Hosting, Email and Care Agreement

1. About this Agreement

1.1 This Agreement applies to all managed hosting, business email, Care Plans, updates and amendments, and related support services ("Hosted Services") provided by Samson Web Design Ltd ("we", "us", "our") to the client named in the Proposal, order or invoice ("you", "your").

1.2 This Agreement forms part of, and should be read with, our Terms and Conditions ("the Terms"). Defined terms in the Terms have the same meaning here. If this Agreement conflicts with the Terms, this Agreement prevails for the Hosted Services. If your Proposal conflicts with this Agreement, the Proposal prevails.

1.3 You accept this Agreement by ordering a Hosted Service, accepting a Proposal that includes one, paying a hosting invoice, setting up a direct debit for a Hosted Service, or continuing to use a Hosted Service after being notified of this Agreement.

2. What we provide

2.1 The Hosted Services you receive are those of the plan you have chosen, as described in Schedule 1. Anything not listed is not included.

2.2 Hosted Services are provided on our Cloud Platform: the shared, auto-scaling UK hosting platform we purchase from our Wholesale Hosting Provider. All sites and email are hosted on the Cloud Platform unless your Proposal expressly states that a Dedicated Server is provided.

2.3 Our Wholesale Hosting Provider is a UK company operating UK data centres. Its identity is available on request. We may change provider, data centre or platform at any time, provided that data remains within the UK and the service you receive is not materially reduced. We will give reasonable notice of any migration that requires action from you.

2.4 We do not register, renew or manage domain names. Domains are your responsibility under clause 19 of the Terms.

3. Term, billing and price changes

3.1 Hosted Services are rolling monthly services. They begin on the date your site or email goes live on our platform, or on the date stated in the Proposal, and continue month to month until cancelled under clause 15.

3.2 Fees are payable monthly in advance by direct debit collected through GoCardless on or around the same date each month. You must keep a valid mandate in place. Where a direct debit fails, we will re-present it and may suspend the Hosted Services under clause 14 if it remains unpaid.

3.3 Fees are stated exclusive of VAT, which is added at the prevailing rate.

3.4 We may change the fees or inclusions of a plan by giving at least 30 days' written notice. If you do not accept a change you may cancel under clause 15 before it takes effect.

3.5 No refund is given for any part of a month in which a Hosted Service is cancelled, suspended or unused.

4. Service Level Agreement: availability

4.1 We target 99.9% availability of your website in each calendar month, measured by our own external uptime monitoring. This allows for approximately 44 minutes of unplanned unavailability per month.

4.2 Availability is a target, not a guarantee. No service credits, refunds, discounts or compensation are payable if the target is not met. Your remedy if availability falls persistently below the target is to cancel under clause 15.

4.3 The following are excluded when measuring availability: (a) planned maintenance notified in advance, and emergency maintenance required to protect security or stability; (b) denial of service attacks, bot floods, brute force attempts and other malicious or unlawful activity, including any protective blocking applied by our Wholesale Hosting Provider; (c) failures or degradation caused by your website's code, plugins, themes, content, database, traffic or configuration, or by anything installed or changed by you or by anyone you have given access to; (d) failures of Third Party Services, including domain registrars, DNS, CDNs, payment gateways, APIs and external scripts; (e) suspension under clause 14 or the Terms; (f) periods during which no fault is confirmed by our monitoring or by our Wholesale Hosting Provider; (g) DNS propagation, domain expiry or incorrect DNS records; (h) wider internet, upstream network or force majeure events; and (i) degraded performance where the site remains reachable.

4.4 Availability applies to the web hosting service only. Email delivery, sending and receipt are subject to clause 10 and not to the availability target.

4.5 Where a Proposal expressly provides a Dedicated Server, our Wholesale Hosting Provider offers a network availability commitment for that server with service credits payable to us. If we receive a credit from the provider in respect of your Dedicated Server we will pass on the amount we receive, less nothing, up to a maximum of one month's fee, and this is the only compensation available. Claims must be raised with us in writing within 5 Business Days of the incident so that we can claim within the provider's deadline.

5. Support hours and response targets

5.1 Support is provided by telephone, email, WhatsApp and Messenger during our working hours: Monday to Friday, 9.00am to 5.30pm, excluding public holidays in England and Wales ("Support Hours").

5.2 Response targets depend on your plan and are set out in Schedule 3. A response target is the time within which we aim to acknowledge and begin work on a request during Support Hours. Response targets are targets, not guarantees, and no compensation is payable if they are missed.

5.3 Outside Support Hours we monitor for site-down alerts. Genuine emergencies, meaning a site that is completely unavailable or actively compromised, are attended to outside Support Hours where reasonably possible on Priority plans, and at our discretion on other plans. Content changes, questions and non-urgent requests are handled in the next Support Hours.

