Terms and Conditions

These Terms of Service ("Terms") govern your use of services provided by PrivyNet Ltd ("PrivyNet", "we", "our", "us"), a company registered in England and Wales. By creating an account, placing an order, signing in or signing up via a third-party identity provider (such as Microsoft), or otherwise using our services, you agree to be bound by these Terms, together with our Acceptable Use Policy, Privacy Policy, and Service Level Agreement (where applicable). These Terms are intended for business customers. If you are a consumer, please contact us before signing up, as additional statutory rights may apply to you. If you do not agree to these Terms, you must not use our services.

In these Terms, the following definitions apply:

• "Customer", "you", "your": The individual or legal entity that creates an account and agrees to these Terms.

• "Services": The Infrastructure-as-a-Service (IaaS) offerings provided by PrivyNet, including shared VPN access, dedicated VPN infrastructure, and related services.

• "Dedicated Infrastructure": VPN servers or resources provisioned exclusively for a single customer.

• "Usage Charges": Fees calculated based on metered consumption of resources (e.g., bandwidth, data transfer, compute hours).

• "Invoice": A billing document issued manually by PrivyNet for services rendered, based on consumption thresholds or monthly billing cycles, payable in accordance with the agreed payment terms.

• "Consumption Threshold": A usage level at which an invoice is triggered. The initial threshold is set at account creation, and subsequent thresholds increase after each invoice.

• "Customer Content" / "Customer Data": Any data, files, configurations, or traffic transmitted or stored by the Customer using the Services.

• "Order" / "Order Form": A document or online selection specifying the Services, pricing, and other commercial terms agreed between PrivyNet and the Customer.

• "Effective Date": The date the Customer first accepts these Terms or an Order, whichever is earlier.

• "AUP": Acceptable Use Policy.

• "SLA": Service Level Agreement.

• "DPA": Data Processing Agreement.

Your agreement with PrivyNet consists of multiple documents. In the event of any conflict or inconsistency between them, the following order of precedence applies (highest to lowest): 1. Order Form / Custom Agreement (if any) 2. Data Processing Agreement (DPA) 3. Service Level Agreement (SLA) 4. These Terms of Service 5. Acceptable Use Policy (AUP) 6. Privacy Policy Unless expressly stated otherwise in a signed Order Form, the standard terms prevail.

Age Requirement: You must be at least 18 years old to create an account and use our Services. Business Use: Our Services are intended for business and professional use. By agreeing to these Terms, you represent that you are acting in a business capacity, not as a consumer. Accurate Information: You agree to provide accurate, current, and complete information when creating an account, including your legal name (or company name), email address, and billing information. You must promptly update this information if it changes. Account Security: You are responsible for maintaining the confidentiality of your account credentials (username, password, API keys, etc.). You must notify us immediately at support@privynet.co.uk if you suspect unauthorised access to your account. Account Responsibility: You are responsible for all activities that occur under your account, whether or not authorised by you, except where such activities result solely from our breach of security obligations. One Account Per Entity: Unless otherwise agreed, each legal entity should maintain a single account. Creating multiple accounts to circumvent usage limits, abuse promotions, or evade enforcement actions is prohibited.

PrivyNet provides Infrastructure-as-a-Service (IaaS), including:

• Shared VPN Access: Access to shared VPN infrastructure with multiple server locations.

• Dedicated VPN Infrastructure: Private VPN servers provisioned exclusively for your use.

• Related Services: APIs, management dashboards, and other tools to configure and monitor your infrastructure.

Service Availability:

We strive to maintain high availability but do not guarantee uninterrupted or error-free service. Availability commitments, where applicable, are set out in our Service Level Agreement (SLA).

Service Modifications:

We may modify, update, or discontinue features of the Services from time to time. For material changes that adversely affect your use:

• We will provide at least 30 days' notice for changes to core functionality.

• We will provide at least 90 days' notice before discontinuing a service entirely (unless required by law, security, or third-party dependencies).

Beta / Preview Services:

We may offer beta or preview features. These are provided "as is" without SLA commitments or warranties, and we may discontinue them at any time without notice.

Pricing:

Fees for the Services are set out in your Order, on our website, or in your account dashboard. All prices are stated in GBP and are exclusive of VAT unless otherwise indicated.

Billing Model:

PrivyNet operates a consumption-based billing model with manual invoicing:

• Your first invoice is issued once your usage reaches the initial consumption threshold (e.g., 10 units of usage).

• After your first invoice, the consumption threshold increases. Subsequent invoices are issued when either the new threshold is reached or at the end of each calendar month, whichever occurs first.

• All invoices are issued manually by PrivyNet and sent to your registered email address.

