Book a consultation

LEGAL

Terms of Business

Version 1.0, 18 October 2026

These terms govern every consultancy engagement between ShieldPath Security Ltd and its clients.

ShieldPath Security Ltd, a company registered in England and Wales, company number 15623992. Registered office: Units 4 & 5, 84 Vaughan Way, Leicester, England, LE1 4SJ. Email: info@spsec.co.uk. Telephone: 0330 633 7661.

1. About these terms

  1. These Terms of Business (the Terms) apply to all services that ShieldPath Security Ltd (ShieldPath, we, us) provides to a client (you).
  2. Each engagement is described in a proposal, quotation or statement of work (a Proposal). The Proposal and these Terms together form the contract (the Agreement).
  3. If the Proposal and these Terms conflict, the Proposal takes priority for that engagement only.
  4. These Terms apply in place of any terms you provide, including terms on a purchase order, unless we agree otherwise in writing.
  5. Our services are provided to businesses only. You confirm you are not entering the Agreement as a consumer.
  6. In these Terms:
    • Deliverables means the reports, documents, plans and other materials we produce for you under a Proposal.
    • Services means the services described in a Proposal.
    • Business Day means a day other than a Saturday, Sunday or public holiday in England.

2. Engagement, scope and changes

  1. An engagement starts when you accept a Proposal in writing (including by email), or by accepting it online through our secure signing page, or when we start work at your request, whichever is earlier.
  2. We will provide the Services described in the Proposal. Anything not described in the Proposal is outside scope.
  3. Either of us may request a change to the scope, timing or approach. A change applies only once we have both agreed it in writing, including any effect on fees and timescales.
  4. Timescales in a Proposal are estimates based on the information available when it was written. We will tell you promptly if we expect a delay.

3. Our services and standard of work

  1. We will provide the Services with reasonable skill, care and diligence, using appropriately qualified people.
  2. Our Services are advisory. You remain responsible for your own management decisions, the controls you implement and your compliance with law, regulation and contract.
  3. No guarantee of certification. Certification against ISO/IEC 27001, ISO/IEC 42001 or any other standard is decided solely by an independent certification body. We help you prepare, but we cannot guarantee that you will achieve or keep certification.
  4. Gap assessments and other reviews reflect the information, people and systems made available to us at the time. They are not an audit opinion and may not identify every issue.
  5. Deliverables are prepared for your internal use. Unless we agree otherwise in writing, no third party may rely on them.

4. Your responsibilities

You will:

  1. provide timely access to the people, information, premises and systems we reasonably need;
  2. make sure the information you give us is accurate and complete, and tell us promptly of relevant changes;
  3. nominate a named contact with authority to make decisions about the engagement;
  4. review and respond to drafts and requests within a reasonable time; and
  5. obtain any permissions needed for us to access systems or data, including from third parties who host or manage them.

If you do not meet these responsibilities, we are not liable for any resulting delay or failure, and we may charge for the extra time involved.

5. Fees, expenses and payment

  1. Our fees are set out in the Proposal, either as a fixed fee or at day rates.
  2. All fees are exclusive of VAT, which will be added at the applicable rate where we are VAT-registered.
  3. Reasonable travel and subsistence for on-site work is charged at cost unless the Proposal says it is included. We will agree any single expense over £250 with you in advance.
  4. Unless the Proposal says otherwise, we will invoice:
    • fixed-fee work of five days or fewer in full on acceptance of the Proposal;
    • longer fixed-fee work at 50% on acceptance and 50% on delivery of the final Deliverables; and
    • day-rate and retainer work monthly in arrears (retainers monthly in advance).
  5. Invoices are payable within 14 days of the invoice date.
  6. We may charge interest and compensation on late payments under the Late Payment of Commercial Debts (Interest) Act 1998.
  7. If an invoice is more than 14 days overdue, we may suspend the Services after giving you 7 days’ written notice.

6. Rescheduling and cancellation

  1. Scheduled workshops, assessment days or on-site visits may be rescheduled free of charge with at least 10 Business Days’ notice.
  2. If you cancel or reschedule with less notice, we may charge:
    • 50% of the fees for the affected days with 5 to 9 Business Days’ notice; and
    • 100% of the fees for the affected days with fewer than 5 Business Days’ notice.
  3. Non-refundable expenses already incurred, such as travel booked for you, are payable in all cases.
  4. Penetration testing rescheduling and cancellation may be subject to our testing partner’s own notice periods, which we will set out in the Proposal.