5.4 Resolution times depend on the nature of the problem, third parties and your responsiveness, and are not guaranteed.

6. Backups and restore

6.1 We take automated backups of your website files and database at least once every 24 hours and retain restore points for 30 days. Mailbox backups are as provided by our Wholesale Hosting Provider's platform and may be more limited; you should keep your own copies of important email.

6.2 Backups are held on infrastructure separate from the live server within the UK.

6.3 On request we will restore your website from a backup of your choice within the retention period. We aim to begin a restore within 4 Support Hours of your request. Restores are included at no charge on Care Plans. On hosting-only plans, one restore per month is included and further restores are charged at our hourly rate.

6.4 A restore returns the site to its state at the backup point. Any content, orders, form submissions, user registrations or changes made after that point are lost. It is your responsibility to decide which restore point to use and to re-enter anything lost.

6.5 While we take reasonable care, we do not guarantee that every backup will be complete or usable. You remain responsible for keeping independent copies of content, product data, orders, documents and email that are important to your business.

7. Security: what we do

7.1 On all Hosted Services we provide: SSL certificates; a web application firewall and network-level protection operated by our Wholesale Hosting Provider; automated malware scanning; brute force login protection; secure platform configuration; and 24/7 uptime monitoring.

7.2 On Care Plans we additionally: apply WordPress core, theme and plugin updates on a regular schedule, normally within days of release and sooner for known security releases; apply security hardening; review scan results; and act on alerts.

7.3 On hosting-only plans, software updates to your website are your responsibility unless you ask us to carry them out, which is chargeable at our hourly rate.

7.4 Updates are applied with reasonable care but can occasionally break functionality because of conflicts between third party software. Where an update breaks a site we host under a Care Plan we will roll it back or fix it at no charge. We are not responsible for third party software that is abandoned, unlicensed or incompatible.

8. Security: what you do

8.1 You must: (a) use strong, unique passwords for every account and change them if compromise is suspected; (b) enable two factor authentication where we make it available; (c) control who has access to your website, email and accounts, and remove access for people who leave; (d) not install plugins, themes, scripts or code without checking with us where we look after your site; (e) keep any software licences you hold valid so that updates continue; (f) not share credentials with third parties unless you have told us; and (g) tell us promptly if you believe an account, device or mailbox has been compromised.

8.2 We are not responsible for any compromise, loss or downtime resulting from a failure to follow clause 8.1, from phishing or social engineering, from a compromised device you or your staff use, or from access you have given to others.

9. If your site is hacked or compromised

9.1 If we detect or you report that a site we host has been compromised, we will respond within the response target for your plan and, where appropriate, take the site offline or restrict access to contain the problem.

9.2 On a Care Plan: we remove malware, close the vulnerability where it lies in software we maintain, restore from a clean backup where necessary, reset credentials, and get the site back online at no charge, however many times it happens, for as long as you remain on the plan and have followed clause 8.1. This is our "fix it free" commitment.

9.3 On a hosting-only plan: we restore your site from the most recent clean backup at no charge. Investigation, malware removal, patching of your software and any further work is chargeable at our published Hacked Site Repair prices or our hourly rate.

9.4 On any plan, the following are chargeable at our hourly rate regardless of plan: (a) compromise caused by weak or shared credentials, a compromised device, or access given to a third party; (b) compromise through plugins, themes, code or scripts installed or modified by you or a third party; (c) compromise of Third Party Services or accounts outside our platform; (d) rebuilding content that was never in a backup; and (e) work with third parties such as Google, payment providers or blacklist operators to restore reputation, which we will assist with on request.

9.5 We cannot guarantee that any compromise can be fully investigated, that its cause can be identified, or that data was not accessed before detection. Where personal data may have been affected, you as controller are responsible for assessing and, where required, notifying the Information Commissioner's Office and data subjects. We will provide the information reasonably available to us to help you do so.

10. Business email

10.1 Where your plan includes email, we provide mailboxes on your domain of the number included in your plan (10GB each unless stated), with webmail, IMAP, POP3 and SMTP access, and spam and virus filtering. We will set the mailboxes up and provide settings for your devices. Configuring your own devices and mail clients is your responsibility, although we will help where we reasonably can.

10.2 Mailboxes are for ordinary business correspondence. They may not be used for bulk mail, newsletters, marketing campaigns, cold outreach or automated high-volume sending. Such mail must be sent through a dedicated service such as Mailchimp or a transactional email provider. Our Wholesale Hosting Provider's sending limits apply and mailboxes that exceed them may be rate-limited or suspended.

10.3 Email delivery depends on many systems we do not control, including the recipient's provider, spam filters, blacklists and DNS. We do not guarantee that any message will be delivered, delivered on time, or not marked as spam. We will configure SPF, DKIM and DMARC records where you give us DNS access, which materially improves deliverability.

