Terms of business

Last updated 6 November 2026

Version 1. These terms apply to every audit and care service we supply. Please read them before you ask us to start, and particularly clauses 3, 4 and 13, which cover our right to test your systems, what an audit can and can’t tell you, and the limits on our liability.

1. Who we are

We are Orleyton Ltd, trading as VibeTend, a company registered in England and Wales with number 12577916. Our registered office is The Old Plough, Bagstone Road, Bagstone, Wotton-Under-Edge, GL12 8BD. You can reach us at hello@vibetend.com.

“You” means the business that asks us to do the work. We supply businesses only, not consumers. By placing an order, you confirm you’re acting in the course of a business.

2. How we agree a job

Before we start, we’ll send you an order by email or as a written quote. It sets out which systems are in scope, what we’ll do, the price and anything particular to your job (the “Order”). The contract begins when you accept the Order in writing, and it’s made up of the Order and these terms. If they conflict, the Order wins.

Work outside the Order needs agreeing in writing first, and may cost more.

3. Your permission for us to test

Looking inside a computer system without permission can be a crime under the Computer Misuse Act 1990, so this clause matters to both of us.

• You authorise us to access and test the systems named in the Order, in the ways the Order describes, using the access you give us.
• You confirm that you own those systems, or have the right to give us this permission. That includes any permission you need from other companies whose services your system uses, and from whoever built it.
• We’ll stay within the scope of the Order. We’ll ask for your go-ahead before any test that would create a record in a live system, and we won’t knowingly change or delete your live data without your agreement.
• You’ll compensate us for any claim by a third party that we accessed or tested a system without authority, where that claim arises because this clause wasn’t true.

4. What we’ll do, and what an audit can’t do

We’ll carry out the work with reasonable care and skill, and tell you promptly if we find something urgent.

An audit is a professional review of your system at a point in time. It reduces risk, but it can’t prove that a system is safe. In particular:

• we can’t promise to find every weakness, and new ones can appear after we finish, for example when your system or a service it uses changes;
• unless the Order says so, it isn’t a certified penetration test or a formal certification, and it isn’t a guarantee to anyone;
• our comments on data protection and other law are practical observations, not legal advice;
• our report is for your business. Other people may not rely on it unless we agree in writing.

Any estimates of time or effort in our report are our honest view, not a promise.

5. What we need from you

You’ll give us the access and information we reasonably need, on time, and tell us about anything that could affect our testing, such as a busy trading period or a fragile system. You remain responsible for your own system and data, for keeping your own backups, and for deciding what to do about our findings. Unless the Order says we’ll fix something, carrying out the fixes is up to you.

If we’re delayed because something we need hasn’t arrived, the dates move accordingly, and we may charge for any extra cost that causes.

6. Logins and access

You keep control of your logins. We’ll use the access you give us only for the work, keep it secure, and not write passwords in our reports. At the end of the work you should remove or change any access you gave us, and we’ll remind you. We’ll keep a record of any changes we make to your systems during the work.

7. Care services

Care services include monitoring, user testing, key-person cover, support and taking a system on for you. The Order says which you’ve chosen, what each covers, any hours and any response times.

• They run monthly until either of us ends them by giving at least 30 days’ written notice, unless the Order gives a different term.
• They aren’t a 24-hour service unless the Order says so.
• Monitoring reduces the chance that a problem goes unnoticed, but it can’t catch everything.
• When a care service ends, we’ll hand back what we hold for you in a reasonable form, and help you remove our access.

8. Prices and payment

Prices are in pounds and exclude VAT, which we’ll add where it applies. Unless the Order says otherwise, audits are invoiced when we deliver the report, and care services are invoiced monthly in advance. Please pay within 14 days of the invoice date.

If an invoice is overdue, we may charge interest under the Late Payment of Commercial Debts (Interest) Act 1998 and pause the work until it’s paid. We can change the price of a continuing care service by giving you 30 days’ written notice.

9. Cancelling or ending the contract

You can cancel an audit by telling us in writing. You’ll pay for work we’ve done and costs we’ve committed to up to that point.

