Standard web hosting terms and conditions

X30 Group Limited, trading as X30 Marketing. Last updated 8 November 2026.

IMPORTANT: Please read these terms carefully before using our hosting services. By submitting an order or continuing to use our hosting services, you agree to be bound by these terms.

1. Definitions and Interpretation

In these Terms the following expressions have the meanings set out below:

“Agreement” means these Terms together with the Order Form and any Schedule or addendum agreed in writing by the parties.
“Authorised Users” means the employees, agents and contractors of the Customer permitted to use the Services.
“Business Day” means any day other than a Saturday, Sunday or public holiday in England and Wales.
“Business Hours” means 09:00 to 17:00 on a Business Day.
“Charges” means the fees payable by the Customer as set out in the Order Form or as otherwise agreed in writing.
“Company” means X30 Group Limited, trading as X30 Marketing, a company registered in England and Wales (registration number 9629184) whose registered office is at 121 Walsall Road, Lichfield, WS13 8AD.
“Confidential Information” means any information disclosed by one party to the other that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure.
“Customer” means the business or individual named in the Order Form as the recipient of the Services, being a person or entity acting in the course of a business or trade.
“Data Processing Agreement” or “DPA” means a data processing agreement between the parties governing the processing of Personal Data by the Company on behalf of the Customer in accordance with Article 28 UK GDPR.
“Data Protection Legislation” means the UK General Data Protection Regulation (UK GDPR) as retained in UK law by the European Union (Withdrawal) Act 2018, the Data Protection Act 2018, and any subordinate legislation or guidance issued by the Information Commissioner’s Office, each as amended or replaced from time to time.
“Effective Date” means the date stated in the Order Form or, if no date is stated, the date on which the Company begins providing the Services.
“Force Majeure Event” means any event, circumstance or cause beyond a party’s reasonable control, whether or not it was foreseeable, including: (a) failures, interruptions or degradation of the internet, telecommunications, DNS, CDN, power, cloud, data-centre or network services, including those supplied or operated by third parties; (b) cyber-attacks and other malicious activity, including denial-of-service attacks, hacking, ransomware, viruses and other malicious software, and previously unknown (“zero-day”) vulnerabilities; (c) failure, delay or insolvency of any third-party supplier, subcontractor or infrastructure provider; (d) industrial disputes, whether or not they involve the affected party’s own workforce; (e) epidemic, pandemic or public-health emergency; (f) changes in law or regulation, or acts of any government, court or regulator; (g) fire, flood, storm, earthquake, explosion, extreme weather or other natural disaster, or acts of God; and (h) war, terrorism, riot, civil unrest, sabotage or malicious damage.
“Intellectual Property Rights” means patents, trademarks, service marks, registered designs, copyrights, database rights, know-how, trade secrets and all other intellectual property rights, whether registered or unregistered, anywhere in the world.
“Minimum Term” means the initial period of 12 months from the Effective Date, unless otherwise stated in the Order Form.
“Order Form” means the order confirmation, quotation or service agreement issued by the Company and accepted by the Customer.
“Personal Data” has the meaning given to it in the Data Protection Legislation.
“Prohibited Content” means: (a) material that breaches any applicable law or regulation; (b) material that infringes any third party Intellectual Property Rights; (c) pornographic, obscene or indecent material; (d) material that is likely to be defamatory, abusive, threatening or harassing; or (e) unsolicited bulk communications (spam).
“Services” means the web hosting and related services described in Clause 4 and the Order Form.
“Sub-Processor List” means the list of third-party sub-processors used by the Company in the provision of the Services, available to the Customer on request from support@x30marketing.co.uk and updated from time to time.
“Website or Application” means the Customer’s website, web application, SaaS platform or other online service hosted by the Company under this Agreement. References to “Website” throughout these Terms shall be construed accordingly.

In these Terms, unless the context otherwise requires:

References to a statute or statutory provision include that provision as amended, consolidated or re-enacted from time to time.
The singular includes the plural and vice versa.
Headings are for convenience only and do not affect interpretation.
Writing includes communication by email where the context permits.

2. Formation of Agreement

2.1 These Terms apply to all Services provided by the Company to the Customer and supersede any previous terms between the parties relating to the same subject matter.

2.2 The Agreement is formed when the Company issues written acceptance of an Order Form submitted by the Customer, or when the Company begins providing the Services, whichever is earlier.

2.3 No variation to these Terms is effective unless agreed in writing and signed by an authorised representative of the Company.

2.4 Order of Precedence. If there is any conflict between the documents forming the Agreement, the Order Form will take precedence, followed by any Schedule or Data Processing Agreement, followed by these Terms. In relation to Personal Data, the Data Processing Agreement will take precedence over these Terms and any Schedule.

