7.3 Where Charges are based on time spent, the Provider shall obtain the Customer's written agreement before doing work that would take the Charges above an estimate it has given, or above a budget agreed with the Customer. Unless the Customer agrees otherwise in writing, the Customer is not liable for Charges for work done in breach of this Clause.

7.4 The Customer may give the Provider standing written agreement for time-based work up to an amount it sets, for each request or for each month. Work within that amount needs no further agreement. The Customer may change or withdraw a standing agreement in writing at any time, and a change applies to work not yet started.

7.5 The Provider may set different Charges for the same or similar Services supplied to different classes of Customer (for example, new customers, existing customers renewing at different Minimum Terms, or customers purchasing additional services). The Charges applicable to the Customer's Services are those specified in the Order confirmation email or otherwise communicated to the Customer in writing at the time of Order.

7.6 The Provider may from time to time vary the Charges payable by the Customer for ongoing Services. This Clause does not apply to Domain Names, whose prices are dealt with in Schedule 2. A variation applies only from the start of the affected Service's next billing period that begins at least thirty (30) days after the Provider gives the Customer written notice of it, so that Charges already paid for the current billing period are not affected. The notice shall set out, in plain English, the reason for the variation and the new Charges that will apply, and shall inform the Customer of the Customer's right to cancel the affected Service without penalty before the new Charges apply. If the Customer gives notice of cancellation before the new Charges apply, the affected Service shall terminate at the end of the current billing period and no cancellation or early termination fee shall be payable. If the Customer does not give notice of cancellation before the new Charges apply, the Customer shall be deemed to have accepted the variation, and the new Charges shall apply to the affected Service from the start of that billing period.

7.7 The Provider may offer promotional pricing from time to time. Promotional pricing applies only to the initial Minimum Term of the Service to which it relates unless the Provider expressly states otherwise in writing, and the Service shall renew at the Provider's then-current standard Charges (subject to Clause 7.6) at the end of the initial Minimum Term.

7.8 Charges for Domain Services are payable in advance in full for the relevant registration period and are non-refundable once the Registry has registered, transferred or renewed the Domain Name, in accordance with Schedule 2.

7.9 Additional one-off charges (including but not limited to Migration Services under Schedule 7, Support Services under Schedule 4 where chargeable, SSL Certificate Services under Schedule 3 and Third-Party Software licences) are payable in accordance with the Order for the relevant additional service or, in the absence of a specific Order, in accordance with the Provider's published price list from time to time.

8. Payments

8.1 The Provider shall issue invoices for the Charges to the Customer in advance of each period to which the Charges relate (or, in the case of one-off Charges, in advance of the supply of the relevant Service).

8.2 Full payment of the Charges for a Service is required before the Provider begins supplying it and before each renewal period begins. Where the renewal of a Service other than a Domain Name remains unpaid, the Provider may continue to supply the Service while the process in Clause 9.3 and Clause 9.4 runs, and may suspend or terminate it only in accordance with those Clauses. Unpaid renewals of Domain Names are dealt with in paragraph 4.8 of Schedule 2.

8.3 The Customer shall pay the Charges to the Provider in pounds sterling (or in such other currency as the Provider makes available for the relevant Service at the point of Order) by debit card, credit card, PayPal or such other payment method as the Provider makes available from time to time. The Provider may retain the Customer's payment method details and use them to collect subsequent Charges in accordance with Clause 8.5 and Clause 8.6.

8.4 Where the Customer pays by bank transfer, including an international wire, the Customer is responsible for all bank charges, including any intermediary and receiving bank fees, so that the Provider receives the full amount invoiced. Any shortfall remains payable.

8.5 Where the Customer has one or more payment methods stored on file with the Provider (including debit or credit cards), the Customer authorises the Provider to attempt to collect any Charge due under the Contract from any such stored payment method, in any order determined by the Provider, in order to support continuity of the Services. This authorisation applies whether or not the original Charge was paid using the same payment method. Before charging a stored debit or credit card, the Provider shall notify the Customer by email in advance of the attempted charge, identifying the Charge, the Service to which it relates and the last four digits of the card that will be charged. The Customer may review and remove stored payment methods at any time through the Client Area; removal does not cancel the underlying Contract or the Customer's obligation to pay Charges when due, and may result in the failure of an automated renewal and the consequences set out in Clause 9.

8.6 Subject to the automatic-renewal and cancellation provisions in Clause 33 and Schedule 2, the Customer authorises the Provider to charge the Customer's payment method on file for Charges payable in respect of the next Minimum Term, such payment being due on the date of renewal.

8.7 VAT and other taxes. The Charges are stated exclusive of value added tax and any other applicable taxes, unless expressly stated otherwise. The value added tax (if any) applicable to an Order is calculated and displayed to the Customer in the Order flow before the Order is placed, based on the Customer's country of consumption as evidenced under Clause 8.8, and is shown separately on the invoice issued in respect of the Order. The Provider shall:

(a) charge value added tax at the applicable rate in the Customer's country of consumption where required under the UK value added tax regime (including where the Provider accounts for that tax under the UK One Stop Shop, the EU One Stop Shop, or any equivalent scheme);

(b) where the Customer has provided a valid value added tax registration number at the time of Order (or subsequently before an invoice is raised), treat the Customer as a business for value added tax purposes, in which case, where the supply is cross-border, the reverse charge may apply; and

(c) where no valid value added tax registration number has been provided, treat the Customer as a consumer for value added tax purposes.

8.8 Evidence of place of supply. The Customer consents to the Provider using the Customer's billing address, payment instrument country, and IP address at the time of Order as evidence of the place of supply for value added tax purposes, consistent with HMRC guidance.

8.9 All Charges are payable by the due date specified on the invoice. If the Customer disputes any part of an invoice in good faith, the Customer shall notify the Provider in writing of the disputed amount within fourteen (14) days of the invoice date, setting out the reason for the dispute. The parties shall use reasonable endeavours to resolve the dispute promptly and in good faith. Pending resolution, the Customer shall pay the undisputed portion of the invoice by the due date, and the disputed portion shall not be treated as overdue. This Clause 8.9 does not entitle the Customer to withhold payment of the undisputed portion or to dispute any amount as a device to delay payment. While a dispute is open, the Provider will not suspend a Service, or add a late payment fee, because of the disputed amount. Once the dispute is resolved, any amount found to be due is payable within seven (7) days, and Clause 9 applies to it only from then.

9. Consequences of non-payment

9.1 If the Customer fails to pay any Charge by the due date, the Provider may:

(a) add a late payment fee in accordance with Clause 9.2; and

(b) after giving the Customer the notice required by Clause 9.3, suspend or terminate the affected Services in accordance with Clause 9.4 and Clause 22.

9.2 If a Charge is still unpaid ten (10) days after its due date, the Provider may add a single late payment fee to the invoice. The fee is five per cent (5%) of the amount unpaid on the invoice, including VAT, and is at least:

(a) for a business account, £10 (or US$15 for an account billed in US dollars); and

(b) for any other account, £2.50 (or US$3), with a maximum of £25 (or US$30).

No VAT is charged on the fee. The fee is charged once per invoice, and the Provider does not charge interest on overdue Charges as well. An account is treated as a business account if a business or organisation name is recorded on it, or if a VAT number or company or charity registration number is recorded on it. A Customer who is a consumer within the meaning of Clause 32.1 but has been charged the business fee may tell the Provider, and the Provider will apply the lower fee and refund the difference.

9.3 Before suspending or terminating any Service for non-payment, the Provider shall give the Customer written notice identifying the unpaid Charge, the affected Service and the date by which payment must be received to avoid suspension or termination. The Provider shall send the notice by email to the Customer's registered email address at least seven (7) days before that date. Where the Provider has agreed with the Customer to defer suspension to a later date, that agreed date is the date by which payment must be received, and no further notice is needed.

9.4 If the Customer has not paid the overdue Charge by the date specified in the notice given under Clause 9.3, the Provider may suspend the affected Services. Suspension does not terminate the Contract and the Customer remains liable for the Charges accrued up to the date of termination. If the Customer has not paid the overdue Charge within a further period of thirty (30) days after suspension, the Provider may terminate the affected Services in accordance with Clause 22.8(c).

9.5 Reinstatement of Services following suspension for non-payment is subject to payment of all overdue Charges and of any late payment fee. The Provider does not charge a separate administrative reinstatement fee in respect of suspension for non-payment.

9.6 Where the Provider incurs external costs (including legal costs and debt-recovery agency costs) in recovering an overdue amount from a Customer that is not a consumer, the Customer shall reimburse those costs on demand, subject to those costs being reasonable and reasonably and properly incurred.

10. Reversion of assignments and licences

10.1 On termination of the Contract (or termination of an affected Service within the Contract), any assignment, licence or sub-licence granted by the Provider to the Customer under Clause 11, Clause 12 or Schedule 3 (SSL Certificate Services) in respect of the affected Service shall automatically terminate, and any rights of use in Maintained Software, Third-Party Software and Provider-owned configuration shall revert to the Provider or to the relevant third-party licensor, as applicable.

10.2 The Customer remains entitled to the benefit of any non-terminable rights (including rights expressly stated in these Terms and Conditions to survive termination, and any statutory rights that cannot be contractually excluded).

11. Software licences and rights

11.1 The Provider grants to the Customer, for the Term, a non-exclusive, non-transferable licence to use:

(a) the Maintained Software, to the extent necessary for the Customer to receive and use the Services; and

(b) any other Software made available by the Provider to the Customer as part of the Services, subject in each case to the applicable licence terms of the licensor of that Software.

11.2 The Customer shall not (and shall not permit any other person to) reverse-engineer, decompile, disassemble, rent, lease, lend, sell, sub-license, redistribute or create derivative works of any Software, other than to the extent permitted by applicable law that cannot lawfully be excluded.

11.3 The Customer retains ownership of all Intellectual Property Rights in Customer Hosted Data and in any application, code, content or configuration created by or on behalf of the Customer in connection with the Services, to the extent the Customer owns those rights. Third-Party Software and other software installed by the Customer (for example, a content management system) remains the property of its licensor, and the Customer is responsible for holding a valid licence for it.

11.4 The Customer grants the Provider a non-exclusive licence to copy, reproduce, store, distribute, publish, export, adapt, edit and translate the Customer Hosted Data to the extent reasonably required for the performance of the Provider's obligations and the exercise of the Provider's rights under the Contract, including taking backups, together with the right to sub-license these rights to its sub-processors and its hosting, connectivity and telecommunications service providers to the same extent.

11.5 The Provider retains ownership of all Intellectual Property Rights in the Hosting Platform, the Network, the Services and any Software developed by or on behalf of the Provider.

12. Third-Party Software

12.1 The Services may include access to, or use of, Third-Party Software. The Customer acknowledges that Third-Party Software is licensed by its respective owner on the terms (including any end-user licence agreement, technical-use limits and acceptable-use terms) notified to the Customer at the point of Order, published by the Provider on its website from time to time, or published by the third-party licensor.

12.2 Where Third-Party Software is made available as part of a Service at no additional charge, the Provider does not warrant the continued availability of that Third-Party Software from the third-party licensor and may substitute the Third-Party Software with a materially equivalent product on reasonable written notice if the third-party licensor discontinues, materially changes the commercial terms of, or materially changes the functional characteristics of, the Third-Party Software in a way that makes continued supply at the Service's existing price point not commercially viable.

12.3 Where Third-Party Software is separately chargeable on the Order, the Charges for that Third-Party Software are payable in accordance with Clause 7 and Clause 8 and shall be varied in accordance with Clause 7.6 if and when the third-party licensor varies its charges to the Provider.

12.4 The Provider's obligations in respect of Third-Party Software are limited to keeping the Third-Party Software reasonably up to date on the Hosting Platform or on any Managed Server, operating any administrative features of the Third-Party Software that the Provider has agreed to operate as part of the Service, and liaising with the third-party licensor in respect of material defects that affect the Service. The Provider is not responsible for the functionality, availability or suitability of Third-Party Software for the Customer's particular purpose beyond those obligations, save to the extent liability cannot lawfully be excluded.

13. Right to re-sale or sub-license

13.1 Subject to this Clause 13 and to the Acceptable Use Policy, the Customer may re-sell or sub-license to the Customer's Clients Services provided under a Reseller Hosting account, a VPS or a Dedicated Server.

13.2 The Customer shall not re-sell or sub-license any Shared Hosting Service, any Domain Service, or any other Service not listed in Clause 13.1, without the prior written consent of the Provider.

13.3 The Customer is and shall remain solely responsible for the Customer's Clients, including for the acts and omissions of Clients using the Services, for billing and collection from Clients, for customer support to Clients, and for the contractual relationship between the Customer and each Client.

13.4 The Customer shall ensure that each of the Customer's Clients is bound by written terms that are no less protective of the Provider than these Terms and Conditions (including the Acceptable Use Policy) in respect of the Services used by the Client.

13.5 The Customer shall comply, and shall procure that the Customer's Clients comply, with the Resource Usage Policy (including its reseller section) published by the Provider from time to time.

13.6 The Customer shall promptly pass on to its Clients, in its own name, any notice the Provider asks it to forward, including notices of planned maintenance or incidents, and any complaint, infringement notice or takedown request concerning a Client's content. The Customer shall respond to the Provider about any such complaint within the time the Provider reasonably requests.

13.7 Where the Customer is not a consumer (within the meaning of section 2(3) of the Consumer Rights Act 2015), the Customer shall indemnify and keep indemnified the Provider from and against all losses, damages, liabilities, costs and expenses (including reasonable legal costs) suffered or incurred by the Provider arising out of or in connection with (a) the Customer's resale of the Services, (b) the acts or omissions of any Client, (c) any claim by a Client against the Provider arising out of or in connection with the Services, and (d) any breach by the Customer or by any Client of these Terms and Conditions (including the Acceptable Use Policy) or of applicable law in connection with the Services.

13.8 Where the Customer is a consumer, the Customer shall be liable to the Provider for losses, damages, liabilities, costs and expenses arising out of the Customer's resale activity (including the acts or omissions of any Client and any claim brought against the Provider by a Client) only to the extent that such loss, damage, liability, cost or expense is a reasonably foreseeable consequence of the Customer's breach of the Contract or of applicable law.

13.9 Separately from and in addition to Clause 13.7 and Clause 13.8, the Customer shall take all reasonable steps to enforce the Customer's contract with each Client in any case where the Client is alleged or suspected to have breached these Terms and Conditions (including the Acceptable Use Policy) in the Client's use of the Services, including by suspending or terminating the Client's service where reasonably required to do so by the Provider to prevent ongoing harm or to comply with applicable law.

14. Confidentiality obligations

14.1 Each party shall:

(a) keep the other party's Confidential Information strictly confidential;

(b) not disclose the other party's Confidential Information to any person without the other party's prior written consent, save to that party's employees, officers, agents, professional advisers, insurers, subcontractors and service providers (including the Provider's sub-processors) who need to know the Confidential Information for the purposes of the Contract and who are bound by duties of confidentiality substantially similar to those set out in this Clause 14;

(c) use the same degree of care to protect the confidentiality of the other party's Confidential Information as the receiving party uses to protect the receiving party's own confidential information of a similar nature, and in any event no less than a reasonable degree of care; and

(d) use the other party's Confidential Information only for the purposes of the Contract.

