djinn six ltd
Company number: 16614427
Registered office: 66 Paul Street, London, England, EC2A 4NA
Contact: contact@djinnsix.com

1. About these terms

1.1 These terms and conditions ("these terms") govern the supply of consultancy services and digital deliverables by djinn six ltd ("djinn six", "we", "us", "our") to the business client named in the applicable proposal, statement of work or order confirmation ("you", "your", "the client").

1.2 These terms apply to business clients only. We do not supply services to consumers under these terms.

1.3 These terms, together with the applicable proposal or statement of work ("the engagement documents"), form the entire agreement between us. They supersede all prior discussions and understandings relating to the engagement.

1.4 These terms prevail over any terms you seek to impose or incorporate, including any terms contained in or referred to by a purchase order, supplier onboarding portal, procurement policy or similar document, whether issued before or after these terms. No such terms shall bind us unless a director of djinn six expressly accepts them in writing. Acceptance of a purchase order, commencement of work or delivery of any output does not constitute acceptance of your terms.

1.5 No variation of these terms is effective unless made in writing and signed by a director of djinn six.

2. Our services and deliverables

2.1 We provide cybersecurity consultancy services, including assessments, reviews, reports, advisory work and related digital deliverables as described in the engagement documents.

2.2 Deliverables are digital products. They are supplied as information and professional analysis, not as goods. Legislation governing the sale of physical goods does not apply to them.

2.3 A deliverable is complete when we make it available to you in the agreed format. Minor typographical corrections aside, we are under no obligation to revise a deliverable after completion unless the engagement documents provide for a review cycle.

2.4 Work not described in the engagement documents is out of scope. Any change to scope requires a written variation agreed by both parties before the additional work begins and may carry additional fees. We are under no obligation to perform out-of-scope work, however it is requested.

3. No returns and no refunds

3.1 Deliverables are digital and are consumed on receipt. Once a deliverable has been made available to you the sale is final. You have no right to return it and no right to a refund, credit or set-off on the grounds that you no longer require it, that you disagree with its findings or that your circumstances have changed.

3.2 Nothing in this clause affects any remedy you may have for our failure to exercise reasonable skill and care, which is addressed in clauses 8 and 9.

4. Fees and payment

4.1 Fees are as stated in the engagement documents. All fees are exclusive of VAT, which is payable in addition where applicable.

4.2 Unless the engagement documents state otherwise, fees are payable as follows: fifty per cent of the total fee on acceptance of the proposal and before any work begins, with the remaining fifty per cent payable in full before release of the final deliverable.

4.3 We are under no obligation to begin work before the first payment is received in cleared funds and under no obligation to release any final deliverable before the balance is received in cleared funds. Withholding a deliverable pending payment is not a breach of these terms.

4.4 Invoices are payable in full without deduction, withholding or set-off.

4.5 Where we agree special payment terms in writing for a particular engagement, payment must in every case be received no later than 30 days after the date of the relevant invoice. No agreement, purchase order term or procurement policy extends payment beyond 30 days.

4.6 If you cancel or reschedule scheduled work within 10 working days of its scheduled start, 50 per cent of the fees for the affected work becomes payable; within 5 working days, 100 per cent. These sums reflect the cost of capacity reserved for you which cannot then be resold and are payable in addition to fees for work already performed. We may at our discretion credit a cancellation fee against the rescheduled engagement.

5. Late payment

5.1 If any sum is not received by its due date we may charge interest on the overdue sum under the Late Payment of Commercial Debts (Interest) Act 1998, at the statutory rate of 8 per cent per annum above the Bank of England base rate in force when the sum became overdue. For reference, at the date of this version that statutory rate is 11.75 per cent per annum.

5.2 We may also claim the fixed compensation payable under that Act for each qualifying invoice (currently £40, £70 or £100 depending on the size of the debt), together with our reasonable costs of recovering the debt to the extent they exceed the fixed sum, including debt collection agency fees, tracing fees and legal fees on a full indemnity basis.

5.3 While any sum is overdue we may suspend all work, withhold all deliverables and decline to begin any further engagement, without liability to you.

5.4 We treat court proceedings as a last resort. Persistent non-payment will nonetheless be pursued through the courts where necessary and clause 5.2 costs will be claimed in full.

6. How we work

6.1 Success of an engagement depends on the working environment you provide. You agree to give us access to the decision makers relevant to the engagement, or to people authorised to provide the information, decisions and materials we reasonably request, within timescales that do not delay the work.