2.5 These Terms apply to business customers only. The Customer confirms that it is acting in the course of a business or trade. The Customer acknowledges that the consumer protection provisions of the Consumer Rights Act 2015 do not apply to this Agreement.

3. Set-up and Transition

3.1 At the Customer’s request, the Company will use reasonable endeavours to assist with the migration of the Website or Application from a third-party host or development environment.

3.2 The Company will host the Website or Application on or before the implementation date set out in the Order Form, provided the Customer supplies a complete copy of the Website or Application at least five Business Days in advance.

3.3 Within five Business Days of the Website or Application going live, the Customer will carry out comprehensive testing and notify the Company of any issues that are apparent on reasonable inspection. Failure to notify within this period will be deemed acceptance of the hosting environment in respect of matters reasonably discoverable by such testing. This deemed acceptance does not apply to latent defects, security vulnerabilities, intermittent faults or issues that could not reasonably have been discovered during standard testing.

4. Services

4.1 From the date the hosting goes live, the Company will host the Website or Application in accordance with the specifications set out in the Order Form and will make available the resources allocated to the Customer’s account.

4.2 The Company may suspend the Services temporarily to carry out scheduled or emergency maintenance. The Company will use reasonable endeavours to give advance notice of planned maintenance and to minimise disruption.

4.3 The Company may make available to the Customer the ability to update or amend the Website or Application through agreed content management tools or by written request.

4.4 Email Hosting. Subject to the Order Form, the Company will provide basic email hosting services using the server-based email platform (cPanel or equivalent) included with the hosting environment. The following apply:

The number of mailboxes and storage allocation per mailbox will be as set out in the Order Form or as notified by the Company from time to time.
If a mailbox exceeds its allocated storage limit, incoming emails may be rejected or lost. The Company will endeavour to notify the Customer when usage approaches the storage limit but accepts no liability for emails lost as a result of storage limits being exceeded, except where such loss is directly caused by the Company’s own breach or negligence.
The Customer is responsible for ensuring that its users manage mailbox storage and archive or delete emails as necessary.
The Company does not guarantee delivery of emails to or from the Customer’s mailboxes. Email delivery is subject to decisions made by receiving mail servers, spam filtering systems and internet infrastructure outside the Company’s control.
Server-based email hosting (cPanel mailboxes) is a basic service and is not equivalent to a dedicated business email platform such as Google Workspace or Microsoft 365. Customers requiring advanced features should consider a dedicated business email platform. The Company can assist with migration to such a platform on request.
Subject to Clause 7.6 and Clause 15, and unless continued access presents a security or legal risk, following termination of this Agreement mailboxes may remain accessible for up to 10 Business Days solely to allow the Customer to export or migrate email data. After that period, or earlier where the Services were terminated for serious misuse or where continued operation presents a security or legal risk, all mailboxes and email data will be permanently deleted. The Customer is responsible for exporting or backing up any emails it wishes to retain during this window.

4.5 Transactional Email. Where expressly included in the Order Form, the Company will configure a suitable transactional email solution (such as an SMTP service or third-party transactional email provider) and will set up SPF, DKIM and DMARC DNS records to support deliverability at the time of configuration. The Company remains responsible for errors introduced during that initial configuration. The following apply:

The Customer is responsible for maintaining the DNS records configured by the Company. If the Customer or its domain registrar subsequently modifies or removes SPF, DKIM or DMARC records, the Company accepts no liability for any resulting deliverability issues.
Where a third-party transactional email provider is used, that provider’s own terms of service, sending limits and pricing apply. Any costs associated with the third-party provider are the Customer’s responsibility unless expressly included in the Order Form.
The Company cannot guarantee that transactional emails will be delivered to recipients’ inboxes. Delivery is subject to the policies of receiving mail servers, spam filters and the sender reputation of the domain.
Ongoing transactional email deliverability monitoring, management or optimisation is not included in the standard hosting service and can be separately quoted if required.

4.6 Technical Support. The Company will provide technical support in relation to the hosting environment in accordance with Clause 5A of these Terms.

4.7 Backups. Where a website maintenance package is included in the Order Form, the Company will maintain daily backups retained for seven days and weekly backups retained for fourteen days. Where no maintenance package is in place, the Customer is responsible for maintaining its own backups. The Company strongly recommends that all Customers maintain independent backups regardless of any backup service included in their package. The Company will not arrange off-site archival storage of the Website or Application unless this is expressly agreed in writing.

5. Acceptable Use

5.1 The Customer must not use the Website or Application, or the Services, to host, transmit, store or process any Prohibited Content.

