Terms and conditions
Last updated: 20 October 2026
These terms apply to every service and monthly plan you buy from Continental Data. Clauses 1 to 13 are the general terms; clauses 14 to 24 set out how we deliver services, your right to cancel and our liability. We sell services only; we do not sell or ship physical goods. Please read these terms before you submit an enquiry. If you are a consumer, some terms apply differently to you and you have legal rights that these terms do not affect.
Contents
- 1. Who we are
- 2. Definitions
- 3. How the contract is formed
- 4. Prices and currency
- 5. Payment
- 6. Our responsibilities
- 7. Your responsibilities
- 8. Changes
- 9. Suspension and termination
- 10. Events outside our control
- 11. Complaints
- 12. Governing law and courts
- 13. Other important terms
- 14. Scope and statement of work
- 15. Authorisation to test
- 16. Rules of engagement and possible disruption
- 17. Your cooperation
- 18. Reports and confidentiality
- 19. Intellectual property
- 20. Data protection
- 21. Monthly plans and recurring services
- 22. Your right to cancel services (consumers)
- 23. Your legal rights about services (consumers)
- 24. Our liability
1. Who we are
1.1 Continental Data is owned and operated by Avanzado Capital Limited, a company registered in England and Wales with company number 12469366, whose registered office is at 85 Booth Road, London, England, NW9 5JU (we, us, our).
1.2 You can contact us by email at info@continental-data.co.uk or through our contact page. Our customer service hours are Monday to Friday, 9am to 5:30pm UK time, excluding bank holidays. If we need to contact you, we will use the email address you gave us in your enquiry.
2. Definitions
2.1 You means the person or organisation that submits an enquiry to us and, once the contract is formed, buys services from us.
2.2 Consumer means an individual acting for purposes wholly or mainly outside their trade, business, craft or profession. Business customer means anyone who is not a consumer. On the enquiry form you tell us which you are, and these terms apply to you on that basis.
2.3 Services means the cyber-security services and monthly plans described on our services and pricing pages.
2.4 Scope means the written description of the services, targets, dates, deliverables and price that we confirm to you before the contract is formed (sometimes called a statement of work). Scope confirmation means the email or document in which we send you the scope.
2.5 Enquiry means the request you submit through our website, listing the services you are interested in and your answers to our scope questions.
2.6 Rules of engagement means the agreed conditions for any testing, including the targets, testing windows, permitted techniques, contacts and what happens if something goes wrong.
2.7 Working day means Monday to Friday, excluding bank holidays in England.
2.8 In writing includes email.
3. How the contract is formed
3.1 Our website takes enquiries, not payments. You choose the services you are interested in, answer our scope questions and click Submit enquiry. You do not need an account. Submitting an enquiry does not create a contract and nothing is charged at that point.
3.2 We review every enquiry and aim to contact you within one working day to discuss your needs and agree the scope and price.
3.3 When the scope is agreed, we send you a scope confirmation in writing, together with a secure payment link from our payment provider.
3.4 A contract is formed only when you have accepted our scope confirmation and paid: (a) for one-off services, the full price shown in the scope confirmation; or (b) for monthly plans and other recurring services, the first monthly payment. We schedule the work once the contract is formed.
3.5 You may withdraw an enquiry at any time before you pay, at no cost. We may decline an enquiry, for example if we cannot verify that you are authorised to have the targets tested, if the work is outside what we offer, or if there is an error in a price or description. If we decline after you have paid, we will refund you in full.
3.6 These terms, the scope confirmation and any data processing agreement under clause 20 make up the contract. If the scope conflicts with these terms, the scope wins for that contract, except that it cannot reduce a consumer's statutory rights.
4. Prices and currency
4.1 The prices on our website are starting prices for a typical small organisation. Your price depends on the scope and is set out in your scope confirmation.
4.2 Our prices are set in US dollars. You can choose to view and pay in pounds sterling, euro, UAE dirham, Indian rupee, Australian dollar, Canadian dollar, Singapore dollar or Swiss franc. We convert using that day's exchange rate based on European Central Bank reference rates, and round the result.
4.3 The price and currency stated in your scope confirmation are binding. Exchange-rate movements after we send it do not change them. Your bank or card issuer may charge its own conversion or overseas transaction fees, which we do not control.
4.4 Prices on our website exclude taxes. Any taxes that apply (such as VAT, where we are required to charge it) are added in your scope confirmation and on your invoice.
4.5 If we find an obvious error in a price, we will tell you before the contract is formed and you can choose to go ahead at the correct price or withdraw your enquiry.