14.2 The obligations in this Clause 14 shall not apply to information that:

(a) is, at the time of disclosure, or subsequently becomes, publicly known through no act or default of the receiving party;

(b) was lawfully in the receiving party's possession before the disclosure;

(c) is lawfully received from a third party without any obligation of confidentiality; or

(d) is required by law, regulation or competent authority to be disclosed, provided that the receiving party (where permitted by law) gives the disclosing party prompt notice of the required disclosure and cooperates with the disclosing party's lawful efforts to limit the scope of the disclosure.

14.3 The obligations in this Clause 14 shall continue in force during the Term and for a period of five (5) years after the termination of the Contract, save that obligations of confidentiality in respect of Personal Data shall continue for so long as the Personal Data remains in the possession or control of the receiving party.

15. Data protection

15.1 In respect of Customer Personal Data, the Provider acts as processor on behalf of the Customer or, where the Customer is itself acting as processor for another controller, as sub-processor, in each case as those terms are defined in the Data Protection Laws. Where the Provider uses personal data for its own purposes, such as billing, keeping records of its dealings with the Customer, protecting its systems and meeting its legal obligations, it does so as controller, as described in its privacy policy. Schedule 5 sets out the parties' respective obligations in respect of Customer Personal Data and forms part of the Contract.

15.2 Where the Provider processes Personal Data in its own right (for example, for billing, fraud prevention, security monitoring, or compliance with its own legal obligations as a hosting provider), the Provider acts as a controller in respect of that Personal Data. The Provider's processing of Personal Data as controller is described in the Provider's Privacy Policy (or any replacement URL notified by the Provider to the Customer from time to time).

15.3 Each party shall comply with its obligations under the Data Protection Laws.

15.4 The Provider shall process Customer Personal Data in accordance with Schedule 5.

15.5 The Customer shall ensure that the Customer is entitled to transfer Customer Personal Data to the Provider for processing in accordance with the Contract, and that appropriate notices and lawful bases are in place to permit such processing.

15.6 The Provider may engage sub-processors to process Customer Personal Data on the basis set out in Schedule 5 (including the Sub-processor List referred to in Clause 15.10).

15.7 The Customer shall cooperate with the Provider in respect of any data subject rights request, supervisory-authority enquiry or personal data breach insofar as it concerns Customer Personal Data, in accordance with Schedule 5.

15.8 The Provider shall make available to the Customer the information reasonably necessary to demonstrate compliance with the Provider's obligations under Article 28 of the UK GDPR, in accordance with Schedule 5.

15.9 On termination of the Contract, the Provider shall return or delete Customer Personal Data in accordance with Schedule 5.

15.10 The Provider maintains a list of the sub-processors processing Customer Personal Data on the Provider's behalf (the "Sub-processor List"). The Sub-processor List is not published on the Provider's website. The Provider makes it available to the Customer through the Client Area, or on request by support ticket, once the Provider has confirmed that the request comes from the Customer or from a contact the Customer has authorised. The Sub-processor List given to the Customer names every sub-processor used for the Services the Provider currently offers, and any other used for Services the Customer holds, states for each its identity, the service it performs, where it processes data and the transfer safeguard relied on, and shows which of them process Customer Personal Data for the Services the Customer holds at the time.

15.11 The Provider shall give the Customer prior written notice of any proposed changes to the Sub-processor List (whether by the addition of a new sub-processor or the replacement of an existing sub-processor) by email to the Customer's registered email address, sent to every Customer whose Services the change affects. Notice shall be given not less than thirty (30) days before the proposed change takes effect, save where the change is required urgently to preserve the security, integrity or availability of the Services or to comply with applicable law, in which case the Provider shall give such notice as is reasonably practicable.

15.12 Where the Customer objects to a proposed sub-processor change on reasonable data-protection grounds, the Customer shall notify the Provider in writing within fourteen (14) days of the notice given under Clause 15.11. The parties shall use reasonable endeavours to agree a resolution. If no resolution can be agreed, the Customer may terminate the affected Service by written notice taking effect on or before the date the proposed change takes effect, and the Provider shall refund any Charges paid in advance for the period after termination in accordance with Clause 33.4 (full months only), without withdrawing any discount the Customer received for paying in advance. Refund under this Clause 15.12 is the Customer's sole contractual remedy for a sub-processor change to which the Customer objects, without prejudice to the Customer's statutory rights.

16. Cookies and similar technologies

16.1 The Provider uses cookies and similar technologies on its public website and within the Client Area for purposes including session management, authentication, security, analytics and service improvement. The Provider's use of cookies is described in the Provider's Cookie Policy (or any replacement URL notified by the Provider to the Customer from time to time).

16.2 Cookies that are not strictly necessary for the provision of the Services are served only with the Customer's consent, given through the cookie-consent mechanism on the Provider's website.

16.3 The Customer is responsible for its own compliance with the Privacy and Electronic Communications (EC Directive) Regulations 2003 in respect of cookies deployed by the Customer on sites hosted on the Hosting Platform.

17. Warranties

17.1 The Provider warrants to the Customer that the Services shall be performed with reasonable care and skill and in accordance with these Terms and Conditions.

17.2 The Customer warrants to the Provider that the Customer has the legal right and authority to enter into the Contract and to perform the Customer's obligations under the Contract.

17.3 All of the parties' warranties and representations in respect of the subject matter of the Contract are expressly set out in these Terms and Conditions. To the maximum extent permitted by applicable law, no other warranties or representations concerning the subject matter of the Contract will be implied into the Contract or any related contract. This Clause 17.3 does not affect the Customer's statutory rights as a consumer.

18. Online Safety Act 2023

18.1 The Customer acknowledges that the Provider is not a user-to-user service or search service within the meaning of the Online Safety Act 2023, and that where the Customer operates a user-to-user service or search service using the Services, the Customer (and not the Provider) is the service provider for the purposes of that Act.

18.2 The Customer shall comply with the Customer's own duties under the Online Safety Act 2023 (if any), including any duties relating to priority illegal content, and shall not use the Services in a manner that causes the Provider to be in breach of any notice or direction issued to the Provider by Ofcom or any successor regulator.

18.3 Where the Provider receives a notice or direction from Ofcom or from a competent authority (including a notice under the Online Safety Act 2023) concerning Customer Hosted Data or the Customer's use of the Services, the Provider may, to the extent reasonably necessary to comply with that notice or direction, suspend access to the affected content or (where required) to the affected Service. The Provider shall inform the Customer of the notice or direction to the extent lawful to do so and shall work with the Customer in good faith to minimise the impact on Services that are not the subject of the notice or direction.

19. Indemnities

19.1 Where the Customer is not a consumer, the Customer shall indemnify and keep indemnified the Provider from and against all losses, damages, liabilities, costs and expenses (including reasonable legal costs) suffered or incurred by the Provider arising out of or in connection with:

(a) any breach by the Customer of the Acceptable Use Policy;

(b) any breach by the Customer of any warranty given by the Customer under the Contract;

(c) any claim brought by a third party against the Provider in respect of Customer Hosted Data or the Customer's use of the Services that, if established, would constitute a breach of the Contract by the Customer; and

(d) any fraudulent, dishonest or wilfully unlawful act or omission of the Customer or any person using the Services through the Customer's account,

each a "Customer Indemnity Event".

19.2 Where the Customer is a consumer, Clause 19.1 does not apply. Instead, the Customer is responsible to the Provider only for losses that are caused by the Customer's breach of the Contract and that were reasonably foreseeable when the Contract was made.

19.3 The Provider shall indemnify and keep indemnified the Customer from and against all losses, damages, liabilities, costs and expenses (including reasonable legal costs) suffered or incurred by the Customer arising out of or in connection with any claim by a third party that the Customer's use of the Services in accordance with the Contract infringes the Intellectual Property Rights of that third party (a "Provider Indemnity Event"), save where the claim arises out of (i) Customer Hosted Data, (ii) Third-Party Software licensed to the Customer by a third party, or (iii) any modification of the Services made by or at the direction of the Customer.

19.4 The party seeking the benefit of an indemnity under this Clause 19 shall give the indemnifying party prompt written notice of any claim, shall not admit liability or settle the claim without the prior written consent of the indemnifying party (not to be unreasonably withheld), and shall cooperate in good faith with the indemnifying party's defence of the claim.

20. Limitation of liability

20.1 Nothing in the Contract shall limit or exclude the liability of either party for:

(a) death or personal injury caused by that party's negligence;

(b) fraud or fraudulent misrepresentation;

(c) any other liability that cannot lawfully be limited or excluded.

In relation to a consumer Customer, nothing in the Contract limits or excludes the Customer's statutory rights under the Consumer Rights Act 2015 or under any other consumer-protection law, nor any of the Provider's corresponding non-excludable obligations. In particular, nothing in this Clause 20 limits a consumer Customer's remedies under sections 49, 50 and 57 of the Consumer Rights Act 2015, including a price reduction or refund where the law provides one.

20.2 Subject to Clause 20.1, neither party shall be liable to the other, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for any of the following, whether direct or indirect:

(a) loss of profits;

(b) loss of revenue;

(c) loss of business or business opportunity;

(d) loss of contracts;

(e) loss of anticipated savings;

(f) loss of or damage to goodwill or reputation; or

(g) loss of or corruption of data that arises from any cause not directly and primarily caused by the acting party.

Where the Customer is a consumer, paragraphs (a) to (f) exclude such loss only to the extent that it is indirect or consequential, and this Clause 20.2 does not exclude liability for foreseeable loss within the scope of section 49 of the Consumer Rights Act 2015 owed to a consumer Customer.

20.3 Subject to Clause 20.1 and Clause 20.2, the Provider's total aggregate liability to the Customer in respect of the Contract and the Services (whether in contract, tort including negligence, breach of statutory duty or otherwise) shall not exceed the greater of (a) £500 (or US$650 for accounts billed in US dollars) and (b) the average monthly Charges paid by the Customer to the Provider under the Contract over the twelve (12) months immediately preceding the event giving rise to the liability, excluding Charges for Domain Names and SSL certificates.

20.4 The Customer's attention is drawn in particular to the availability of the service-credit remedies set out in Annex 1 (in respect of Hosting Services), Annex 2 (in respect of Email Services) and Annex 3 (in respect of a Managed Environment). Save for liability that cannot lawfully be limited, service credits are the Customer's sole contractual remedy for Downtime, Environment Downtime and missed response times under those Annexes, without prejudice to the Customer's other rights under the Contract or under applicable law (including consumer-rights legislation).

20.5 Each provision of this Clause 20 operates separately. If any part of this Clause 20 is held to be unenforceable, the remaining parts shall continue to apply.

21. Force Majeure

21.1 Neither party shall be liable for any failure or delay in performing its obligations under the Contract to the extent that the failure or delay is caused by a Force Majeure Event, provided that the party affected:

(a) notifies the other party in writing of the Force Majeure Event as soon as reasonably practicable, describing the nature of the event and its anticipated impact and duration; and

(b) uses reasonable endeavours to mitigate the effect of the Force Majeure Event and to resume performance as soon as reasonably practicable.

21.2 Payment obligations that have already accrued at the time the Force Majeure Event commences are not excused by this Clause 21, save to the extent that the Force Majeure Event specifically prevents payment (for example, where a payment-systems outage prevents the making or receipt of payment).

21.3 If the Force Majeure Event continues for a continuous period of more than thirty (30) days, either party may terminate the Contract (or the affected Service) by giving the other party written notice. On such termination, the Provider shall refund any Charges paid in advance for the period after termination in accordance with Clause 33.4 (full months only), without withdrawing any discount the Customer received for paying in advance.

21.4 The exercise by a party of its rights under this Clause 21 shall not give rise to any liability for the terminating party, save for the refund obligation in Clause 21.3.

21.5 This Clause 21 is intended to operate alongside, and not to displace, any rights or remedies that the Customer has under applicable law (including the doctrine of frustration and the Customer's statutory rights as a consumer).

22. Termination

22.1 The Customer may terminate the Contract (or any Service within the Contract) in accordance with the cancellation provisions of Clause 33 and, where the Customer is a consumer exercising a right of withdrawal under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, in accordance with Clause 32 and Schedule 6.

22.2 The Provider may terminate the Contract (or any Service within the Contract) on not less than thirty (30) days' written notice to the Customer, save where a longer period of notice is required by the Consumer Rights Act 2015 or any other applicable consumer-protection law. Where the Provider terminates under this Clause 22.2, it shall refund any Charges paid in advance for the period after termination in accordance with Clause 33.4 (full months only), without withdrawing any discount the Customer received for paying in advance.

22.3 Either party may terminate the Contract immediately by written notice to the other if the other party:

(a) commits a material breach of the Contract that is irremediable or, if remediable, that the breaching party fails to remedy within thirty (30) days of receiving written notice to do so;

(b) becomes insolvent, enters into a compulsory or voluntary arrangement with its creditors, has an administrator, receiver or liquidator appointed, is the subject of a winding-up order or petition, or takes or is subject to any analogous action in any jurisdiction by reason of actual or threatened insolvency;

(c) ceases or threatens to cease to carry on business;

(d) persistently breaches the Contract, whether or not each breach is material; or

(e) being an individual, is made bankrupt or dies.

22.4 Where the Provider is told that a Customer who is an individual, or the sole director or officer of an organisation, has died, the Provider will act only on the instructions of the personal representative of the estate (an executor or administrator, or the equivalent under the law that governs the estate), or, for an organisation with other directors, officers or trustees, a person who legally represents it. On receiving proof of the death, of that person's authority (such as a grant of probate, letters of administration, letters testamentary, or the equivalent where the estate is administered) and of their identity, the Provider may give them access to the account or a copy of its data, transfer the Services or Domain Names as they direct, or close the account. If the Customer has given the Provider written instructions about what should happen to the account after their death, such as naming a person to be given access or asking for the account to be closed, the Provider will follow them where it reasonably can, once it has proof of the death and of that person's identity, unless the personal representative of the estate or a court directs otherwise. Until then, the Services continue while they are paid for, and an account that is no longer paid is suspended and deleted in the usual way.

22.5 Where the Customer is an organisation, the Provider may act on the instructions of a person it has verified as one of its directors, officers or trustees, including to change who holds the account, after telling the current account holder and giving them a reasonable opportunity to object.

22.6 Either party may terminate the Contract immediately by written notice to the other if required to do so by applicable law or by direction of a competent authority.

22.7 Where the Provider terminates the Contract (or a Service) under Clause 22.3 on grounds of the Customer's material breach or insolvency, the Provider is not obliged to refund any Charges paid in advance for the period after termination, save to the extent that retention of those Charges would be unfair under applicable consumer-protection law.

22.8 Without limiting Clause 22.3, the Provider may terminate the Contract (or an affected Service) immediately by written notice to the Customer where:

(a) the Customer has materially breached the Acceptable Use Policy and that breach is irremediable or poses an immediate risk to the security, integrity or lawful operation of the Services or of any third party;

(b) a competent authority has required the Provider to cease providing a Service to the Customer; or

(c) the Customer has not paid an overdue Charge within thirty (30) days of the Service being suspended under Clause 9.4.