5.2 The Customer must not use the Services in any way that:

breaches any applicable law or regulation;
infringes any third party Intellectual Property Rights or other rights;
places excessive or unreasonable load on the Company’s infrastructure beyond the resources allocated in the Order Form;
may bring the Company into disrepute or expose it to legal liability;
involves the use of the hosting environment for cryptocurrency mining or any other computationally intensive process not related to the operation of the Customer’s Website or Application;
involves using the hosting server as a mail relay, or sending bulk, unsolicited or marketing email from the hosting environment;
involves running automated bots, scrapers or crawlers that place sustained or excessive load on the server or on third-party websites;
involves storing, distributing or facilitating access to illegal content of any kind;
involves attempting to gain unauthorised access to any other system, server or network;
involves running processes, scripts or scheduled tasks (including CRON jobs) that have not been approved by the Company where they materially affect server performance.

5.3 The Services are provided to the Customer only. The Customer may not resell or sub-licence the Services to any third party without the prior written consent of the Company.

5.4 The Customer is responsible for keeping all account passwords confidential and must notify the Company immediately if it suspects any unauthorised access to its account.

5.5 The Company reserves the right to remove content from the Website or Application where it reasonably suspects that content constitutes Prohibited Content. The Company will attempt to notify the Customer before doing so where this is practicable.

5.6 Fair Use and Resource Limits. If the Customer’s resource usage consistently exceeds the limits set out in the Order Form, or materially impacts the performance of other customers on shared infrastructure, the Company will notify the Customer. The parties will seek to agree an appropriate upgrade or adjustment within seven days. If no agreement is reached, or if usage continues to cause material impact to other customers, the Company may suspend the Services or require the Customer to upgrade to an appropriate hosting plan.

5.7 Consequences of Breach. Any material breach, or repeated breach, of this Clause 5 will be treated as a material breach of this Agreement. Where the Company reasonably suspects a breach of this Clause, it reserves the right to suspend the Services immediately and without prior notice pending investigation. The Company will notify the Customer of the suspension as soon as reasonably practicable and will seek to resolve the matter promptly. Where a breach is confirmed, the Company may terminate this Agreement in accordance with Clause 15.

5.8 The Customer will indemnify and hold harmless the Company against all claims, damages, losses and expenses (including reasonable legal costs) arising from any breach by the Customer of this Clause 5. The Customer’s aggregate liability under this Clause 5.8 will not exceed the liability cap calculated under Clause 14.3, except in the case of fraud, wilful misconduct or deliberate unlawful activity.

5A. Support Services

5A.1 Standard Support

The Company will provide technical support in relation to the hosting environment during Business Hours by email to support@x30marketing.co.uk or by telephone. Standard support covers:

Faults or failures within the hosting environment, server infrastructure or network connectivity that are within the Company’s control.
Basic email hosting configuration and mailbox issues.
DNS configuration assistance for domains hosted or managed by the Company.
Assistance with restoring the Website or Application from backup where a maintenance package is in place.
General guidance on accessing and using the hosting control panel (cPanel or equivalent).

5A.2 Support Priority Levels

Support requests will be categorised and responded to as follows:

Critical — the Website or Application is completely unavailable, materially compromised, or unable to process transactions (for ecommerce sites). Target acknowledgement: within 2 Business Hours. Target resolution: best endeavours, as soon as reasonably practicable.
High — significant functionality is impaired, or a fault is materially affecting the Customer’s business operations. Target acknowledgement: within 4 Business Hours. Target resolution: within 2 Business Days.
Normal — minor faults, configuration questions or non-urgent requests. Target acknowledgement: within 1 Business Day. Target resolution: within 5 Business Days.

Response times are targets only and are not guaranteed. They represent acknowledgement and initial assessment, not guaranteed resolution.

5A.3 Out-of-Hours Support

Out-of-hours support is not included as part of the standard hosting service. Customers who require out-of-hours emergency support may request a named support arrangement. Where such an arrangement is agreed in writing and reflected in the Order Form, the Company will use reasonable endeavours to respond to critical incidents outside Business Hours. Additional charges will apply as set out in the Order Form. Where no out-of-hours arrangement is in place, the Company will address critical incidents raised outside Business Hours at the start of the next Business Day.

5A.4 Maintenance Package — WordPress and Plugin Updates

WordPress core updates, theme updates and plugin updates are not included in the standard hosting service and are provided only where the Customer has a website maintenance package in place as set out in the Order Form. Where a maintenance package is in place, the Company will:

Apply WordPress core updates on a regular basis, typically monthly or following the release of security-critical updates.
Update active plugins and themes to current stable versions, subject to compatibility testing.
Perform a basic post-update check to confirm the Website or Application remains functional following updates.
Restore from backup in the event that an update causes a material fault, where a backup exists.

The Company accepts no liability for faults caused by WordPress core, plugin or theme updates where the Customer has applied updates independently without a maintenance package in place. The Company strongly recommends that all Customers with a WordPress installation take out a maintenance package, as running outdated software is one of the most common causes of website security vulnerabilities.

