Review & Checkout

Effective date: 1 December 2026 – v2.0

Last updated: 26 October 2026

Governing agreement for services, hosting, support and project delivery.

1. About these Terms

1.1 These Terms & Conditions ("Terms") apply to services supplied by DevEdge Ltd, a company registered in England and Wales with company number 15132814 ("DevEdge", "we", "us" or "our"), to the client ("you" or "your").

1.2 By accepting a proposal, quotation, order or Service Contract, approving work to begin, purchasing a service or continuing to use an ongoing service, you agree to these Terms.

1.3 This version 2.0 applies:

• (a) to new orders placed, and Service Contracts accepted, on or after the date this version is published on the DevEdge website; and

(b) to services you already have, from 1 December 2026, after we have notified you of it. If we notify you later than 1 November 2026, this version applies to those services 30 calendar days after we notify you. Until then, the version of these Terms that previously applied to those services continues to apply.

1.4 This version does not put any existing service onto a Minimum Term. Services ordered before 22/10/2026 continue as set out in clause 54.

2. Business customers only

2.1 These Terms are designed for business customers, including companies, partnerships, sole traders and individuals acting for purposes relating to their trade, business, craft or profession ("Business Customers"). DevEdge does not intend to supply services to consumers.

2.2 When you order through our website or Client Area, you must confirm at checkout that you are acting for purposes relating to your trade, business, craft or profession. By engaging DevEdge or placing an order, you warrant and represent that you are a Business Customer acting for business or commercial purposes.

2.3 If you are not acting for business purposes, please do not place an order. Contact us first and we will tell you whether we can help.

3. If you are a consumer

3.1 If, despite clause 2, you are a consumer (an individual acting wholly or mainly outside your trade, business, craft or profession), this clause 3 applies to you and takes precedence over anything else in these Terms or any Service Contract that gives you fewer rights.

3.2 Your statutory rights, including under the Consumer Rights Act 2015, are not affected. Nothing in these Terms excludes or limits any liability or right that cannot be excluded or limited in a consumer contract.

3.3 Right to cancel: under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, you may cancel a contract made online or at a distance within 14 calendar days of the day it was made, without giving a reason. To cancel, tell us clearly through the Client Area (using the cancellation option or a support ticket) or by email to [email protected].

3.4 If you asked us to start a service within the 14-day period, you must pay for the service provided up to the time you tell us you are cancelling, in proportion to the full service. If a service (for example a domain registration) is fully performed within the 14 days at your express request and you acknowledged that you would then lose the right to cancel, the right to cancel no longer applies to that service.

3.5 We will refund any money due to you under this clause within 14 calendar days of receiving your cancellation, using the payment method you used.

3.6 The business-only confirmation in clause 2 and the statutory interest and compensation in clause 13.5 do not apply to you.

4. Definitions

4.1 In these Terms:

• • Activation Date has the meaning in clause 9.
• • Business Customer has the meaning in clause 2.
• • Business day means a day other than a Saturday, Sunday or public holiday in England.
• • Client Area means DevEdge's online client area at https://hosting.devedge.co.uk (or any replacement notified to you).
• • Data Processing Agreement or DPA means DevEdge's Data Processing Agreement published at https://devedge.co.uk/legal/data-processing-agreement/.

• End Date means the date a service finally ends, being the later of (a) the date the contract for that service ends (whether on notice, at the end of a minimum term, on an agreed early release or on termination by either party) and (b) the end of any billing period for that service that has been paid in full.

• Minimum Term means the initial minimum commitment period for a recurring service, as described in clause 53.

• Notice Period means 30 calendar days, unless a different notice period is shown in the applicable Service Contract or agreed in writing.

• Retrieval Period means the 30 calendar days after the End Date described in clause 64.

• Service Contract means a service-specific contract (for example a hosting minimum term, notice and billing contract) accepted by you at checkout or in the Client Area, or a contract signed by both parties for a specific service.

• Taxes means VAT and any other tax, duty or levy imposed by law on the services or the fees.

• Third-Party Charges means charges set by a third party that DevEdge passes on to you for a service and that are shown as a separate item in your proposal, order, Service Contract or invoice, including domain registry and registrar fees; software licence fees (such as cPanel, CloudLinux, Imunify, LiteSpeed, premium plugin and theme licences); Microsoft 365 and Google Workspace licences; paid SSL certificates; and other third-party subscriptions or usage charges.

• Written or in writing includes email, messages through the Client Area and support tickets.

4.2 Third-party costs that are included in a DevEdge fee and not shown separately are not Third-Party Charges.

5. Proposals, scope and document priority

5.1 The services we agree to provide will normally be described in a proposal, quotation, order form, statement of work, service plan, Service Contract or other written agreement.

5.2 The agreed scope, deliverables, pricing and timescale form part of the contract between you and DevEdge.

5.3 If there is a conflict between documents, the following order of priority applies, unless DevEdge expressly agrees otherwise in writing with specific reference to the provision being varied:

• (a) the Data Processing Agreement, on the processing, security, return and deletion of personal data processed on your behalf, to the extent necessary to comply with applicable data protection law (unless an alternative legally compliant data processing agreement has been expressly agreed);
• (b) a Service Contract, on the matters it covers (such as minimum term, notice, billing, price changes, non-payment, end of service, data return timing and domains);
• (c) a signed proposal, quotation, statement of work or other specific written agreement, on scope, deliverables, pricing and timescales;
• (d) any service-specific terms or service descriptions;
• (e) these Terms;
• (f) our Acceptable Use Policy and Fair Usage Policy, where applicable.
• 5.4 Any change to the agreed scope must be confirmed in writing and may affect the price, delivery date or both.

6. Client responsibilities

6.1 You agree to provide the information, content, access, credentials, approvals and feedback reasonably required for us to carry out the work.

6.2 You are responsible for ensuring that information and materials supplied to DevEdge are accurate and that you have the necessary rights and permissions to use them.

6.3 Delays in providing content, access, feedback or approvals may affect delivery dates.

6.4 Where a project is delayed for an extended period because we are waiting for information or action from you, we may reschedule the remaining work according to our availability.

6.5 You must keep your contact details in the Client Area up to date, because we send notices to the account holder's email address (see clause 55).

7. Project payments

7.1 A deposit is normally required before project work begins.

7.2 The amount may vary depending on the size and nature of the project and will be stated in the proposal. Typical arrangements may include a 25% deposit or staged payments such as 50% before work begins and 50% before launch or delivery.

7.3 The deposit reserves development capacity and contributes towards discovery, planning and project mobilisation.

7.4 Except where required by law or agreed otherwise in writing, deposits are non-refundable once work has commenced or project capacity has been reserved.

7.5 Projects will not normally begin until the required deposit has cleared.

7.6 Further instalments may be invoiced at agreed milestones.

7.7 Unless otherwise agreed, the final project balance must be paid before launch, migration, transfer of final deliverables or deployment to a live environment.

7.8 Project invoices are payable within 14 calendar days unless a different payment term is stated on the invoice or agreed in writing.

8. Recurring services and billing

8.1 Recurring services may include:

• • Website Support
• • Managed WordPress Hosting
• • Performance Hosting
• • WooCommerce Hosting
• • Agency Hosting
• • VPS, VDS or dedicated infrastructure
• • Domain management
• • Business email
• • Microsoft 365
• • Google Workspace
• • SEO or digital marketing retainers
• • Other ongoing services agreed with DevEdge

8.2 Recurring services are invoiced in advance and normally collected automatically using an approved payment method. Recurring invoices are issued 7 calendar days before their due date, which is the first day of the billing period they cover.

8.3 Monthly billing means the service fee is collected monthly. It does not necessarily mean that the underlying service contract is cancellable monthly.

8.4 The applicable Minimum Term and Notice Period will be stated in the proposal, order, Service Contract or service description. If none is stated, clause 53.4 applies.

8.5 You remain responsible for all fees due during an agreed Minimum Term or renewal term.

9. Minimum term commencement

9.1 Unless otherwise agreed in writing, the Minimum Term for a recurring service begins on the date we first provision the service and send you its login or welcome details (the "Activation Date"). For services that do not require technical provisioning, such as Website Support, the Activation Date is the date the service is set up in your account following payment.

9.2 The Activation Date, agreed Minimum Term and applicable billing cycle will be recorded in your service or contract details in the Client Area. If they are wrong, tell us and we will correct them; the correct dates apply.

9.3 The Minimum Term runs for the agreed number of calendar months from the Activation Date, rather than being calculated by the number of invoices issued. It ends at the end of the day before the same date in the final month (for example, a 12-month term activated on 15 March 2027 ends at the end of 14 March 2028). If the final month has no matching date, it ends at the end of the last day of that month.

9.4 The billing cycle may differ from the Minimum Term. Monthly payments during a Minimum Term do not create a separate monthly cancellation entitlement.