23. Effects of termination

23.1 On termination of the Contract for any reason:

(a) all Services provided under the Contract shall cease, save for those that the Provider is obliged to continue providing under Schedule 5 (Part E: Retention) or under applicable law;

(b) all licences granted under Clause 11 and Clause 12 in respect of the terminated Services shall terminate, subject to Clause 10;

(c) all amounts payable by the Customer to the Provider (or vice versa) in respect of the period up to termination shall become due and payable;

(d) the Provider shall return or delete Customer Personal Data in accordance with Schedule 5;

(e) each party shall return or destroy the other party's Confidential Information in its possession or control, save to the extent retention is required by applicable law or is necessary to document the parties' legal position; and

(f) any rights or remedies of either party that have accrued up to the date of termination shall continue to be enforceable, and the provisions of these Terms and Conditions that expressly or by implication are intended to survive termination shall continue in force.

23.2 Without limiting Clause 23.1(f), the following provisions shall survive termination of the Contract: Clauses 1, 7 (in respect of Charges accrued up to termination), 8 (as applicable), 9 (in respect of amounts accrued), 10, 11.3 and 11.5, 14, 15 and 16, 17.3, 19, 20, 23, 25, 26, 27, 28, 29, 30, 34, 35, 36, 37, Schedule 5 (to the extent required by that Schedule), and any provision of any Schedule that is expressly stated to survive.

23.3 Where the Customer requires access to Customer Hosted Data for migration purposes after notice of termination, the Provider shall cooperate with reasonable requests for that access until the Service ends. What remains available after that is set out in Schedule 5 Part E.

23.4 The Customer is responsible for retrieving or arranging for the retrieval of Customer Hosted Data before the Service ends. After it ends, Customer Hosted Data is removed and deleted as set out in Schedule 5 Part E, without further notice.

23.5 Termination of the Contract shall not affect any Order of, or other contractual arrangements between, the parties that are expressly stated to survive, or that by their nature are intended to survive, termination of the Contract.

24. Non-solicitation of personnel

24.1 Neither party shall, without the other party's prior written consent, directly or indirectly induce or attempt to induce any employee of the other party who has been materially involved in the provision or receipt of the Services to leave the employment of that other party, for the duration of the Contract and for a period of twelve (12) months after termination. This Clause 24 does not prohibit general advertising of employment opportunities or the recruitment of a person who applies in response to such general advertising.

25. Notices

25.1 Any notice given by a party under the Contract shall be in writing and shall be sent:

(a) by email (other than a notice of termination for material breach or insolvency, a notice of formal dispute under Clause 34, or any other notice expressly required to be given in a different form); or

(b) by pre-paid first-class post to the other party's registered office (or such other postal address as the party has notified in writing for the purposes of this Clause 25).

25.2 Notices to the Provider shall be directed as follows:

(a) routine operational and billing notices: via the contact form on the Provider's website or to the account contact email address published on that form for the relevant notice category;

(b) privacy, data-protection and data-subject-rights notices: [email protected];

(c) formal legal notices (including notices of termination for material breach, formal disputes under Clause 34, indemnity claims and notices required by applicable law to be in writing): by pre-paid first-class post to the registered office at 20–22 Wenlock Road, London, N1 7GU, United Kingdom, marked for the attention of "The Directors".

The Provider's contact page is structured to route each category of notice to the appropriate team. Use of the contact page is the recommended route for operational notices.

25.3 Notices to the Customer may be sent by email to the email address registered for the Customer's Client Area account, or by post to the Customer's registered address. The Customer shall keep the Customer's contact details current.

25.4 A notice is deemed to have been received:

(a) if sent by email, at the time of transmission, provided that if transmission occurs outside Business Hours, receipt is deemed to occur at 09:00 on the next Business Day;

(b) if sent by first-class post, two (2) Business Days after posting.

26. Subcontracting

26.1 The Provider may subcontract the performance of any of its obligations under the Contract, provided that the Provider shall remain responsible to the Customer for the performance of those obligations as if performed directly by the Provider. Where the subcontractor is a sub-processor of Customer Personal Data, Schedule 5 and Clauses 15.6, 15.10, 15.11 and 15.12 apply.

27. Assignment

27.1 The Customer may not assign, transfer, charge or otherwise deal with any of the Customer's rights or obligations under the Contract without the Provider's prior written consent, such consent not to be unreasonably withheld in respect of a consumer Customer.

27.2 The Provider may assign, transfer, charge or otherwise deal with the Provider's rights or obligations under the Contract to an Affiliate of the Provider or to a purchaser of all or substantially all of the assets of the Provider's business to which the Contract relates, on notice to the Customer. Any such assignment shall not materially reduce the Customer's rights under the Contract.

28. No waivers

28.1 No failure or delay by a party in exercising any right or remedy under the Contract shall operate as a waiver of that right or remedy, nor shall any single or partial exercise of any right or remedy preclude the further exercise of that right or remedy or any other right or remedy.

29. Severability

29.1 If any provision of the Contract is found to be illegal, invalid or unenforceable, the remaining provisions of the Contract shall continue in full force and effect. The parties shall negotiate in good faith to replace any illegal, invalid or unenforceable provision with a legal, valid and enforceable provision that gives effect, as far as possible, to the parties' original commercial intention.

30. Third party rights

30.1 A person who is not a party to the Contract shall have no rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any provision of the Contract.

30.2 This Clause 30 does not affect the rights of the Provider's Affiliates to enforce any provision of the Contract that is expressed to be for their benefit.

31. Variation

31.1 The Provider may from time to time vary these Terms and Conditions (including the Schedules, Annexes, the Acceptable Use Policy and the Resource Usage Policy) where the variation is:

(a) required to comply with applicable law or a direction of a competent authority;

(b) required to address a security risk or vulnerability, or to reflect a change in the Provider's or a supplier's security posture;

(c) required to reflect a change in the Services, the Hosting Platform, the Network, Third-Party Software or another supplier-dependent component of the Services that is not within the Provider's reasonable control;

(d) a clarification or correction of wording that does not materially change the parties' substantive rights and obligations; or

(e) otherwise a variation that does not materially disadvantage the Customer.

31.2 The Provider shall give the Customer not less than thirty (30) days' written notice of any variation under Clause 31.1 that would materially affect the Customer's rights or obligations, save where a shorter period is necessary to comply with applicable law, to address an urgent security or stability risk, or in the case of variations under Clause 31.1(d) or Clause 31.1(e) that do not materially affect the Customer. The notice shall set out, in plain English, the nature of the variation and its anticipated impact on the Customer. A variation takes effect for each Customer on the date given in the notice sent to that Customer, or on the day the Customer accepts it in the Client Area or in writing, if sooner.

31.3 Where the variation materially disadvantages the Customer, the Customer may cancel the affected Service without penalty by giving written notice to the Provider at any time before the variation takes effect, and the Provider shall refund any Charges paid in advance for the period after termination in accordance with Clause 33.4 (full months only), without withdrawing any discount the Customer received for paying in advance. Clause 7.6 applies to cancellations in response to a variation of Charges.

31.4 Variations to Charges are made under Clause 7.6 and not under this Clause 31. Any other variation of the Contract (including any variation proposed by the Customer) requires the written agreement of both parties.

32. Consumers

32.1 This Clause 32 applies where the Customer is a consumer within the meaning of section 2(3) of the Consumer Rights Act 2015 (being an individual acting for purposes that are wholly or mainly outside the individual's trade, business, craft or profession).

32.2 The Services are digital content or digital services within the meaning of the Consumer Rights Act 2015 and are supplied with the quality standards required by that Act. Nothing in the Contract excludes or limits the consumer Customer's statutory rights.

32.3 Where the Customer is a consumer, the Customer has the right to withdraw from the Contract under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 within the period of fourteen (14) days beginning on the day after the date of the Contract. To exercise the right of withdrawal, the Customer may use the Model Cancellation Form set out at Schedule 6 or make any other clear statement to the Provider of the Customer's decision to withdraw. Withdrawal notice should be sent to [email protected] or through the contact page on the Provider's website.

32.4 If the Customer has expressly requested that the Services begin during the 14-day withdrawal period (and the Provider has acknowledged that request), the Customer shall pay the Provider an amount proportionate to the Services supplied up to the date the Customer communicates withdrawal, calculated in accordance with Regulation 36(4) of those Regulations, subject to Regulation 36(6). The Provider's obligation to refund the balance applies within fourteen (14) days after the day on which the Provider is informed of the withdrawal, in accordance with Regulation 34.

32.5 Where the Services have been fully performed during the withdrawal period and performance began with the Customer's express consent and acknowledgement that the right of withdrawal would be lost once the Services had been fully performed, the Customer loses the right of withdrawal under Regulation 36(2). A Domain Service is fully performed once the Registry has registered, transferred or renewed the Domain Name, so where the Customer asked for it to go ahead during the withdrawal period and acknowledged that the right would be lost, the right of withdrawal ends at that point.

32.6 The Provider explains how a consumer may exercise the Customer's rights under this Clause 32 and under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 in the Client Area and in the Order confirmation email, and the Provider's support team will assist any consumer Customer who asks.

32.7 Nothing in the Contract affects any other statutory right of the consumer Customer, including any right under section 49 of the Consumer Rights Act 2015 (services to be performed with reasonable care and skill), under section 62 of that Act (requirement for fairness in consumer contract terms), under Part 4 of the Digital Markets, Competition and Consumers Act 2024 in relation to subscription contracts once the relevant provisions come into force, or under any applicable regulations or codes made under those Acts.

32.8 Money-back guarantee. Separately from, and in addition to, the rights in this Clause 32, the Provider offers the money-back guarantee published on the Provider's website (at the date of these Terms and Conditions, a refund of the Charges for a Hosting Service other than a Dedicated Server, or for an Email Service, where the Customer cancels it within sixty (60) days of first ordering it). For a Dedicated Server, the guarantee is a refund of its Charges where the Customer cancels it within fourteen (14) days of first ordering it, unless the Order states that the server's hardware was bought or built specifically for the Customer, in which case the guarantee does not apply to it. The guarantee does not apply to the registration, transfer or renewal of Domain Names, to set-up fees, or to an SSL certificate once the certificate authority has issued it. A certificate that has not yet been issued is refunded under the guarantee. Where a Domain Name was supplied free of charge with a Hosting Service, the refund under the guarantee is the Charges paid for that Hosting Service less the Provider's standard price, at the date of the Order, to register or transfer that Domain Name for one year (plus VAT where VAT applies to the Customer), and the Domain Name remains registered to the Customer. Migration Charges are dealt with in paragraph 9.2 of Schedule 7. The guarantee is available to all Customers, whether or not consumers, and nothing in the guarantee reduces a consumer Customer's statutory rights.

32.9 Renewal refund. Where the Customer is a consumer in the United Kingdom and a Service with a Minimum Term of twelve (12) months or more renews, the Customer may cancel that Service within fourteen (14) days after the renewal and receive a full refund of the Charges paid for the renewal, notwithstanding Clause 33.4. This does not apply to a Domain Name once the Registry has renewed it, to set-up fees, or to an SSL certificate once the certificate authority has issued it. It is in addition to the Customer's other rights under this Clause 32.

33. Subscription information and automatic renewals

33.1 Services are supplied on a recurring-subscription basis unless expressly stated otherwise at the point of Order. The Minimum Term for each Service is set out in the Order confirmation email.

33.2 Subject to Clause 33.3 (Domain Services) and to the Customer's right of cancellation, each Service shall renew automatically at the end of the then-current Minimum Term for a further period equal to the Minimum Term, at the Provider's then-current standard Charges for the Service (as varied under Clause 7.6 where applicable).

33.3 Domain Services renew automatically only where the Customer has Domain Auto Renewal enabled in the Client Area for the relevant Domain Name, as further set out in Schedule 2.

33.4 The Customer may cancel a Service at any time by giving written notice of cancellation through the Client Area, by email to [email protected], or through the contact page on the Provider's website. Where the Schedule for a Service sets a notice period for cancelling it, that period applies. Otherwise a Service needs no notice and may be cancelled at any time before its next renewal date. A cancellation is effective only once the Provider has confirmed it to the Customer in writing, which the Provider will do promptly. A Customer who has not received confirmation within two (2) Business Days should contact the Provider, as the Service remains active, and its Charges payable, until cancellation is confirmed. Cancellation takes effect at the end of the current Minimum Term, save that the Customer may request earlier cancellation. Where the Customer has prepaid for any Services that were to be provided after cancellation takes effect, at the Customer's request the Provider will issue a refund for full months unused; no partial month refunds will be issued. If by prepaying the Customer received a discount, the Provider will, upon early cancellation, calculate the refund retroactively, withdrawing the discount back to the start of the current prepaid term; this will result in the Customer paying the full undiscounted price for the months used and receiving a refund for the balance. The discount is not withdrawn where a Service ends under Clause 15.12, Clause 21.3, Clause 22.2 or Clause 31.3. This does not apply to Charges that these Terms and Conditions state are non-refundable, and does not affect the Customer's statutory rights. Within the period of the money-back guarantee in Clause 32.8, the Customer may use that guarantee instead where it applies.

33.5 The Provider shall send pre-renewal reminder notices to the Customer:

(a) before the expiry of each Minimum Term for Services other than Domain Services, at the intervals required from time to time by the subscription-contract regime in Part 4 of the Digital Markets, Competition and Consumers Act 2024 (once in force) and in any event not less than a reasonable period before the renewal date, identifying the Service, the renewal date and the renewal Charges;

(b) before the expiry of each Domain Name registration for which Domain Auto Renewal is enabled, at the intervals set out in Schedule 2;

(c) on a timely basis where the Charges for a Service are to be varied under Clause 7.6.

34. Dispute resolution

34.1 The parties shall use reasonable endeavours to resolve any dispute arising under or in connection with the Contract amicably and informally, in the first instance by direct communication between the individuals responsible for the day-to-day operation of the Contract.

34.2 If a dispute is not resolved under Clause 34.1 within fourteen (14) days of it being raised in writing, either party may escalate the dispute to a director of each party (or equivalent senior representative) by giving written notice. The parties shall use reasonable endeavours to resolve the dispute at that level within a further period of twenty-one (21) days.

34.3 Where the Customer is a consumer and the Provider's final response to a complaint does not resolve it, the Provider shall say so in writing, tell the Customer how they may take the matter further, and tell them where to get free independent advice. The Provider will give its final response within eight (8) weeks of receiving the complaint. The Provider is not a member of an alternative dispute resolution (ADR) scheme and is not obliged to take part in ADR, but will consider in good faith any request by the Customer to refer the dispute to an ADR provider accredited under Chapter 4 of Part 4 of the Digital Markets, Competition and Consumers Act 2024.

34.4 If the dispute is not resolved under Clause 34.2, the parties may agree to refer the dispute to mediation. The mediator shall be agreed between the parties or, if they cannot agree, nominated by CEDR on the application of either party.

34.5 Where the Customer is a consumer, nothing in this Clause 34 affects the Customer's right to bring court proceedings at any time, or to ask at any time for the dispute to be referred to ADR under Clause 34.3.