5A.5 What Support Does Not Cover

The following are outside the scope of standard support and will be chargeable at the Company’s then-current rates, or separately quoted:

Faults caused by changes made to the Website or Application by the Customer or a third party.
Faults arising from the Customer’s own code, application logic, plugins or themes.
Support for software not installed or configured by the Company.
Recovery of content, data or emails deleted by the Customer or its users.
Training on WordPress, CMS platforms or other software.
New development work, design changes or feature additions.
Issues arising from the Customer’s failure to maintain a maintenance package, including security incidents caused by outdated software.
Support for third-party services integrated with the Website or Application unless the Company configured and manages the integration under a separate agreement.
Device or email client configuration on the Customer’s hardware.

5A.6 Raising a Support Request

Support requests should be submitted by email to support@x30marketing.co.uk, including as much detail as possible about the issue, steps to reproduce it and any error messages. For critical incidents, the Customer may also telephone the Company during Business Hours to escalate the request. The Company may request reasonable access to the Customer’s hosting account, CMS or related systems to investigate and resolve a request. Delays caused by the Customer’s failure to provide timely access may extend resolution times.

5B. Subcontractors and Third-Party Infrastructure

5B.1 The Company may engage subcontractors or third-party infrastructure providers in the delivery of the Services, including hosting infrastructure providers, server software licensors, DNS and CDN services, control panel software providers and transactional email platforms. The Company maintains a Sub-Processor List, available to the Customer on request, identifying the principal third-party providers used. The Company will give the Customer not less than 30 days’ written notice of any material addition to or replacement of sub-processors, during which time the Customer may raise reasonable objections on data-protection grounds. Continued use of the Services after that period constitutes acceptance of the change. Any subcontracting involving the processing of Personal Data will remain subject to Clauses 5B and 9.

5B.2 The Company will exercise reasonable care in the selection and configuration of third-party providers and will remain responsible for: (a) selecting reputable providers appropriate to the Services; (b) correctly configuring and integrating those providers; (c) its own incident response and customer communication obligations; and (d) failures caused by the Company’s own acts or omissions. The Company will not be liable for failures, interruptions or degradation caused by a third-party provider acting independently and outside the Company’s reasonable control, provided the Company has fulfilled its obligations under this Clause 5B.2.

5B.3 The Company will use reasonable endeavours to notify the Customer promptly of any known third-party service failure that is materially affecting the Services.

6. Customer Responsibilities

6.1 The Customer will:

provide the Company with all reasonable co-operation, access and information required to deliver the Services;
ensure that all content uploaded to or hosted on the Website or Application complies with applicable law and does not infringe any third party rights;
obtain and maintain all licences, consents and permissions necessary for the Customer’s use of the Services;
be solely responsible for the accuracy, legality and appropriateness of all Website or Application content.

6.2 The Customer acknowledges that the Company does not review or moderate the content of the Website or Application and is not responsible for the accuracy, legality or appropriateness of that content.

7. Charges and Payment

7.1 The Customer will pay the Charges in accordance with the Order Form. Unless otherwise stated, hosting Charges are invoiced monthly or annually in advance.

7.2 All invoices are due for payment within 30 days of the invoice date.

7.3 All Charges are exclusive of VAT, which will be added at the applicable rate.

7.4 Payment may be made by bank transfer, direct debit, or debit or credit card, using the payment details notified by the Company from time to time.

7.5 If any invoice is not paid in full by the due date, the Company may charge interest and claim statutory compensation and recovery costs under the Late Payment of Commercial Debts (Interest) Act 1998 (as amended), and may suspend the Services in accordance with Clause 15.1.

7.6 Retention of Files Pending Payment. The Company reserves the right to withhold delivery of Website or Application files, databases, configuration files and access credentials while any hosting invoices remain outstanding and unpaid. This right of retention applies only to outstanding hosting invoices and not to unrelated debts. For the avoidance of doubt: (a) the Company will not withhold Personal Data in a manner that prevents the Customer from meeting its legal obligations under Data Protection Legislation; (b) the Company will not withhold customer-owned domain names where transfer is legally required; and (c) the Company will not withhold information required by law to be provided. Release of files and credentials is conditional on payment of all outstanding hosting invoices. Any additional work required to assist with migration or to supply configuration information (including CRON job details, server configuration, DNS records or other technical migration data) will be charged at the Company’s then-current standard hourly rate, quoted at the time of request.

7.7 Price Increases. The Company may increase its Charges by giving the Customer not less than 30 days’ written notice. Where an annual fee has already been paid in full, the new rate will take effect from the next renewal date. The Company will endeavour to issue renewal reminders not less than 45 days before the end of the Minimum Term. If the Customer does not wish to accept a price increase, it may give written notice of termination before the new rate takes effect, in which case the Company will provide the Customer’s Website or Application files within 10 Business Days of termination, subject to all outstanding hosting invoices being settled in full in accordance with Clause 7.6.

