Terms of service

Version 1.0, effective [to confirm: launch date]

These terms set out how Coffee Cyber supplies CrowdStrike Falcon endpoint protection to your business. Please read them carefully. By creating an account or placing an order, you agree to them on behalf of your business.

1. About us and these terms

1.1 Coffee Cyber is a trading name of Coffee Cup Solutions Ltd, a company registered in England and Wales with company number 08905462. Our VAT number is GB185644476. Our registered and trading address is Unit 3, Millars Brook, Wokingham, Berkshire, RG41 2AD. Our website is coffeecyber.com.

1.2 In these terms, "we", "us" and "our" mean Coffee Cup Solutions Ltd. "You" and "your" mean the business that signs up for the service.

1.3 These terms form a contract between you and us. The contract also includes:

• our Privacy Notice, which explains how we handle personal data as a controller;
• our Data Processing Agreement, which applies where we process personal data on your behalf;
• our Acceptable Use Policy; and
• the plan, add-ons and prices shown on our website and in your control panel at the time you order.

1.4 If there is a conflict between these documents, these terms take priority, except that the Data Processing Agreement takes priority on matters of data protection.

2. Business customers only

2.1 The service is for businesses only. It is not available to consumers. By signing up, you confirm that you are acting for the purposes of your trade, business or profession, and that you are a business established in the United Kingdom.

2.2 The person who signs up confirms that they have authority to bind the business to these terms.

2.3 Because you are a business, consumer protection rights (such as the statutory right to cancel within 14 days) do not apply to this contract.

3. Key words used in these terms

• Add-on means an optional extra module you can switch on in addition to your plan, as listed on our website.
• Control panel means our online customer portal at coffeecyber.com, where you manage your account, plan, add-ons, billing and support.
• CrowdStrike means CrowdStrike, Inc. and its group companies, who make and operate the Falcon platform.
• CrowdStrike Terms means CrowdStrike's own end user terms for the Falcon platform, which you accept when you sign up.
• Device means any computer, server, virtual machine or other endpoint on which the Falcon agent is installed.
• Falcon agent (also called the Falcon sensor) means the CrowdStrike software installed on your devices.
• Falcon console means the CrowdStrike web console set up for your business.
• Falcon platform means CrowdStrike's Falcon endpoint protection platform, including the agent, the console and CrowdStrike's cloud services.
• Fees means the charges for your plan and add-ons, calculated as described in section 9.
• Pax8 means Pax8 and its group companies, the distributor through which we buy CrowdStrike licences.
• Plan means the Defend, Defend Plus or Complete plan described in section 5.
• Service means the resale of Falcon platform licences and the related services we provide under these terms.

4. What the service is

4.1 We resell CrowdStrike Falcon endpoint protection and provide first-line support for it. We do this as a member of CrowdStrike's managed security service provider programme, buying licences through the distributor Pax8.

4.2 Each customer gets their own Falcon console. Your console is a separate customer environment (known as a "child" environment) under our CrowdStrike parent account. Your data in the Falcon platform is kept separate from other customers.

4.3 CrowdStrike makes and runs the Falcon platform. We do not control how the Falcon platform works, how CrowdStrike develops it, or CrowdStrike's own services.

5. Plans and add-ons

5.1 We currently offer three plans. Prices are per device per month, excluding VAT.

5.2 You can add the following add-ons to your plan:

• Identity Protection (charged per user);
• AI Agent Security, Vulnerability Management, Asset Discovery, Mobile and Data Protection (charged per device); and
• Next-Gen SIEM log retention (priced by quote).

5.3 The current prices for plans and add-ons are shown on our website and in your control panel. The detailed features of each plan and add-on are set by CrowdStrike and may change from time to time as CrowdStrike updates the Falcon platform.

5.4 The Falcon Complete service is provided by CrowdStrike, not by us. It is delivered as described in CrowdStrike's service description for Falcon Complete. CrowdStrike requires us to hold a minimum monthly commitment for Falcon Complete across all of our customers combined. That commitment is ours, not yours: you are not subject to any minimum number of devices or minimum spend on the Complete plan.

6. What we do

6.1 As part of the service, we will:

• process your orders and arrange your CrowdStrike licences through Pax8;
• set up your Falcon console;
• help you roll out the Falcon agent to your devices, including guidance on removing your old antivirus software;
• provide first-line support, through the control panel, for questions about the Falcon agent, the Falcon console, your plan and your billing; and
• bill you for the service.