10. Prices, Taxes and Third-Party Charges

10.1 Prices are exclusive of VAT unless stated otherwise. Taxes are added at the applicable rate.

10.2 The agreed recurring service fee will remain fixed throughout the Minimum Term, unless otherwise expressly agreed in writing.

10.3 Clause 10.2 does not prevent:

• (a) changes in Taxes; or

(b) changes in Third-Party Charges. Third-Party Charges are passed on at cost without mark-up, unless a different price is shown in your order or proposal. We will tell you about any change in a Third-Party Charge as early as reasonably practicable.

10.4 Any agreed service upgrade, additional resources or optional services may result in additional charges.

10.5 After the Minimum Term, or at any time where a service has no Minimum Term, DevEdge may revise recurring service fees by giving at least 30 calendar days' written notice, no more than once in any 12-month period. The notice will state the new fee and the date it takes effect.

10.6 If you do not accept a fee increase under clause 10.5, you may end the affected service by giving notice at any time before the increase takes effect. The service then ends on the day before the new fee applies, even if your Notice Period is longer, and you pay the existing fee until then.

10.7 If DevEdge does not give the notice required by clause 10.5 or clause 53.10, the increase will not take effect until 30 calendar days after the notice is given.

11. Service upgrades and downgrades

11.1 Clients may request an upgrade to a higher service plan at any time, including during a Minimum Term, subject to technical compatibility.

11.2 Unless expressly agreed otherwise in writing, an upgrade will not restart or extend the original Minimum Term.

11.3 The upgraded service fee will apply from the agreed upgrade date, with a pro rata adjustment for the current billing period.

11.4 Downgrades to lower-priced plans are not normally permitted during a Minimum Term unless DevEdge agrees otherwise in writing.

11.5 Clients may request a downgrade to take effect after the Minimum Term, subject to technical compatibility, resource requirements and applicable notice arrangements.

11.6 Where an upgrade involves replacing the original service with a materially different service, any new Minimum Term must be expressly agreed before it takes effect.

12. Service-specific prepaid credit

12.1 Certain services may require prepaid credit to cover future usage, incident charges or additional services.

12.2 Where applicable, the allocation, use, replenishment, expiry and refund of prepaid credit will be governed by the relevant Service Contract accepted by the client.

12.3 Prepaid credit is separate from recurring subscription fees and does not automatically reduce or discharge amounts payable under an agreed Minimum Term.

12.4 Any applicable administration charges or deductions will be disclosed in the relevant Service Contract and remain subject to applicable law.

13. Late payment and non-payment

13.1 Invoices must be paid in full by the stated due date.

13.2 For recurring services, unless a Service Contract states otherwise, the following timetable applies if an invoice is not paid in full by its due date:

• (a) we will send payment reminders by email 1, 3 and 5 calendar days after the due date;
• (b) if the invoice is still unpaid 7 calendar days after the due date, we will add the late payment charge described in clause 13.4 and suspend the affected service. The suspension notice will tell you the date from which we may terminate the service;
• (c) once all overdue invoices are paid in full, the service is unsuspended automatically;
• (d) if the invoice is still unpaid 30 calendar days after the due date, we may terminate the affected service. The termination date is then the End Date, and clause 64 applies to your data.
• 13.3 We may, at our discretion, allow more time at any stage. For project invoices, we may suspend work until the account is brought up to date.

13.4 Late payment charge: if an invoice is still unpaid 7 calendar days after its due date, a late payment charge of 10% of the overdue amount (minimum £5) is added. This charge reflects the reasonable administrative cost of chasing payment and of suspending and restoring the service. It is not a penalty.

13.5 Statutory rights: for Business Customers, the late payment charge does not affect DevEdge's statutory rights under the Late Payment of Commercial Debts (Interest) Act 1998 to interest at 8% a year above the Bank of England base rate from the due date until payment, fixed compensation of £40 (invoices under £1,000), £70 (£1,000 to £9,999.99) or £100 (£10,000 or more), and any further reasonable costs of recovering the debt. Any statutory compensation claimed for an invoice is reduced by the late payment charge already paid for that invoice, so that the same costs are not recovered twice.

13.6 Suspension for non-payment does not stop fees falling due, pause the Minimum Term or remove your responsibility to pay amounts due under the contract. While a service is suspended we keep your data, and you can still use the Client Area to pay, give notice, raise a support ticket or ask for a copy of your data.

13.7 Unpaid invoices are not cancelled by suspension, termination or the end of a service, and remain payable.

13.8 We may require outstanding balances to be settled before releasing project files, transferring managed services or carrying out non-essential additional work. This does not apply to the return of personal data under clause 64 and the DPA.

14. Website design and development

14.1 Website design and development services may include discovery, planning, design, development, integrations, testing, migration and deployment depending on the agreed scope.

14.2 The exact deliverables will be stated in the proposal.

14.3 Additional functionality, integrations, pages, content entry, revisions or other work outside the agreed scope will be quoted separately or charged at an agreed hourly rate.

14.4 You are responsible for reviewing and approving the completed website, including content, spelling, pricing, contact details, legal information and business-specific information.

14.5 Changes requested after approval or completion may be chargeable.

14.6 Development work may use WordPress, open-source software, third-party plugins, APIs, frameworks, libraries and other external services where appropriate.

15. Website Support

15.1 Website Support covers WordPress application-level maintenance and technical support according to the selected plan.

15.2 This may include eligible WordPress core, plugin and theme updates, troubleshooting, application-level security measures, configuration changes, technical fixes and agreed website amendments.

15.3 Website Support is separate from hosting unless expressly bundled in writing.

15.4 Managed hosting does not automatically include WordPress core, plugin or theme maintenance.

16. Support requests and response targets

16.1 Support requests should normally be submitted through the DevEdge Client Support system.

16.2 Requests are prioritised according to their impact and urgency.

16.3 High priority requests, including complete website outages or failure of critical business functionality, target an initial response within 4 business hours.

16.4 Medium priority requests, including significant issues affecting normal operation while the website remains operational, target an initial response within 1 business day.

16.5 Low priority requests, including minor issues, content changes, configuration requests, cosmetic problems and other non-urgent work, target an initial response within 2 business days.

16.6 For standard Website Support plans, response times are operational targets and do not constitute guaranteed service levels unless a separate SLA has been agreed in writing. Response targets apply during DevEdge's normal support hours unless otherwise agreed.

17. Emergency Response and SLAs

17.1 Where an active Emergency Response plan or add-on has been purchased, qualifying critical website emergencies (such as complete website outages or critical security incidents) are governed by our committed 2-hour response SLA, operational 24/7/365.

17.2 Resolution times depend on the complexity of the issue, third-party dependencies and factors outside DevEdge's control. While DevEdge works diligently to restore service as quickly as possible, no specific resolution time is guaranteed.

18. 24/7 monitoring

18.1 Where 24/7 website monitoring is included, this refers to automated availability monitoring.

18.2 It does not mean that DevEdge provides 24/7 staffed technical support unless Emergency Response has also been contracted.

18.3 Monitoring alerts are handled in accordance with the applicable support arrangements and response targets.

19. Included support hours

19.1 Any monthly support hours included in a Website Support plan reset at the end of each billing period and do not roll over.

19.2 Unused hours have no cash value.

19.3 Work outside the scope of the plan or exceeding the included monthly hours will be discussed and agreed before additional chargeable work is carried out.

19.4 Major redesigns, substantial new functionality, new websites and significant development projects are not normally included within support-plan hours unless expressly agreed.

20. Managed WordPress updates

20.1 Where WordPress updates are included in a Website Support plan, DevEdge will apply updates at appropriate intervals.

20.2 We may delay an update where we reasonably believe that it presents a compatibility, security or stability risk.

20.3 Third-party software may contain defects or incompatibilities outside DevEdge's control.

20.4 Where remediation requires substantial work outside the scope or available hours of the support plan, additional work may be quoted separately.

21. DevEdge Connect and Security Monitoring

Monitoring services

21.1 Where included in the selected Website Support, Emergency Response or other eligible service, DevEdge may install and operate its DevEdge Connect plugin to monitor website health, performance, security and technical configuration.

21.2 DevEdge Connect communicates with the DevEdge Hub to provide automated monitoring, security reporting, fault detection and incident management.

21.3 Monitoring capabilities and frequencies may vary depending on the selected service, website configuration and supported integrations.

Administrator and account security monitoring

21.4 DevEdge Connect monitors security-related activity involving WordPress administrators and other privileged accounts, including:

• • administrator account creation, removal and changes to roles or permissions;
• • successful administrator logins and repeated failed login attempts;
• • unusual login activity, including previously unseen IP addresses or geographic locations;
• • creation of application passwords for privileged accounts;
• • two-factor authentication status, where supported;
• • dormant or previously inactive administrator accounts;
• • changes to public registration settings and security-related configuration;
• • relevant plugin and theme installations, removals or deactivations.
• 21.5 Security events may be reported to the DevEdge Hub as they occur or during scheduled scans.