8. Intellectual Property

8.1 The Customer retains all Intellectual Property Rights in the Website or Application content and materials it supplies to the Company.

8.2 The Customer grants the Company a non-exclusive licence to host, copy and transmit the Website or Application content solely to the extent necessary to provide the Services.

8.3 Any software, tools, scripts or infrastructure provided or developed by the Company in connection with the Services remain the property of the Company unless expressly agreed otherwise in writing.

8.4 The Customer warrants that it has full right and authority to grant the licence in Clause 8.2 and that the Website or Application content does not infringe any third party Intellectual Property Rights.

9. Data Protection and Privacy

9.1 Both parties will comply with all applicable Data Protection Legislation in connection with this Agreement.

9.2 For the purposes of the Data Protection Legislation, the parties acknowledge that:

the Customer is the Data Controller in respect of any Personal Data contained in or processed through the Website or Application;
the Company acts as a Data Processor in respect of any Personal Data that it processes on the Customer’s behalf in the course of providing the Services.

9.3 Article 28 Processor Obligations. As a Data Processor, the Company will:

process Personal Data only on the documented instructions of the Customer and only to the extent necessary to provide the Services, unless otherwise required by applicable law, in which case the Company will inform the Customer of that legal requirement before processing (unless prohibited by law from doing so);
if it considers that any instruction from the Customer infringes Data Protection Legislation, notify the Customer promptly;
implement and maintain appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, having regard to the state of the art and the nature of the data;
not transfer Personal Data outside the United Kingdom except where appropriate safeguards are in place as required by Data Protection Legislation, such as standard contractual clauses or adequacy decisions, and where such transfer is necessary for the delivery of the Services. The Company will maintain records of such transfers and the safeguards applicable to them;
promptly notify the Customer if it becomes aware of a Personal Data breach affecting the Customer’s data, and provide reasonable assistance to the Customer in meeting its notification obligations to the ICO and to data subjects;
assist the Customer in responding to data subject requests (including requests for access, rectification, erasure, restriction and portability) to the extent reasonably possible given the nature of the processing;
assist the Customer with its obligations relating to data protection impact assessments and prior consultation with supervisory authorities where required;
on request, make available all information necessary to demonstrate compliance with this Clause 9 and cooperate with any audit or inspection reasonably requested by the Customer, subject to reasonable notice and confidentiality obligations;
not engage any sub-processor to process the Customer’s Personal Data other than those identified on the Sub-Processor List, and ensure that any sub-processor is subject to equivalent data protection obligations by written contract;
ensure that all persons authorised to process Personal Data on behalf of the Company are subject to an appropriate duty of confidentiality;
on termination or expiry of this Agreement, securely delete or return all Personal Data processed on the Customer’s behalf, unless retention is required by law, and certify in writing that it has done so.

9.4 Processing Details. The processing details required by Article 28 UK GDPR — including the subject matter and duration of processing, the nature and purpose of processing, the types of Personal Data and the categories of data subjects — shall be set out in the Order Form, a Schedule to these Terms or a separate Data Processing Agreement. Where the Company processes Personal Data on behalf of the Customer, those provisions automatically form part of this Agreement and are mandatory. The Order Form shall also record the rights and obligations of the Customer as Data Controller. The Company will provide a Data Processing Agreement on request and will not rely on the absence of a formal DPA as a reason to depart from its obligations under this Clause 9.

9.5 The Customer warrants that it has a valid lawful basis for processing any Personal Data in connection with the Website or Application and that it has provided all necessary privacy notices to data subjects in accordance with Data Protection Legislation.

9.6 The Customer gives general written authorisation for the Company to use the sub-processors listed on the Sub-Processor List. The Company will notify the Customer of any material additions or replacements to the Sub-Processor List not less than 30 days in advance, giving the Customer a reasonable opportunity to object on data-protection grounds. Where the Customer has reasonable data-protection grounds for objection and the parties cannot agree an alternative solution, either party may terminate this Agreement on reasonable notice.

9.7 The Company processes certain personal data of the Customer’s personnel for account administration purposes in its capacity as a Data Controller. The Company’s privacy notice, available on its website, sets out how that data is handled.

10. Confidentiality

10.1 Each party will keep the other party’s Confidential Information confidential and will not disclose it to any third party without prior written consent, except as permitted by Clause 10.2.

10.2 Either party may disclose Confidential Information to its employees, professional advisers, sub-contractors or regulatory authorities to the extent reasonably necessary for the purposes of this Agreement, provided that the recipient is subject to equivalent obligations of confidentiality.

10.3 The obligations in this Clause 10 do not apply to information that: (a) is or becomes publicly known other than through a breach of this Agreement; (b) was already known to the receiving party before disclosure; or (c) is required to be disclosed by law or a court of competent jurisdiction.