6.2 We will provide the service with reasonable skill and care.

6.3 Where a support request needs CrowdStrike's input (for example a fault in the Falcon platform), we will raise it with CrowdStrike or Pax8 for you and keep you updated through the control panel. We cannot control how quickly CrowdStrike or Pax8 respond.

7. What we do not do

7.1 It is important that you understand the limits of the service. We do not:

• monitor, investigate or respond to security alerts or detections raised in your Falcon console;
• provide general IT support for your devices, network, software or users;
• carry out incident response, recovery, clean-up or rebuild work after a security incident; or
• give any response-time commitment for security alerts.

7.2 Who deals with security alerts depends on your plan:

• Defend and Defend Plus: you, or your IT provider, are responsible for watching your Falcon console and investigating and responding to alerts. On Defend Plus, CrowdStrike Falcon OverWatch hunts for threats and may notify you of what it finds, but acting on those findings remains your responsibility.
• Complete: CrowdStrike's Falcon Complete team monitors, investigates and responds to detections, as described in CrowdStrike's service description. We do not perform or supervise that work.

7.3 If you need help beyond the service, such as incident recovery, you will need to arrange it separately with your IT provider or another specialist.

8. Support

8.1 All support is provided through the support section of your control panel. We do not offer telephone support.

8.2 Our support covers the Falcon agent, the Falcon console, your plan, add-ons and billing. It does not cover the matters listed in section 7.

8.3 We aim to respond to support requests within a reasonable time during normal UK business hours. [to confirm: whether to state target response times for support tickets]

8.4 Please give us accurate and complete information when you raise a ticket, including any logs or screenshots we reasonably ask for.

9. How we work out your bill

9.1 We bill monthly in arrears. That means each invoice covers the calendar month that has just ended.

9.2 For each calendar month, we charge:

• your plan price for each device that ran the Falcon agent and reported in to the Falcon platform at any time during that month;
• the price of each per-device add-on you had switched on, for the same number of devices; and
• the price of Identity Protection, if switched on, for each user it covers.

9.3 A device counts once in a month if it reported in at least once that month, however long it was active. A device that reported in during a month counts for that month even if you uninstalled the agent before the month ended.

9.4 We work out device counts from daily records of the devices reporting in to your Falcon console. We keep these records so you can check your count. If you think a count is wrong, please raise it through the control panel within 30 days of the invoice date and we will look into it with you.

9.5 If you upgrade your plan during a month, the higher plan applies to the whole of that month. If you downgrade, the lower plan applies from the 1st of the following month.

9.6 If you switch on an add-on during a month, it is charged for the whole of that month. If you switch it off, it stops being charged from the 1st of the following month.

9.7 Next-Gen SIEM log retention, and anything else we agree to supply by quote, will be charged as set out in the quote you accept.

10. Invoices and payment

10.1 We issue invoices at the start of each month for the previous month. Invoices are in pounds sterling (GBP) and VAT is added at the applicable rate.

10.2 We collect payment automatically by Bacs Direct Debit or by card. Payments are handled by our payment processor, Stripe. You must set up a valid payment method in your control panel and keep it up to date.

10.3 We do not take any payment when you sign up. Your first payment is collected after your first invoice.

10.4 If a payment fails, we will tell you and try to collect it again. If a payment remains unpaid, we may:

• charge interest on the overdue amount at 4% a year above the Bank of England base rate, from the due date until paid, or the statutory rate under the Late Payment of Commercial Debts (Interest) Act 1998 if we choose; and
• suspend the service under section 15 after giving you notice.

10.5 You must pay all fees in full, without any deduction or set-off, unless the law requires otherwise. If you dispute part of an invoice in good faith, you must still pay the undisputed part.

11. Price changes

11.1 We may change our prices. We will give you at least 30 days' notice before any price increase takes effect, by email or through the control panel.

11.2 If you do not want to accept a price increase, you can cancel before it takes effect, as described in section 14.

12. No minimum term

12.1 The service runs on a rolling monthly basis. There is no minimum term, no minimum number of devices and no annual contract.

12.2 The contract starts when you create your account and accept these terms, and continues until it is ended under section 14 or section 16.

13. Your responsibilities

13.1 You must:

• give us accurate account, company and billing details and keep them up to date;
• only install the Falcon agent on devices that you own or are authorised to manage;
• install, configure and keep the Falcon agent running on your devices, following our guidance and CrowdStrike's documentation;
• remove or disable any conflicting security software when advised;
• comply with the CrowdStrike Terms and our Acceptable Use Policy;
• keep access to your control panel and Falcon console secure, and tell us promptly if you think someone has gained access without permission;
• make sure you have a lawful basis, and have given any notices needed, to monitor your devices and users with the Falcon platform; and
• take responsibility for the people you give access to, including your IT provider (see section 13.3).