Administrator identification and data collection

21.6 To identify changes to privileged accounts, DevEdge Connect may use pseudonymous account identifiers, allowing administrator accounts to be distinguished without routinely transmitting usernames or email addresses.

21.7 Depending on the monitoring activity, information collected or processed may include account roles, pseudonymous identifiers, login timestamps, IP addresses, approximate geographic information, authentication events, security configuration, technical errors and relevant incident records.

21.8 DevEdge limits the collection and use of personal data to what is reasonably necessary for monitoring, security investigation and delivery of the agreed services.

21.9 Passwords, password hashes, authentication tokens and session credentials are not intentionally collected or transmitted as part of routine monitoring.

Security alerts and authorised changes

21.10 Where potentially suspicious activity is detected, DevEdge may generate security alerts, review relevant events and request confirmation that changes were authorised.

21.11 Events may be classified as authorised, suspicious or requiring further investigation. Acknowledgement of an alert does not necessarily mean the underlying activity has been verified as safe.

21.12 Clients remain responsible for managing authorised website users, maintaining appropriate permissions and informing DevEdge of significant planned changes where relevant.

Emergency Response

21.13 Administrator monitoring forms part of Website Support where included in the selected plan. Detection of a security event does not automatically constitute a critical incident or activate an Emergency Response commitment.

21.14 Where Emergency Response has been purchased, qualifying critical security incidents may be escalated in accordance with the applicable Emergency Response terms, incident classifications and enabled monitoring categories.

21.15 Routine administrator changes, unsuccessful login attempts or unusual login locations do not automatically constitute confirmed security breaches.

Monitoring limitations

21.16 DevEdge Connect is designed to assist in identifying security risks, vulnerabilities and unusual activity but does not guarantee that every threat, unauthorised access attempt or security incident will be detected or prevented.

21.17 Monitoring effectiveness may depend on website configuration, hosting infrastructure, third-party software, supported integrations and the continued operation and connectivity of DevEdge Connect.

21.18 Where a security control cannot be reliably verified, it may be reported as unverified rather than confirmed secure.

21.19 Monitoring reports and security assessments reflect the information available at the time and do not constitute a guarantee that a website is secure.

Data retention and protection

21.20 DevEdge retains monitoring information only for as long as reasonably necessary for the relevant security, operational, contractual or legal purpose. Standard retention periods are:

• • detailed login telemetry: normally up to 30 days;
• • security events and associated alerts: normally up to 90 days;
• • confirmed security incidents: longer where reasonably necessary for investigation, dispute resolution or legal obligations.
• 21.21 Access to security monitoring records is restricted to authorised personnel and approved service providers who require access for legitimate purposes.
• 21.22 Personal data is processed in accordance with applicable UK data protection law, DevEdge's Privacy Policy and the DPA.

21.23 Client privacy warranty: the client warrants that it has provided appropriate privacy notices to, and where legally required obtained any necessary permissions from, its WordPress administrators, editors, employees, contractors and authorised users, informing them that administrative authentication telemetry, security events, access timestamps and IP addresses are collected, processed and logged for system security, diagnostic and audit purposes.

22. Bulk Hours

22.1 Clients may purchase prepaid Bulk Hours for development, website changes or technical assistance.

22.2 Bulk Hours are valid for 12 months from the date of purchase unless otherwise stated.

22.3 Unused hours expire after that period and are non-refundable.

22.4 Bulk Hours do not include Third-Party Charges, external service charges or expenses unless expressly stated.

22.5 Bulk Hours do not constitute a Website Support plan, maintenance contract or service-level agreement. They do not automatically provide priority response.

22.6 Bulk Hours are non-transferable unless agreed otherwise in writing.

23. Hosting services

23.1 DevEdge provides managed hosting services including:

• • Managed WordPress Hosting
• • Performance Hosting
• • WooCommerce Hosting
• • Agency Hosting
• • Managed VPS
• • Managed VDS
• • Dedicated infrastructure
• • Other hosting environments agreed in writing
• 23.2 The hardware, resources, account limits, security controls, backup arrangements and management scope vary by service.
• 23.3 Specific specifications shown in the applicable hosting plan or proposal apply to that service.

23.4 Hosting infrastructure may use technologies including AMD Ryzen or Intel processors, NVMe storage, LiteSpeed Enterprise, cPanel, CloudLinux, Redis or other object caching technologies and other appropriate server technologies.

23.5 The underlying technology may change where required to maintain or improve the service.

24. Managed hosting scope

24.1 Managed hosting covers the hosting environment rather than the WordPress application itself.

24.2 Depending on the plan, managed hosting may include server configuration, hosting software management, operating system updates, security patching, hosting-level security, malware scanning, firewall configuration, SSL, caching, performance configuration, backups, uptime monitoring, assisted restoration and hosting support.

24.3 WordPress core, plugin and theme updates are not included with hosting alone unless Website Support or another maintenance service has also been purchased.

24.4 Application-level troubleshooting, plugin conflicts, layout issues, website changes and WordPress maintenance may therefore be chargeable separately.

25. Agency Hosting

25.1 Agency Hosting is designed for agencies managing multiple client websites.

25.2 Agency environments may be provided using isolated VPS, VDS, dedicated or cloud infrastructure depending on the selected service.

25.3 Agency Hosting may include server setup, security patching, monitoring, managed backups, account provisioning, performance configuration and assisted restoration.

25.4 Where provided, agencies may receive WHM, cPanel or other agreed management access.

25.5 Individual client websites may be separated into individual hosting accounts.

25.6 Site-capacity figures shown on the website or in proposals are indicative only. Actual capacity depends on traffic, plugins, database activity, optimisation, ecommerce workload and other resource requirements.

25.7 DevEdge may recommend additional resources or a larger environment where the existing environment is no longer appropriate for the portfolio.

26. Availability and uptime

26.1 DevEdge designs and manages hosting environments with availability in mind.

26.2 Where an uptime target is stated, it is a service target rather than a financially backed guarantee unless a separate SLA expressly provides service credits or other remedies.

26.3 Scheduled maintenance, emergency maintenance, upstream network failures, third-party failures, cyberattacks, DNS problems, client configuration and circumstances outside DevEdge's reasonable control may be excluded from uptime calculations.

26.4 Automated availability monitoring does not constitute 24/7 staffed support.

27. Fair use and resource usage

27.1 Services described as unmetered or without a fixed usage allowance remain subject to reasonable fair use.

27.2 You must not use resources in a way that materially affects the performance, stability, security or availability of the hosting platform or other clients.

27.3 Where sustained CPU, memory, storage, bandwidth, email or other resource usage is unsuitable for the selected service, we may contact you to discuss optimisation, an upgrade or migration to a more appropriate environment.

27.4 We will normally discuss such changes with you before additional charges apply, except where immediate action is reasonably necessary to protect security or platform stability.

27.5 Our Acceptable Use Policy and Fair Usage Policy form part of these Terms where applicable.

28. Backups

28.1 Backup schedules and retention periods vary by service.

28.2 Where a hosting plan includes backups, they are kept on a rolling basis for between 21 days and 12 months, depending on the server or platform the service is hosted on and the plan. The backup frequency and retention period for a specific plan are shown on its product page or are available on request.

28.3 Backups may include daily, weekly, monthly or other restore points depending on the selected service. Additional or higher-frequency backups may be available separately.

28.4 Backups are provided as a convenience and recovery measure, not as a guaranteed archive, and should not be treated as the client's sole archival or business continuity system. Clients should keep their own copies of their website, database and email data. Clients operating mission-critical systems should maintain appropriate independent business continuity arrangements.

28.5 Restoration is subject to the availability and integrity of the relevant backup. DevEdge cannot guarantee that every backup will always be recoverable in every circumstance.

28.6 Routine backups age out automatically at the end of their retention period. What happens to backups when a service ends is set out in clause 64. No backup copy is kept for more than 12 months after the End Date of the service it relates to.

29. Domain registration and management

29.1 Domains may be registered through third-party accredited registrars and remain subject to the rules of the relevant registry, including organisations such as Nominet and ICANN.

29.2 Where supported by the registry, the client will normally be recorded as the registrant of domains registered on their behalf.

29.3 DevEdge may act as the administrative or technical contact and may manage the domain through a DevEdge registrar account.

29.4 Domain availability is not guaranteed until registration has been successfully completed.

29.5 Domain registration, renewal, transfer and redemption charges are Third-Party Charges and may vary by extension.

29.6 Privacy protection is available only where supported by the relevant registry and registrar.

30. Domain renewals

30.1 Domain registrations are separate services. They are not cancelled when a hosting or other associated service ends.

30.2 Where domain renewal is managed by DevEdge, domains are set to renew automatically and are invoiced separately, including after any associated hosting service has ended, unless you cancel them. You can cancel by turning off automatic renewal in the Client Area or by telling us at least 30 days before expiry, unless a different deadline applies to that domain extension.