10.4 The obligations of confidentiality in this Clause 10 will survive termination of this Agreement for a period of five years.

11. Security, Privacy and Resilience

11.1 The Company will implement and maintain commercially reasonable technical and organisational security measures appropriate to the nature of the Services, including as a minimum:

HTTPS/SSL encryption for the Website or Application, configured at server level;
firewall and web application firewall (WAF) controls where available on the hosting infrastructure;
regular patching of server-level software and infrastructure components;
access controls limiting administrative access to authorised personnel.

11.2 Cloudflare and DNS-level Protection. The Company strongly recommends that the Customer registers and maintains its own Cloudflare account (or equivalent DNS-level security service). Where requested by the Customer and included in the Order Form, the Company will assist with the initial configuration of Cloudflare on the Customer’s behalf. The Company remains responsible for errors introduced during that initial configuration. The Cloudflare account will remain the Customer’s own account, under the Customer’s control, and the Customer is solely responsible for its ongoing management, renewal and any associated costs. The Company accepts no liability for any loss or disruption arising from the Customer’s Cloudflare account or its configuration after initial setup has been completed without error.

11.3 The Company recommends that Customers enable multi-factor authentication on their WordPress or CMS administrator accounts and will assist with configuration where requested.

11.4 The Customer is responsible for the security of its own CMS installation, including plugins, themes, user accounts and passwords. The Company is not responsible for security vulnerabilities arising from software installed or configured by the Customer, except to the extent separately assumed by the Company under a development or maintenance agreement.

11.5 The Company will use reasonable endeavours to notify the Customer promptly of any security incident affecting the hosting environment that may impact the Customer’s Website or Application.

12. Exclusions and Items Not Included

The following are expressly excluded from the Services unless separately agreed in writing and reflected in the Order Form.

12.1 Security Testing

The Company applies commercially reasonable security practices appropriate to the hosting environment. The following are not included in the standard hosting service:

Penetration testing of the hosting environment, Website or Application.
Vulnerability assessments or security audits of the Customer’s codebase, application or infrastructure.
Remediation of vulnerabilities identified by third-party security testing, which will be separately assessed and quoted.
Compliance assessments or certifications such as ISO 27001, Cyber Essentials or SOC 2.

The Company strongly recommends that Customers hosting applications that process personal data, financial data or other sensitive information commission independent penetration testing at least annually from a qualified third-party provider.

12.2 Application Security

The Company is responsible for the security of the hosting infrastructure only. The following remain the sole responsibility of the Customer or their application developer, except to the extent separately assumed by the Company under a development or maintenance agreement:

Security of the Customer’s application code, including protection against common vulnerabilities such as SQL injection, XSS, CSRF and authentication weaknesses.
Security of third-party plugins, themes, libraries or frameworks.
Application-level authentication, session management and access controls.
API security, including authentication and rate limiting.

12.3 Uptime Guarantees and SLAs

Unless a specific Service Level Agreement is included in the Order Form, the Company does not guarantee any particular level of uptime or availability. Customers requiring formal uptime SLAs should discuss this with the Company before placing an order.

12.4 Disaster Recovery and Business Continuity

Standard backups as described in Clause 4.7 are provided where a maintenance package is in place. The following are not included unless separately agreed:

Formal disaster recovery planning or business continuity documentation.
Offsite or geographically redundant backup storage.
Failover hosting or high-availability infrastructure.
Recovery time objective (RTO) or recovery point objective (RPO) guarantees.

12.5 Compliance and Regulatory Requirements

The Customer is solely responsible for ensuring that its Website or Application and its use of the Services comply with all applicable laws, regulations and industry standards, including UK GDPR, PCI DSS, FCA rules, AML regulations and accessibility requirements. The Company is not a compliance adviser and nothing in these Terms constitutes legal, regulatory or compliance advice.

12.6 Content Delivery and Performance Optimisation

Unless expressly included in the Order Form, the following are not part of the standard hosting service: CDN services beyond any basic Cloudflare configuration assisted by the Company; advanced caching configuration; load balancing or auto-scaling infrastructure.

12.7 Domain Registration and Management

Unless expressly stated in the Order Form, domain registration, renewal, transfer and DNS management remain the Customer’s responsibility. The Company is not responsible for the lapse or loss of domain names registered in the Customer’s name.

12.8 Email Services — Exclusions

The following are not included in the standard hosting service unless separately agreed:

Enterprise email platforms such as Google Workspace or Microsoft 365.
Email archiving, legal hold or eDiscovery functionality.
Advanced spam filtering or email security gateway services beyond standard server-level controls.
Email marketing platforms or bulk mailing infrastructure. The Company’s hosting servers must not be used for bulk or marketing email sends, as this may damage the server’s sending reputation and affect all customers on the same environment.
Ongoing transactional email deliverability monitoring beyond initial configuration.
Recovery of deleted emails from cPanel mailboxes.
Configuration of email on the Customer’s devices, mobile phones or email clients.