10.4 If your domain or IP is blacklisted as a result of your sending behaviour, a compromised mailbox or a compromised website, the work required to resolve it is chargeable unless you are on a Care Plan and the cause lies in software we maintain.

10.5 Spam filtering is automated and may occasionally delay or misclassify legitimate mail. You should check your spam folder regularly. We are not responsible for messages blocked, quarantined or delayed by filtering.

10.6 Mailbox storage that reaches its limit will stop receiving mail. It is your responsibility to manage mailbox size or ask us to increase it, which may carry an additional fee.

10.7 Email is not a document storage or archiving service. You are responsible for retaining any email you need for legal, tax or regulatory purposes elsewhere.

11. Updates, amendments and included time

11.1 Where your plan includes amendment time, it covers changes to your existing website such as text and image changes, adding a blog post or project, updating contact details, minor layout tweaks, and adding or amending content within existing page templates.

11.2 Included time applies to the current month only and does not roll over. Unused time has no cash value.

11.3 Where a plan is described as including "unlimited amendments", this covers ordinary content changes of the kind described in clause 11.1 to existing pages, submitted in reasonable volume and frequency by a business of your size. It does not cover new pages beyond the page templates already built, new functionality, redesign, integrations, ecommerce product loading in bulk, or work that in our reasonable opinion is a project rather than an amendment. We will tell you before treating a request as outside the plan.

11.4 Work beyond the included time is charged at our hourly rate, currently £60 plus VAT per hour billed in 15 minute intervals, or at a fixed price we quote. We will tell you before starting chargeable work.

11.5 Requests are made by email, WhatsApp, Messenger or telephone in plain English. We aim to complete small amendments within the response target for your plan, and larger amendments within a timescale we agree with you.

12. Premium software licences

12.1 Where we provide premium plugins, themes or software under our own licences as part of your plan, those licences remain ours. They apply to your site only while your plan is active. When your plan ends the software remains installed but stops receiving updates until you purchase your own licence.

12.2 Where a premium licence is held in your name, you are responsible for keeping it valid. We will tell you if we become aware it has lapsed.

13. Acceptable use and fair use

13.1 You must not use the Hosted Services: (a) for anything unlawful, defamatory, obscene, discriminatory, harassing or infringing of anyone's rights; (b) to send spam or unsolicited bulk email; (c) to host, distribute or link to malware, phishing content or hacking tools; (d) to host adult content, gambling, cryptocurrency mining, or anything else prohibited by our Wholesale Hosting Provider; (e) to run applications, scripts or cron jobs that consume disproportionate resources; (f) as file storage, backup storage or a file sharing service unrelated to your website; (g) to run mail relays, proxies, VPNs or game servers; or (h) in any way that damages our reputation or that of our Wholesale Hosting Provider.

13.2 The Cloud Platform is shared. Storage, bandwidth and processing are subject to fair use appropriate to a business website of your type. If your site's usage materially exceeds what is reasonable, or affects other clients, we will discuss options with you, which may include optimisation work, a higher plan or a Dedicated Server at an additional fee.

13.3 You are responsible for everything hosted on your account, whether placed there by you, your staff, your other suppliers or your users.

14. Suspension

14.1 We may suspend some or all Hosted Services immediately where: (a) fees remain unpaid 7 days after we have notified you of non-payment; (b) you breach clause 13; (c) your site is compromised, sending spam, or endangering the platform or other clients; (d) we are required to by law, a court, a regulator or our Wholesale Hosting Provider; (e) a Payment Plan instalment is overdue under the Spread the Cost Schedule; or (f) you are abusive to us or our suppliers.

14.2 We will tell you why we have suspended and what is needed to lift the suspension. Fees continue to accrue during suspension. Where suspension results from your breach, we may charge our hourly rate for the work of suspending and reinstating.

15. Cancellation and moving away

15.1 Either party may cancel any Hosted Service by giving at least 30 days' written notice. Fees remain payable to the end of the notice period. Notice by email is sufficient.

15.2 Where a Project was paid by Payment Plan, or a monthly price was offered on the basis that we host the site, you may not cancel Hosting while any instalment remains unpaid.

15.3 On cancellation, provided your account is fully paid: (a) we will provide a complete export of your website files and database, and of your mailboxes in a standard format, at no charge within 10 Business Days of request; (b) we will supply the DNS records you need; and (c) mailboxes will remain accessible for 14 days after the Hosted Service ends so that you can export or forward mail.

15.4 Hands-on migration to a new supplier, configuration of the site or email at the new supplier, and support for the new supplier are charged at our hourly rate.

15.5 30 days after the Hosted Service ends we will delete your website, database, mailboxes and backups from our platform. We are not responsible for any data you have not exported by then.