30.3 You are responsible for making sure your domains are renewed and their renewal invoices paid, and for updating DNS and nameserver settings when you move services. Website, email and DNS services that rely on a DevEdge hosting service stop at that service's End Date unless you have moved them.

30.4 A domain will not be renewed if its renewal invoice is unpaid by the renewal deadline.

30.5 Expired domains may enter grace, redemption or deletion periods determined by the relevant registry or registrar. Recovery of an expired domain may not always be possible and may involve additional fees. DevEdge cannot guarantee recovery once a domain has expired.

31. Domain transfers

31.1 You may request transfer of an eligible domain to another provider at any time, including when an associated service ends. On request, we will provide the transfer (auth) code or change the Nominet tag, subject to applicable registry rules and payment of amounts properly due for that domain.

31.2 Transfer times and procedures are controlled partly by registries and registrars and are therefore outside DevEdge's complete control.

31.3 We will provide reasonable assistance with an authorised transfer request.

32. Business email

32.1 DevEdge may provide hosted business email as part of a hosting service or as a separate service.

32.2 Mailbox availability, storage, account limits and sending limits depend on the selected service and remain subject to reasonable fair use.

32.3 Email services must not be used for spam, unlawful communications, abusive bulk mailing or activity that damages the reputation of DevEdge infrastructure.

32.4 We may suspend a mailbox or sending service where there is evidence of compromise, spam, abuse or other activity that threatens security or deliverability.

33. Email deliverability

33.1 DevEdge may configure technical email authentication including SPF, DKIM and DMARC where appropriate.

33.2 These technologies help authenticate a sending domain and reduce common deliverability problems but do not guarantee inbox placement.

33.3 Email delivery is affected by factors outside DevEdge's control, including domain reputation, IP reputation, message content, recipient engagement, blocklists, sending patterns, recipient mail providers and third-party filtering systems.

33.4 DevEdge does not guarantee that every message will be accepted or delivered to a recipient's inbox.

34. Microsoft 365 and Google Workspace

34.1 Microsoft 365 and Google Workspace are third-party services governed by their respective provider terms.

34.2 Features depend on the selected licence.

34.3 Licence fees are Third-Party Charges and may change if the provider changes its pricing.

34.4 Unless otherwise agreed, licence charges are additional to DevEdge's setup, migration or administration charges.

34.5 DevEdge may assist with setup, licensing, DNS, account configuration and administration according to the agreed scope.

34.6 Availability and operation of Microsoft 365, Google Workspace and other third-party platforms are outside DevEdge's direct control.

35. Email migrations

35.1 Email migration scope depends on the source system, destination platform, access available and compatibility between services.

35.2 DevEdge will take reasonable care to transfer the data agreed in scope and perform appropriate checks.

35.3 We cannot guarantee that every historical message, calendar entry, contact, rule, permission, archive, metadata item or platform-specific feature can be transferred between every provider.

35.4 The existing service will normally remain operational during preparation where possible. DNS and MX changes will be planned to minimise disruption.

35.5 No email migration can guarantee zero interruption or that no message will ever be delayed during propagation or provider cutover.

36. Website migrations

36.1 Website migrations depend on the capabilities of the source platform, available access, data exports and compatibility with WordPress or the agreed destination platform.

36.2 DevEdge will migrate the content, functionality and data specified in the agreed scope.

36.3 Certain platform-specific features, historical data, integrations or proprietary functionality may need to be recreated rather than directly transferred.

36.4 A standard website migration does not automatically include complex email migration, specialist applications, bespoke data transformation or other work not expressly agreed.

36.5 Where a migration involves rebuilding a website, the project may be treated as both a migration and a website development project.

37. SEO during migration

37.1 DevEdge may implement redirects, migrate suitable SEO metadata, update sitemaps and perform other technical migration measures where included in scope.

37.2 These measures are intended to reduce migration-related SEO risk.

37.3 DevEdge cannot guarantee that rankings, traffic, impressions or other search performance will remain unchanged following a website migration. Search engines control their own crawling, indexing and ranking systems.

38. SEO and digital marketing

38.1 SEO, content, link-building and digital marketing services are provided on a best-efforts basis.

38.2 Search visibility is influenced by algorithms, competitors, market conditions, website quality, user behaviour and other factors outside DevEdge's control.

38.3 We do not guarantee specific search rankings, a particular amount of traffic, specific conversion rates, a particular number of leads, revenue levels or visibility within AI-generated search responses.

38.4 Recommendations and strategies may change as search platforms and market conditions evolve.

39. AI Development

39.1 AI-powered services may use third-party artificial intelligence models, APIs, vector databases, cloud services or other external technologies.

39.2 AI systems can produce incomplete, inaccurate, outdated, misleading or unexpected outputs.

39.3 Unless expressly agreed otherwise, AI-generated output should be reviewed by an appropriate person before being relied upon. Clients remain responsible for decisions made using AI-generated output.

39.4 AI systems supplied by DevEdge should not be relied upon as a substitute for qualified legal, financial, medical, safety-critical or other regulated professional advice.

39.5 Model availability, capabilities, pricing, limits and behaviour may change where third-party providers alter their services.

39.6 Where relevant, the AI providers and data-processing arrangements used for a project will be considered during the project design and agreed according to the requirements of the service.

39.7 Training data protection: where DevEdge develops, integrates or deploys AI features, agents or retrieval-augmented generation (RAG) systems, DevEdge will configure commercial or enterprise APIs designed to ensure that client confidential information and personal data are not retained or used by third-party model providers to train foundational AI models, unless otherwise instructed or agreed in writing.

39.8 Intellectual property in AI outputs: DevEdge does not warrant or represent that third-party AI-generated outputs are capable of exclusive copyright protection or free from third-party intellectual property infringement claims. The client remains responsible for verifying the originality, legality and suitability of any AI-generated content or outputs before public dissemination or commercial use.

40. Third-party services

40.1 DevEdge services frequently depend on third-party providers, including hosting suppliers, registrars, payment providers, software vendors, APIs, cloud platforms, analytics platforms and AI providers.

40.2 Third-party services are governed by their own terms, availability and pricing.

40.3 DevEdge is not responsible for outages, changes, defects, discontinuation or restrictions caused by third-party providers outside our reasonable control.

40.4 Where a third-party product changes materially, we may recommend an alternative or charge for migration or redevelopment where significant additional work is required.

41. Third-party licences

41.1 Projects may use third-party plugins, themes, fonts, stock assets, APIs, SaaS platforms, open-source software and other licensed components.

41.2 These remain subject to their respective licences and are not owned by the client merely because they are used within a DevEdge project.

41.3 Where DevEdge initially provides a third-party licence, continued access after termination, transfer or expiry of the DevEdge service may require the client to purchase their own licence.

41.4 Third-party licence fees and renewal costs are chargeable as Third-Party Charges where they are shown separately, in accordance with clause 10.

42. Security

42.1 DevEdge applies reasonable technical and organisational security measures appropriate to the services supplied.

42.2 Hosting environments may include technologies such as server-level malware protection, firewalls, Cloudflare services, SSL, monitoring and access controls.

42.3 Website Support may include WordPress application-level security measures where provided by the selected plan.

42.4 Where included in the selected service, DevEdge Connect provides automated website security monitoring, subject to clause 21.

42.5 Security measures reduce risk but cannot guarantee prevention of every attack, compromise, vulnerability or malicious action.

42.6 Clients are responsible for maintaining appropriate passwords, multi-factor authentication where available, user permissions and internal security practices.

43. Security incidents

43.1 Where DevEdge identifies a security incident affecting a managed service, we may take reasonable steps to investigate, contain or mitigate the issue.

43.2 We may temporarily restrict access, suspend a compromised account, reset credentials or take other reasonable protective measures where necessary to protect the client, other users or DevEdge infrastructure.

43.3 Security remediation outside the normal scope of the client's service may be chargeable.

44. Data protection

44.1 DevEdge complies with applicable UK data protection law, including the UK GDPR and the Data Protection Act 2018.

44.2 DevEdge is registered with the Information Commissioner's Office under registration number ZB823609.

44.3 DevEdge acts as a data controller for personal information processed for its own business purposes, including client administration, billing, enquiries and support records.

44.4 Where DevEdge processes personal data on a client's behalf as part of hosting, Website Support, development, monitoring, backups or other technical services, DevEdge acts as a data processor or subprocessor, as applicable.

44.5 The DPA forms part of the applicable service agreement where DevEdge processes personal data on behalf of the client, and takes precedence as set out in clause 5.3. It sets out the responsibilities of both parties, including processing instructions, security measures, authorised subprocessors, personal data breaches, data retention, return and deletion, and individual rights.