6.2 We reserve the right to determine our own working methods, tools, location and conditions. Where we consider that the conditions of an engagement have become unworkable, including through obstruction, unreasonable demands or failure to provide agreed inputs, we may suspend the engagement until the issue is resolved. Fees for work already performed remain payable. If a suspension caused by your failure to meet your obligations under this clause 6 continues for more than 30 days we may terminate the engagement under clause 13 and invoice for all work performed and costs committed to the date of termination.

6.3 The engagement gives you no right of access to our systems, infrastructure, personnel records, methodologies, internal tooling or premises. You are engaging us for defined services and deliverables, not acquiring oversight of or access to our company. Any audit, assurance or supplier due diligence requirement must be agreed in writing in advance and may be chargeable.

6.4 Where the engagement involves testing, scanning or assessing systems, applications or AI endpoints, you warrant that you own each system in scope or hold every authorisation needed for us to test it, and that written authority from any third party owner or operator has been obtained before testing begins. You will indemnify us in full against any claim, investigation, penalty or loss arising from testing performed in reliance on that warranty. We may suspend testing immediately and without liability if we have reason to doubt that the necessary authority exists.

6.5 You acknowledge that testing may affect the performance, availability or data of systems in scope. Effects of that kind are an anticipated outcome of testing, not a breach of these terms and not a security incident caused by us. You are responsible for maintaining adequate backups of all systems and data in scope before testing begins.

7. Intellectual property

7.1 All intellectual property rights in the deliverables and in any materials, methodologies, tools, templates, scan logic, prompts, frameworks and know-how used or created by us in the course of the engagement belong to and remain with djinn six.

7.2 On receipt of full payment we grant you a non-exclusive, non-transferable licence, revocable only if you materially breach this clause 7, to use the deliverables for your own internal business purposes, solely within the scope of the engagement for which they were produced. The licence does not permit you to:

(a) disclose, publish or make the deliverables available to any third party, other than professional advisers bound by confidentiality, regulators where disclosure is required by law or third parties you engage to remediate findings, provided a remediation party receives only the findings needed for that purpose, not our methodologies, and is bound by confidentiality obligations no weaker than clause 10;

(b) apply the deliverables, or the methodologies they embody, outside the scope of the engagement, including to other systems, group companies or clients of yours;

(c) reverse engineer, decompile or attempt to derive our methodologies, tooling or scan logic from any deliverable;

(d) reproduce, adapt or create derivative works from the deliverables for any commercial purpose;

(e) pass off any deliverable, methodology or material of ours as your own or as that of any third party.

7.3 djinn six is a registered trade mark of djinn six ltd (UK trade mark UK00004246085, registered in classes 9 and 42). Probe Six is a brand of djinn six ltd in which we assert and will assert all available rights, including any application or registration made after the date of these terms. You acquire no right to use either mark. We actively enforce our trade mark rights and will pursue infringement and passing off.

7.4 This clause 7 is a condition of the engagement. We do not agree engagements in which it is removed or materially weakened, whatever the procurement route.

7.5 Nothing in these terms transfers to us any intellectual property in materials you provide. You grant us a licence to use those materials solely to deliver the engagement. You warrant that materials you provide do not infringe the rights of any third party and you will indemnify us against claims arising from our use of them in accordance with the engagement.

8. No guarantee of outcome

8.1 We will perform the services with reasonable skill and care, using appropriately experienced people and current professional knowledge.

8.2 Cybersecurity is an adversarial and continuously changing field. Technology, configurations, threat actors and attack techniques all change, sometimes within days. Accordingly:

(a) our findings, assessments and recommendations reflect the tests we performed and the information made available to us at the time of the work, and speak only as at that time;

(b) a finding that no issue was detected is not a finding that no issue exists, and is not a certification, warranty or guarantee that any system is secure, compliant or free of vulnerabilities;

(c) we do not guarantee any particular outcome, result or level of security, nor that implementing our recommendations will prevent any incident.

8.3 The value you obtain also depends on factors within your control, including how and whether recommendations are implemented. That does not dilute our duty in clause 8.1. Where a deliverable is deficient because we failed to exercise reasonable skill and care, clause 9 governs our liability; clause 8 is not a defence to that failure and is not to be read as placing the consequences of our own errors on you.