13.2 You remain responsible for your own IT security. In particular, unless you are on the Complete plan and CrowdStrike is responding as described in its service description, you are responsible for:

• monitoring your Falcon console and acting on alerts;
• keeping good backups and testing that you can restore them;
• keeping your software and systems patched;
• using multi-factor authentication; and
• having your own plan for responding to and recovering from a security incident.

Even on the Complete plan, backups, patching, multi-factor authentication and recovery remain your responsibility.

13.3 You may invite your IT provider or other third parties to your control panel or Falcon console. If you do, they act on your behalf, and you are responsible for what they do as if you had done it yourself.

14. Cancelling the service

14.1 You can cancel at any time from your control panel.

14.2 When you cancel, the service continues until the end of the current calendar month. We will send a final invoice for that month in the usual way.

14.3 Before we close your Falcon console, we will give you instructions for uninstalling the Falcon agent. You must uninstall the agent from all your devices. Once your console is closed, your devices will no longer be protected and you will lose access to the data held in your console.

14.4 If you need to keep any data from your Falcon console, such as detection history, you must export it before the console is closed.

15. Suspending the service

15.1 We may suspend all or part of the service if:

• you do not pay an invoice when due and have not paid within 14 days of our notice telling you the payment is overdue;
• you seriously or repeatedly breach these terms or our Acceptable Use Policy;
• CrowdStrike or Pax8 requires us to suspend your access; or
• we reasonably believe suspension is needed to protect the security of our platform, the Falcon platform or other customers.

15.2 Where we can, we will give you notice and a chance to put things right before suspending. In urgent cases, such as a security risk, we may suspend straight away and tell you as soon as we can.

15.3 While suspended, your devices may not be protected. Fees continue to build up during a suspension caused by your breach or non-payment. We will lift the suspension as soon as the reason for it has been resolved.

16. Ending the contract

16.1 We may end the contract by giving you at least 30 days' notice for any reason.

16.2 Either of us may end the contract straight away by written notice if the other:

• commits a serious breach of these terms and, if it can be put right, fails to do so within 14 days of being asked to; or
• becomes insolvent, enters administration or liquidation, makes an arrangement with its creditors, or stops trading.

16.3 We may also end the contract, or stop offering a plan or add-on, if CrowdStrike or Pax8 stops supplying it to us, or our agreement with either of them ends. We will give you as much notice as we reasonably can.

16.4 When the contract ends for any reason:

• you must pay all fees due up to the end date;
• section 14.3 and 14.4 apply to uninstalling the agent and closing your console; and
• any terms that are meant to continue (including those about payment, liability, confidentiality and data protection) will continue.

17. CrowdStrike's terms

17.1 Your use of the Falcon platform is also governed by the CrowdStrike Terms, which you accept when you sign up. You must comply with them.

17.2 CrowdStrike, not us, is responsible for the Falcon platform itself, its performance and any commitments CrowdStrike makes in the CrowdStrike Terms or its service descriptions.

17.3 If CrowdStrike changes its terms in a way that affects the service, we will tell you where we reasonably can.

18. Intellectual property

18.1 CrowdStrike owns all rights in the Falcon platform. You get the right to use it only as set out in the CrowdStrike Terms.

18.2 We own, or are licensed to use, all rights in our control panel, our website and our own materials. We give you a non-exclusive, non-transferable right to use the control panel for your internal business purposes while the contract is in force.

18.3 You keep all rights in your own data. You give us permission to use it only as needed to provide the service and as set out in our Privacy Notice and Data Processing Agreement.

19. Data protection

19.1 We are the controller of the personal data we collect to run your account and the control panel. Our Privacy Notice explains how we use it.

19.2 Where we process personal data on your behalf, such as device and telemetry data from the Falcon platform, we do so as your processor under our Data Processing Agreement, which forms part of these terms.

19.3 CrowdStrike processes endpoint telemetry as part of the Falcon platform under its own terms and data protection terms.

20. Confidentiality

20.1 Each of us will keep the other's confidential information secret and use it only for the purposes of this contract. Confidential information includes information about your systems, security set-up and detections, and our pricing and business arrangements.

20.2 This does not apply to information that is already public (other than through a breach of this section), that the receiving party already lawfully had, or that it must disclose by law or to a regulator. Either of us may share confidential information with our professional advisers, and we may share it with CrowdStrike, Pax8 and our sub-processors where needed to provide the service.