44.6 On the end of a service, personal data processed on your behalf is returned or deleted at your choice in accordance with clause 64 and the DPA.

44.7 Further information about how DevEdge processes personal information for its own purposes is available in our Privacy Policy.

45. Client privacy and compliance responsibilities

45.1 Clients remain responsible for determining the legal requirements applicable to their own business, website and processing activities.

45.2 Unless expressly included in scope, clients remain responsible for matters including privacy notices, cookie information, consent requirements, lawful bases for processing, data retention requirements, marketing permissions and industry-specific regulation.

45.3 DevEdge may assist with technical configuration but does not provide legal advice unless expressly arranged through an appropriately qualified provider.

46. Confidentiality

46.1 DevEdge will treat confidential client information with reasonable care and will use it only as required to deliver and administer the agreed services.

46.2 Access to client systems and information is limited to people or approved partners who reasonably require access for the relevant work.

46.3 Where a separate non-disclosure agreement has been entered into, that agreement will apply in addition to these Terms.

47. Client and third-party changes

47.1 DevEdge is not responsible for faults, downtime, vulnerabilities, performance problems or data loss to the extent they are caused by unauthorised, uncoordinated or inappropriate changes made by the client or another third party outside DevEdge's control.

47.2 Where investigation or remediation is required following such changes, additional work may be chargeable.

48. Intellectual property and ownership

48.1 Upon payment in full of all amounts due for a project, the client will own bespoke code, designs, graphics and content created specifically for that client as part of the agreed project, unless otherwise stated in writing.

48.2 DevEdge background IP: this transfer does not include ownership of DevEdge's pre-existing intellectual property, which remains our exclusive property, including:

• • DevEdge's pre-existing tools, starter themes and utility scripts;
• • reusable code, libraries and modular components;
• • internal frameworks, development workflows and methodologies;
• • know-how, general techniques and technical architecture;
• • open-source software, third-party plugins, themes, fonts, APIs and stock imagery (which remain subject to their respective third-party licences).

48.3 Licence to client: conditional upon payment in full of all fees due, DevEdge grants the client a perpetual, worldwide, non-exclusive, royalty-free licence to use, operate, execute, display and modify DevEdge's pre-existing tools and reusable components solely to the extent incorporated into, and necessary for the normal operation, maintenance and hosting of, the completed website or deliverable. This licence does not grant the right to extract, sub-licence, distribute or commercialise DevEdge's background IP or reusable tools as standalone products, templates or software.

49. Client-supplied materials

49.1 You retain ownership of materials supplied to DevEdge.

49.2 You warrant that you have the necessary rights, licences and permissions for us to use those materials as part of the agreed work.

49.3 You are responsible for claims arising from materials supplied by you where those materials infringe the rights of another party.

50. Portfolio use

50.1 Unless otherwise agreed in writing or restricted by confidentiality obligations, DevEdge may identify completed public-facing work as part of its portfolio and may display publicly available screenshots, the client's name and a general description of the work.

50.2 Where a project is white-label, confidential or subject to an NDA that prevents such use, those restrictions will take priority.

51. Business continuity

51.1 DevEdge maintains backup and continuity procedures intended to support recovery following service disruption, hardware failure or data loss.

51.2 Recovery times depend on the affected system, incident, hosting environment and availability of usable backups.

51.3 No recovery time is guaranteed unless expressly stated in a separate SLA.

51.4 Clients with mission-critical systems should maintain appropriate independent continuity and disaster recovery arrangements.

52. Suspension

52.1 DevEdge may suspend all or part of a service where reasonably necessary because of:

• • non-payment, in accordance with clause 13;
• • material breach of these Terms;
• • illegal activity;
• • spam or abuse;
• • security compromise;
• • excessive resource usage;
• • threats to infrastructure;
• • third-party provider requirements;
• • other activity that creates a material security or operational risk.

52.2 Where reasonably possible, we will notify the client before suspension. Immediate action may be taken where necessary to protect infrastructure, data, other clients or third parties.

52.3 Suspension does not stop fees falling due or pause any Minimum Term. We do not delete data because a service is suspended.

53. Contract term and renewal

Standard minimum terms

53.1 Hosting services: our standard Minimum Term for hosting services is 12 calendar months from the Activation Date.

53.2 Website Support plans: our standard Minimum Term for monthly-billed Website Support plans is 3 calendar months from the Activation Date.

53.3 The Minimum Term that applies to your service is the one shown in your order, Service Contract or proposal at the time you agree to it.

53.4 If no Minimum Term is shown, or it is shown as "no minimum term" or 0 months, the service has no Minimum Term. It runs on a monthly rolling basis from the Activation Date and either party can end it by giving 30 calendar days' written notice, unless a different Notice Period is shown.

After the Minimum Term

53.5 Following completion of the Minimum Term, the service automatically continues on a monthly rolling basis without entering a further fixed-term commitment, unless the parties expressly agree otherwise.

53.6 Monthly rolling services may be cancelled by either party by giving written notice of at least the Notice Period.

Annual prepaid service periods

53.7 Where a service is purchased and paid for in advance for a fixed billing period (for example annually), the minimum contractual commitment extends to the end of that paid period where it would otherwise expire earlier.

53.8 Clients may give cancellation or non-renewal notice during the prepaid period, subject to the applicable notice requirements. Unless earlier termination is agreed in writing or required by law, the service will remain available until the end of the prepaid period, provided the client complies with their contractual obligations.

53.9 Fees paid in advance are non-refundable. Cancellation or notice of non-renewal does not shorten the prepaid period or entitle the client to a refund of fees already paid, except where required by law, where agreed in writing, where DevEdge ends the service for a reason other than the client's breach (in which case DevEdge will refund the unused part), or where another contractual remedy applies.

Annual renewals and monthly transitions

53.10 Before an annual service period ends, DevEdge will give the client at least 30 calendar days' written notice of the monthly recurring fee that will apply afterwards. The notice will explain the monthly rate, the transition date and the available options, including cancellation and annual renewal.

53.11 Unless the client expressly chooses annual renewal (for example in the Client Area or in writing), the service will move to monthly rolling billing at the notified monthly rate when the annual period ends. An annual renewal that creates a new fixed commitment must be expressly agreed by the client. Automatic collection of an annual renewal payment does not by itself count as agreement: if an annual renewal is collected without the client having chosen it, the client may ask within 30 calendar days of payment to switch to monthly billing, and DevEdge will refund or credit the payment less the monthly fees for the period used.

53.12 Where the required notice has not been given, DevEdge will not implement an unnotified price increase, and clause 10.7 applies.

Minimum commitment

53.13 Monthly billing during a Minimum Term does not make the underlying contract cancellable on a monthly basis.

53.14 Fees falling due during an agreed Minimum Term remain payable in accordance with the contract, subject to any agreed early release, lawful termination or other applicable legal rights.

Service Contracts

53.15 Where a service has its own Service Contract, accepted by the client when ordering or afterwards, that contract sets out the Minimum Term, notice, billing, price change, non-payment and end-of-service arrangements for that service and takes precedence over these Terms on those matters, as set out in clause 5.3.

54. Existing Client Arrangements

54.1 The standard Minimum Terms stated in these Terms apply to new services ordered on or after 22/10/2026, unless otherwise expressly agreed.

54.2 Services ordered before 22/10/2026 are not subject to any Minimum Term or Service Contract. They continue on a monthly rolling basis, with no Minimum Term, on the notice period that already applies to them (30 calendar days unless a different period was agreed). This remains the case unless the client expressly agrees a Minimum Term for that service, for example by accepting in the Client Area a Service Contract or offer that states that a Minimum Term applies to that existing service and shows its start and end dates.

54.3 Version 2.0 of these Terms applying to existing services from 1 December 2026 (see clause 1.3), or accepting any updated version of these Terms or a Service Contract for a service you already have, does not by itself:

• (a) start a new Minimum Term;
• (b) extend a Minimum Term that is already running; or
• (c) impose a Minimum Term on a service that is already operating on a rolling basis or has no agreed Minimum Term.

Any Minimum Term already running continues to its original end date. A new Minimum Term for an existing service applies only if you expressly agree it, as described in clause 54.2.

54.4 Where an existing service is subject to an agreed Minimum Term, DevEdge may record the original commencement and expiry dates in the Client Area for administrative and billing purposes.

54.5 Any agreed change to the duration, price or material contractual obligations of an existing service will be recorded and, where required, separately accepted by the client.

55. Cancellation and notices

55.1 Cancellation notice must be given in writing. Any of the following counts as written notice:

• (a) using the cancellation or contract notice facility in the Client Area;
• (b) a support ticket raised in the Client Area; or
• (c) an email to [email protected] from the account holder's registered email address.

55.2 Notice is treated as received on the date (UK time) it is successfully submitted through the Client Area or the email arrives. We will confirm the resulting end date in writing. If you are locked out of the Client Area or your service is suspended, you can still give notice by email.

