Terms of business - Cloudship

Cloudship Ltd (“Cloudship”), company number 11184233, registered in England and Wales, 38 Bridge Street, Bungay, Suffolk, NR35 1HD.

Version: 1, 1 October 2026

1. How these terms apply

These terms apply to every quote, statement of work and invoice Cloudship issues that refers to them, and to the work it describes (the “work”). The person or organisation it is addressed to is the “client”.
For new work, the client accepts these terms by accepting a quote referring to them, or by expressly instructing Cloudship to proceed after receiving them and before the contract is made.
For work already contracted for, these terms apply only from a date both sides agree in writing. Paying an existing debt does not itself accept a change of terms.
A separately signed agreement between Cloudship and the client wins wherever it differs from these terms. Otherwise these terms win over a quote, unless the quote expressly says it changes a named section of them.
Cloudship offers these terms only for contracts with clients who are not consumers. A consumer is an individual acting wholly or mainly outside their trade, business, craft or profession. Cloudship will agree appropriate consumer terms before accepting consumer work. Nothing here removes any mandatory consumer right.

2. Quotes, scope and estimates

The work is what the quote describes. Anything else is extra, and Cloudship will quote for it and have the client’s agreement before starting it.
Work is charged on time and materials at the rates in the quote, unless the quote states a fixed price. An estimate is Cloudship’s honest forecast, not a fixed price or a promise. Cloudship will tell the client as soon as it expects an estimate to be exceeded.
A fixed price covers only the work the quote describes. Changes the client asks for, or delays the client causes, may be charged as extra.
Prices are in pounds sterling. Cloudship is not registered for VAT, so no VAT is charged. If it registers, VAT will be added at the applicable rate from the date of registration. Third-party costs Cloudship pays on the client’s behalf, such as licences, domain names or hosting, are recharged at cost unless the quote says otherwise.
Dates in a quote are targets, not deadlines.

3. How Cloudship does the work

Cloudship does the work with reasonable skill and care. It gives no other warranty, express or implied, so far as the law allows.
Cloudship builds and supports software (websites, web applications and related tools) and gives software and AI consultancy. Where a quote includes hosting, Cloudship arranges and looks after hosting for software it has built, on third-party platforms (section 5). Cloudship does not operate or manage the client’s own IT systems, networks, devices or staff accounts.
AI tools. Cloudship uses AI coding assistants (for example Claude Code and Codex) to help write specifications, documentation and source code, with model training switched off. Cloudship reviews what they produce and is responsible for it as for any other work. Cloudship uses synthetic or anonymised examples wherever practicable and implements appropriate technical and organisational measures to prevent unauthorised disclosure of client personal data to AI coding assistants. Any planned processing of client personal data through those assistants requires the client’s prior written instructions and compliance with the schedule’s sub-processor and international-transfer requirements (items 4 and 5). Any personal data breach is handled under the schedule.
Subcontractors. Cloudship may use subcontractors for part of the work. Each works under written terms that include confidentiality, assignment to Cloudship of the intellectual property in what they make, data protection obligations no less protective than these terms, and a requirement to hold appropriate insurance. Cloudship stays responsible to the client for their work.
Consultancy, recommendations and written findings are Cloudship’s professional opinion on the information it had at the time. The client decides whether and how to act on them.

4. What the client does

The client will:

give Cloudship accurate information, decisions, content and access when it reasonably needs them;
make sure that content, data, images and trade marks it supplies (“client materials”) are lawful and that it has the right to let Cloudship use them; the client is responsible for any claim that client materials infringe someone else’s rights;
hold its own accounts with third parties (such as domain registrars, email, payment and hosting providers) in its own name wherever practical, keep its credentials secure, and pay those providers’ charges;
test and approve work before it goes live; approving a release, or putting it into use, is acceptance; and
be responsible for its own legal and regulatory compliance, including its website content, privacy and cookie notices, terms with its own customers, accessibility and the rules of its sector, and for keeping its own IT systems and devices secure.

5. Hosting and maintenance, if bought

This section applies only where a quote includes hosting, maintenance or support.

Hosting runs on third-party providers, currently including DigitalOcean servers managed through Laravel Forge, and Netlify. Cloudship may change provider on reasonable notice.
Cloudship gives no uptime or availability guarantee. Any guarantee is the provider’s, on the provider’s own terms; where a provider pays Cloudship a credit for downtime on the client’s hosting, Cloudship passes it on.
Cloudship applies security updates to the software and servers it looks after on a reasonable-endeavours basis, as the quote describes.
Cloudship is not liable for:
- outages, data loss or service changes at a hosting or other third-party provider;
- vulnerabilities in third-party plugins, packages, frameworks or platforms; or
- attacks or security incidents Cloudship could not reasonably have prevented by doing what this section and the quote require.
These exclusions do not apply to the extent that Cloudship’s failure to perform its agreed obligations caused or contributed to the loss. Section 12 still applies.