34.6 Nothing in this Clause 34 shall prevent a party from seeking urgent interim or injunctive relief from a court of competent jurisdiction.

35. Entire agreement

35.1 The Contract constitutes the entire agreement between the parties in respect of its subject matter and supersedes all previous agreements, negotiations, representations and understandings, whether written or oral, in respect of that subject matter.

35.2 Each party acknowledges that it has not relied upon any representation, warranty or undertaking in entering into the Contract other than those expressly set out in the Contract. Nothing in this Clause 35 limits liability for fraud or fraudulent misrepresentation.

35.3 From the day these Terms and Conditions apply to a Service, they replace every earlier agreement between the parties about that Service, unless the Provider agrees in writing, after these Terms and Conditions were last updated, that an earlier agreement or part of it continues. Until that day, the earlier terms continue to apply to that Service.

36. Law and jurisdiction

36.1 The Contract (and any non-contractual dispute or claim arising out of or in connection with the Contract) shall be governed by and construed in accordance with the laws of England and Wales.

36.2 The courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim (including any non-contractual dispute or claim) arising out of or in connection with the Contract or its subject matter or formation, save that where the Customer is a consumer who is habitually resident outside England and Wales, the Customer may also bring proceedings in the courts of the Customer's country of habitual residence to the extent required by applicable law.

37. Interpretation and construction

37.1 In the Contract, a reference to a statute or statutory provision is a reference to it as amended, extended, consolidated or re-enacted from time to time.

37.2 A reference to a "person" includes an individual, firm, company, corporation, partnership, unincorporated association, joint venture, government, state, agency, or other entity (whether or not having separate legal personality).

37.3 The words "include", "includes" and "including" shall be construed without limitation.

37.4 A reference to "writing" or "written" includes email (save where expressly stated otherwise in the Contract).

37.5 Clause, Schedule and Annex headings are for ease of reference only and shall not affect the construction of the Contract.

37.6 A reference to the singular includes the plural and vice versa.

37.7 A reference to one gender includes all genders.

37.8 Where a provision of the Contract would be unenforceable if read as extending to an unreasonable degree, it shall be read down to the maximum extent to which it would be enforceable.

37.9 Where the same subject matter is dealt with in more than one provision of the Contract, the provisions shall be read together wherever possible. If there is an irreconcilable conflict, the following order of precedence applies: (i) Schedule 5, in respect of the processing of Customer Personal Data; (ii) any special terms that the parties have expressly agreed in an Order for the Services that Order covers; (iii) a Schedule, for the Service it covers; (iv) the main body of these Terms and Conditions; (v) the Annexes; and (vi) the rest of the Order. An Order does not override Schedule 5 unless the parties expressly agree in writing a lawful variation to it.

Schedule 1: Hosting Services

1. Scope and classification

1.1 This Schedule 1 sets out the terms applicable to the Hosting Services supplied by the Provider, as defined in Clause 1. Hosting Services comprise Shared Hosting (including Reseller Hosting) and Servers (VPS and Dedicated Servers), the latter supplied either as Managed Servers (at the Basic Managed or Fully Managed Service Level) or as Unmanaged Servers.

1.2 The features, technical specifications and published limits of each Hosting Service are set out on the Provider's website in the description of the relevant Service at the point of Order.

1.3 All servers and other equipment used to provide the Hosting Services, including Dedicated Servers, remain the property of the Provider. The Customer may not physically access them, or the data centres that house them, without the Provider's prior written permission.

2. Responsibilities: Shared Hosting (including Reseller Hosting)

2.1 The Provider shall operate Shared Hosting at the Fully Managed Service Level. The Provider is responsible for the hardware, hypervisor, operating system, control panel, common services (web server, mail server, database server, DNS), common-security tooling, routine patching, and platform-wide monitoring.

2.2 The Customer is responsible for:

(a) content (Customer Hosted Data);

(b) the Customer's application code and third-party applications installed by the Customer;

(c) application-level configuration within the control panel (including the Customer's email accounts, cron jobs, SSL installation where not automatic, and custom PHP configuration where made available);

(d) the Customer's Client Area Credentials and Hosting Account Credentials; and

(e) lawful and acceptable use of the Service in accordance with the Acceptable Use Policy.

2.3 The Provider shall make commercially reasonable efforts to protect Shared Hosting from malware, abuse and exploitation, including through the Third-Party Software listed in Clause 1.1 of these Terms and Conditions. The Provider's security software scans Customer Hosted Data automatically and may block, clean or quarantine files it detects as malicious. The Provider tells the Customer when files are quarantined, and may delete quarantined files after fourteen (14) days if the Customer takes no action. The Customer acknowledges that no security measures can guarantee absolute protection against all threats.

3. Responsibilities: Managed Servers

3.1 Where the Customer has ordered a Managed Server, the Provider manages the server software: the operating system, the control panel, and the web, email and database server software and PHP versions that the Provider installs and supports (together, the "Managed Components"), at the Service Level the Customer has ordered.

3.2 The Provider does not manage, update or patch the websites and applications the Customer installs, such as WordPress, its plugins and themes, other content management systems and the Customer's own code, at any Service Level. Keeping them up to date and secure is the Customer's responsibility. Where the Provider's security tools patch or clean them automatically, that is an additional protection, not an undertaking to keep them secure.

3.3 At the Basic Managed Service Level, the Provider sets the Server up, applies security and other updates to the Managed Components, and, when the Customer reports them, fixes faults in the Managed Components themselves that the Provider caused or that come from a bug in that software (for example, a service that fails after an update the Provider applied, or a control panel bug). The Server is connected to the Provider's monitoring, which records its activity for later analysis; the Provider does not act on monitoring alerts or resolve issues proactively at this level. Other system administration is charged at the Provider's published hourly rate, including investigating or fixing high load or poor performance, tuning, configuration changes, and anything caused by the Customer's own software, settings or changes, as are application installation, troubleshooting and support.

3.4 At the Fully Managed Service Level, the Provider also acts on its monitoring: it responds to alerts and investigates and resolves issues it detects in the Managed Components, without waiting for the Customer to report them. It provides incident response and system administration for the Server, and helps the Customer troubleshoot commonly used applications, as described for that level on the Provider's website. That help does not make the Provider responsible for keeping those applications updated or secure.

3.5 At the Fully Managed Service Level, the Provider does not give the Customer, or anyone acting for the Customer, root or administrator access unless the Provider agrees in writing. Where it does, problems caused by changes made with that access fall outside the Provider's management responsibilities. The Provider will put them right on request, charged at its standard rates under Schedule 4, and, where the work is likely to be chargeable, will tell the Customer and start it only once the Customer confirms, unless the Customer has already authorised that work in writing.

4. Responsibilities: Unmanaged Servers

4.1 Where the Customer has ordered an Unmanaged Server, the Provider's responsibility is limited to:

(a) the hardware (for Dedicated Servers) or the hypervisor (for VPS Unmanaged Servers);

(b) the Network connecting the Server to the internet;

(c) (unless the Customer has elected otherwise) initial provisioning of the Server with the operating system image selected by the Customer at the point of Order; and

(d) any additional matter expressly stated in the Order to be the Provider's responsibility.

4.2 The Customer is responsible for all other aspects of the operation of an Unmanaged Server, including operating-system patching, application installation, application security, firewall configuration, user management, backups and general system administration. Support Services for an Unmanaged Server are chargeable under Schedule 4 unless expressly included in the Order.

5. Resources and Resource Usage Policy

5.1 Each Hosting Service is supplied with the Resources specified for that Service on the Provider's website at the point of Order and in the Resource Usage Policy (including its reseller section) published by the Provider from time to time.

5.2 The Customer shall operate the Services within the applicable Resource limits. The Provider may monitor Resource usage and may take action under paragraph 5.3 where the Customer's usage exceeds the applicable limits or adversely affects other customers sharing the Hosting Platform.

5.3 Where the Customer's usage exceeds the applicable Resource limits, the Provider may (acting reasonably and proportionately, and in the following escalation order where time permits):

(a) notify the Customer and request that the Customer reduce usage within a reasonable period;

(b) rate-limit or throttle the Service;

(c) offer the Customer an upgrade to a Service with higher Resource allocations; or

(d) suspend the Service, after giving the Customer at least seven (7) days' written notice.

The Provider may act without prior notice where the Customer's usage poses an immediate risk to the Hosting Platform or to other customers. A Service that reaches its allocated Resource limits (for example, memory, processor time or concurrent processes) may slow down or return errors until usage falls or the Customer upgrades; that is the Service operating within its allocation and is not a fault in the Service or unavailability for the purposes of Annex 1.

5.4 Whatever the cause, including traffic from bots, crawlers or attacks, or a website's own code, scheduled tasks or database queries, where a Service is affecting, or poses a serious risk to, the stability, performance or security of the Hosting Platform or other customers, the Provider may take reasonable and proportionate steps straight away to protect them. These include blocking or limiting traffic; placing a check in front of a website that visitors pass before reaching it; changing the website's server or web configuration, or adding files to it, for that purpose; stopping processes or database queries; pausing scheduled tasks; or temporarily isolating the Service. While such a measure is in place, some visitors may see the check, and some automated traffic, including search engines and monitoring services, may be blocked or delayed. The Customer shall not remove or change the measure while it is in place. The Provider will tell the Customer what it has done and why as soon as practicable, and will remove the measure once it is no longer needed. Such a step is not a suspension under Clause 9 or the Acceptable Use Policy.

5.5 The Provider's fair-use framework in relation to so-called "unlimited" or "uncapped" resources is set out in the Resource Usage Policy. "Unlimited" or "uncapped" terminology refers to the absence of a single hard-coded numerical cap and is subject to the fair-use principles and the service-level caps described in that policy.

5.6 A Server includes Data Transfer of up to 5 TB a month, measured as the greater of inbound and outbound, unless the Order states otherwise. If a Server goes over its allowance, the Provider will contact the Customer to agree how to deal with it, such as moving to a plan with a larger allowance or paying for the extra Data Transfer at a rate the Provider tells the Customer before charging. If no agreement is reached, the Provider may limit the Server's network speed so that it stays within the allowance.

6. Backups

6.1 The backups included depend on the Service.

(a) For Shared Hosting and Reseller Hosting, the Provider shall use reasonable endeavours to take a backup at least once a day. Some plans include more frequent backups, as published for the plan on the Provider's website and shown for each Service in the Client Area.

(b) For a Managed Server, at either the Basic Managed or Fully Managed Service Level, the Provider sets up backups to run at least once a day and uses reasonable endeavours to keep them running, unless otherwise agreed in writing. Any further backups, and the backups on an Unmanaged Server, are as set out in the Order or as otherwise agreed in writing. On a Basic Managed or Unmanaged Server, or a Fully Managed Server where the Provider has agreed to give root or administrator access, the Customer can change its backup settings, and the Provider cannot confirm that they stay as set up.

(c) The backups the Provider can detect for each of the Customer's Services are shown in the Client Area. Where the Provider's systems cannot read a Service's backup settings automatically, that does not mean its backups are not configured or running; the Provider will confirm them on request, in writing if the Customer needs.

(d) The Provider monitors the backup jobs it manages and, where one fails, will investigate and work to resolve it. The Provider does not guarantee that every scheduled backup will be completed or that every restore will succeed.

(e) Where supplied as part of the Service, backup and restore tools in the control panel let the Customer take and restore backups.

6.2 The Provider's backups are supplied as a convenience feature for the Customer and do not relieve the Customer of its responsibility for its own disaster-recovery planning. The Customer shall maintain independent off-platform backups of any Customer Hosted Data that is business-critical to the Customer.

6.3 On termination of a Service, Provider-held backups shall be retained for the periods set out in Schedule 5 Part E.

7. SSL

7.1 The Provider makes free, automatically renewing SSL certificates (Let's Encrypt or equivalent) available for domains served from Shared Hosting and Managed Servers as a feature of the Service at no additional charge, subject to the certificate authority's terms. They are issued through the control panel's own feature for this, such as cPanel's AutoSSL ("AutoSSL" in this Schedule includes the equivalent feature of another control panel). Paid SSL certificate products are supplied under Schedule 3 (SSL Certificate Services).

7.2 AutoSSL certificates are issued and renewed automatically, but only where the certificate authority can validate each domain, by checking its DNS or a file served from the website. A domain may not get or keep an AutoSSL certificate if it points elsewhere, sits behind a proxy or content delivery network that interferes with validation, blocks access to the validation file, or has DNS records that do not allow that authority to issue certificates for it. Keeping each domain set up so that it can be validated is the Customer's responsibility.

7.3 Certificate authorities limit how many certificates they will issue in a given period and how many names one certificate can cover (Let's Encrypt, for example, currently covers up to 100). Where a single website, meaning a domain together with its aliases and subdomains, has more names than that, some may not be covered. Some limits apply across all the certificates requested from a server, not just the Customer's, so when one is reached, issuing or renewing a certificate may be delayed until it resets, and new certificates may take priority over renewals. These limits are set by the certificate authority and are outside the Provider's control.

7.4 AutoSSL certificates are not issued for suspended accounts, and the Customer can exclude domains from AutoSSL in the control panel. The Provider does not guarantee that an AutoSSL certificate will be issued or renewed for every domain. A Customer who needs a certificate that does not depend on AutoSSL can buy a paid certificate under Schedule 3.

8. Third-Party Software on Hosting Services

8.1 The Third-Party Software made available as part of a Hosting Service varies by tier and is set out on the Provider's website in the description of the relevant Service. The Provider shall give the Customer reasonable prior notice of any material change in the Third-Party Software bundle affecting the Customer's Service, in accordance with Clause 31.

9. Cancelling a Server

9.1 A VPS requires at least ten (10) days' written notice of cancellation, and a Dedicated Server at least thirty (30) days' written notice, before the end of the current Minimum Term. These notice periods do not apply to a cancellation under Clause 7.6, Clause 15.12, Clause 21.3, Clause 31.3 or Clause 32.

Annex 1: Availability Service Level Agreement

1. Scope

1.1 This Annex 1 sets out the availability service level for Hosting Services (Shared Hosting, Reseller Hosting, VPS and Dedicated Servers) supplied under Schedule 1. Email Services have their own service level in Annex 2, and a Managed Environment has the service level in Annex 3 instead of this Annex 1.

2. Availability commitment

2.1 The Provider aims for its Network, and the hardware and hosting platform it operates to deliver each Hosting Service, to be available 100% of the time. For an Unmanaged Server, this commitment covers the Network and the hardware and virtualisation the Server runs on, but not the operating system or software the Customer manages.

3. Downtime and how it is measured

3.1 "Downtime" means a period during which a Hosting Service cannot be reached from the public internet, or is so degraded that it cannot reasonably be used, because of a fault in the Network or in the hardware or hosting platform the Provider operates, other than a period excluded under paragraph 4. Downtime is a failure of the Provider's own service. A Hosting Service that is reachable but whose website, application or email does not work because of something outside the Provider's Network, hardware or hosting platform is not Downtime.

3.2 Downtime is measured to the nearest minute by the Provider's monitoring systems from external vantage points. It runs from the earlier of the moment the Provider's monitoring detects it and the moment the Customer reports it to the Provider, until the Hosting Service is restored.