15.6 Where the Hosted Service ends because of your unpaid fees, no exports, files or access are provided until the account is settled in full.

15.7 On cancellation of a Care Plan, responsibility for updates, security, backups and monitoring passes to you or your new supplier from the end of the notice period.

16. Sites hosted elsewhere and sites we did not build

16.1 This Agreement applies only to sites and email on our platform. Where your site is hosted elsewhere, we provide no availability target, no backups, no security commitments and no included restore, and any support is charged at our hourly rate.

16.2 Where we take over a site built by someone else, we will assess it before agreeing a plan. We may require remedial work, chargeable at our hourly rate or a fixed price, before the site is eligible for a Care Plan. Problems inherited from the previous build are not covered until we have agreed they are.

17. Data protection

17.1 In providing the Hosted Services we act as your processor in respect of personal data in your website, database, forms, email and hosting account. The Data Processing Terms in Schedule 2 apply.

18. Liability

18.1 Clauses 28 and 29 of the Terms apply to the Hosted Services. In particular, our total liability in connection with the Hosted Services in any 12 month period is limited to the fees you have paid us for the affected Hosted Service in the 3 months before the event giving rise to the claim, and we are not liable for lost sales, lost data beyond restoration of the most recent available backup, downtime, security breaches, or Third Party Services.

19. General

19.1 Clause 33 of the Terms (General) and clause 34 (Governing law) apply to this Agreement.

Schedule 1: Your plan

Your plan is the hosting, email or Care Plan named in your Proposal, order confirmation or invoice, with the inclusions published on samsonwebdesign.co.uk for that plan on the date you ordered it, as varied by anything expressly stated in your Proposal. This determines your monthly fee, the number of mailboxes included (10GB each unless stated), any included amendment time, your response target level under Schedule 3, whether software updates, hardening and malware clean-up are included, any premium licences we provide, and whether your site is on the Cloud Platform or a Dedicated Server. Where a Project was paid by Payment Plan, the Spread the Cost Schedule also applies to your hosting.

Schedule 2: Data Processing Terms

2.1 Roles. You are the controller and we are the processor of personal data processed in the course of the Hosted Services ("Client Data").

2.2 Subject matter and duration. Processing consists of hosting, storing, backing up, transmitting, restoring, securing and supporting your website, database, forms and email for the duration of the Hosted Services and the deletion period in clause 15.5.

2.3 Nature and purpose. Storage and transmission of Client Data on our platform; automated backup; malware scanning; technical support; restoration; and export on request.

2.4 Types of data and data subjects. Whatever you and your users place in your website, database, forms and email, which may include names, contact details, addresses, order details, account credentials, correspondence and any other categories you choose to collect from customers, prospects, staff, suppliers and website visitors. You must not use the Hosted Services for special category data or payment card data without telling us first and agreeing appropriate measures.

2.5 Our obligations. We will: (a) process Client Data only on your documented instructions, which include this Agreement and the Terms, unless required otherwise by law; (b) ensure that people we authorise to process Client Data are bound by confidentiality; (c) implement appropriate technical and organisational measures, including those in clause 7; (d) engage sub-processors only under written terms imposing equivalent obligations, and remain responsible for them; (e) assist you, taking into account the nature of the processing, with responding to data subject requests, with security, breach notification and impact assessments, at our hourly rate where the assistance is more than minimal; (f) notify you without undue delay after becoming aware of a personal data breach affecting Client Data; (g) at the end of the Hosted Services delete or return Client Data as described in clause 15; and (h) make available the information reasonably necessary to demonstrate compliance and allow for audits, which will normally be satisfied by written responses to reasonable questions.

2.6 Sub-processors. You give general authorisation for us to use sub-processors, including our Wholesale Hosting Provider (a UK company using UK data centres) and any email delivery, backup or monitoring providers we use. A current list is available on request. We will notify you at least 14 days before adding or replacing a sub-processor that processes Client Data, and you may object on reasonable grounds; if we cannot resolve the objection you may cancel the affected Hosted Service.

2.7 International transfers. Client Data is hosted in the United Kingdom. We will not transfer Client Data outside the UK without ensuring appropriate safeguards under Data Protection Law.

2.8 Your obligations. You warrant that you have a lawful basis for the Client Data, that your instructions to us comply with Data Protection Law, and that you have provided the necessary privacy information to data subjects. You are responsible for the content of your website and the data your website collects.

2.9 Precedence. This Schedule prevails over anything inconsistent in the Terms in relation to the processing of Client Data.

Schedule 3: Support and response targets

Support Hours are Monday to Friday, 9.00am to 5.30pm, excluding public holidays in England and Wales. Response targets are the time within which we aim to acknowledge and begin work; they are not resolution times and are not guaranteed.