5. Payment
5.1 You pay through the secure payment link from our payment provider that we send with your scope confirmation. Your card details go directly to the provider; they never reach us and we never store them.
5.2 For one-off services, you pay the full price before work is scheduled, unless the scope confirmation says otherwise.
5.3 For monthly plans and per-device or per-user services, you pay the first month to form the contract, then monthly in advance from the start date in the scope.
5.4 We send an invoice for every payment to the billing contact you gave us.
5.5 If a business customer does not pay an amount when due, we may suspend the services under clause 9 and charge interest under the Late Payment of Commercial Debts (Interest) Act 1998.
6. Our responsibilities
6.1 We will provide the services with reasonable care and skill, using appropriately skilled people, and in line with the scope and rules of engagement.
6.2 We will keep your information confidential as set out in clause 18 and handle personal data as set out in clause 20 and our privacy notice.
6.3 We do not hold, and do not claim, any industry accreditation or certification unless it is stated in your scope. Our Cyber Essentials service is readiness support: the certificate itself is issued by an IASME certification body, which charges its own separate fee.
7. Your responsibilities
7.1 You must give us accurate, complete information in your enquiry and keep it up to date.
7.2 You must cooperate with us as set out in clause 17, and for testing you must meet the authorisation requirements in clause 15.
7.3 You must not use our reports, tools or advice to break the law or to attack systems you are not authorised to test.
8. Changes
8.1 Either of us may ask to change the scope. A change takes effect only when we both agree it in writing, including any change to the price or timetable.
8.2 We may make minor changes to the services to reflect changes in law or good security practice, as long as they do not reduce the quality of what you receive.
8.3 We may update these terms from time to time. The version in force when your contract was formed applies to that contract. For monthly plans, we will give you at least 30 days' notice of any change that affects you; if you are unhappy with it you may end the plan before the change takes effect without paying any early-termination amount.
9. Suspension and termination
9.1 We may suspend testing immediately if we reasonably believe that continuing would cause serious harm to your systems or a third party's, or that you are not authorised to have a target tested. We will tell you as soon as we can.
9.2 We may suspend the services, after giving you at least 7 days' written notice, if you do not pay an amount when due.
9.3 Either of us may end the contract by written notice if the other seriously breaches it and (where the breach can be put right) does not put it right within 14 days of being asked to.
9.4 Either of us may end the contract by written notice if the other becomes insolvent, enters administration or liquidation, or stops trading.
9.5 When the contract ends, you pay for services provided up to the end date, and each of us returns or deletes the other's confidential information as set out in clauses 18 and 20. Clauses that by their nature should continue (including confidentiality, intellectual property, data protection and liability) continue to apply.
10. Events outside our control
10.1 Neither of us is responsible for delay or failure caused by events outside our reasonable control, such as a power or network outage, the failure of a third-party service, extreme weather, pandemic or government action. The affected party must tell the other promptly and take reasonable steps to limit the effect.
10.2 If such an event delays the services by more than 30 days, either of us may end the affected contract by written notice, and you will receive a refund for anything paid for but not provided.
11. Complaints
11.1 If you are unhappy with anything we have done, please tell us through our contact page (choose the topic Complaint) or by email to info@continental-data.co.uk, with your enquiry or order reference and a description of the problem.
11.2 We will acknowledge your complaint within 2 working days and aim to give you a full response within 14 days.
11.3 If you are a consumer and we cannot resolve your complaint, we will tell you which alternative dispute resolution (ADR) provider can consider it. You may refer it to an ADR provider or bring a claim in the courts (see clause 12). This does not affect your statutory rights.
12. Governing law and courts
12.1 These terms and any dispute arising from them (including non-contractual disputes) are governed by the law of England and Wales.
12.2 If you are a business customer, the courts of England and Wales have exclusive jurisdiction.
12.3 If you are a consumer, you may bring proceedings in the courts of England and Wales; if you live in Scotland you may also bring proceedings in Scotland, and if you live in Northern Ireland you may also bring proceedings in Northern Ireland. Nothing in these terms takes away any protection you have under the mandatory consumer law of the country where you live.
13. Other important terms
13.1 No one other than you and us has any right under the Contracts (Rights of Third Parties) Act 1999 to enforce any of these terms.
13.2 You may not transfer your rights under the contract without our written agreement. We may transfer our rights and obligations to another organisation, and will tell you if we do; if you are a consumer and unhappy with the transfer, you may end the contract and receive a refund for anything paid for but not provided.