6. Backups

The client is responsible for backing up its own systems, websites and data unless a quote expressly buys a backup service from Cloudship.
Where a quote does buy a backup service, Cloudship provides it on a reasonable-endeavours basis. Restoring from a backup may not recover everything, and the client keeps its own copies of anything it cannot afford to lose.
Hold harmless. Where the client is responsible for backups under section 6.1, the client holds Cloudship harmless against loss, and will indemnify Cloudship against claims and reasonable costs, to the extent caused by the absence or failure of those backups and avoidable by an appropriate working backup. This does not apply to the extent caused by a breach of contract or negligence by Cloudship or anyone for whose conduct Cloudship is responsible.

7. What Cloudship does not provide unless a quote says so

Unless a quote expressly includes it, Cloudship does not provide managed IT services, security monitoring, backup services, or legal, financial, investment, trading, tax or regulatory advice.
AI-assisted tools and analysis. Some software Cloudship builds uses AI or automated analysis to produce summaries, forecasts, scores or commentary. That output is information and commentary only. It may be inaccurate, incomplete or out of date, and it is not advice or a recommendation to take, or not take, any action. The client is solely responsible for checking it and for every decision it makes using it, and Cloudship is not liable for the results of those decisions. This does not exclude liability for Cloudship’s failure to exercise reasonable skill and care in providing the agreed software or services. Section 12 still applies.

8. Payment

Cloudship invoices as the quote says. Invoices are due within 14 days of the invoice date, without deduction or set-off.
Cloudship may claim interest and compensation on late payment under the Late Payment of Commercial Debts (Interest) Act 1998.
If an invoice is overdue, Cloudship may give the client written notice and, if it is still unpaid 7 days after that notice, suspend work, support and hosting until it is paid. Cloudship is not liable for the effects of a suspension made under this section.

9. Intellectual property

Work Cloudship makes specifically for the client is “bespoke work”. Unless the quote says otherwise, once the client has paid for the bespoke work in full, Cloudship will, on request, sign a written assignment transferring its intellectual property in that work to the client. Until then, the client has a licence to use the bespoke work for the purpose the quote describes.
Cloudship keeps what it owned before the work and its general tools, code, methods and know-how, including improvements to them. Where any of that is part of bespoke work, the client has a permanent, non-exclusive, royalty-free licence to use, copy and modify it as part of that work.
Third-party and open-source components stay under their own licences, which the client agrees to follow.
Client materials remain the client’s. The client licenses Cloudship to use them for the work.
Cloudship may name the client or show its work in a portfolio only with the client’s prior written agreement.

10. Confidentiality

Each side keeps the other’s confidential information confidential, uses it only for the work, and shares it only with staff, subcontractors and advisers who need it and are bound to keep it confidential. This does not cover information that is public other than through a breach of these terms, that the receiving side already had or developed independently, or that the law or a regulator requires to be disclosed. This section continues after the work ends.

11. Data protection

Where Cloudship processes personal data on the client’s behalf, the client is the controller and Cloudship is the processor. Cloudship processes it only on the client’s documented instructions and on the terms of the data processing schedule at the end of these terms.
The client is responsible for having a lawful basis for the processing, for giving people the privacy information the law requires, and for the lawfulness of its instructions.

12. Liability

Nothing in these terms limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else the law does not allow to be limited or excluded.
Neither side is liable to the other for indirect or consequential loss, or for any loss of profit, revenue, business, contracts, anticipated savings or goodwill, whether direct or indirect.
Each side’s total liability to the other arising from or in connection with the work and these terms, whether in contract, tort (including negligence), breach of statutory duty or otherwise, and including liability under data protection law, is limited to the greater of (a) the total fees paid or payable by the client to Cloudship in the 12 months before the Event and (b) £2,500. This limit applies to all claims together. “Fees” here does not include third-party costs recharged at cost under section 2.4. “Event” means the act or omission giving rise to the claim or, for a series of related acts or omissions, the first of them.
The limits and exclusions in this section do not apply to the client’s obligation to pay agreed fees, third-party costs properly recharged under section 2.4, or interest and compensation properly due under section 8.
The limits and exclusions in this section do not apply to the client’s obligations under section 6.3.

13. Ending the work

Either side may end the work, or any hosting or maintenance service, on 30 days’ written notice.
Either side may end it immediately by written notice if the other commits a material breach and does not put it right within 14 days of being asked to, or becomes insolvent.
On ending, the client pays for work done and costs committed up to the end date. Once those invoices are paid, Cloudship hands over the bespoke work it has been paid for, including the source code and documentation it holds; and hands over the credentials for the client’s accounts and transfers any domain names it registered for the client, at the client’s cost for transfer fees. Whether or not those invoices are paid, Cloudship removes its own access to the client’s systems within 14 days of the end date or, where hosting continues under section 13.4, of the end of that hosting period, telling the client which credentials it held so the client can change any that were shared.
Where Cloudship hosts the client’s software, hosting continues for up to 14 days after the end date to allow the client to move it, provided the client pays for that period. After that, Cloudship may close the hosting and delete what it holds, as the schedule describes.
Sections 6, 7, 8, 9, 10, 11, 12, 13 and 16, and the schedule, continue after the work ends for as long as they need to, as does anything else that by its nature should.