• Invoices reflect actual usage and any applicable fixed service fees for the billing period.

Usage Charges:

• Usage-based charges (e.g., bandwidth, data transfer) are calculated based on our metering systems, which are the authoritative source.

• Usage is rounded to the nearest unit as specified in your plan details.

• You can monitor your current usage at any time via the Customer Dashboard.

Taxes (VAT):

• All fees are exclusive of VAT and other applicable taxes.

• If you are a UK business, VAT will be added at the prevailing rate.

• If you are an EU/EEA business with a valid VAT number, reverse charge may apply. You must provide a valid VAT number in your account settings.

• You are responsible for any taxes, duties, or levies imposed by your jurisdiction.

Payment Methods:

Payments are processed securely through Stripe. We accept major credit/debit cards. PrivyNet does not store or have access to your full card details.

Payment Terms:

• Invoices are due upon receipt unless otherwise agreed.

• For enterprise customers, we may offer NET-30 payment terms by separate agreement.

Failed Payments:

• If a payment fails, we will notify you and retry the payment up to 3 times over 7 days.

• If payment remains unsuccessful after 14 days, we may suspend your access to the Services.

• After 30 days of non-payment, we may terminate your account and delete your data in accordance with our retention policy.

Billing Disputes:

• If you believe an invoice is incorrect, you must notify us in writing at billing@privynet.co.uk within 30 days of the invoice date.

• Disputed amounts must be clearly identified with supporting reasons.

• Undisputed portions remain due and payable.

• We will investigate disputes in good faith and issue corrections or credits where appropriate.

Price Changes:

• We may change our prices with at least 30 days' notice.

• Price changes will apply to your next billing period. If you do not agree to the new pricing, you may terminate your service before the changes take effect.

General Refund Policy:

Since PrivyNet operates a consumption-based billing model, charges reflect resources and services already consumed. As such, usage charges are generally non-refundable.

14-Day New Customer Guarantee:

• New customers may request a refund within 14 days of their first invoice if they are not satisfied with the Services.

• Refund requests must be submitted to billing@privynet.co.uk.

• Refunds are issued to the original payment method and may take 5-10 business days to process.

No Refunds After 14 Days:

• After the initial 14-day period, fees are non-refundable.

• Partial-period refunds are not provided for early termination.

Usage Charges:

• Usage-based charges are non-refundable, as they represent resources already consumed.

Exceptions:

• If we materially breach our SLA and you are entitled to service credits exceeding your monthly fees, we may, at our discretion, issue a refund instead of credits.

• Refunds may be issued in cases of billing errors confirmed by our investigation.

This refund policy does not affect any statutory rights you may have as a consumer (if applicable).

Your use of the Services is subject to our Acceptable Use Policy ("AUP"), which forms part of these Terms. By using the Services, you agree to comply with the AUP.

The AUP prohibits, among other things:

• Illegal activities, including violations of the Computer Misuse Act 1990.

• Security threats such as launching DDoS attacks or distributing malware.

• Network abuse such as spamming or excessive bandwidth consumption that impacts other customers.

• Hosting or transmitting unlawful, defamatory, or infringing content.

Consequences of Violation:

Violations of the AUP may result in:

• Warning and request to remediate.

• Temporary suspension of Services.

• Permanent termination of your account.

• Cooperation with law enforcement authorities.

• Civil or criminal liability.

We reserve the right to take immediate action, including suspension without prior notice, where necessary to protect our infrastructure, other customers, or comply with legal obligations.

Ownership:

You retain all rights, title, and interest in your Customer Content. PrivyNet does not claim ownership of any data you transmit or store using our Services.

Licence to PrivyNet:

You grant PrivyNet a limited, non-exclusive licence to host, transmit, and process your Customer Content solely as necessary to provide the Services and comply with your instructions.

Customer Responsibilities:

You are solely responsible for:

• The legality, accuracy, and appropriateness of your Customer Content.

• Ensuring you have all necessary rights and consents to use and transmit your Customer Content.

• Compliance with applicable data protection laws (e.g., UK GDPR) when processing personal data through our Services.

• Configuring and securing your applications and workloads running on our infrastructure.

No Monitoring Obligation:

We do not proactively monitor Customer Content for legality or policy compliance. However, we may investigate and take action if we receive complaints, legal requests, or detect abuse.

Data Processing:

Where you use our Services to process personal data on behalf of your customers or users, you act as the data controller, and we act as your data processor. Our Data Processing Agreement (DPA) governs this relationship and is available upon request or in your account settings.

Security Measures:

We implement industry-standard security measures to protect our infrastructure and your data, including encryption, access controls, and monitoring. Details are provided in our Privacy Policy and Security documentation.