13.3 If a court finds part of these terms unlawful, the rest continues in force.
13.4 If we do not insist straight away that you do something you are required to do, that does not stop us insisting later.
13.5 Entire agreement (business customers only). For business customers, the contract described in clause 3.6 is the entire agreement between us and replaces any earlier discussions, proposals or representations about its subject matter. Each of us agrees that we have not relied on any statement that is not set out in the contract. Nothing in this clause limits liability for fraudulent misrepresentation. This clause does not apply to consumers.
14. Scope and statement of work
14.1 Before the contract is formed we will agree the scope with you in writing. It will describe the services, the targets (for example domains, IP ranges, applications, APIs, networks, wireless sites or cloud tenants), the dates or testing windows, the deliverables, the price and any assumptions.
14.2 We will only provide the services described in the scope. Work outside it is a change under clause 8.
14.3 Services are delivered remotely or on site, in the UK or abroad, as agreed in the scope. Travel for on-site work outside Greater London is quoted in the scope. Typical lead times are on our service delivery page.
15. Authorisation to test
15.1 Testing computer systems without the owner's permission can be a criminal offence under the Computer Misuse Act 1990. Before any testing, you must confirm in writing that you own each target in the scope or have the written permission of its owner to have it tested in the way described in the scope.
15.2 We will take reasonable steps to verify that you control the targets before testing (for example by asking you to place a file or DNS record, or to confirm from an authorised email address). We will not start or continue testing a target we cannot verify.
15.3 Where a hosting, cloud or other service provider's terms require you to notify it of, or get its approval for, security testing, you are responsible for doing so before the testing window.
15.4 If you are a business customer, you will indemnify us against any losses, costs (including reasonable legal costs), claims and liabilities we suffer as a result of testing any target that you were not, in fact, entitled to authorise us to test, or of your breach of this clause.
16. Rules of engagement and possible disruption
16.1 We will carry out testing only within the agreed scope, testing windows and rules of engagement. You must give us an emergency contact who can be reached during testing.
16.2 Security testing is designed to find weaknesses and, even with care, can sometimes slow down or interrupt systems, trigger security alerts, lock accounts or affect data. We use techniques intended to minimise this and will stop and contact you if we see signs of disruption.
16.3 You are responsible for having current backups of the systems and data in scope before testing begins and for telling us about any systems that are fragile or business-critical.
16.4 Security testing and reviews give a view of your security at a point in time, using the methods and time agreed. We cannot guarantee that testing will find every vulnerability, or that your systems will be secure after the services.
17. Your cooperation
17.1 You must give us, on time, the access, accounts, information, documents, decisions and contacts that the scope says we need, and make sure your staff and suppliers cooperate with us.
17.2 If you do not, and this delays or prevents the services, we are not responsible for the delay. For business customers, we may charge for reasonable extra costs caused, and a testing slot missed because access was not provided is treated as a late cancellation, as set out on our refunds and cancellations page.
17.3 For managed services (endpoint protection, security monitoring, awareness training and phishing simulation), you must install or allow the agreed software, keep the device and user counts we bill against accurate, and tell your users where required by law or your own policies that phishing simulations may take place.
18. Reports and confidentiality
18.1 Each of us will keep the other's confidential information secret, use it only to perform or receive the services, and share it only with employees, contractors and advisers who need to know it and are bound by equivalent confidentiality duties. This does not apply to information that is public (other than through a breach), that the recipient already lawfully had, or that the law or a regulator requires to be disclosed.
18.2 Findings, vulnerabilities, credentials and reports relating to your systems are your confidential information. We will send reports securely and will not disclose your findings to anyone else without your permission, except as the law requires.
18.3 If you need a separate non-disclosure agreement before sharing information during scoping, we will sign a reasonable one.
18.4 These confidentiality duties continue for five years after the contract ends, and indefinitely for credentials and unremediated vulnerability details.
19. Intellectual property
19.1 You keep all rights in your data, systems and materials. You give us a licence to use them only as needed to provide the services.
19.2 We keep all rights in our methods, know-how, tools, scripts, templates and any material we owned before the contract or developed independently of it.
19.3 Once you have paid for them, we grant you a non-exclusive, perpetual, royalty-free licence to use, copy and share the reports and deliverables within your organisation and with your auditors, insurers, regulators and advisers, for your own internal purposes. You may share them with others (for example a customer) with our written agreement, which we will not unreasonably refuse.
20. Data protection
20.1 When we handle personal data to run our business (for example your contact, enquiry and billing details), we do so as a controller, as described in our privacy notice.