21. No security product can stop every attack

21.1 The Falcon platform is designed to help detect and prevent threats. However, no security product or service can guarantee to detect or stop every attack. We do not promise that the service will prevent every security incident, data loss or disruption.

21.2 We do not promise that the service or the Falcon platform will be uninterrupted or free from errors. Except as set out in these terms, all other warranties, conditions and terms implied by law are excluded to the extent the law allows.

22. Our liability to you

22.1 Nothing in these terms limits or excludes either party's liability for:

• death or personal injury caused by negligence;
• fraud or fraudulent misrepresentation; or
• anything else that cannot be limited or excluded by law.

22.2 Nothing in these terms limits your obligation to pay the fees.

22.3 Subject to section 22.1, we will not be liable to you, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for any:

• loss of profits, sales, business or revenue;
• loss of anticipated savings;
• loss of goodwill or reputation;
• loss or corruption of data or software, or the cost of restoring it;
• business interruption; or
• indirect or consequential loss.

22.4 Subject to section 22.1, our total liability to you for all claims arising in any 12-month period under or in connection with this contract is limited to the total fees you paid to us in that 12-month period. [to confirm: liability cap]

22.5 We are not liable for any loss caused by the Falcon platform itself, by CrowdStrike (including the Falcon OverWatch and Falcon Complete services), by Pax8, or by anything you, your users or your IT provider do or fail to do. Your remedies for the Falcon platform and CrowdStrike's services are those set out in the CrowdStrike Terms.

22.6 We are not liable for any loss caused by your failure to meet your responsibilities in section 13.

23. Your indemnity

23.1 You will indemnify us against any losses, costs and claims we suffer as a result of you, your users or your IT provider using the service against systems you do not own or have authority over, or otherwise breaching our Acceptable Use Policy or the CrowdStrike Terms. [to confirm: whether to include an indemnity]

24. Events outside our control

24.1 We are not liable for any delay or failure to perform caused by events outside our reasonable control. These include failures or outages of the Falcon platform, CrowdStrike, Pax8, Stripe or internet and hosting providers, as well as cyber attacks on third parties, power failures, fire, flood, pandemic, war, strikes and government action.

24.2 If such an event affects the service, we will tell you as soon as we can and do what we reasonably can to reduce its effect.

25. Changes to these terms

25.1 We may change these terms from time to time. We will give you at least 30 days' notice of any change that materially affects you, by email or through the control panel. If you do not agree to the change, you may cancel before it takes effect.

25.2 We may make changes needed for legal, regulatory or security reasons, or because CrowdStrike or Pax8 requires them, on shorter notice where that is reasonable.

25.3 The version in force and its effective date are shown at the top of this page.

26. Notices and how to contact us

26.1 For day-to-day matters, including support, billing and cancellation, please use the support section of your control panel.

26.2 Formal legal notices to us must be sent in writing by post to: Coffee Cup Solutions Ltd, Unit 3, Millars Brook, Wokingham, Berkshire, RG41 2AD.

26.3 We will send notices to you by email to the main account contact in your control panel, through the control panel, or by post to your registered office. A notice by email or through the control panel is treated as received on the next business day after it is sent.

27. General

27.1 Entire agreement. This contract (including the documents listed in section 1.3) is the whole agreement between us about the service. Neither of us has relied on anything said or written that is not set out in it.

27.2 Transfer. You may not transfer your rights or obligations under this contract without our written agreement. We may transfer our rights and obligations to another business, for example if we sell all or part of our business, and we will tell you if we do.

27.3 Subcontractors. We may use subcontractors and suppliers to provide the service. We remain responsible for our obligations under these terms.

27.4 Waiver. If we do not enforce a right straight away, we can still enforce it later.

27.5 Severability. If a court finds any part of this contract invalid, the rest will still apply.

27.6 Third parties. No one other than you and us has any right to enforce this contract under the Contracts (Rights of Third Parties) Act 1999.

27.7 Relationship. Nothing in this contract creates a partnership, joint venture or agency between us.

28. Governing law and disputes

28.1 This contract, and any dispute or claim arising out of or in connection with it (including non-contractual disputes or claims), is governed by the law of England and Wales.

28.2 If a dispute arises, please raise it with us first through the control panel. We will both try in good faith to resolve it within 30 days.

28.3 The courts of England and Wales have exclusive jurisdiction to settle any dispute or claim that we cannot resolve between us.