Either of us can end the contract at once by written notice if the other seriously breaks these terms and doesn’t put it right within 14 days of being asked to, or becomes insolvent. We can also stop testing at any time if we think continuing could cause harm, or if we doubt we have proper authority.

When the contract ends, you’ll pay for the work done so far. Clauses that are meant to continue, such as confidentiality and liability, will do so.

10. Confidentiality

Each of us will keep the other’s confidential information private, use it only for this work, and share it only with people who need it and are bound to keep it private, or where the law requires. Our findings about your system are confidential to you. We won’t name you as a client or describe your job publicly without your written agreement. This clause continues for five years after the contract ends, and for as long as the information stays sensitive where it concerns security weaknesses.

11. Personal data

When we look at your systems we may see personal data that you are responsible for. We’ll keep this to the minimum the work needs. For that data, you are the controller and we are your processor under UK data protection law, and this clause applies:

• What and why: we process whatever personal data is in the systems in scope, such as customer and staff names and contact details, only for as long as the work needs and only to carry out the Order.
• Your instructions: we’ll act only on your written instructions, which include the Order, unless the law requires otherwise, in which case we’ll tell you if we can.
• Confidentiality and security: everyone we authorise is bound to keep the data confidential, and we use appropriate technical and organisational security measures.
• Other suppliers: you give general permission for us to use sub-processors to deliver our work. We’ll give you our current list before the work starts and tell you about changes, so you can object. We’ll bind them to equivalent terms and remain responsible for them.
• Transfers: if data goes outside the UK, we’ll make sure the safeguards UK law requires are in place.
• Helping you: we’ll help you, as far as is reasonable, to respond to people exercising their rights and to meet your security, breach-reporting and assessment duties. We’ll tell you without undue delay if we become aware of a personal data breach affecting this data.
• At the end: we’ll delete or return the data, as you choose, unless the law requires us to keep it, and we’ll give you the information you reasonably need to show these duties have been met, including allowing reasonable audits.

We’re the controller of our own business contact details for you and your staff. Our privacy notice explains how we use them.

12. Ownership

Your system and your data stay yours. Once you’ve paid, you may use our report and other deliverables freely within your business, and share them with your advisers, insurers and suppliers in confidence. Our methods, templates and general know-how stay ours, and we may use what we learn in general terms, provided nothing identifies you or your system.

13. Our liability to you

Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else the law doesn’t allow us to limit.

Subject to that:

• we aren’t liable for loss of profit, revenue, business, goodwill or anticipated savings, or for any indirect or consequential loss;
• we aren’t liable for weaknesses that already existed, for loss caused by you not acting on a finding, or for the services of other companies that your system uses;
• we aren’t liable for loss of data you could have avoided by keeping suitable backups;
• our total liability under or in connection with each Order, however it arises, is limited to the greater of £10,000 and twice the fees paid or payable under that Order in the 12 months before the event giving rise to the claim.

The law’s implied terms are excluded as far as the law allows, except the promise to use reasonable care and skill.

14. Events beyond our control

Neither of us is responsible for delay or failure caused by something outside our reasonable control, including outages at other companies’ services. This doesn’t apply to your obligation to pay for work done.

15. General

• Notices must be in writing. Email is fine, to the address each of us normally uses for the work, or to hello@vibetend.com for us.
• Changes: we may update these terms for future Orders. The version in force when you accept an Order applies to that Order. Changes to a continuing care service need 30 days’ notice.
• Transfer: neither of us may transfer this contract without the other’s written agreement, not to be unreasonably refused. We may use subcontractors and remain responsible for their work.
• Whole agreement: the Order and these terms are the whole agreement between us about the work. Neither of us has relied on anything else, but this doesn’t limit liability for fraud.
• Other people: nobody else has rights under this contract under the Contracts (Rights of Third Parties) Act 1999.
• If part fails: if a court finds part of these terms invalid, the rest continues.
• Law: these terms and any dispute about them are governed by the law of England and Wales, and its courts alone deal with them.