3.3 On request, the Provider will give the Customer the availability measurements it holds for the Customer's Service for the period of a claim.

4. Exclusions

4.1 The following do not count as Downtime:

(a) scheduled maintenance notified to the Customer in accordance with Clause 4.5, up to the notified duration;

(b) emergency maintenance carried out in accordance with Clause 4.5 and required to address a security vulnerability or imminent risk of loss of data;

(c) unavailability directly caused by a Force Majeure Event;

(d) unavailability caused by the Customer's act or omission, including a breach of the Acceptable Use Policy or configuration by the Customer at the control-panel or application layer;

(e) unavailability caused by third-party software, third-party systems or third-party services that are not within the Provider's reasonable control and are not operated by or on behalf of the Provider;

(f) faults in the Customer's website, application, code, plugins, themes, database or content, including errors shown by them while the Hosting Service itself is running;

(g) reaching or exceeding the Resources of the Service under the Resource Usage Policy, and any slowdown or limiting while it does so;

(h) traffic or attacks directed at the Customer's Service, including bots, crawlers, traffic spikes and denial-of-service attacks, and measures the Provider takes to protect the platform from them (such as limiting, blocking or isolating the Service);

(i) a compromise of the Customer's website or account (such as malware or a hacked password) and the time taken to contain or clean it;

(j) suspension or limitation of the Service under these Terms (for example for non-payment or a breach of the Acceptable Use Policy);

(k) DNS, domain names or SSL certificates that are not managed by the Provider, or that have expired or been changed by the Customer;

(l) problems with the Customer's own internet connection, devices or networks between the Customer and the Provider's Network that the Provider does not operate;

(m) delivery of email to, or blocking by, third-party mail providers or blocklists; and

(n) work the Customer asks for, such as restores, migrations or upgrades, for the time agreed.

5. Service credits

5.1 For each complete period of thirty (30) minutes of Downtime affecting a Hosting Service in a calendar month, the Customer is entitled to a service credit of five per cent (5%) of the monthly Charge for that Hosting Service (calculated pro rata where the Hosting Service is billed for a period longer than a month). All periods of Downtime affecting the Hosting Service in the month are added together. Downtime totalling less than thirty (30) minutes in a month, and any remainder of less than thirty (30) minutes, does not give rise to a credit.

5.2 For example, three separate periods of Downtime of 28 minutes each in a month total 84 minutes, which is two complete periods of thirty minutes, so the service credit is 10% of the monthly Charge. A single period of Downtime of five and a half hours gives a service credit of 55%.

5.3 Service credits for a Hosting Service in any calendar month shall not exceed 100% of the monthly Charge for that Hosting Service.

5.4 Where Downtime is caused by a fault in the Provider's Network, the service credit for that Downtime is instead, once Network Downtime in the calendar month exceeds four (4) minutes in total, one per cent (1%) of the monthly Charge for the Hosting Service for each complete minute of Network Downtime in that month, if that gives the Customer a larger credit. The same Downtime is never credited under both this paragraph and paragraph 5.1.

5.5 Service credits are applied as a credit against the Customer's next invoice for the affected Service. Service credits do not give rise to a right to a cash refund, save where the Customer has no further invoice to be credited against (for example, following termination of the affected Service), in which case the Provider shall refund them.

5.6 To claim a service credit, the Customer shall notify the Provider in writing of the claim within thirty (30) days of the end of the calendar month to which the claim relates, giving the Service affected and the dates and times of the Downtime as far as the Customer knows them.

5.7 Service credits are the Customer's sole contractual remedy for Downtime, subject to Clause 20.4.

6. Statutory rights

6.1 This Annex 1 does not affect the Customer's statutory rights, including any right under the Consumer Rights Act 2015.

Annex 2: Email Services Service Level Agreement

1. Scope

1.1 This Annex 2 sets out the availability service level for the Provider's Email Services, being the Zimbra-based hosted email service supplied as a discrete product and any other discrete hosted-email product the Provider supplies from time to time. It does not apply to mailbox functionality supplied as part of the Shared Hosting or Managed Server control panel, which is covered (to the extent of Provider-controlled mail servers) by Annex 1.

2. Upstream-dependency acknowledgement

2.1 The Email Services described in this Annex 2 are supplied using an upstream email platform operated by a supplier of the Provider, which is identified on the Sub-processor List. The Provider's ability to meet the service level in this Annex 2 is dependent on the availability of that upstream platform. The service level committed to the Customer in this Annex 2 does not exceed the service level the Provider itself receives from the upstream provider.

3. Availability target

3.1 The Provider aims for Email Services to be available 100% of the time, subject to paragraph 2.1.

4. Measurement, exclusions and service credits

4.1 The Email Services are unavailable when they cannot send or receive email over the public internet through the Provider's supply chain, as observed by the Provider's monitoring systems from external vantage points. The exclusions in paragraph 4.1 of Annex 1 apply, as does any unavailability of the upstream email platform while its provider is itself affected by a Force Majeure Event or carrying out scheduled maintenance.

4.2 A period during which the Email Services are unavailable, measured as set out in paragraph 4.1, counts as Downtime, and the Customer is entitled to service credits for it in accordance with paragraphs 5.1 to 5.3 of Annex 1, calculated on the monthly Charge for the Email Services.

4.3 Paragraphs 3.2, 5.5, 5.6, 5.7 and 6.1 of Annex 1 apply to this Annex 2.

Annex 3: Complex Managed Hosting Service Level Agreement

1. Scope

1.1 This Annex 3 applies to a Managed Environment in place of Annex 1. A "Managed Environment" is a group of Servers supplied at the Fully Managed service level on which the Provider has configured load balancing across more than one Server and database replication, so that the hosted service can continue if one Server fails. This Annex 3 also applies to any other Service for which an Order says it applies.

1.2 Where an Order sets out service levels for a Managed Environment that differ from this Annex 3, the Order prevails, as Clause 37.9 provides.

2. Availability commitment

2.1 The Provider commits to the Managed Environment being available 100% of the time. The commitment covers the internal network between the Servers, the external Network, the Server hardware, the cloud hosts, persistent storage, the load-balancing infrastructure and the web stack the Provider manages (such as the web server, database server and PHP).

2.2 "Environment Downtime" means a period during which the Managed Environment as a whole cannot be reached from the public internet, or is so degraded that it cannot reasonably be used, because of a failure of anything listed in paragraph 2.1. Because a Managed Environment is designed to keep working while one or more of its Servers is out of service, the loss of a Server that does not stop the Managed Environment as a whole is not Environment Downtime.

2.3 Environment Downtime is measured as set out in paragraph 3.2 of Annex 1.

3. Availability credits

3.1 For each minute of Environment Downtime, the Customer is entitled to a service credit of one hundred (100) times the Charge for that minute of the Services in the Managed Environment, calculated pro rata from their monthly Charges. For example, Environment Downtime of 3 hours gives a credit equal to 300 hours of those Charges, and Environment Downtime of 15 minutes gives a credit equal to 25 hours of them.

4. Failover to a second site

4.1 Where the Customer has contracted the Provider to provide a failover facility at a second site, the Provider may move the Managed Environment to that site if the primary site fails completely. The primary site has failed completely when all of the following apply:

(a) the Customer's Managed Environment cannot be reached at the primary site at all, however caused (for example, a total network outage, a total loss of power, or the failure of all or enough of the Customer's equipment to stop the service);

(b) the failure has lasted, or is expected to last, more than 30 minutes; and

(c) the Provider's technical team agree that failing over will restore the service.

4.2 Failover is started by a member of the Provider's team and, once started, is designed to complete in about five (5) minutes under normal conditions. Moving the Managed Environment back to the primary site requires its data to be copied back, which the Provider and the Customer shall schedule for an agreed maintenance window.

5. Response times

5.1 When the Customer raises a support request about the Managed Environment through the Provider's support system, the Provider shall respond within the time in the table below for its severity, and send updates at the interval shown until the issue is resolved. The Provider has responded when it has replied to the request with a solution or a request for further information. Response times are measured by the Provider's support system from the moment the request is submitted.

5.2 If the Provider misses an initial response time, the Customer is entitled to a service credit for each hour by which it was missed, pro rata to the minute, of 5% (Critical), 2% (High) or 1% (Normal) of the total monthly Charges for the Managed Environment. For example, a Critical request answered 15 minutes late on a Managed Environment with monthly Charges of £1,000 gives a credit of £12.50.

5.3 The response times apply only to requests raised through the Provider's support system. Related requests about the same issue may be merged into one. Updates are part of the service but missing one does not give rise to a credit, and the Provider does not guarantee how long an issue will take to resolve.

6. Exclusions

6.1 Paragraph 4.1 of Annex 1 applies to this Annex 3, with the notice for scheduled maintenance being at least seventy-two (72) hours unless the Customer agrees a shorter period. In addition, nothing is Environment Downtime, and no response-time credit is due, where it results from:

(a) the Customer preventing the Provider from carrying out required maintenance or updates; or

(b) changes the Customer, or anyone acting for the Customer, makes to the configuration of the Managed Environment without the Provider's agreement.

7. Credits

7.1 Service credits under this Annex 3 for any calendar month, for availability and response times together, shall not exceed 100% of the monthly Charges for the Managed Environment, and credits that would exceed that limit are not carried forward.

7.2 Paragraphs 5.5, 5.6, 5.7 and 6.1 of Annex 1 apply to this Annex 3.

Annex 4: Acceptable Use Policy

1. Introduction

1.1 The Customer shall comply with this Acceptable Use Policy in the Customer's use of the Services.

1.2 The Customer shall ensure that each person accessing or using the Services through the Customer's account (including the Customer's employees, contractors, agents and, where the Customer holds a Reseller Hosting account, the Customer's Clients) complies with this Acceptable Use Policy.

2. General principles

2.1 The Customer shall not use the Services in any manner that is, or may reasonably be considered to be:

(a) unlawful or in breach of any applicable law or regulation;

(b) fraudulent, dishonest or deceptive;

(c) infringing of the Intellectual Property Rights, privacy rights or other rights of any third party;

(d) defamatory, libellous, obscene, harassing, discriminatory, threatening or hateful;

(e) harmful to minors;

(f) in breach of data-protection law, privacy law or any other law protecting personal information;

(g) in breach of any obligation of confidentiality owed to any third party; or

(h) otherwise in breach of a duty owed to any person.

2.2 The Customer shall not use the Services to host, transmit, store, distribute or make available any of the following:

(a) child sexual abuse material or any content in respect of which the Provider would be required to notify or remove by reason of the Customer's own duties under the Online Safety Act 2023;

(b) content encouraging or inciting terrorism, violent extremism or violence;

(c) content that is a priority illegal content under the Online Safety Act 2023;

(d) content supplying controlled drugs or unlicensed firearms to persons in the United Kingdom;

(e) content facilitating human trafficking or modern slavery;

(f) malicious software (including viruses, worms, ransomware, Trojan horses, keyloggers, rootkits and any other code designed to damage or gain unauthorised access to a system or data);

(g) pornography or other sexually explicit material, including links to websites that provide it;

(h) material that teaches or encourages breaking into systems, accounts or data without permission (security news, and security research and training carried out ethically, are permitted);

(i) content that is lawful in itself but that the Provider has informed the Customer falls within a specific restricted-content category that the Provider does not host (such restrictions to be proportionate and applied without discrimination); or

(j) content depicting violence in an explicit, graphic or gratuitous way, other than genuine news, educational or documentary content.

2.3 The Customer shall not:

(a) use the Services to conduct any security testing, penetration testing, load testing or stress testing of any system (including any Provider system) without the Provider's prior written consent;

(b) operate a Tor relay or exit node, or a public VPN, proxy or anonymising service;

(c) send unsolicited commercial email, bulk email or spam in breach of the Privacy and Electronic Communications (EC Directive) Regulations 2003 or any applicable anti-spam law;

(d) operate an open relay, open proxy or open SMTP service;

(e) engage in any activity that the Provider reasonably considers may damage, overburden or impair the Provider's Network, Hosting Platform or other customers' use of the Services;

(f) reverse-engineer, decompile, disassemble or attempt to derive the source code or algorithms of any Software or Provider system, save to the extent expressly permitted by applicable law that cannot be excluded;

(g) resell or sub-license Services other than as Clause 13 permits (on a Reseller Hosting account, a VPS or a Dedicated Server, and never Shared Hosting without the Provider's written consent);

(h) send email to bought or rented lists, or advertise a website hosted with the Provider by spam sent from any network;

(i) act in a way likely to cause any of the Provider's IP addresses or domains to be listed by an anti-spam or blocklist service; or

(j) carry on, without the Provider's prior written agreement, any business that needs a licence, registration or authorisation where it operates or where its customers are, such as gambling, betting or lotteries, the sale of medicines or weapons, or financial services. The Provider may ask for evidence of the licence, registration or authorisation before agreeing.

2.4 Where the Provider has reasonable grounds to suspect a breach of paragraph 2.1, 2.2 or 2.3, the Provider may investigate, and in doing so may inspect the Customer Hosted Data to the extent reasonably necessary for the investigation. Any inspection shall be proportionate and documented.

2.5 Where the Provider receives a complaint, notice or takedown request concerning Customer Hosted Data from a third party (including a rights-holder's notice of alleged infringement or a regulator's notice), the Provider shall act in accordance with applicable law and may, where appropriate, suspend access to the affected content pending resolution. The Provider shall give the Customer notice of the complaint or notice to the extent lawful to do so.

2.6 The Provider acts reasonably in exercising any discretion under this Annex 4 and shall not exercise it arbitrarily or in bad faith.

3. Use of computing resources

3.1 The Customer shall use the Services within the Resource limits set out in the Resource Usage Policy (including its reseller section).

3.2 In addition to paragraphs 2.1 to 2.3, the Customer shall not:

(a) attempt to gain unauthorised access to any system, data or account (including any Provider system or any other customer's account);

(b) circumvent or attempt to circumvent any access controls, authentication mechanisms or security measures;

(c) intercept or attempt to intercept data not intended for the Customer;

(d) use the Services to host or operate any botnet, command-and-control infrastructure, phishing infrastructure or any other system used for coordinated unlawful activity;

(e) use the Services in a manner that causes the Provider to be in breach of any sanctions regime or export-control regime applicable to the Provider;

(f) use the Services to facilitate fraud against any third party;

(g) use the Services in a manner that the Provider reasonably considers presents an unacceptable operational risk to the Hosting Platform, the Network or other customers;

(h) send, relay or forward unsolicited commercial email or bulk email in breach of paragraph 2.3(c);

(i) use the Services for any activity that constitutes or facilitates tax evasion, fraud or money laundering under the laws of the United Kingdom or any applicable jurisdiction;

(j) use the Services to host, distribute or operate any scheme that is a pyramid scheme, Ponzi scheme or other fraudulent financial scheme;

(k) use the Services for any activity prohibited by the Fraud Act 2006;

(l) use the Services in contravention of the National Security Act 2023;

(m) use the Services in a manner that, if done by a corporate person, would constitute a failure to prevent fraud under section 199 of the Economic Crime and Corporate Transparency Act 2023 (where applicable to that person);

(n) use the Services in a manner that would be prohibited if it were carried out by or on behalf of the Provider under the Provider's own regulatory or legal obligations (including the Computer Misuse Act 1990, the Digital Economy Act 2017, the Online Safety Act 2023, and applicable sanctions and export-control regulations);

(o) use the Services to mine, stake or otherwise generate cryptocurrency or similar token-based assets, or for any other proof-of-work or similar sustained computational activity that is not the operation of a website, application or mail service;

(p) run a BitTorrent tracker or take part in peer-to-peer file sharing;

(q) host, install or distribute software, themes or plugins whose licence checks have been removed or bypassed (so-called "nulled" software), or that are otherwise distributed without the right-holder's permission;

(r) offer, sell or advertise services that flood or attack other systems (including so-called "stresser" or "booter" services), or distribute tools or kits whose main purpose is to attack, break into or take control of systems that the user is not authorised to access; or

(s) collect content from third-party websites in bulk by automated means in breach of those websites' terms or technical restrictions, or run bots that create accounts, post content or submit forms in bulk on third-party services.