7. Partners, subcontractors and third-party tools

  1. We may use subcontractors to deliver parts of the Services. We remain responsible for their work under the Agreement, except where clause 7.2 applies.
  2. Penetration testing is delivered by our testing partner, Closed Door Security. Testing is performed under a scope and rules of engagement agreed with you in writing before testing starts. You must have authority to permit testing of every system in scope.
  3. Where we provide access to ReguEase or another software platform, use of that platform is also subject to its own terms of use and privacy notice.
  4. We are not responsible for third-party products, platforms or services you choose to use, even if we recommended them.

8. Confidentiality

  1. Each of us will keep confidential the other’s non-public business, technical and security information, and use it only for the engagement.
  2. This does not apply to information that is public through no fault of the recipient, was already lawfully known to it, is independently developed, or must be disclosed by law or a regulator.
  3. We may share your confidential information with our staff, subcontractors and professional advisers who need it for the engagement and are bound by equivalent confidentiality duties.
  4. We may name you as a client only with your prior written consent.
  5. These obligations continue for five years after the engagement ends, and indefinitely for information about security vulnerabilities.

9. Data protection

  1. Each of us will comply with the UK GDPR and the Data Protection Act 2018.
  2. We process business contact details of your staff as an independent controller, as described in our Privacy Notice.
  3. Where we process personal data on your behalf as part of the Services, we act as your processor. We will then process it only on your documented instructions, and the parties will sign a data processing agreement meeting Article 28 UK GDPR.
  4. You should not give us more personal data than the engagement needs.

10. Intellectual property

  1. Once you have paid the relevant fees in full, you own the Deliverables we create specifically for you.
  2. We keep ownership of our pre-existing materials, templates, methods, tools and know-how, including anything we develop that is not specific to you. Where these are built into your Deliverables, we grant you a non-exclusive, perpetual licence to use them for your internal business purposes.
  3. You must not resell or publish our templates or materials, other than as part of your own management system documentation.
  4. You keep ownership of the information and materials you give us, and grant us a licence to use them for the engagement.

11. Limitation of liability and insurance

  1. Nothing in the Agreement limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be limited.
  2. Neither of us is liable to the other for loss of profit, revenue, business, goodwill or data, or for any indirect or consequential loss.
  3. Our total liability under or in connection with each Proposal is limited to the fees paid or payable under that Proposal in the 12 months before the event giving rise to the claim.
  4. We are not liable for any security incident, breach or loss that the Services were not designed or engaged to prevent, or that results from your failure to act on our recommendations.
  5. We hold professional indemnity insurance with cover of £1,000,000 and will provide evidence on request.

12. Term and termination

  1. Each engagement continues until the Services are complete, unless ended earlier under this clause.
  2. Retainers and virtual CISO services run for the minimum term in the Proposal and then continue until either of us gives 30 days’ written notice.
  3. Either of us may end the Agreement immediately by written notice if the other materially breaches it and does not remedy the breach within 14 days of being asked to, or becomes insolvent.
  4. On termination, you will pay for Services performed and expenses incurred up to the termination date. Clauses that by their nature should survive (including 5, 8, 9, 10 and 11) continue to apply.

13. General

  1. Force majeure. Neither of us is liable for delay or failure caused by events beyond our reasonable control.
  2. Entire agreement. The Agreement is the whole agreement between us about its subject and replaces any earlier discussions.
  3. Changes to these Terms. We may update these Terms. Changes apply only to Proposals accepted after the updated Terms are issued.
  4. Assignment. Neither of us may transfer the Agreement without the other’s written consent, which will not be unreasonably withheld.
  5. Third parties. No one other than you and us has any right to enforce the Agreement.
  6. Notices. Notices must be in writing and sent by email to the address in the Proposal, or to info@spsec.co.uk for ShieldPath.
  7. Governing law. The Agreement and any dispute arising from it are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Version 1.0, 18 October 2026.