8.4 Some deliverables are produced with the assistance of AI tooling. Findings and recommendations, however generated, are professional guidance to be validated in your own environment before implementation, not instructions warranted to be error free. Where an error in a deliverable results from our failure to exercise reasonable skill and care, clause 9 governs; where you implement a recommendation without appropriate validation, clause 9.2(d) applies.

9. Liability

9.1 Nothing in these terms excludes or limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation or for any other liability which cannot lawfully be excluded or limited.

9.2 Subject to clause 9.1, we shall not be liable, in contract, tort (including negligence), breach of statutory duty or otherwise, for:

(a) loss of profits, revenue, business, anticipated savings, goodwill or reputation;

(b) loss or corruption of data;

(c) losses arising from any security incident, breach, attack or compromise affecting your systems, whenever occurring, except to the extent such losses are caused by our failure to exercise reasonable skill and care, in which case our liability is limited by clause 9.3 rather than excluded;

(d) losses arising from your acts or omissions, from information you provided that was incomplete or inaccurate or from decisions you took or declined to take;

(e) any indirect or consequential loss of any kind, whether or not foreseeable and whether or not we were advised of its possibility.

9.3 Subject to clauses 9.1 and 9.2, our total aggregate liability arising out of or in connection with an engagement shall not exceed the total fees paid by you under that engagement.

9.4 We are not liable for any failure or delay caused by events outside our reasonable control.

9.5 No claim may be brought more than 12 months after the completion or termination of the engagement giving rise to it.

10. Confidentiality

10.1 Each party shall keep confidential all information disclosed by the other in connection with the engagement which is identified as confidential or which a reasonable person would regard as confidential, including the existence and content of findings, reports and commercial terms.

10.2 Confidentiality obligations bind both parties equally and survive completion or termination of the engagement for five years, save that trade secrets remain protected without limit of time.

10.3 Either party may disclose confidential information where required by law or a regulator, to professional advisers bound by confidentiality or, in our case, to associates under clause 11.

10.4 We may state the fact that you are or were a client, and the general nature of the work, in credentials and proposals unless the engagement documents provide otherwise. We will not disclose findings or identifiable detail without your written consent.

11. Associates and trusted third parties

11.1 We may perform any part of the engagement through associates, subcontractors and trusted third parties selected by us. We remain responsible to you for work performed on our behalf.

11.2 You consent to us sharing information relating to the engagement, including your confidential information, with such associates to the extent needed for the engagement. Every associate is bound by written confidentiality obligations no less protective than clause 10 before receiving any of your information.

11.3 We will notify you of any associate who will have access to your confidential information or personal data, on or before the point at which they first receive it. We do not require your consent to engage an associate. If you object on reasonable security grounds we will discuss the concern in good faith before proceeding.

11.4 Where an associate processes personal data, clause 12 applies and the sharing will comply with UK GDPR.

12. Data protection

12.1 Each party shall comply with applicable data protection law, including UK GDPR and the Data Protection Act 2018, in connection with the engagement.

12.2 Where we process personal data on your behalf the engagement documents shall include or incorporate processing terms meeting the requirements of Article 28 UK GDPR. Our privacy policy describes our processing as a controller.

13. Term and termination

13.1 Either party may terminate an engagement immediately by written notice if the other commits a material breach which is not remedied within 14 days of notice requiring remedy, or becomes insolvent.

13.2 We may terminate or suspend under clauses 5.3 and 6.2.

13.3 On termination for any reason, fees for work performed to the date of termination become immediately payable, accrued rights survive and clauses 3, 5, 7, 8, 9, 10, 12 and 14 continue in force.

14. General

14.1 You may not assign or transfer the benefit of an engagement without our written consent. We may assign to a successor of our business.

14.2 Neither party may solicit for employment or engagement any person employed or engaged by the other who was materially involved in the engagement, during the engagement and for 12 months after, save through a genuine public recruitment process.

14.3 If any provision of these terms is found unenforceable, the remainder continues in force and the provision is deemed modified to the minimum extent needed to make it enforceable.

14.4 A person who is not a party to the engagement has no rights under the Contracts (Rights of Third Parties) Act 1999 to enforce it.

14.5 Formal notices under an engagement must be in writing and sent by email to the contacts named in the engagement documents, taking effect when received.

14.6 These terms and any dispute arising out of or in connection with them are governed by the law of England and Wales and the courts of England and Wales have exclusive jurisdiction.