14. Events outside anyone’s control

Neither side is liable for delay or failure caused by events beyond its reasonable control, including failures of hosting, internet or power providers. The affected side tells the other promptly and does what it reasonably can to limit the effect. This section does not excuse a failure to pay.

15. Changes to these terms

Cloudship may propose revised terms on at least 30 days’ written notice. Revised terms apply to new contracts only where provided and accepted as section 1.2 describes. Work already contracted for, including ongoing hosting, maintenance and support, continues on its existing terms unless both sides agree the changes and their effective date in writing.

16. General

Entire agreement. These terms, the quote and any separately signed agreement are the whole agreement about the work.
Notices are given by email to the address each side last gave the other, or by post to its registered office.
Transfer. Neither side may transfer its rights under these terms without the other’s written agreement, which will not be unreasonably withheld.
Severance. If a court finds part of these terms unenforceable, the rest still applies.
Insolvency law. Rights to terminate, suspend services or require payment as a condition of continuing services (including under sections 8.3, 13.2 and 13.3) are subject to mandatory insolvency law, including sections 233, 233A and 233B of the Insolvency Act 1986 where applicable.
Governing law. These terms, and any dispute about them, are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Schedule: data processing

This schedule applies wherever Cloudship processes personal data on the client’s behalf, and sets out the terms Article 28(3) of the UK GDPR requires.

The processing. Its subject matter, nature and purpose are building, hosting, maintaining and supporting the client’s software, as the quote describes. It lasts as long as that work continues and until deletion or return under item 8. The personal data is whatever the client’s software holds, typically names, contact details and account and usage data of the client’s customers, website users, staff and contacts, and any other types a quote names.

Cloudship will:

Process the personal data only on the client’s documented instructions, including on transfers outside the United Kingdom, unless UK law requires otherwise, in which case it tells the client first unless that law forbids it. These terms, the quote and the client’s written requests are its instructions. Cloudship immediately tells the client if, in its opinion, an instruction infringes applicable data protection law.
Make sure everyone who processes the personal data is bound to keep it confidential.
Take the security measures Article 32 of the UK GDPR requires, including encryption in transit, access limited to those who need it, multi-factor authentication on the provider accounts and on every system that supports it, and prompt removal of access no longer needed.
Use other processors (“sub-processors”) only under written terms giving the same protection as this schedule. The client authorises those listed below. Cloudship gives the client at least 14 days’ notice of adding or replacing one; if the client objects on reasonable data protection grounds and the two sides cannot agree, the client may end the affected service without waiting for the notice period in section 13.1. Cloudship stays responsible to the client for its sub-processors.
Not transfer personal data outside the United Kingdom unless the transfer meets the requirements of the UK GDPR.
Taking account of the nature of the processing, assist the client through appropriate technical and organisational measures, so far as possible, to respond to individuals exercising their data protection rights. Cloudship also assists with compliance with Articles 32–36 of the UK GDPR, taking account of the nature of the processing and the information available to it. Substantial help may be charged at Cloudship’s normal rates, except where the need for help arises from Cloudship’s breach of this schedule.
Tell the client about a personal data breach affecting the client’s personal data without undue delay after becoming aware of it.
When the relevant processing services end, at the client’s choice, return or securely delete all personal data and delete remaining copies, unless UK law requires retention. Backup copies that cannot immediately be deleted are put beyond use, remain protected by this schedule and are deleted as soon as possible in the ordinary backup cycle. These duties are not conditional on payment and take priority over sections 13.3 and 13.4.
Give the client all information necessary to show compliance with this schedule, and allow for and contribute to audits and inspections by the client or an auditor it appoints, where reasonably required to show that compliance. An audit or inspection is at the client’s cost unless the need for it arises from Cloudship’s breach of this schedule. Except after a personal data breach involving Cloudship or where a regulator requires it, it is on reasonable written notice and no more than once in any twelve months. Any auditor is bound by confidentiality, and an audit is carried out so as to protect other customers’ information.

Authorised sub-processors

Provider	What it does	Where the data sits
DigitalOcean	Servers for hosted web applications	the United Kingdom or the European Union, depending on the client’s hosting
Laravel Forge	Management of those servers	United States, under the UK Extension to the EU-U.S. Data Privacy Framework
Netlify	Hosting for websites and their forms	United States, with global edge processing and onward processing under Netlify’s data processing terms
Hetzner Online GmbH	Server for AstroAdmin, the content editor Cloudship provides for some websites	Finland (European Union)
Cloudship’s subcontractors (individuals based in the United Kingdom; names on request)	Development and support work	United Kingdom
any other provider Cloudship tells the client about under item 4

Changes follow item 4. Cloudship relies on the UK Extension to the EU-U.S. Data Privacy Framework only where the recipient’s active certification covers the transfer; otherwise it puts another lawful transfer arrangement in place before transferring the data.

An AI provider processing client personal data on Cloudship’s behalf is a sub-processor. Any authorised use must comply with items 4 and 5.