These Terms & Conditions govern the provision of services by Koncise Solutions Limited (“Koncise”) to the customer named in the applicable Quote (together, this “Agreement”). This Agreement is self-contained. Where a Quote references third-party vendor products or services, the applicable vendor terms will be identified in the Quote and, where expressly incorporated, shall form part of the Agreement in respect of those vendor products only. No other external terms shall apply unless specifically attached to and expressly incorporated into the signed Quote. In this Agreement, a “business day” means a day other than a Saturday, Sunday or public holiday in England.
Part A - General Terms
1. Payment and Payment Terms
1.1 Customer agrees to pay the fees set out in the applicable Quote by bank transfer in accordance with the invoice instructions. Invoices will be issued on the date of signature and payment is due within the number of days stated on the quote.
1.2 Prices exclude VAT, which will be charged at the applicable rate. All pricing is fixed as set out in the Quote. No additional charges, overage fees or scope-based uplifts may be introduced without Customer’s prior written approval.
1.3 Customer may withhold amounts that are genuinely disputed in good faith, provided that: (a) undisputed amounts remain payable in accordance with the payment terms set out above; (b) the basis of any invoice query is raised in writing within 10 business days of receipt of that invoice; and (c) nothing in this clause shall prevent either party from bringing wider contractual claims in respect of matters that come to light after that period.
1.4 Amounts not paid when due shall accrue interest at 1.5% per month or the highest rate permitted by applicable law, whichever is lower, from the date due until the date paid.
2. Automatic Renewal
This Agreement will automatically renew at the end of the Subscription Period unless a written request to cancel is received by Koncise from Customer no less than 30 days prior to the renewal date. Cancellation requests must be submitted by email to renewals@koncisesolutions.com.
3. Service Warranty and Performance
3.1 Koncise shall provide the services with reasonable skill and care and in all material respects in accordance with the agreed scope set out in this Agreement.
3.2 If Customer notifies Koncise in writing of any material failure of the services to conform to the agreed scope, Koncise shall use reasonable endeavours to investigate and remedy such failure within 10 business days of notification, unless the nature of the issue reasonably requires a longer resolution period, in which case Koncise shall communicate a revised timeline promptly.
3.3 Koncise shall not be liable for any failure or delay caused by Customer’s systems, Customer delay or inaccuracy, or any third-party platform outage outside Koncise’s reasonable control, provided that Koncise remains responsible for managing the Koncise-delivered elements of the services with reasonable skill and care.
4. Confidentiality
4.1 Each party undertakes to keep confidential all confidential information received from the other party in connection with this Agreement and not to use such information for any purpose other than the performance or receipt of the services under this Agreement.
4.2 Each party shall disclose the other party’s confidential information only to those of its employees, contractors or advisers who have a genuine need to know it for the purposes of this Agreement, and shall ensure that such persons are subject to equivalent obligations of confidentiality.
4.3 Neither party shall disclose the other’s confidential information to any third party without the other’s prior written consent, save where required by law or regulation, or where the information is already in the public domain through no fault of the receiving party.
4.4 On termination or expiry of this Agreement, each party shall, on request, promptly return or securely delete all confidential information of the other party, and confirm in writing that it has done so.
4.5 The obligations in this clause shall survive termination or expiry of this Agreement for a period of two years.
5. Data Protection
5.1 To the extent that Koncise processes personal data on behalf of Customer in delivering the services, Customer is the data controller and Koncise is the data processor, each as defined under the UK GDPR and the Data Protection Act 2018. The categories of personal data and purposes of processing will be as set out in the applicable Quote or as otherwise agreed in writing between the parties.
5.2 Koncise shall: (a) process personal data only on Customer’s documented instructions and solely for the purpose of delivering the services; (b) implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage; (c) not transfer personal data outside the UK or EEA without Customer’s prior written consent; (d) assist Customer in meeting its obligations under applicable data protection law, including in relation to data subject rights requests; (e) notify Customer without undue delay on becoming aware of any personal data breach affecting Customer’s personal data; and (f) on termination or expiry of this Agreement, securely delete or return all Customer personal data as directed by Customer.