Logging:

To maintain security, prevent abuse, and comply with legal obligations, we collect and retain certain technical data, including:

• IP addresses and login timestamps.

• API request metadata.

• Usage and bandwidth metrics.

• Security and audit logs.

Logs are retained in accordance with our Privacy Policy and are not used for advertising or sold to third parties.

Law Enforcement & Legal Requests:

We may disclose Customer Content or account information:

• Where required by valid legal process (e.g., court order, warrant, subpoena) from a court or authority with jurisdiction.

• Where necessary to prevent imminent harm, fraud, or illegal activity.

• To protect our legal rights or property.

Where legally permitted, we will notify you of such requests before disclosure. We may be prohibited from providing notice in some circumstances (e.g., gag orders).

Emergency Suspension:

We may suspend Services immediately, without prior notice, where we reasonably believe:

• Your account is being used for illegal activity.

• Your use poses a security threat to our infrastructure or other customers.

• Suspension is required to comply with law or a legal order.

We will notify you as soon as practicable after any emergency suspension and work with you to resolve the issue.

PrivyNet IP:

PrivyNet retains all rights, title, and interest in and to:

• The Services, including all software, APIs, platforms, and infrastructure.

• Our website, documentation, branding, trademarks, and logos.

• Any improvements, modifications, or derivative works we create.

Licence to Use Services:

Subject to your compliance with these Terms and payment of applicable fees, we grant you a limited, non-exclusive, non-transferable, revocable licence to access and use the Services during your service term for your internal business purposes.

Restrictions:

You may not:

• Reverse engineer, decompile, or disassemble our software or Services.

• Copy, modify, or create derivative works of our Services (except as expressly permitted).

• Sublicense, resell, or distribute access to our Services without our prior written consent.

• Remove or alter any proprietary notices or labels.

Feedback:

If you provide suggestions, ideas, or feedback about our Services ("Feedback"), you grant us a perpetual, irrevocable, royalty-free licence to use, modify, and incorporate such Feedback into our Services without any obligation to you.

Open Source:

Certain components of our Services may include open-source software. Such software is licensed under its respective open-source licences, which take precedence over these Terms for that software only.

Our Warranties:

We warrant that:

• We will provide the Services with reasonable skill and care.

• The Services will substantially conform to their published documentation.

• We have the right to provide the Services to you.

Disclaimers:

TO THE MAXIMUM EXTENT PERMITTED BY LAW:

• The Services are provided "AS IS" and "AS AVAILABLE" without warranties of any kind, whether express, implied, or statutory.

• We disclaim all implied warranties, including warranties of merchantability, fitness for a particular purpose, and non-infringement.

• We do not warrant that the Services will be uninterrupted, error-free, or secure.

• We do not warrant that the Services will meet your specific requirements or achieve any particular results.

Third-Party Services:

Our Services may integrate with or depend on third-party services (e.g., Microsoft Azure, Stripe). We are not responsible for the availability, performance, or security of third-party services.

SLA as Sole Remedy for Availability:

Your sole remedy for availability issues is the service credits described in our Service Level Agreement (SLA). The SLA sets out the exclusive remedies for downtime and availability failures.

Exclusion of Certain Damages:

TO THE MAXIMUM EXTENT PERMITTED BY LAW, PRIVYNET SHALL NOT BE LIABLE FOR:

• Indirect, incidental, special, consequential, or punitive damages.

• Loss of profits, revenue, business, goodwill, or anticipated savings.

• Loss of data or data corruption (except as set out in our DPA).

• Costs of procuring substitute services.

• Any damages arising from circumstances beyond our reasonable control.

Liability Cap:

OUR TOTAL AGGREGATE LIABILITY UNDER OR IN CONNECTION WITH THESE TERMS, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, SHALL NOT EXCEED THE GREATER OF:

• The fees paid by you to PrivyNet in the 12 months preceding the claim; or

• £1,000.

Exceptions — Liabilities We Do Not Limit:

Nothing in these Terms excludes or limits liability for:

• Death or personal injury caused by negligence.

• Fraud or fraudulent misrepresentation.

• Any liability that cannot be excluded or limited under applicable law.

• Your payment obligations for Services received.

• Breaches of confidentiality obligations.

• Your indemnification obligations.

• Wilful misconduct or gross negligence.

Allocation of Risk:

You acknowledge that the limitations in this section reflect a reasonable allocation of risk between the parties and are an essential basis of the bargain. The fees charged for the Services reflect this allocation.