3.3 The Customer shall promptly notify the Provider of any suspected or actual security compromise, unauthorised access, or unauthorised use of the Services involving the Customer's account.

4. Email use

4.1 The Customer shall not use the Services (or procure any third party to use the Services) to send:

(a) spam (meaning unsolicited bulk email or unsolicited commercial email not complying with the Privacy and Electronic Communications (EC Directive) Regulations 2003);

(b) email that is forged, misleading or contains falsified headers;

(c) phishing email; or

(d) email in breach of any applicable anti-spam law.

4.2 The Customer shall maintain appropriate sender-reputation hygiene (including SPF, DKIM and, where applicable, DMARC records) for any domain from which the Customer sends email using the Services.

5. Content obligations

5.1 The Customer is solely responsible for the Customer Hosted Data.

5.2 Where the Customer operates a user-to-user service or search service through the Services, the Customer (and not the Provider) is the service provider for the purposes of the Online Safety Act 2023.

6. Reporting and enforcement

6.1 The Provider may investigate suspected breaches of this Acceptable Use Policy. The Customer shall cooperate reasonably with any such investigation.

6.2 Where the Provider determines that the Customer has breached this Acceptable Use Policy, the Provider may (acting reasonably and proportionately):

(a) notify the Customer of the breach and require the Customer to remedy it within a reasonable period;

(b) suspend the affected content or Service: straight away where the breach poses a risk to the security, integrity or lawful operation of the Services or to any third party, and otherwise if the Customer has not remedied the breach within the period given under (a). The Provider will tell the Customer why, and will restore the content or Service once the breach is remedied;

(c) remove or disable the offending content; or

(d) terminate the affected Service in accordance with Clause 22.

6.3 Where the breach involves illegal content, the Provider may (and in some cases must) notify law enforcement or a competent authority.

7. Third-party reports and complaints

7.1 Any person wishing to report a breach of this Acceptable Use Policy may do so through the contact page on the Provider's website or by email to [email protected].

8. Review of this Acceptable Use Policy

8.1 The Provider may update this Acceptable Use Policy from time to time in accordance with Clause 31.

9. Survival

9.1 The Customer's obligations under this Acceptable Use Policy survive termination of the Contract to the extent necessary to address acts or omissions of the Customer occurring during the Term.

Schedule 2: Domain Name Services

1. Scope

1.1 This Schedule 2 sets out the terms applicable to the Domain Services supplied by the Provider.

2. Registry and Registrar terms

2.1 Domain Names are registered with a Registry through a Registrar. Each Registry and each Registrar has its own terms that the Customer must comply with in respect of each Domain Name. The Customer shall comply with the terms of the applicable Registry and Registrar, as well as with ICANN's policies where applicable (including the Uniform Domain-Name Dispute-Resolution Policy and the Registration Data Directory Service policies).

2.2 The Provider is a reseller for some top-level domains and acts as registrar of record for others. The Provider shall identify the registrar of record for any Domain Name on request.

3. Registration and availability

3.1 Domain Name availability is determined by the applicable Registry at the time the registration request is submitted. The Provider cannot guarantee that a Domain Name requested by the Customer will be available or that any requested registration will be successful.

3.2 The Customer warrants that the Customer has the right to register the requested Domain Name and that registration of the Domain Name will not infringe any third party's rights.

3.3 The Charges for Domain Services are payable in advance in full for the relevant registration period. Charges for Domain Services are non-refundable once the Registry has registered, transferred or renewed the Domain Name (where the Customer is a consumer, see Clause 32.5).

3.4 The Provider may refuse to register a Domain Name, for example where it appears to infringe someone else's rights or to be intended for abuse, and will refund any Charge paid for it.

3.5 The Customer is responsible for checking that a Domain Name is spelled as intended before ordering it. Charges for a Domain Name registered as ordered are not refunded.

3.6 A transfer that has not started, or that fails, is refunded in full.

3.7 If the payment for a Domain Name's registration or renewal fails or is reversed (including by a chargeback) after the Provider has registered or renewed it, the Provider may straight away cancel the registration, or suspend the Domain Name and lock it so that it cannot be transferred to another Registrar until the Charge is paid, as far as the Registry's rules allow. Clause 9.3 and Clause 9.4 do not apply.

4. Renewal and Domain Auto Renewal

4.1 Domain Auto Renewal is enabled by default when the Customer orders a Domain Name through the Order flow. The Customer may opt out of Domain Auto Renewal at the time of Order, and may disable or re-enable Domain Auto Renewal at any time through the Client Area in respect of any Domain Name. Where Domain Auto Renewal is disabled for a Domain Name, that Domain Name will not renew automatically and will expire at the end of its current registration period unless the Customer places a renewal Order before expiry.

4.2 Domain Auto Renewal renews a Domain Name for the same period as its most recent registration or renewal.

4.3 Where Domain Auto Renewal is enabled:

(a) the Provider shall give the Customer reminder notices as set out in paragraph 4.5 before auto-renewal occurs;

(b) the Provider shall invoice the renewal and charge the Customer's payment method on file before the Domain Name expires, as set out in paragraph 4.7, and renew the Domain Name with the Registry once payment is received; and

(c) the Customer may turn Domain Auto Renewal off at any time through the Client Area, which cancels any unpaid renewal invoice for that Domain Name. To be sure of not being charged, the Customer should turn it off before the renewal invoice's due date, nine (9) days before the Domain Name expires (paragraph 4.7). A renewal that has been paid is not refunded.

4.4 Where the Customer orders a Domain Name through the Order flow, Domain Auto Renewal is enabled by default. The Order flow tells the Customer this and how to turn it off, which the Customer may do at any time through the Client Area (subject to paragraph 4.3(c)), and the Order confirmation email repeats it. Turning Domain Auto Renewal off also cancels any unpaid renewal invoice for that Domain Name.

4.5 The Provider shall send renewal reminder notices to the Customer's registered email address at such intervals as comply with the Provider's obligations (and, where applicable, the obligations of the Provider's upstream registrar) to ICANN or the relevant Registry. These shall include, at a minimum, a pre-expiry reminder not less than thirty (30) days before the renewal date, a further reminder not less than seven (7) days before the renewal date, and a post-expiry notice. The Provider may in its discretion send additional reminders, payment-related notices and operational communications, and may vary the precise schedule of those additional reminders from time to time.

4.6 On successful renewal of a Domain Name (whether by auto-renewal or by manual renewal), the Provider shall send the Customer a renewal confirmation by email. The Customer is responsible for ensuring that the email address on the Customer's account is current and actively monitored, and that communications from the Provider are not blocked, diverted or discarded by the Customer's spam filter, email-routing rules or mailbox configuration. This responsibility applies to all communications from the Provider in relation to the Customer's Domain Names, including the reminder notices referred to in paragraph 4.5, payment-related notices, and renewal confirmations sent under this paragraph 4.6. The Provider is not liable for the consequences of any such communication failing to reach the Customer by reason of the Customer's out-of-date contact details, inbox configuration or email filtering.

4.7 The Provider first attempts to charge the Customer's payment method on the renewal invoice's due date, nine (9) days before the Domain Name expires. If that fails, the Provider notifies the Customer and tries again once a week for up to four (4) weeks, the second attempt falling two (2) days before expiry. If payment is not successfully taken before the Domain Name expires, the Domain Name may enter the Registry's redemption or expiration process, the consequences of which (including additional Registry fees for reinstatement) are the Customer's responsibility.

4.8 A Domain Name is renewed with the Registry only once its renewal has been paid. If it has not been paid by its expiry date, it expires under the Registry's rules, as set out in paragraphs 4.10 to 4.12, and Clause 9.3 and Clause 9.4 do not apply to that expiry. A late payment fee may be added to an unpaid renewal invoice under Clause 9.2. If the Customer decides not to renew, by turning Domain Auto Renewal off or by telling the Provider, the renewal invoice and any late payment fee on it are cancelled.

4.9 Where Domain Auto Renewal is not enabled for a Domain Name, the Provider shall still send the Customer the pre-expiry and post-expiry reminder notices referred to in paragraph 4.5 (being those required to meet ICANN and Registry obligations). Payment-related notices and the additional operational reminders referred to in paragraph 4.5 are not applicable where Domain Auto Renewal is not enabled. Renewal in those cases requires the Customer to take positive action to place a renewal Order before expiry.

4.10 When a Domain Name expires without being renewed, the Customer's rights in it end, save where the Customer transferred it to another registrar before expiry, and subject to any grace or redemption period under paragraph 4.11.

4.11 Each Registry sets its own grace and redemption periods, and some offer none. During a grace period, the Customer may renew the Domain Name at the normal renewal Charge. Once it has entered its redemption period, the Customer may recover it on payment of a redemption fee as well as the renewal Charge. The periods and fees that apply to a Domain Name are available from the Provider on request, and any redemption fee is shown on the renewal invoice before it is paid.

4.12 On expiry, the Provider may park the Domain Name on its own nameservers. A Domain Name whose Registry offers no grace or redemption period may not be recoverable after expiry, and the Provider is not liable for that. After expiry, the Registry or the upstream registrar may change the Domain Name's registration details under their own rules, and once any grace and redemption periods have ended, they may delete, release, take over or auction it. These are actions of the Registry or the upstream registrar, not of the Provider.

4.13 Where a Domain Name has been registered at a promotional rate, the renewal Charge shall be the Provider's then-current standard renewal Charge for that Domain Name, and the renewal reminder notices shall disclose the renewal Charge.

4.14 Domain renewal Charges may change from time to time, most often because a Registry changes its prices. The renewal Charge is stated in the reminder sent at least thirty (30) days before the renewal date, and that is the amount charged. A change to a domain renewal Charge is not a variation of Charges under Clause 7.6. The Customer may instead turn off Domain Auto Renewal, or transfer the Domain Name to another registrar, before it renews.

4.15 Once the Registry has registered, transferred or renewed a Domain Name, the Customer may not cancel the registration, transfer or renewal and recover the Charges already paid, save as expressly permitted by the applicable Registry's policy (and, where the Customer is a consumer, subject to Clause 32.5).

4.16 Where the Customer transfers a Domain Name to a different Registrar, the Customer shall be responsible for ensuring that all applicable transfer conditions are met (including unlocking the Domain Name at the losing Registrar and providing the transfer authorisation code).

4.17 In respect of Domain Names for which the Provider provides DNS hosting, the Provider shall make commercially reasonable efforts to maintain the availability of the DNS service. The Provider does not warrant the availability of any DNS service operated by a third party.

5. Transfer in and out

5.1 The Customer may initiate the transfer of a Domain Name to another Registrar in accordance with the applicable Registry's policies. The Provider shall not unreasonably prevent any such transfer and shall comply with its obligations under the Registrar Transfer Dispute Resolution Policy and related ICANN policies.

5.2 The Provider shall transfer a Domain Name to another Registrar on the Customer's request provided that (a) the Customer has paid for the Domain Name's registration or renewal (including any payment for it that failed or was reversed), (b) the Domain Name is not subject to a restriction imposed by a court, Registry or other competent authority, and (c) the transfer request complies with the applicable Registry's policy.

6. Registry data

6.1 The Customer's contact details are submitted to the applicable Registry for inclusion in the Registration Data Directory Service (WHOIS or equivalent) as required by the Registry. The Customer warrants that the Customer's Registry contact details are accurate and shall update them promptly on change.

6.2 The Provider may offer a privacy service for certain Domain Names, through which the contact details disclosed to the Registry's Registration Data Directory Service may be obscured to the extent permitted by Registry policy.

6.3 The registrant shown in the Registry's records is the holder of a Domain Name, whether or not they are the Customer. This paragraph is subject to Clause 22.4 and Clause 22.5, and a person entitled to act under those Clauses may act as the registrant. The Customer may manage the Domain Name through its account, but on the transfer or ownership of a Domain Name, the Provider will act on the registrant's instructions, once it has verified that they are the registrant, including where those instructions differ from the Customer's. Where who holds a Domain Name is disputed, the Provider may ask for evidence, may lock the Domain Name until the dispute is resolved, or may refer the parties to the Registry's dispute process.

7. Dispute resolution

7.1 Disputes over the registration of a Domain Name are subject to the applicable Registry's dispute-resolution policy (including ICANN's Uniform Domain-Name Dispute-Resolution Policy for generic top-level domains, and Nominet's Dispute Resolution Service for ".uk" domains). The Provider is not a party to, and makes no representation or warranty in respect of, any such dispute.

8. Action by a Registry or Registrar

8.1 A Registry or Registrar may, under its own policies, suspend, lock, place on hold, cancel, delete or transfer a Domain Name. It may do so, for example, where the registrant's contact details cannot be verified within the period its policy allows, where the Domain Name is reported for abuse such as phishing, malware or fraud, where the Customer no longer meets the Registry's eligibility rules, or where a dispute decision, court order or competent authority requires it.

8.2 While a Domain Name is suspended, on hold or cancelled, websites, email and other services that use it may stop working. The Hosting and Email Services themselves, and the data held on them, are not affected.

8.3 The Provider shall tell the Customer promptly when it learns of any such action, give the reason where it is given one, and help the Customer take the steps the Registry or Registrar requires to restore the Domain Name. Where the Provider is itself the Registrar of record and its accreditation obligations allow, it shall give the Customer notice before acting.

8.4 The Customer shall respond promptly to any verification request about a Domain Name from the Provider, the Registry or the Registrar.

8.5 Unavailability caused by such action is not Downtime or Environment Downtime for the purposes of Annex 1, Annex 2 or Annex 3. The Provider is not liable for loss caused by action a Registry or Registrar takes under its own policies, except to the extent caused by the Provider's breach of the Contract or negligence (for example, failing to pass on a verification request the Provider received, or failing to renew a Domain Name for which Domain Auto Renewal was enabled and payment was taken). Nothing in this paragraph limits Clause 20.1 or the Customer's statutory rights.

Schedule 3: SSL Certificate Services

1. Scope

1.1 This Schedule 3 applies to paid SSL Certificate Services supplied by the Provider. Free, automatically renewing SSL certificates (Let's Encrypt or equivalent) are supplied as a feature of Shared Hosting and Managed Servers under Schedule 1 and are not covered by this Schedule.