5.3 Koncise shall not engage any sub-processor in relation to Customer’s personal data without Customer’s prior written consent.
5.4 Each party shall comply with its respective obligations under applicable data protection legislation in connection with this Agreement.
6. Liability
6.1 Nothing in this Agreement excludes or limits either party’s liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; or (c) any other liability which cannot lawfully be excluded or limited.
6.2 Subject to clause 6.1, neither party shall be liable to the other for any indirect, consequential, special or punitive loss, or for any loss of profit, loss of revenue, loss of business, loss of goodwill, or loss of anticipated savings, in each case whether direct or indirect.
6.3 The exclusions in clause 6.2 apply regardless of the cause of the loss, including any breach of clause 4 (Confidentiality) or clause 5 (Data Protection).
6.4 Subject to clauses 6.1 and 6.5, Koncise’s total aggregate liability to Customer arising out of or in connection with this Agreement, whether in contract, tort (including negligence), misrepresentation or otherwise, shall not exceed 100% of the total fees paid or payable by Customer under this Agreement.
6.5 Koncise’s aggregate liability arising from breach of clause 4 (Confidentiality) or clause 5 (Data Protection) shall not exceed 150% of the total fees paid or payable by Customer under this Agreement.
6.6 Where the Agreement includes third-party vendor products or services, Koncise’s liability in respect of those products or services is limited to using reasonable endeavours to enforce any warranty or remedy available under the applicable vendor terms. Koncise accepts no liability for failures, defects or losses arising from vendor products beyond this.
7. Termination
7.1 Either party may terminate this Agreement on written notice if the other party: (a) commits a material breach of this Agreement and (where the breach is capable of remedy) fails to remedy it within 14 days of receiving written notice requiring it to do so; (b) becomes insolvent, enters administration, receivership, liquidation or makes any arrangement with its creditors; or (c) persistently fails to meet its material obligations under this Agreement in a manner that cannot reasonably be remedied.
7.2 On termination by Customer under clause 7.1, Koncise shall refund a pro-rata proportion of any prepaid fees relating to Koncise-delivered services not yet provided as at the effective date of termination. Fees relating to third-party vendor products are subject to the refund terms of the applicable vendor.
7.3 Termination shall not affect any accrued rights or liabilities of either party as at the date of termination, nor shall it affect any provisions of this Agreement that are expressed or implied to survive termination.
8. Privacy Policy
Koncise’s Privacy Policy is available at our Privacy Policy and describes Koncise’s general data handling practices. To the extent of any conflict between the Privacy Policy and the express terms of this Agreement (including clause 5), the express terms of this Agreement shall prevail.
9. Use of Customer Name and Brand
Koncise shall not use Customer’s name, logo, or refer to Customer publicly as a customer or user of the services without Customer’s prior written consent. This clause shall survive termination of this Agreement.
10. Assignment
Neither party may assign this Agreement or any of its rights or obligations under it without the other party’s prior written consent, save that either party may assign without consent in connection with an intra-group reorganisation, affiliate transfer, or a sale of the whole or substantially the whole of its business to which this Agreement relates, provided that the assigning party gives prompt written notice of any such assignment.
11. Disputes
Any dispute arising out of or in connection with this Agreement shall be referred first to senior representatives of both parties for good faith resolution. If not resolved within 20 business days, either party may pursue its legal remedies. Nothing in this clause prevents either party from seeking urgent interim relief from a court of competent jurisdiction.
12. Governing Law
This Agreement and all matters arising out of or in connection with it (including non-contractual disputes) are governed by the laws of England and Wales. The courts of England and Wales shall have exclusive jurisdiction to settle any disputes arising out of or in connection with this Agreement.
Part B - Penetration Testing
13. When this Part applies
13.1 This Part applies only where the Quote includes penetration testing, vulnerability assessment, adversary simulation, social engineering or other authorised security testing (“Testing”). It is additional to clauses 1 to 12.