Your Indemnification of PrivyNet:

You agree to indemnify, defend, and hold harmless PrivyNet, its officers, directors, employees, and agents from and against any claims, damages, losses, liabilities, costs, and expenses (including reasonable legal fees) arising out of or related to:

• Your use of the Services in violation of these Terms or the AUP.

• Your Customer Content, including any claims that it infringes third-party rights or violates applicable law.

• Your violation of any applicable law or regulation.

• Any third-party claims related to your use of the Services.

Indemnification Process:

• We will promptly notify you of any claim subject to indemnification.

• You will have the right to control the defence and settlement of such claims, provided you do not admit liability on our behalf without our consent.

• We will provide reasonable cooperation at your expense.

• We may participate in the defence with our own counsel at our own expense.

Term:

These Terms are effective from the Effective Date and continue until terminated by either party.

Termination by Customer:

• You may terminate your service at any time by contacting support or via your account dashboard.

• Upon termination, a final invoice will be issued for any outstanding usage up to the date of termination.

• Dedicated infrastructure is billed based on deployed resources and measured usage. Charges continue to accrue until the relevant resources are deleted or terminated. You are responsible for removing deployed resources you no longer require in order to stop further charges.

Consumer Cancellation Rights:

If you are a consumer, you may have a legal right to cancel within 14 days. Where you request that we begin providing the service immediately, you acknowledge that your right to cancel may be lost or reduced in accordance with applicable consumer law.

Termination by PrivyNet:

We may suspend or terminate your account:

• Immediately, for material breach of these Terms or the AUP.

• Immediately, for non-payment after the cure period in Section 6.

• Immediately, if required by law or to prevent harm.

• With 30 days' notice, for any reason or no reason (convenience).

Effect of Termination:

Upon termination:

• Your access to the Services will cease immediately (or at the end of your billing period, if terminated for convenience).

• All outstanding fees become immediately due and payable.

• We will delete your Customer Content in accordance with our data retention policy (typically within 30 days), unless you request an export or we are required by law to retain it.

• Provisions that by their nature should survive termination will survive, including: Sections 2 (Definitions), 9 (Customer Data), 11 (IP), 13 (Limitation of Liability), 14 (Indemnification), 16 (Confidentiality), 18 (Governing Law), and 21 (General Provisions).

Data Export:

For dedicated infrastructure customers, we will provide a reasonable data export window (up to 30 days) upon written request before or at the time of termination.

Confidential Information:

"Confidential Information" means any non-public information disclosed by one party to the other that is designated as confidential or that a reasonable person would understand to be confidential, including:

• Business plans, pricing, and financial information.

• Technical data, product roadmaps, and source code.

• Customer lists and account information.

• Security configurations and credentials.

Exclusions:

Confidential Information does not include information that:

• Is or becomes publicly available through no fault of the receiving party.

• Was known to the receiving party before disclosure.

• Is received from a third party without restriction.

• Is independently developed without use of Confidential Information.

Obligations:

Each party agrees to:

• Protect the other's Confidential Information with at least the same care it uses for its own (and no less than reasonable care).

• Use Confidential Information only for the purposes of this agreement.

• Limit access to personnel who need to know and who are bound by confidentiality obligations.

• Not disclose Confidential Information to third parties without prior written consent, except to professional advisors or as required by law.

Required Disclosure:

If required by law to disclose Confidential Information, the receiving party will (where legally permitted) give the disclosing party prompt notice and cooperate to seek protective measures.

Duration:

Confidentiality obligations survive termination for 3 years, or indefinitely for trade secrets.

Neither party shall be liable for any failure or delay in performing its obligations (other than payment obligations) where such failure or delay results from circumstances beyond its reasonable control, including:

• Natural disasters (earthquakes, floods, storms).

• Acts of war, terrorism, or civil unrest.

• Government actions, embargoes, or sanctions.

• Epidemics or pandemics.

• Power outages or telecommunications failures.

• Failures of third-party infrastructure providers (e.g., Microsoft Azure backbone outages).

• Cyberattacks or DDoS attacks beyond our reasonable mitigation capabilities.

The affected party must:

• Notify the other party promptly of the force majeure event.

• Use reasonable efforts to mitigate its effects and resume performance.

If a force majeure event continues for more than 60 days, either party may terminate the affected Services without liability (other than payment for Services already rendered).

Governing Law: These Terms and any disputes arising out of or in connection with them are governed by and construed in accordance with the laws of England and Wales. Jurisdiction: The courts of England and Wales shall have exclusive jurisdiction to settle any dispute arising out of or in connection with these Terms. Informal Resolution: Before initiating formal proceedings, each party agrees to attempt to resolve disputes informally by contacting the other party's designated representative. Either party may escalate to formal proceedings if the dispute is not resolved within 30 days. No Class Actions: To the extent permitted by law, any dispute resolution proceedings will be conducted on an individual basis and not as part of a class, consolidated, or representative action.