2. Issuing authority

2.1 SSL certificates are issued by a third-party certificate authority. Each certificate is subject to the terms of the issuing certificate authority (the "CA Terms") in addition to these Terms and Conditions. The Customer must comply with the CA Terms, and the certificate authority decides whether a certificate is issued, how long it is valid and whether it is revoked. Everything else between the Customer and the Provider is governed by these Terms and Conditions.

3. Issuance

3.1 The Provider shall submit the Customer's certificate request to the certificate authority. Issuance is subject to the certificate authority's validation process. The Provider does not warrant that a requested certificate will be issued within any particular timeframe.

4. Installation and renewal

4.1 Where the Customer has ordered installation of the SSL certificate as part of the Service, the Provider shall install the certificate on the Customer's Service with reasonable diligence. Where the Customer has not ordered installation, the Customer is responsible for installation on the Customer's own infrastructure.

4.2 A paid SSL certificate renews under Clause 33.2, subject to the Customer's payment of the renewal Charge in advance. A renewal may need the Customer to complete the certificate authority's validation again, for example confirming control of the domain or, for organisation and extended validation certificates, the organisation's details. The Provider cannot complete validation for the Customer, and a certificate that is not validated in time may lapse.

4.3 Certificate authority rules limit how long a certificate can be valid. Where a Service runs longer than that limit, the certificate is reissued during the Service, which may need the Customer to complete validation again. Where the Provider installs the certificate, it installs each reissued certificate.

5. Revocation

5.1 A certificate authority may revoke an issued SSL certificate in the circumstances set out in the CA Terms, including where the certificate authority believes the certificate has been compromised or issued in breach of the certificate authority's issuance policy. The Provider has no control over such revocation decisions.

6. Refunds

6.1 Once the certificate authority has issued the certificate, the Charge for the SSL certificate is non-refundable, save to the extent of the Customer's statutory rights as a consumer.

Schedule 4: Web Support and Maintenance Services

1. Scope

1.1 This Schedule 4 sets out the terms applicable to the Support Services supplied by the Provider. Support Services comprise technical assistance, advice, investigation, diagnosis, and (where agreed) application-layer work supplied in respect of the Services.

1.2 Support Services are supplied on one of the following footings:

(a) as a feature of the relevant Service, included within the Charges for Shared Hosting (including Reseller Hosting) and for Managed Servers at the Fully Managed Service Level, at the scope described in paragraph 2 of this Schedule;

(b) as additional chargeable Support Services specifically ordered by the Customer, including Basic Managed support for matters outside the Basic Managed scope, Unmanaged Server support, application-layer development work, and custom integration work; and

(c) as paid consultancy supplied in response to a Severe Security Compromise, as described in paragraph 2.4 of this Schedule.

2. Scope of included Support Services

2.1 The Provider shall respond to support requests submitted by the Customer through the ticketing system in the Client Area or by email to the relevant support address.

2.2 Included Support Services on Shared Hosting and at the Fully Managed Service Level comprise:

(a) advice and assistance on the configuration of the Service through the control panel;

(b) investigation and diagnosis of suspected faults in the Provider-managed layers of the Service;

(c) remediation of faults for which the Provider is responsible under Schedule 1;

(d) assistance with common application installations through the control panel's one-click installers (including Softaculous);

(e) assistance with malware detection and response tooling bundled with the Service (including Imunify360 where available at the Customer's tier);

(f) response to Customer questions of a reasonable nature by the support team, which is available around the clock;

(g) emergency out-of-hours response to Provider-side infrastructure incidents; and

(h) any further matter expressly stated on the Provider's website in the description of the relevant Service to be included.

2.3 At the Basic Managed and Unmanaged Service Levels, included Support Services are limited to help using the control panel (where there is one) and connecting to the Server, and to fixing faults the Provider is responsible for under Schedule 1. All other system administration is chargeable, as set out in paragraph 3.3 of Schedule 1 for Basic Managed Servers.

2.4 Support Services supplied in response to a Severe Security Compromise are paid consultancy and are charged at the Provider's then-current standard hourly rates. A Severe Security Compromise means a compromise of the Customer's Service that (a) arises primarily from the Customer's acts or omissions (including out-of-date application code, weak application credentials, or known-vulnerable third-party plug-ins installed by the Customer) rather than from the Provider's infrastructure, and (b) requires material forensic, clean-up, restoration or hardening work beyond the scope of included Support Services in paragraph 2.2 above. The Provider shall give the Customer an estimate before commencing chargeable work and shall not commence chargeable work without the Customer's authorisation. The Provider may contain a compromise straight away, without the Customer's authorisation, where that is needed to prevent ongoing harm to the Provider's infrastructure or to other customers (for example by suspending the affected Service or blocking the harmful activity). Containment is not charged; clean-up, restoration and hardening start only once the Customer has authorised them.

3. Scope of additional chargeable Support Services

3.1 Without limitation, the following fall outside the scope of included Support Services and are chargeable as additional Support Services:

(a) troubleshooting of the Customer's application code;

(b) manual installation or configuration of applications not covered by the Provider's one-click installers;

(c) database repair or optimisation work;

(d) performance tuning of the Customer's application;

(e) work at the operating-system level on Unmanaged Servers;

(f) migration work outside the scope of Schedule 7 (Website Migration Services);

(g) third-party integration work;

(h) development or design work; and

(i) any other matter expressly stated on the Provider's website not to be included.

4. Request channels and response times

4.1 Support requests should be submitted through the ticketing system in the Client Area or by email to the relevant support address. The Provider's target response times vary by the seriousness of the issue and the Service tier, as published from time to time. Except as set out in paragraph 4.2, response times are targets rather than contractually guaranteed commitments.

4.2 If a new support ticket raised with the technical support department through the Client Area does not receive a first response from a member of the support team within one (1) hour, the Customer may claim a credit of £1 (or US$1 for accounts billed in US dollars) for that ticket. The guarantee applies only to the first response to a newly opened ticket: it does not apply to replies within an existing ticket, to automated acknowledgements, or to tickets for other departments (such as billing or sales). A first response means a reply from a person confirming that the issue is being looked at; it does not mean the issue has been resolved. Credits must be claimed by ticket to the accounts department within thirty (30) days of the ticket, are applied to future invoices and are not paid as cash, and the total in any month may not exceed the Customer's monthly (or monthly equivalent) hosting fee for that month.

5. Charges for additional Support Services

5.1 Where additional Support Services are requested, the Provider shall quote for the work (unless a published price applies) and, on the Customer's acceptance in writing (including by email or ticket reply), shall carry out the work. The Customer shall pay the quoted Charge in accordance with Clause 8.

5.2 Published current pricing for additional Support Services and for chargeable consultancy is available on the Provider's website and in the Client Area.

6. Pricing externalised to website

6.1 The Charges for additional Support Services are varied, multi-currency and vary by Service tier. They are therefore externalised to the Provider's website and are not stated in monetary amounts in this Schedule. Variation of those Charges is subject to Clause 7.6.

Schedule 5: Data Processing

Part A: Data processing terms

1. Definitions

1.1 In this Schedule 5, the following terms have the following meanings:

"Customer Personal Data" means any Personal Data processed by the Provider on behalf of the Customer under or in connection with the Contract.

"Data Subject Request" means a request made by or on behalf of a data subject to exercise any of the data subject's rights under the Data Protection Laws.

"Personal Data Breach" has the meaning given in Article 4(12) of the UK GDPR.

"Sub-processor" means a third party engaged by the Provider to process Customer Personal Data in connection with the Provider's processor obligations under the Contract.

Other capitalised terms used in this Schedule have the meanings given in Clause 1 of the main body of these Terms and Conditions.

1.2 Where the EU GDPR applies to the Customer's processing of Customer Personal Data, this Schedule applies as if each reference to the UK GDPR were also a reference to the EU GDPR.

2. Status of the parties

2.1 In respect of Customer Personal Data, the Customer is the controller (or, where the Customer is itself a processor acting on behalf of a third-party controller, the processor) and the Provider is the processor (or, where the Customer is a processor, the sub-processor).

2.2 Part D of this Schedule 5 sets out the details of processing required by Article 28(3) of the UK GDPR, namely the subject matter, duration, nature and purpose of the processing, the types of Personal Data, the categories of data subjects, and the obligations and rights of the controller.

3. Processor obligations

3.1 The Provider shall:

(a) process Customer Personal Data only on the documented instructions of the Customer (including as set out in the Contract), unless the Provider is required to process the Customer Personal Data by applicable law, in which case the Provider shall (to the extent permitted by that law) inform the Customer of that legal requirement before processing, and immediately inform the Customer if, in its opinion, an instruction infringes Data Protection Laws;

(b) ensure that persons authorised by the Provider to process Customer Personal Data are bound by an appropriate duty of confidentiality;

(c) implement appropriate technical and organisational measures to meet the requirements of Article 32 of the UK GDPR, as set out in Part B of this Schedule 5;

(d) respect the conditions for engaging Sub-processors set out in paragraph 4 and in Part C of this Schedule 5;

(e) taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures, insofar as is possible, for the fulfilment of the Customer's obligations to respond to Data Subject Requests, as set out in paragraph 6;

(f) assist the Customer in ensuring compliance with the obligations in Articles 32 to 36 of the UK GDPR (security, breach notification, data protection impact assessment and prior consultation) taking into account the nature of the processing and the information available to the Provider;

(g) at the Customer's choice, delete or return Customer Personal Data to the Customer on termination of the provision of services relating to the processing, as set out in Part E of this Schedule 5; and

(h) make available to the Customer all information necessary to demonstrate compliance with the Provider's obligations under Article 28 of the UK GDPR, and allow for and contribute to audits in accordance with paragraph 10.

4. Sub-processors

4.1 The Customer authorises the Provider to engage the Sub-processors identified in Part C of this Schedule 5 (as updated from time to time).

4.2 Where the Provider engages a Sub-processor, the Provider shall put in place a written contract with the Sub-processor imposing data-protection obligations that are substantially similar to those set out in this Schedule 5, insofar as applicable to the nature of the services provided by the Sub-processor. The Provider remains liable to the Customer for the performance of its Sub-processors' data-protection obligations.

4.3 The Provider's notice and objection procedure in respect of changes to the Sub-processor list is set out in Clauses 15.10, 15.11 and 15.12 of the main body of these Terms and Conditions.

5. International transfers

5.1 The Provider shall not transfer Customer Personal Data outside the United Kingdom (or, where EU GDPR applies, outside the European Economic Area) without complying with Chapter V of the UK GDPR (or, as applicable, Chapter V of the EU GDPR).

5.2 Where a transfer is to be made to a country not subject to an adequacy regulation or decision, the Provider shall implement appropriate safeguards, which may include (as applicable) the UK Information Commissioner's International Data Transfer Agreement (IDTA), the UK Addendum to the European Commission's Standard Contractual Clauses, the UK Extension to the EU-US Data Privacy Framework, the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework where the EU GDPR applies, binding corporate rules, or another lawful transfer mechanism.

5.3 The Provider shall, on request, provide the Customer with copies of the transfer safeguards in place in respect of Sub-processors located outside the United Kingdom or the European Economic Area.

6. Data Subject Requests

6.1 Where the Provider receives a Data Subject Request directly from a data subject in respect of Customer Personal Data, the Provider shall (without substantively responding to the request save where legally required to do so) forward the request to the Customer promptly and in any event within five (5) Business Days of receipt.

6.2 Taking into account the nature of the processing, the Provider shall assist the Customer in responding to Data Subject Requests by appropriate technical and organisational measures insofar as reasonably possible. This assistance includes making available the Client Area functionality necessary for the Customer to locate, export or delete Customer Personal Data where the Services expose such functionality.

6.3 Where the Provider's assistance materially exceeds the functionality made available through the Client Area, the Provider may charge for that assistance at its standard hourly rates, subject to proper scoping and to the Customer's prior authorisation.

7. Security

7.1 The Provider shall implement and maintain the technical and organisational measures set out in Part B of this Schedule 5. The Provider may vary those measures from time to time provided that the measures remain appropriate to the risk in accordance with Article 32 of the UK GDPR.

8. Personal Data Breach notification

8.1 The Provider shall notify the Customer without undue delay, and in any event within twenty-four (24) hours, of becoming aware of a Personal Data Breach affecting Customer Personal Data. The first notification shall give the information then available, and the Provider shall keep the Customer updated as further information becomes available.

8.2 The Provider's notification shall, to the extent known at the time of notification:

(a) describe the nature of the Personal Data Breach (including, where possible, the categories and approximate number of data subjects and Personal Data records concerned);

(b) communicate the name and contact details of the Provider's data protection point of contact;

(c) describe the likely consequences of the Personal Data Breach; and

(d) describe the measures the Provider has taken or proposes to take to address the Personal Data Breach, including measures to mitigate its adverse effects.

8.3 Where the Provider cannot provide all of the above information at the time of initial notification, the Provider shall provide it in phases as it becomes available.

9. Retention and return or deletion

9.1 On termination of the Contract (or of the affected Service), the Provider shall return or delete Customer Personal Data in accordance with Part E of this Schedule 5.

10. Audit

10.1 The Provider shall make available to the Customer, on reasonable written request and subject to reasonable confidentiality undertakings, the information reasonably necessary to demonstrate compliance with the Provider's obligations under Article 28 of the UK GDPR, including by providing:

(a) the Provider's most recent third-party audit reports, certifications or attestations (where the Provider holds any);

(b) responses to reasonable questionnaires (up to one per twelve-month period per Customer, save where there has been a material Personal Data Breach or a change in law justifying additional queries); and

(c) information about the Provider's security measures, Sub-processors and international transfer mechanisms.

10.2 Where the information provided under paragraph 10.1 is reasonably considered by the Customer to be insufficient to demonstrate compliance, the Customer may carry out an audit of the Provider's relevant processing activities, subject to:

(a) reasonable prior written notice, normally not less than thirty (30) days, unless a shorter period is reasonably necessary because of a Personal Data Breach, a substantiated concern about compliance or a request from a supervisory authority;

(b) carrying out the audit during Business Hours without unreasonably interfering with the Provider's business;

(c) the auditor entering into confidentiality undertakings with the Provider;

(d) the auditor not being a competitor of the Provider;

(e) the audit scope being limited to what is reasonably necessary to verify the Provider's compliance; and

(f) the Customer bearing its own costs and the Provider's reasonable costs of facilitating the audit, save where the audit uncovers material non-compliance by the Provider with this Schedule 5.

10.3 The Provider is not normally required to permit more than one audit in any twelve-month period. A further audit shall be permitted where it is reasonably necessary, including after a material Personal Data Breach, after a material change to the processing, where the Customer has a substantiated concern about the Provider's compliance with this Schedule 5, or at the reasonable request of a supervisory authority, with its scope agreed between the parties in proportion to its reason.

11. Term

11.1 This Schedule 5 continues in force for so long as the Provider processes Customer Personal Data on behalf of the Customer.