13.2 Unless expressly agreed in writing, Testing does not include physical entry, tailgating, lock bypass or other physical intrusion.
14. Authorisation
14.1 Koncise will not begin Testing until Customer has signed an Authorisation to Test recording the agreed scope, permitted and prohibited techniques, testing window, blackout periods, emergency contacts and stop conditions.
14.2 Customer confirms that it has the authority to permit the Testing, that the person signing the Authorisation to Test is authorised to do so, and that any permission required from a third party who controls an in-scope system has been obtained in writing before Testing begins.
14.3 The signed Authorisation to Test records Customer’s consent for the purposes of the Computer Misuse Act 1990, to the extent Customer is entitled to control the relevant access.
14.4 A purchase order, payment or the provision of credentials does not by itself authorise Testing.
14.5 Customer will indemnify Koncise against third-party claims arising from a breach of clause 14.2. This does not apply to the extent the claim arises from Koncise acting outside the scope authorised in the Authorisation to Test.
15. Customer Responsibilities
15.1 Before Testing begins, Customer will identify critical systems, blackout periods and operational restrictions, and will ensure appropriate backup and recovery arrangements are in place.
15.2 Customer will provide the agreed access and credentials, and contacts who can authorise or stop Testing during the testing window.
15.3 Unless otherwise agreed in writing, Testing is provided only to customers established in the United Kingdom. Customer will identify any in-scope system hosted outside the United Kingdom and confirm that any permission required in that location has been obtained.
16. Nature and Risk of Testing
16.1 Customer understands and agrees that there is an element of risk associated with penetration testing, particularly where systems are tested in a live environment. That risk includes the possibility that some services may become unavailable or unstable during the test. Although this risk is reduced by the use of experienced professional testers and tools obtained from trusted sources, it cannot be eliminated entirely.
16.2 Customer further understands and agrees that Testing is a point-in-time assessment and that there is no guarantee that every vulnerability in its systems will be identified.
16.3 Customer acknowledges that Testing may lead to the loss or corruption of Customer’s data, including personal data, and that this is an inherent risk of security testing even where it is carried out with reasonable skill and care. Customer is advised to back up its data before Testing begins, as required by clause 15.1. Subject to clause 6.1, Koncise will not be liable for any such loss or corruption.
16.4 Koncise may pause or stop Testing where it reasonably believes there is a risk to systems or data, a suspected security incident, or uncertainty about scope or authority. Customer may require Testing to stop at any time through the emergency contact process recorded in the Authorisation to Test.
17. Reports and Findings
17.1 Koncise reports its findings independently of any product or service that Koncise sells. Customer is free to use Koncise, its own team or another provider to remediate.
17.2 Customer may share the report with its professional advisers, auditors, insurers, regulators and remediation providers, provided the report remains confidential. No third party acquires any right to rely on the report by receiving it.
17.3 A retest checks specified remediation only and is not a new full assessment unless expressly agreed.
18. Testing Evidence
18.1 Koncise will collect only the evidence reasonably needed to support its findings and will securely delete working evidence, including credentials, tokens and raw tool output, within 30 days of delivering the final report.
18.2 Koncise may retain the final report and engagement records for six years from delivery of the final report, for insurance and legal purposes, and will securely delete them at the end of that period unless a legal or insurance hold applies.
19. Cancellation and Rescheduling
19.1 Testing capacity is reserved in advance. Where Customer cancels or postpones confirmed Testing, the following percentage of the fees for the affected testing may be charged, according to the notice given:
- 10 or more business days: 0%
- 6 to 9 business days: 25%
- 3 to 5 business days: 50%
- Fewer than 3 business days: 100%
19.2 Customer may reschedule once without charge on at least 10 business days’ notice.
19.3 No charge applies where the cancellation results from Koncise’s breach or from an event outside either party’s reasonable control.
20. Liability for Testing
20.1 Clause 6 applies to Testing.
.png)
Lewis Warner
Chief Hacking Officer · Koncise Solutions