20.2 During some services we may process personal data on your behalf, such as data in logs, mailboxes, endpoints or systems we test or monitor. For those services we act as your processor and you remain the controller.
20.3 Before we process personal data as your processor, we will both sign a data processing agreement that meets Article 28 of the UK GDPR. It will set out the subject matter, duration, nature and purpose of the processing, the types of data and data subjects, and our obligations, including acting only on your documented instructions, confidentiality, security, sub-processors, assisting with data subject requests and breaches, and deleting or returning data at the end of the services.
20.4 You are responsible for having a lawful basis for the processing you instruct us to carry out, and for any notices to your staff or users.
21. Monthly plans and recurring services
21.1 Our Starter, Business and Complete monthly plans have a minimum term of 12 months from the start date in the scope. After the minimum term the plan continues month to month until either of us gives at least 30 days' written notice to end it.
21.2 If a business customer ends a monthly plan during the minimum term (other than under clause 8.3, 9.3, 9.4 or 10.2), the monthly fees for the rest of the minimum term remain payable.
21.3 Other recurring services (managed endpoint protection per device per month, 24/7 security monitoring, security awareness and phishing simulation per user per month, virtual CISO and incident response retainers) continue month to month from the start date in the scope, subject to any minimum term stated there, until either of us gives at least 30 days' written notice.
21.4 You may increase the number of devices or users at any time; the new fee applies from the next billing month. Decreases take effect from the next billing month after 30 days' notice.
21.5 Consumers have the cancellation rights in clause 22 and, where a minimum term would otherwise apply, may end the plan early by giving 30 days' notice if we have broken the contract or as otherwise allowed by law.
21.6 Monthly fees already paid for a month that has started are not refunded, unless you cancel under clause 22 or we have broken the contract.
22. Your right to cancel services (consumers)
22.1 If you are a consumer, you may cancel a services contract within 14 days after the day the contract is formed, without giving a reason. To cancel, email info@continental-data.co.uk or use our contact page, quoting your enquiry or order reference; you may use the model form on our refunds and cancellations page, but you do not have to.
22.2 We will not start services during the 14-day cancellation period unless you ask us to, by ticking the box on the enquiry form or by asking us in writing. If you ask us to start early and then cancel within the 14 days, you must pay for the services provided up to the time you tell us you are cancelling, in proportion to the full price.
22.3 If you asked us to start early and acknowledged that you would lose your right to cancel once the services are fully performed, you lose your right to cancel once we have fully performed them.
22.4 We will refund any amount due to you within 14 days after the day you tell us you are cancelling, to your original payment method and in the currency you paid.
23. Your legal rights about services (consumers)
23.1 If you are a consumer, the Consumer Rights Act 2015 says services must be carried out with reasonable care and skill, and as described where we have said something that you relied on.
23.2 If we do not do this, you can ask us to repeat or fix the service at no cost. If we cannot do that, or cannot do it within a reasonable time and without significant inconvenience to you, you are entitled to an appropriate price reduction, which may be up to the full price.
23.3 Nothing in these terms affects these rights. For more information, contact Citizens Advice.
24. Our liability
24.1 What we never limit. Nothing in these terms limits or excludes our liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot be limited or excluded by law.
24.2 Consumers. If you are a consumer, we are responsible for loss or damage you suffer that is a foreseeable result of our breaking these terms or failing to use reasonable care and skill. Loss is foreseeable if it is obvious it will happen or if we both knew it might happen when the contract was formed. We are not responsible for loss that is not foreseeable. We supply services to consumers for domestic and private use only; we are not liable to consumers for loss of profit, loss of business or business interruption. Nothing in these terms excludes or limits your statutory rights.
24.3 Business customers. Subject to clause 24.1, and to the extent this is reasonable under the Unfair Contract Terms Act 1977: (a) we are not liable, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for any loss of profit, revenue, business, goodwill, anticipated savings or data, or for any indirect or consequential loss; and (b) our total liability arising under or in connection with each contract is limited to the total fees paid by you under that contract in the 12 months before the event giving rise to the claim.
24.4 Clause 24.3(a) does not stop us being liable for the cost of restoring data that we lose or corrupt through our negligence during the services, within the cap in clause 24.3(b), where you held a current backup as required by clause 16.3.
24.5 Because testing cannot find every weakness (clause 16.4), we are not liable for a security incident caused by a vulnerability that was outside the scope or that we did not find despite using reasonable care and skill.
Last updated: 20 October 2026