55.3 Notice must be given by the account holder or a user authorised to act for the account.

55.4 Notices from DevEdge: we give written notice by email to the account holder's email address in the Client Area and, where possible, place a copy in the Client Area. Our notices are treated as received on the next business day after we send them.

56. Withdrawal of cancellation notice

56.1 A client may request to withdraw cancellation notice before the End Date.

56.2 Withdrawal through the Client Area is permitted while that option remains available. Where online withdrawal is unavailable, DevEdge may agree to reinstate or continue the service following a written request.

56.3 An accepted withdrawal means the service continues under its existing contractual arrangements, unless otherwise expressly agreed. It does not start a new Minimum Term.

56.4 Withdrawal does not automatically reverse invoices, credits, refunds or other financial adjustments already completed.

57. Cancellation during a Minimum Term

57.1 Clients may give notice of cancellation at any time during a Minimum Term.

57.2 Unless an earlier termination date has been expressly agreed, the contract ends on the later of:

• (a) the expiry of the Minimum Term; or
• (b) the end of the Notice Period after valid cancellation notice is received.

57.3 To end a service at the expiry of its Minimum Term, valid cancellation notice must therefore be received at least the Notice Period before that term expires. Where notice is received later, the service continues until the Notice Period has elapsed.

57.4 Fees remain payable for the service provided during the Minimum Term and Notice Period.

58. Billing period in which cancellation takes effect, and the End Date

58.1 Recurring service fees are invoiced in advance.

58.2 Where the contract end date falls within a billing period that has already been paid for in full, the service will remain available until the end of that paid billing period, without an additional recurring charge for that period.

58.3 The End Date is the later of the contract end date and the end of any billing period paid for in full. The End Date is the single date that triggers removal of the service and the start of the Retrieval Period under clause 64.

58.4 Where a billing period has not been paid for in full, the invoice for it:

• (a) remains payable for the part of that period up to the contract end date, calculated pro rata;
• (b) does not extend the service beyond the contract end date; and
• (c) is not cancelled automatically when notice is given or the service ends.
• Any invoice for a billing period that starts after the contract end date will be cancelled or credited.
• 58.5 No new recurring service period will be charged solely because DevEdge continues providing the service until the end of an already-paid billing period.
• 58.6 This clause does not prevent earlier suspension or termination where permitted under these Terms or applicable law.

59. Cancellation after the Minimum Term

59.1 Once a service has entered its monthly rolling period, or where it has no Minimum Term, it may be cancelled by giving written notice of at least the Notice Period.

59.2 The service will normally remain available until the End Date, subject to payment, security requirements and the other provisions of these Terms.

59.3 After the Minimum Term, DevEdge may also end a service by giving written notice of at least the Notice Period. If it does, DevEdge will refund any fees paid for the period after the End Date, and clause 64 applies.

60. Early release from a Minimum Term

60.1 DevEdge may, at its discretion, agree in writing to release a client from a Minimum Term before its scheduled expiry.

60.2 Any early-release arrangement must specify the agreed termination date, the settlement amount, the payment deadline and whether payment releases the client from all further recurring fees for the affected service.

60.3 Unless otherwise agreed, an approved early release takes effect only after any agreed settlement amount has been received in cleared funds.

60.4 The settlement amount will not exceed the recurring fees remaining for the Minimum Term, less any costs DevEdge avoids because the service ends early (for example third-party licence and infrastructure costs), and may take account of other relevant contractual circumstances.

60.5 An early-release settlement is not an additional charge on top of recurring fees covering the same remaining service period.

60.6 No early release or settlement is agreed merely because a client submits a cancellation request.

61. Service termination

61.1 On the End Date, DevEdge may stop the relevant service and remove its associated hosting resources from live use, subject to clause 64, any outstanding payment arrangements and legal obligations.

61.2 Clients should arrange any necessary data exports, website migrations and email transfers before the End Date.

61.3 Domain registrations continue as set out in clause 30 and remain subject to applicable registry and registrar requirements.

62. Termination by DevEdge

62.1 DevEdge may terminate a service immediately where there is:

• • non-payment of an invoice that remains unpaid 30 calendar days after its due date (see clause 13);
• • material breach of these Terms;
• • illegal use;
• • serious security abuse;
• • repeated misuse of hosting resources;
• • fraudulent activity;
• • conduct that materially threatens DevEdge infrastructure or other clients.
• 62.2 Where appropriate, we may provide an opportunity to remedy a breach before termination.
• 62.3 The date of termination is the End Date, and clause 64 applies.

63. Termination during a Minimum Term

63.1 Where a client materially breaches the agreement, including through non-payment, DevEdge may suspend or terminate the affected service in accordance with these Terms and applicable law.

63.2 Termination for breach does not cancel invoices properly issued or release the client from payment obligations which accrued before termination.

63.3 Where DevEdge seeks to recover losses arising from early termination caused by a client's breach, any claim will be subject to the terms of the agreement, applicable law and appropriate adjustments for costs reasonably avoided or losses mitigated.

63.4 DevEdge will not charge both recurring service fees and an early-termination settlement for the same service period in a manner that results in duplicate recovery.

63.5 Termination of a hosting service does not terminate any separate domain registration, third-party licence or other independently contracted service.

64. Data, backups and migration at the end of a service

64.1 You are responsible for arranging any required transfer, export or migration before the End Date. DevEdge will provide reasonable assistance with an orderly transfer where requested, subject to payment of applicable charges.

64.2 For 30 calendar days after the End Date (the "Retrieval Period"), DevEdge will keep your website files, databases, mailboxes and other hosted data, either in the suspended service or as a complete backup copy. During the Retrieval Period you can tell us, through the Client Area, by support ticket or by email, whether you want us to:

• (a) return your data, by providing a full backup for download or temporary access so that you can export it; or
• (b) delete your data straight away.

64.3 If you ask for your data back during the Retrieval Period, we will provide it even if that takes us beyond the end of the period. Unless you ask for earlier deletion, we will delete the active service data at the end of the Retrieval Period, or once we have returned your data if that is later.

64.4 After the End Date and the Retrieval Period, your data is removed from live systems. Routine backups cannot be deleted individually: copies held in backup systems are kept on their normal rolling retention cycle (between 21 days and 12 months, depending on the server or platform and the plan, as described in clause 28) and are deleted as those backups expire, and in any event no later than 12 months after the End Date. Until then they are kept secure, access is restricted, and they are not restored or used except where you ask us to or where the law requires.

64.5 This clause applies however the service ends, including where it ends on your notice, on DevEdge's notice or on termination for non-payment or breach.

64.6 DevEdge will not withhold the return of personal data processed on your behalf as a way of collecting unpaid fees. Unpaid fees remain payable, and migration assistance beyond providing a backup or temporary access may be charged.

64.7 DevEdge may retain information for longer where required for legal, accounting, security or regulatory purposes. Retained information remains protected and is not used for unrelated purposes. DevEdge's own business records are covered by its Privacy Policy, and security monitoring records by clause 21.20.

64.8 Where DevEdge processes personal data on your behalf, the DPA applies and takes precedence on the return and deletion of that data.

65. Liability

65.1 DevEdge will provide its services with reasonable care and skill.

65.2 Nothing in these Terms excludes or limits liability where it would be unlawful to do so, including liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation.

65.3 Exclusion of specific losses: subject to clause 65.2, DevEdge shall not be liable to the client, whether in contract, tort (including negligence), breach of statutory duty, indemnity, misrepresentation or otherwise, for any of the following categories of loss or damage, in each case whether direct, indirect or consequential:

• • loss of profits, revenue or turnover;
• • loss of business, sales or contracts;
• • loss of anticipated savings;
• • loss of commercial opportunity;
• • loss of or damage to goodwill, brand or reputation;
• • loss of, corruption of or damage to data, software or database records;
• • business interruption, operational downtime or wasted management time;
• • special, exemplary, indirect or consequential losses of any kind.

65.4 The exclusion of loss of, corruption of or damage to data in clause 65.3 does not apply to loss caused by DevEdge deleting, or failing to return, your data in breach of clause 64, a Service Contract or the DPA. Such loss remains subject to the cap in clause 65.6.

65.5 DevEdge is not responsible for loss caused by matters outside its reasonable control, including third-party provider outages, cyberattacks, internet failures, software defects, client actions or force majeure events.

65.6 Aggregate liability cap: where DevEdge is held liable for direct loss not effectively excluded above, our total aggregate liability arising out of or in connection with the contract or relevant service (whether in contract, tort including negligence, or otherwise) will in no circumstances exceed the total fees actually paid by the client for the affected service during the 12 months immediately preceding the event giving rise to the claim.

65.7 Where the affected service has been active for less than 12 months, liability will not exceed the total fees paid for that service during the period it has been active.