The Company strongly recommends that any business using email for customer-facing communications, order processing or regulated activity uses a dedicated business email platform rather than server-based cPanel mailboxes.

13. Warranties

13.1 The Company warrants that:

it has the legal right and authority to enter into and perform its obligations under this Agreement;
it will perform its obligations under this Agreement with reasonable care and skill;
it will comply with all applicable laws and regulations in providing the Services.

13.2 The Customer warrants that:

it has the legal right and authority to enter into and perform its obligations under this Agreement;
it owns or has sufficient rights in all Website or Application content to grant the licence in Clause 8.2;
its use of the Services will comply with all applicable laws and regulations.

13.3 Except as expressly set out in this Agreement, the Company gives no warranties in relation to the Services, including as to fitness for a particular purpose, uninterrupted availability or freedom from errors.

14. Limitation of Liability

14.1 Nothing in this Agreement will limit or exclude either party’s liability for:

death or personal injury caused by its negligence;
fraud or fraudulent misrepresentation;
any other liability that cannot be excluded or limited by applicable law.

14.2 Subject to Clause 14.1, the Company will not be liable (whether in contract, tort, breach of statutory duty or otherwise) for:

loss of profits, revenue, business, contracts or anticipated savings;
loss of goodwill or reputation;
any indirect, special or consequential loss or damage;
any loss, damage, cost or expense (whether direct or indirect) arising from or in connection with a Force Majeure Event, as set out in Clause 17;
loss of or damage to data or software, except to the extent directly caused by the Company’s failure to exercise reasonable care and skill in performing an expressly agreed backup or restoration service.

14.3 Subject to Clause 14.1, the Company’s total aggregate liability to the Customer under or in connection with this Agreement in any 12-month period will not exceed the total Charges paid by the Customer to the Company in the 12 months immediately preceding the event giving rise to the claim. Where the Agreement has been in place for less than 12 months at the time of the event, the cap will be calculated on the basis of the annualised equivalent of the Charges paid to date. This cap applies to all types of liability under this Agreement, including claims arising from data protection breaches and breaches of confidentiality obligations.

14.4 The parties acknowledge that the limitations in this Clause 14 reflect a reasonable allocation of risk between commercial parties and that the Charges would be higher but for these limitations.

15. Suspension, Term and Termination

15.1 Suspension

The Company operates a staged suspension process for payment failures as follows:

Stage 1 — Overdue notice: where any invoice remains unpaid 14 days after the due date, the Company will issue a written overdue notice requesting immediate payment.
Stage 2 — Suspension: where payment has not been received within 7 days of the overdue notice, the Company may suspend the Services. On suspension, the Company may display a suspension page in place of the Customer’s Website or Application. Suspension does not affect the Customer’s obligation to pay Charges during the period of suspension.
Stage 3 — Termination: where payment has not been received within 14 days of the suspension notice, the Company may terminate this Agreement in accordance with Clause 15.4.

The Company also reserves the right to suspend the Services immediately and without prior notice where it reasonably suspects a breach of Clause 5 (Acceptable Use), a security incident affecting the hosting environment, or any other circumstance where continued operation of the Services would pose a material risk to the Company, other customers or third parties. The Company will notify the Customer of any such suspension as soon as reasonably practicable and will restore the Services promptly following resolution of the relevant issue.

15.2 Term and Renewal

This Agreement commences on the Effective Date and continues for the Minimum Term. Following the Minimum Term, this Agreement will renew automatically on a monthly rolling basis unless either party gives not less than 30 days’ written notice of termination before the end of the Minimum Term or any subsequent monthly renewal period. The Company will endeavour to issue a renewal reminder not less than 45 days before the end of the Minimum Term.

15.3 Termination by Notice

Either party may terminate this Agreement at the end of the Minimum Term, or at the end of any subsequent monthly renewal period, by giving the other not less than 30 days’ written notice.

15.4 Termination for Cause

Either party may terminate this Agreement immediately on written notice if:

the other party commits a material breach of this Agreement that is not capable of remedy, or that is capable of remedy but has not been remedied within 14 days of written notice requiring it to be remedied;
the other party is unable to pay its debts as they fall due, enters administration, liquidation, or makes any arrangement with its creditors; or
the other party ceases or threatens to cease to carry on business.

The Company may also terminate this Agreement immediately where the Customer commits a serious or repeated breach of Clause 5 (Acceptable Use Policy), or where payment remains outstanding following completion of the staged process in Clause 15.1.

16. Effects of Termination

16.1 On termination of this Agreement for any reason:

all sums owed by the Customer to the Company become immediately due and payable;
each party will promptly return or destroy the other party’s Confidential Information, subject to Clauses 4.4 and 9, applicable law, legitimate record-retention requirements and data contained in routine backups;
the licences granted under Clause 8 will terminate, except to the extent reasonably necessary for the Company to provide the termination, retention and migration assistance described in Clauses 4.4, 9 and 16.