Our data collection and processing practices are described in our Privacy Policy, which forms part of these Terms.

Summary of Data We Collect:

• Account information (name, company, email).

• Billing metadata and payment records (processed by Stripe).

• Technical and log data (IP addresses, login events, API logs, usage metrics).

• Support communications.

• Service usage data for billing and capacity planning.

We process this data in accordance with UK GDPR under lawful bases including contract, legitimate interests, and legal obligation.

Your Obligations:

If you process personal data through our Services, you must comply with applicable data protection laws. Our Data Processing Agreement (DPA) governs our processing of Customer Content containing personal data.

For full details, please review our Privacy Policy.

We may update these Terms from time to time. When we do:

Significant Changes:

• We will notify you at least 30 days before the changes take effect, via email and/or notice in your account dashboard.

• If you do not agree to the changes, you may terminate your service before the effective date.

• Continued use of the Services after the effective date constitutes acceptance of the revised Terms.

Minor Changes:

• For non-material changes (e.g., clarifications, formatting), we may update the Terms without individual notice.

• The "Last Updated" date at the top of these Terms indicates when they were last revised.

Current Version:

The current version of these Terms is always available on our website. Previous versions may be requested by contacting legal@privynet.co.uk.

Entire Agreement:

These Terms, together with the Order Form, DPA, SLA, AUP, and Privacy Policy, constitute the entire agreement between you and PrivyNet regarding the Services and supersede all prior agreements and understandings.

Assignment:

You may not assign or transfer these Terms or your rights hereunder without our prior written consent. We may assign these Terms to an affiliate or in connection with a merger, acquisition, or sale of assets upon notice to you.

Subcontracting:

We may subcontract our obligations under these Terms to third parties (including cloud infrastructure providers like Microsoft Azure), provided we remain responsible for their performance.

Notices:

• Notices to you will be sent to the email address associated with your account or posted in your account dashboard.

• Notices to us should be sent to legal@privynet.co.uk or by post to our registered office.

• Email notices are deemed received when sent (if no bounce) or, for postal notices, 3 business days after posting.

Severability:

If any provision of these Terms is held invalid or unenforceable, the remaining provisions will continue in full force and effect. The invalid provision will be modified to the minimum extent necessary to make it valid and enforceable.

Waiver:

Our failure to enforce any right or provision of these Terms will not constitute a waiver of that right or provision. Any waiver must be in writing and signed by PrivyNet.

No Partnership:

Nothing in these Terms creates a partnership, joint venture, agency, or employment relationship between you and PrivyNet. Neither party has authority to bind the other.

Third-Party Rights:

These Terms do not confer any rights on third parties under the Contracts (Rights of Third Parties) Act 1999.

Headings:

Section headings are for convenience only and do not affect the interpretation of these Terms.

Language:

These Terms are written in English. If translated into another language, the English version prevails in case of conflict.

PrivyNet allows you to create an account or sign in using third-party identity providers, such as Microsoft ("SSO" or "Single Sign-On"). Agreement to Terms: By signing in or signing up with a third-party identity provider, you automatically agree to be bound by these Terms of Service, our Privacy Policy, and our Acceptable Use Policy, to the same extent as if you had created an account using an email address and password and explicitly accepted these Terms. Account Creation via SSO: When you sign up using a third-party identity provider, we may receive certain profile information from that provider (such as your name and email address) to create and manage your account. You are responsible for ensuring the information held by the identity provider is accurate and up to date. Third-Party Terms: Your use of a third-party identity provider is subject to that provider's own terms of service and privacy policy. PrivyNet is not responsible for the practices, availability, or security of third-party identity providers. We recommend reviewing the terms and privacy policies of any identity provider you use. Account Linking: If you sign in via SSO using the same email address as an existing PrivyNet account, we may link your SSO credentials to your existing account. If no account exists, a new account will be created automatically. Revocation: You may disconnect your third-party identity provider from your PrivyNet account at any time via your account settings. Disconnecting an identity provider does not terminate your PrivyNet account or these Terms.

If you have any questions about these Terms, please contact us:

General Enquiries:

• Email: support@privynet.co.uk

Billing Enquiries:

• Email: billing@privynet.co.uk

Legal & Compliance:

• Email: legal@privynet.co.uk

Privacy & Data Protection:

• Email: privacy@privynet.co.uk

Registered Office:

• PrivyNet Ltd

• [Your registered address]

• Company Number: [Your company number]

We aim to respond to all enquiries within 5 business days.