65.8 This liability cap does not apply where liability cannot legally be limited.

66. Data loss

66.1 DevEdge takes reasonable precautions to protect client data but cannot guarantee that data loss will never occur.

66.2 Where backups are included, restoration depends on the availability and integrity of a suitable backup.

66.3 Clients remain responsible for maintaining appropriate independent copies of business-critical data where required.

67. Insurance

67.1 DevEdge maintains Professional Indemnity Insurance and Cyber Liability Insurance appropriate to its business activities.

67.2 Current evidence of cover can be provided on request.

67.3 Insurance limits may change from time to time and do not themselves determine or increase DevEdge's contractual liability.

68. Force majeure

68.1 DevEdge is not liable for failure or delay caused by circumstances beyond its reasonable control. These may include internet or network outages, third-party hosting failures, cloud or software provider outages, cyberattacks, utility failures, industrial disputes, government action, war, civil unrest, fire, flood, severe weather, natural disasters and other events outside DevEdge's reasonable control.

68.2 We will take reasonable steps to resume affected services when practicable.

69. Changes to services

69.1 Technology, software, infrastructure and third-party services change over time.

69.2 DevEdge may make reasonable technical changes to a service where required for security, compatibility, performance, legal compliance or continued operation.

69.3 Where a change would materially alter the nature of a contracted service, we will notify the client where reasonably practicable. Price changes are dealt with under clause 10.

70. Changes to these Terms

70.1 DevEdge may update these Terms to reflect changes in law, technology, security requirements, service structure or commercial arrangements.

70.2 Where a change materially affects the contractual rights or obligations of an existing client, DevEdge will provide appropriate notice and, where required, seek the client's agreement before the change takes effect.

70.3 Changes will not retrospectively impose a new Minimum Term, increase an existing Minimum Term or restart an existing contract term without the client's express agreement.

70.4 Where the existing agreement permits a change to take effect by notice, DevEdge will follow the applicable notice provisions and any requirements imposed by law.

70.5 The current version of these Terms will be published on the DevEdge website.

70.6 DevEdge may maintain an electronic record of the versions accepted by clients, together with the relevant acceptance dates and contractual service details.

70.7 Clause 1.3 explains when this version applies to new orders and to existing services.

71. Entire agreement

71.1 These Terms, together with the applicable proposal, quotation, statement of work, Service Contract, service-specific terms, the DPA and any expressly incorporated policies, form the agreement between DevEdge and the client.

71.2 They supersede previous discussions or communications relating to the same subject matter, except where an earlier written agreement has expressly been preserved.

72. Severability

72.1 If any provision of these Terms is found to be invalid, unlawful or unenforceable, the remaining provisions will continue in full force.

73. Waiver

73.1 A failure or delay by either party to enforce a right under these Terms does not waive that right.

74. Third-party rights

74.1 Unless expressly stated otherwise, a person who is not a party to the agreement has no right to enforce these Terms.

75. Governing law

75.1 These Terms are governed by the laws of England and Wales.

75.2 The courts of England and Wales will have exclusive jurisdiction over disputes arising from these Terms, subject to any rights that cannot legally be excluded.

76. Contact

76.1 Questions about these Terms should be sent to:

• DevEdge Ltd, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ
• Email: [email protected] | Telephone: +44 (0)7944 857818
• Company number: 15132814 | ICO registration: ZB823609 | Registered in England & Wales

DevEdge Ltd

Effective date: 16 October 2026

This Data Processing Agreement (“DPA”) forms part of the contractual agreement between DevEdge Ltd (“DevEdge”, “we”, “us” or “our”) and the client (“you” or “your”) where DevEdge processes personal data on the client’s behalf.

This agreement supplements our Terms and Conditions and applies to relevant services provided by DevEdge.

1. Scope and Application

This DPA applies where DevEdge acts as a data processor on behalf of a client acting as a data controller, or where DevEdge acts as a subprocessor on behalf of a client acting as a processor, under applicable data protection law, including the UK GDPR, the Data Protection Act 2018, and the EU GDPR (Regulation (EU) 2016/679) where applicable (together, “Data Protection Legislation”).

Relevant services may include:

• Website and managed WordPress hosting.
• Website Support and technical maintenance.
• Website backups, recovery and restoration.
• DevEdge Connect website health and security monitoring.
• DevEdge Hub reporting, diagnostics and incident management.
• Emergency Response services.
• Website and email migrations.
• Development, integration and technical administration services.
• Other agreed services involving the processing of personal data.
• This DPA applies only to personal data processed on behalf of the client.

Where DevEdge acts as an independent data controller, including for its own billing, business administration and client account management, that processing is governed by our Privacy Policy and applicable data protection law.

2. Roles and Responsibilities

The client acts as the data controller, or as a processor acting on behalf of another controller, in respect of personal data supplied to or processed through the relevant services.

DevEdge acts as a data processor or subprocessor, as applicable.

The client is responsible for:

• Establishing a lawful basis for processing personal data.
• Providing appropriate privacy notices to individuals.
• Determining the purposes of processing and applicable retention requirements.
• Managing data subject requests and other controller obligations.
• Ensuring that instructions given to DevEdge are lawful.
• Obtaining any necessary authorisation from an upstream controller where the client acts as a processor.

DevEdge is responsible for processing personal data in accordance with this DPA, documented lawful instructions and its applicable obligations under data protection legislation.

3. Processing Instructions

DevEdge will process personal data only on the client’s documented instructions, including instructions relating to international transfers, unless otherwise required by applicable UK, EU or member state law to which DevEdge is subject.

The service agreement, agreed service configuration, this DPA and subsequent documented instructions together constitute the client’s instructions.

DevEdge may process personal data as reasonably necessary to deliver, maintain, secure, monitor, troubleshoot and administer the agreed services within those instructions.

If DevEdge is legally required to process data outside those instructions, it will inform the client beforehand unless prohibited by law.

Where DevEdge reasonably believes an instruction infringes applicable data protection law, it will inform the client without undue delay.

4. Confidentiality

DevEdge will ensure that personnel authorised to process client personal data are subject to appropriate confidentiality obligations.

Access to client personal data will be limited to personnel and approved service providers who reasonably require access to perform their responsibilities.

Confidentiality obligations will continue after an individual’s involvement in providing the services ends.

5. Security Measures

DevEdge will implement appropriate technical and organisational measures, taking into account the nature, scope, context and risks of the processing.

Depending on the service, these may include:

• Access controls and restricted administrative permissions.
• Encryption in transit and, where appropriate, at rest.
• Hosting and application-level security measures.
• Malware detection, vulnerability monitoring and security updates.
• Logging, monitoring and security incident investigation.
• Backup and recovery arrangements.
• Security segregation between client environments.
• Measures to maintain the confidentiality, integrity and availability of systems.
• Processes for reviewing and assessing security controls.
• The precise measures depend on the purchased service and applicable technical environment.

DevEdge may update security technologies and implementation methods provided an appropriate level of protection is maintained.

6. DevEdge Connect and Security Monitoring

Where DevEdge Connect is enabled, technical and security-related personal data may be processed to provide website monitoring, diagnostics, vulnerability assessment and incident management.

This may include:

• Pseudonymous administrator account identifiers.
• Administrator account creation, removal and permission changes.
• Login timestamps and relevant authentication activity.
• IP addresses and approximate location information where necessary for security monitoring.
• Two-factor authentication status where supported.
• Website security configuration and relevant software changes.
• Technical fault information and security incident records.
• DevEdge aims to minimise the personal information collected and transmitted.

Routine monitoring is not intended to collect passwords, password hashes, authentication tokens or session credentials.

Monitoring is subject to the agreed service scope and the DevEdge Connect & Security Monitoring provisions within our Terms and Conditions.

7. Subprocessors

The client grants DevEdge general written authorisation to engage subprocessors reasonably necessary to provide the agreed services, subject to the conditions in this section.

These may include providers of:

• Hosting and server infrastructure.
• Cloud storage and off-site backups.
• Content delivery, DNS and security services.
• Monitoring and technical infrastructure.
• Support, communication and incident-management systems.
• DevEdge will maintain a current register of subprocessors identifying their functions and relevant processing locations.

Where DevEdge intends to add or replace a subprocessor, it will provide reasonable advance notice and an opportunity for the client to object on legitimate data protection grounds.

The client may raise an objection within 14 calendar days of notification. DevEdge will consider reasonable objections and discuss available alternatives. Where an objection cannot reasonably be resolved, the parties may agree an alternative service arrangement or termination of the affected service in accordance with the applicable contract and legal obligations.

DevEdge will ensure subprocessors are bound by written contractual obligations providing an equivalent level of protection to the applicable requirements of this DPA.

DevEdge remains responsible to the client for the performance of its subprocessors’ data protection obligations in accordance with applicable law.