16.2 Where this Agreement is terminated by either party under Clause 15.3, or by the Customer under Clause 15.4 because the Company has materially breached the Agreement:

the Company will provide a copy of the Website or Application files to the Customer within 10 Business Days of termination, subject to all outstanding hosting invoices being settled in full in accordance with Clause 7.6;
the Company will provide reasonable assistance to migrate the Website or Application to an alternative host, subject to payment of the Company’s reasonable costs at the then-current standard hourly rate;
domain transfers, DNS configuration information, server configuration details, CRON job information and other technical migration data will be provided subject to all outstanding invoices being settled and at the Company’s then-current standard hourly rate where staff time is required;
the Customer will be entitled to a pro-rata refund of any Charges paid in advance for Services not yet delivered, provided no outstanding invoices remain unpaid.

16.3 Where the Company terminates under Clause 15.4 because of the Customer’s breach, or terminates following completion of the non-payment process in Clause 15.1, no refund of prepaid Charges will be due and the Company’s right of retention under Clause 7.6 will apply until all outstanding hosting invoices are paid in full.

16.4 Clauses 7 (to the extent of any outstanding Charges), 8.4, 9 (data deletion obligations), 10, 13, 14, and 16 will survive termination of this Agreement.

17. Force Majeure

17.1 Neither party will be in breach of this Agreement or liable for any failure or delay in performing its obligations to the extent that the failure or delay is caused by a Force Majeure Event.

17.2 Without limiting Clause 17.1 or Clause 14, the Company will have no liability to the Customer or to any third party, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for any loss, damage, cost or expense (whether direct or indirect, and including loss of availability, performance, data, email, revenue or profit) arising from or in connection with a Force Majeure Event. No service credit, refund, compensation or other remedy is due in respect of any unavailability, interruption or degradation of the Services caused by a Force Majeure Event, except the pro-rata refund described in Clause 17.5.

17.3 The Company is not required to maintain failover, redundant or alternative infrastructure to guard against a Force Majeure Event (see Clause 12.4). The Customer remains responsible for keeping its own backups (see Clause 4.7).

17.4 The party affected by a Force Majeure Event will use reasonable endeavours to notify the other as soon as reasonably practicable (which may be by email or by a notice on the Company’s website), to take reasonable steps to mitigate its effects and to resume performance as soon as reasonably possible.

17.5 If a Force Majeure Event continues for more than 30 days, either party may terminate this Agreement on 14 days’ written notice without liability, save that the Customer will be entitled to a pro-rata refund of prepaid Charges for Services not delivered.

17.6 A Force Majeure Event does not excuse the Customer from paying any Charges that fell due before the Force Majeure Event began.

18. General

18.1 Notices. Any notice given under this Agreement must be in writing and delivered personally, sent by first class post, or sent by email to the address set out in the Order Form. Notices sent by email are deemed received at the time of transmission, provided the sender retains evidence of transmission. Notices sent by post are deemed received two Business Days after posting.

18.2 Entire Agreement. This Agreement constitutes the entire agreement between the parties in relation to its subject matter and supersedes all prior agreements, representations and understandings. Each party acknowledges that it has not relied on any representation not expressly set out in this Agreement.

18.3 No Waiver. No failure or delay by a party in exercising any right or remedy will constitute a waiver of that right or remedy.

18.4 Severability. If any provision of this Agreement is held to be unlawful, invalid or unenforceable, that provision will be deemed deleted and the remaining provisions will continue in full force and effect.

18.5 Assignment. The Company may assign or sub-contract its obligations under this Agreement to any third party, provided that any subcontracting involving the processing of Personal Data will remain subject to Clauses 5B and 9. The Customer may not assign this Agreement or any rights under it without the prior written consent of the Company.

18.6 Third Parties. This Agreement does not confer any rights on any third party under the Contracts (Rights of Third Parties) Act 1999.

18.7 Relationship. Nothing in this Agreement creates a partnership, joint venture, agency or employment relationship between the parties.

18.8 Governing Law and Jurisdiction. This Agreement is governed by the laws of England and Wales. Each party irrevocably submits to the exclusive jurisdiction of the courts of England and Wales in relation to any dispute arising under or in connection with this Agreement. This Agreement is intended for customers based in England, Wales and Scotland only.

19. Complaints

19.1 Any complaints about the Services should be directed to support@x30marketing.co.uk in the first instance. The Company will acknowledge all complaints within two Business Days and will seek to resolve them promptly.

20. Insurance

20.1 The Company maintains appropriate professional indemnity, cyber and data, public liability and employers’ liability insurance cover. Evidence of the Company’s current insurance arrangements is available on written request.