12. Order of precedence

12.1 In the event of a conflict between this Schedule 5 and the main body of these Terms and Conditions (or any other Schedule) in respect of the processing of Customer Personal Data, this Schedule 5 prevails.

Part B: Technical and organisational measures

B.1 Shared responsibility. The security of Customer Personal Data within the Services is shared between the Provider (operating the infrastructure, platform and common services) and the Customer (operating the Customer's applications, data, application-layer credentials and end-user accounts). The measures below are those the Provider operates. The Customer is responsible for, among other things, application-layer patching and authentication, the lawful basis for processing, and retention of Customer-side data.

B.2 Service tiers. The measures apply in a manner appropriate to the Service: for shared hosting and fully managed servers, to all Provider-controlled layers; for basic managed servers, to Provider-managed layers, with the application layer the Customer's responsibility; for unmanaged servers, to the hardware, hypervisor and network layers only.

B.3 Encryption in transit. Communications with the Client Area and the Provider's management interfaces are protected by TLS 1.2 or higher. The Provider supports TLS for web, email and control panel traffic and makes free automatically renewing SSL certificates available.

B.4 Storage infrastructure. The Provider uses enterprise-grade storage with hardware-level redundancy appropriate to each Service tier.

B.5 Identity and access management. Access to the Provider's production systems is restricted to named personnel on a least-privilege basis, with multi-factor authentication required for privileged access, and is logged. Access rights are reviewed on personnel changes and periodically.

B.6 Network security. The Provider operates firewalls, network segregation, intrusion detection and prevention tooling and DDoS mitigation appropriate to the class of infrastructure, and restricts administrative network access to authorised channels.

B.7 Vulnerability management and patching. The Provider operates priority patching of Provider-managed operating systems and control panels, platform-wide security update deployment, and live kernel patching on supported systems.

B.8 Logging and monitoring. The Provider operates logging and monitoring of Provider-controlled infrastructure, including access logs, security logs, platform health monitoring and security event alerting. Security-relevant logs are retained for the periods set out in the Provider's internal access control policy.

B.9 Physical security. The Provider's data centre providers operate physical security controls appropriate to a commercial hosting environment, including access control, CCTV, environmental controls and intrusion monitoring. Retired storage media are destroyed under certificate.

B.10 Personnel. The Provider's personnel with access to Customer Personal Data are bound by contractual confidentiality obligations and receive security awareness training.

B.11 Incident response. The Provider maintains an incident response process covering detection, triage, containment, investigation, notification and review for Personal Data Breaches and other security incidents. Notification timelines are as set out in paragraph 8 of Part A of this Schedule 5.

B.12 Business continuity and backup. The Provider maintains a written business continuity policy, reviewed at least once a year, covering how it continues to operate and to support Customers through a disruption. The policy is confidential to the Provider. Each Service benefits from the resilience of the data centre in which it operates. Whether backups are included in a Service, and where they are kept, varies by Service and is described in Schedule 1 and on the Provider's website for the relevant Service; on an Unmanaged Server, backups are the Customer's responsibility. Higher availability across servers or data centres is available as a separately quoted managed Service. Backup functionality available to the Customer is described in Schedule 1.

B.13 Vendor support access. The Provider's software vendors have no routine access to Customer Personal Data. Where the Provider grants a vendor's engineer temporary access to a server to resolve a support case, the Provider does so only under the vendor's written confidentiality terms, for the duration of the case, and removes the access when the case closes.

B.14 AI tooling. The Provider's support team uses AI tools to help read and reply to requests, transcribe and summarise calls, and investigate problems. When investigating a problem those tools may process configuration, log and file information from the Customer's Services. Under the business terms the Provider uses them on, the AI providers may not use the data to train their models, and keep it only for limited periods. The AI providers are identified on the Sub-processor List.

B.15 Data portability. The Provider makes Customer Personal Data available for export in a structured, commonly used and machine-readable format where the Services expose such export functionality, as set out in Part E of this Schedule 5.

Part C: Authorised Sub-processors

C.1 The Provider's current list of authorised Sub-processors is the Sub-processor List referred to in Clause 15.10 of the main body of these Terms and Conditions. It is not published on the Provider's website; the Provider makes it available to the Customer through the Client Area, or on request by support ticket, once the Provider has confirmed that the request comes from the Customer or from a contact the Customer has authorised.

C.2 The Customer authorises the Provider to engage the Sub-processors identified on the Sub-processor List from time to time, subject to the notice and objection procedure in Clauses 15.10 to 15.12 of the main body of these Terms and Conditions.

Part D: Details of processing (Article 28(3) UK GDPR)

D.1 Subject matter of the processing

The supply of the Services to the Customer under the Contract, comprising (as applicable) Hosting Services, Domain Services, Email Services, Migration Services, Support Services and associated Third-Party Software.

D.2 Duration of the processing

For the Term of the Contract and for the retention periods specified in Part E.

D.3 Nature and purpose of the processing

The processing consists of storing, hosting, transmitting, securing, backing up, restoring and otherwise handling Customer Personal Data as necessary to deliver the Services in accordance with the Customer's documented instructions, including agreed support and migration activities. The Provider's processing for its own purposes, such as invoicing and complying with its own legal obligations, is not part of this processing and is described in its privacy policy.

D.4 Types of Personal Data processed

The types of Customer Personal Data processed are determined by the Customer and reflect the nature of the Customer's own business. Without limitation, the Customer Personal Data may include: names, email addresses, postal addresses, telephone numbers, user account names, authentication credentials (in hashed form where possible), IP addresses, order and transaction data, the content of Customer Hosted Data, the content of email handled by the Email Services, and any other Personal Data that the Customer chooses to upload, host or transmit through the Services.

D.5 Categories of data subjects

The categories of data subjects are determined by the Customer and reflect the nature of the Customer's own business. Without limitation, the data subjects may include the Customer's customers, the Customer's website users, the Customer's employees, the Customer's contractors, the Customer's suppliers, and any other person whose Personal Data the Customer processes through the Services.

D.6 Obligations and rights of the controller

The obligations and rights of the Customer as controller (or as processor on behalf of a third-party controller, as the case may be) are as set out in Part A of this Schedule 5, in the main body of these Terms and Conditions, and in the Data Protection Laws.

Part E: Retention, return and deletion

E.1 Customer-controlled deletion during the Term

During the Term, the Customer may at any time delete Customer Hosted Data (including Customer Personal Data within it) through the Client Area or through the Hosting Account, subject to the retention of backups in accordance with the Service's backup cadence and the Provider's backup-retention window.

E.2 Return and deletion on termination

The Customer shall download or otherwise retrieve Customer Hosted Data before a Service ends. The Provider gives notice before ending a Service for non-payment under Clause 9.3.

E.3 When a Service ends

When a Service ends, the Provider removes Customer Hosted Data (including Customer Personal Data) from the live service, unless the law requires otherwise.

(a) For shared and reseller hosting, copies remain in the Provider's backups, and for thirty (30) days after the Service ends the Customer may ask for a copy to be restored for the Customer to download.

(b) For cloud, virtual and dedicated servers, the server and its storage are kept for at least forty-eight (48) hours after the Service ends, during which the Customer may ask the Provider for access to retrieve its data. After that, the server, its storage and any backups held on it are erased, and no copy can be restored.

(c) Separate copies taken as part of a Service, such as off-site backups, are not available to the Customer after that Service ends.

E.4 Backups

Backup copies containing Customer Hosted Data are deleted automatically as they rotate out or expire, and in any event within six (6) months of the Service ending. The Customer may ask in writing for copies to be deleted sooner, and the Provider will delete those it can. The Provider does not restore data from backups after a Service ends, except on the Customer's request under paragraph E.3(a).

E.5 Post-closure records retention

Notwithstanding paragraphs E.3 and E.4, the Provider shall retain limited records (including invoices, payment records, support tickets and account metadata) after termination for the periods required by law and, in respect of support tickets, for a period of six (6) years from the closure of the Customer's account with the Provider. These records are the Provider's own records of its dealings with the Customer, held by the Provider as controller under its privacy policy. Where a support ticket also holds Customer Personal Data that the Customer supplied for the Provider to act on for the Customer (for example a database extract or log file), that data remains subject to this Schedule 5 until it is deleted. The records are kept for the retention period. The Customer may ask the Provider to delete them sooner, which the Provider will do unless it needs them to meet a legal obligation or to establish or defend a legal claim.

E.6 Transition costs

The Customer bears the Customer's own costs of transitioning away from the Services on termination, including the costs of downloading or migrating Customer Hosted Data. The Provider shall, on reasonable request, cooperate with the Customer's transition to another provider, and may charge for any material time spent assisting with transition where that assistance falls outside the Provider's ordinary obligations under paragraphs E.1 to E.4.

E.7 Legal retention overrides

Where applicable law requires the Provider to retain Customer Personal Data beyond the periods in this Part E, the Provider shall retain the data to the extent and for the period required, and shall not further process it except as required by that law. On the expiry of the retention period imposed by law, the Provider shall delete the data.

Schedule 6: Model Cancellation Form

1. Purpose

1.1 This Schedule 6 is the model cancellation form referred to in Clause 32.3, provided in accordance with Part B of Schedule 3 of the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013. The Customer is not required to use this form; any clear statement of the Customer's decision to cancel is sufficient.

2. Model cancellation form

Complete and return this form only if you wish to withdraw from the Contract.

To: Kualo Limited

Registered office: 20–22 Wenlock Road, London, N1 7GU, United Kingdom

Company number: 04004280

VAT registration number: GB879440088

Email: [email protected]

Website contact form: the contact page on the Provider's website

I/We [] hereby give notice that I/We [] cancel my/our [] contract of sale of the following goods []/for the supply of the following service [*],

• Ordered on [] / received on []:

• Name of consumer(s):

• Address of consumer(s):

• Signature of consumer(s) (only if this form is notified on paper):

• Date:

[*] Delete as appropriate.

Schedule 7: Website Migration Services

1. Definitions

1.1 In this Schedule 7:

"Migration" means the migration of a website, database, email account or related digital assets from a source provider (whether or not the Provider is the source provider) to a destination hosting environment operated by the Provider.

"Migration Product" means a migration service as described on the Provider's website or in the Provider's order form at the time of Order, as set out in paragraph 3.

"Go-Live" means the point at which the Customer's live traffic is directed to the destination hosting environment, usually by the DNS change described in paragraph 6.

2. Scope

2.1 This Schedule 7 sets out the terms that apply to the Migration Services supplied by the Provider.

2.2 Migration Services are charged as one-off Services, unless the description of the Migration Product says the Migration is included with a Hosting Service.

3. Migration Products

3.1 The Provider offers Migration Services as the Migration Products described on its website or in its order form. The description of the Migration Product the Customer orders, as it stands at the time of Order, forms part of the Contract for that Order, including its scope (such as the number of websites and email accounts), any free migration allowance included with a Hosting Service, its price, and whether its Charge is refundable once the Migration has been performed.

3.2 The Provider may add, change or withdraw Migration Products at any time. A change applies only to Orders placed after it and does not change a Migration already ordered.

4. Checks before and after the Migration

4.1 Before the Migration begins, the Provider checks that it is feasible, based on the information the Customer gives. Where the Migration is materially outside the scope of the Migration Product ordered, or the Customer asks for more, the Provider will tell the Customer and propose a revised scope, a different Migration Product or an additional Charge, and will not carry out the additional work until the Customer has agreed it in writing (including by email).

4.2 After the Migration, the Provider checks that the migrated website loads. Testing how the website and its features work, such as forms, logins, payments and email, is for the Customer, on the temporary address the Provider gives, before Go-Live. The Provider will look into any problem the Customer reports before Go-Live that is caused by the Migration itself.

4.3 A Migration transfers and configures the data and settings that were present in the source environment. It does not include development, redesign or application work unless the Provider agrees otherwise in writing.

5. Limits of a Migration

5.1 The Provider is not responsible for:

(a) faults, errors or slowness that the website already had in the source environment;

(b) orders, posts, messages, emails or other changes made in the source environment while the Migration is in progress, unless the Migration Product ordered includes a test copy and a Go-Live at an agreed time;

(c) the acts or failures of the source provider, including blocking or limiting access, or data that is missing, out of date or corrupt in the source environment;

(d) whether the Hosting Service the Customer has chosen is large enough for what is being migrated, although the Provider will point out any obvious shortfall it notices; or

(e) email, DNS records or other services hosted elsewhere that the Customer has not told the Provider about.

5.2 The Customer shall keep the source environment active and accessible until the Provider confirms that the Migration is complete, and is responsible for cancelling the source service.

5.3 The Provider may pause or decline a Migration if it is not feasible, if the access or information it needs is not provided, or if it finds malware or content that breaches the Acceptable Use Policy, until the matter is resolved. If the Provider declines a Migration before starting it, it refunds the Charge for that Migration.

6. Go-Live, DNS and timing

6.1 Go-Live usually involves updating DNS records to point to the destination hosting environment. Unless the Migration Product ordered includes the Provider making the change, the Customer makes it, and the Provider gives guidance.

6.2 DNS changes take time to reach everyone, and during that period some traffic may still reach the source environment. The Provider uses reasonable endeavours to keep disruption to a minimum.

6.3 Any timescale the Provider gives for a Migration is an estimate. A Go-Live booked for an agreed time needs the Customer to be available, and may be moved to another agreed time if the Customer is not, or if something outside the Provider's reasonable control prevents it.

7. Care, data and consumer rights

7.1 The Provider performs Migration Services with reasonable care and skill, in accordance with section 49 of the Consumer Rights Act 2015 where the Customer is a consumer.

7.2 Customer Personal Data and any other Personal Data transferred during the Migration are processed by the Provider in accordance with Schedule 5, which applies in full to Migration Services.

7.3 Where the Customer is a consumer, the Migration Services are subject to the Customer's right of withdrawal under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 (see Clause 32 and Schedule 6). If the Customer expressly requests the Migration to begin during the 14-day withdrawal period, Regulation 36(4) applies (subject to Regulation 36(6)) and the Customer shall pay the Provider an amount proportionate to the work performed up to the date of withdrawal. Where the Migration has been fully performed during the withdrawal period, performance having begun with the Customer's express request and acknowledgement that the right of withdrawal would be lost once the Migration had been fully performed, the Customer loses the right of withdrawal under Regulation 36(2).

7.4 The Provider does not warrant that the migrated environment will be identical to the source environment in every respect.

8. The Customer's part

8.1 The Customer shall provide, promptly on request, the access, source-environment details, DNS authority and other information the Migration needs. Delays caused by the Customer not providing them are outside the Provider's control.

8.2 The Customer shall keep its own backup of all source-environment data, and shall not rely on the Provider for its own disaster recovery during the Migration.

9. Charges

9.1 The Charges for Migration Services are set out in the description of the Migration Product. Once a Migration has been ordered at a price, that price does not change other than by written agreement.

9.2 Where the Customer cancels a Hosting Service under the money-back guarantee in Clause 32.8, the refund includes any Charge paid for a Migration Product, whether or not the Migration has been performed, unless the description of that Migration Product at the time of Order said that its Charge is not refundable once the Migration has been performed and the Migration has been performed. This paragraph does not affect a consumer Customer's rights under paragraph 7.3.