8. International Data Transfers

Hosting and backup regions: Personal data processed under this agreement is hosted, managed and backed up across infrastructure located within the United Kingdom and the European Economic Area (EEA), specifically:

• United Kingdom: London (Region eu-west-2)
• European Union: Germany / Berlin (Region eu-central-3)

Cross-border transfers: Transfers of personal data between the UK and the EEA/EU rely on mutual UK and EU adequacy regulations. Where personal data is transferred internationally outside the UK or EEA, or where adequacy regulations are varied or no longer apply, DevEdge ensures appropriate statutory transfer safeguards are maintained, including:

• The UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses;
• The European Commission’s Standard Contractual Clauses (EU SCCs – Commission Implementing Decision (EU) 2021/914, Module 2 Controller-to-Processor or Module 3 Processor-to-Processor as applicable), which are hereby incorporated by reference;
• Another legally permitted transfer mechanism under applicable Data Protection Legislation.
• DevEdge will undertake or assist with relevant transfer risk assessments where required.

9. Personal Data Breaches

DevEdge will notify the client without undue delay, and where feasible within 48 hours, after becoming aware of a confirmed personal data breach affecting personal data processed on the client’s behalf.

Where reasonably available, notification will include relevant information about:

• The nature of the incident.
• The categories of personal data potentially affected.
• The known or reasonably estimated impact.
• Measures taken or proposed to contain and address the incident.
• Information may be provided in stages as an investigation progresses.

DevEdge will take reasonable steps to investigate, contain and remediate incidents within its responsibilities and assist the client with relevant breach notification obligations.

The client remains responsible for determining whether notification to the ICO, relevant EU supervisory authority or affected individuals is required, except where applicable law places a direct obligation on DevEdge.

10. Data Subject Rights

Taking into account the nature of the processing, DevEdge will provide appropriate technical and organisational assistance to enable the client to respond to data subject rights requests.

These may include requests for access, rectification, erasure, restriction, portability or objection.

Where DevEdge receives a request directly concerning personal data processed on the client’s behalf, it will refer the request to the client where appropriate, unless legally required to respond otherwise.

DevEdge will not independently determine the outcome of requests concerning data for which the client is responsible as controller.

11. Compliance Assistance

Taking into account the nature of processing and information available to DevEdge, we will provide reasonable assistance with the client’s obligations relating to:

• Security of personal data.
• Personal data breach assessment and notification.
• Data protection impact assessments.
• Prior consultation with the ICO where legally required.
• Relevant information concerning processing performed through DevEdge services.

Where assistance requires substantial work outside the contracted service scope, reasonable additional charges may apply where agreed in advance, without limiting assistance DevEdge is legally required to provide.

12. Data Retention, Return and Deletion

Personal data will be retained for the duration reasonably necessary to provide the agreed services and satisfy applicable legal obligations.

Service-specific retention periods, including hosting backups and security monitoring records, may be described in the relevant service documentation.

On termination of the relevant processing services, the client may instruct DevEdge to return or delete personal data processed on its behalf.

DevEdge will provide a reasonable opportunity for the client to request or retrieve relevant data, subject to the service agreement and applicable technical arrangements.

At the client’s choice, DevEdge will delete or return the relevant personal data and delete existing copies, unless applicable law requires retention.

Where data is held in backup systems, deletion may occur through the documented backup expiry and deletion process, subject to appropriate access restrictions and any applicable legal requirements.

Any data retained under a legal obligation will remain protected and will not be used for unrelated purposes.

13. Audit and Compliance Information

DevEdge will make available information reasonably necessary to demonstrate compliance with its obligations under this DPA and Article 28 of the UK GDPR.

DevEdge will allow for and contribute to reasonable audits or inspections by the client or an appropriately appointed auditor, subject to appropriate confidentiality, security and operational safeguards.

Where practicable, requests may initially be satisfied through relevant policies, records, independent assessments or other supporting documentation.

Audits will be coordinated to minimise unnecessary disruption and avoid compromising other clients’ confidential information or the security of shared infrastructure.

The client will provide reasonable advance notice except where urgent circumstances reasonably justify a shorter period.

Any additional fees for exceptional audit assistance must be reasonable, agreed where applicable and must not prevent the exercise of mandatory statutory audit rights.

14. Processing Records and Cooperation

DevEdge will maintain appropriate records of processing activities where required by applicable data protection law.

The parties will reasonably cooperate to investigate and address compliance concerns affecting personal data processed under this DPA.

Each party will promptly inform the other where it becomes aware of circumstances materially affecting the lawful performance of its obligations.

15. Liability and Relationship with Other Terms

This DPA forms part of the relevant service agreement between the parties.

Commercial liability arrangements in the main agreement apply to this DPA only to the extent permitted by applicable law.

Nothing in this DPA excludes, restricts or overrides statutory responsibilities, regulatory powers or liabilities that cannot lawfully be excluded or limited.

Where another contractual provision conflicts with this DPA concerning mandatory controller–processor obligations, this DPA takes precedence to the extent necessary to comply with applicable data protection law.

16. Duration and Termination

This DPA applies for as long as DevEdge processes personal data on behalf of the client under an applicable service agreement.

Obligations concerning confidentiality, protection of retained data, return or deletion, and compliance cooperation will continue where necessary after termination.

17. Governing Law

This DPA is governed by the laws of England and Wales, subject to applicable mandatory data protection legislation.

Details of Processing

Subject matter

Provision of website hosting, technical support, website monitoring, security services, backup management, migrations, development and associated technical operations.

Duration

For the duration of the relevant service agreement and any applicable lawful retention or deletion period.

Nature and purpose

Hosting, storing, accessing, transmitting, backing up, restoring, monitoring, diagnosing, securing, maintaining, migrating and otherwise technically processing personal data as necessary for agreed services.

Categories of data subjects

Depending on the client’s website and services:

• Website visitors.
• Customers and prospective customers.
• Registered website users and members.
• WordPress administrators and editors.
• Client employees, contractors and representatives.
• Individuals whose information is stored in client-managed applications, databases or mailboxes.

Categories of personal data

Depending on the service and information supplied by the client:

• Names and contact details.
• Account and user profile information.
• IP addresses, technical identifiers and activity records.
• Website form submissions.
• Order, transaction and membership records.
• Website content containing personal information.
• Email messages, attachments and mailbox information.
• Administrator security and authentication telemetry.
• Database records and backup data.

Special category data: Unless explicitly agreed otherwise in a signed Proposal, Statement of Work or service specification specifying agreed elevated technical controls, the client warrants that it shall not instruct DevEdge to process, nor upload to DevEdge-managed environments, any Special Category Data (as defined in Article 9 UK/EU GDPR) or criminal convictions data. Where the client processes sensitive data without prior written agreement, the client remains solely responsible for establishing an appropriate lawful basis and maintaining suitable elevated security safeguards.

Controller obligations

The client retains responsibility for determining lawful purposes, relevant legal bases, required notices, retention requirements and lawful processing instructions.

Processing operations

Collection, receipt, storage, organisation, retrieval, consultation, transmission, backup, restoration, modification, restriction, deletion and other operations necessary to provide the agreed services.

Subprocessor Register

DevEdge may use third-party service providers (subprocessors) to assist in delivering contracted services, including hosting infrastructure, cloud storage, backups, website security, monitoring and related technical operations.

Core hosting, cloud storage and offsite backup infrastructure operates in facilities located in the United Kingdom: London (Region eu-west-2) and the European Union: Germany / Berlin (Region eu-central-3). DevEdge maintains an internal record of relevant subprocessors, including their specific services, types of data processed and processing locations.

Information about subprocessors relevant to a client’s services will be made available upon request.

Where DevEdge intends to add or replace a subprocessor, affected clients will be notified in accordance with Section 7 of this Agreement and given a reasonable opportunity to object on legitimate data protection grounds before the change takes effect.

DevEdge will ensure that subprocessors are subject to appropriate contractual data protection and confidentiality obligations providing an equivalent level of protection in accordance with applicable UK and EU data protection law.

Technical and Organisational Measures

The security measures applicable to a service may include, as relevant:

• Role-based access controls and restricted privileged access.
• Appropriate authentication and multifactor authentication controls.
• Encryption in transit and appropriate storage protection.
• Network, server and application security controls.
• Malware detection and vulnerability management.
• Secure backup storage and restoration procedures.
• Monitoring of service availability and security incidents.
• Logging and incident response processes.
• Software maintenance and security updates.
• Confidentiality obligations for personnel.
• Controlled access to production systems.
• Segregation of client resources and data where appropriate.
• Periodic review of security arrangements.
• Secure disposal or deletion of personal data.

The measures actually implemented depend on the relevant service and infrastructure, and may be supplemented by service-specific documentation. DevEdge will maintain measures appropriate to the risk and its legal obligations.

DevEdge Ltd

Website: https://devedge.co.uk

ICO Registration: ZB823609

This DPA forms part of the applicable contractual agreement between DevEdge and the client where incorporated through the agreed Terms and Conditions or another valid contractual arrangement.