Terms of Service

Acceptance

By using this website you agree to Part A. If you do not agree, please do not use the site. Visiting the site does not make you a client and does not bring Part B into effect. Part B applies only when a proposal or statement of work refers to it.

Permitted use

You may view the site, link to it, and share links to it. You may not:

• Copy, scrape, or republish the site's content or code, other than as needed to view it in a browser.
• Probe, scan, or test the site or its hosting for vulnerabilities, or try to bypass any access control, without our written permission.
• Interfere with the site's availability or with other visitors' use of it.
• Use the site for anything unlawful, or to send us unlawful or infringing material.

Intellectual property

The site's design, text, code, graphics, and the Nycto name and logo belong to us or our licensors. You get no licence to use them beyond viewing the site. Open-source software used in the site stays under its own licence.

Client logos and project images

The client names, logos, and project images on the site belong to their owners. They appear with the owner's permission, to show work we have done. Their presence does not mean the owner endorses us or that we speak for them. If you own a logo or image shown here and want it changed or removed, email info@nyctosys.com and we will act promptly.

No warranty on site content

The site is provided as is. Its content is general information and may be out of date. It is not advice, and it is not an offer that becomes a contract when you accept it. A contract for services is formed only under Part B.

We take reasonable steps to keep the site secure and available, but we do not promise it will be uninterrupted, error-free, or free of harmful components.

Links to third parties

The site links to our profiles on Facebook, Instagram, LinkedIn, and WhatsApp. Those services are run by other companies under their own terms and privacy policies. Nothing loads from them until you click a link. We do not control them and are not responsible for them.

Liability for the website

The site is free to use and provided for information only. So far as the law allows, we are not liable for loss arising from your use of it or your reliance on its content.

Nothing in Part A limits liability that cannot be limited by law, including liability for death or personal injury caused by negligence, or for fraud. If you are a consumer, your statutory rights are not affected.

Changes

We may change the site and Part A at any time. The date at the top of this page shows when we last changed these terms. Using the site after a change means you accept the change.

Definitions

A few terms have a fixed meaning in Part B:

• Proposal: a written proposal, quote, or statement of work we issue and you accept, in writing or by paying the first invoice.
• Services: the work described in the Proposal.
• Deliverables: the outputs we agree to deliver under the Proposal, such as code, designs, documents, configurations, reports, or hardware.
• Client Materials: content, data, credentials, systems, accounts, and anything else you give us or give us access to.
• Fees: the amounts payable under the Proposal.
• Agreement: the Proposal, Part B, and any data processing agreement between us, read together.

How Part B applies

If the parts of the Agreement conflict, this order applies: the data processing agreement for data protection matters, then the Proposal, then Part B. Terms printed on your purchase order or other documents do not apply unless we accept them in writing.

Scope and changes

We deliver what the Proposal describes. Anything outside it is a change. Either of us may ask for a change in writing. Before we start on a change, we tell you its effect on Fees and timing, and we start only when you confirm in writing. Email counts as writing.

Timelines in a Proposal are estimates and depend on you providing what we need on time. If a delay on your side delays the work, dates move by at least the same amount. The Proposal may allow us to charge for time we reserved but could not use.

Your responsibilities

To let us deliver on time, you will:

• Give us the Client Materials, access, and information we need, when we need them.
• Give decisions and approvals within five business days, unless the Proposal says otherwise.
• Name a contact who can make decisions for you.
• Make sure Client Materials are lawful, do not infringe anyone's rights, and that you have the right to give them to us.
• Keep your own backups of your systems and data, unless the Proposal says we will.
• Keep any credentials we give you secure, and tell us at once if they are compromised.

Fees and payment

Fees are set out in the Proposal, as a fixed price, a day or hour rate, or a recurring charge. Unless the Proposal says otherwise, we invoice [deposit percentage] of a fixed price before we start, the rest at the milestones in the Proposal, and time-based work monthly in arrears. Invoices are due [payment due period] from the invoice date, in [currency].

Fees exclude VAT, sales tax, and similar taxes, and any bank or currency-transfer charges. If your law requires you to withhold tax, tell us before you pay and send us the withholding certificate. Expenses are charged at cost when you have approved them in advance.

If you pay late, we may charge interest at the statutory rate for late payment between businesses under Directive 2011/7/EU: the European Central Bank's reference rate plus eight percentage points, from the due date until you pay. We may also claim the fixed sum of EUR 40 for recovery costs under that Directive, plus reasonable recovery costs above that sum. If the law of your country sets a higher rate or sum, that applies instead. We may pause work seven days after telling you in writing that an invoice is overdue.

If you dispute an invoice, tell us within 14 days of receiving it and pay the undisputed part on time.

Intellectual property

Client Materials stay yours. You give us a licence to use them to deliver the Services.

When you have paid all Fees for a Deliverable, we assign to you the intellectual property in the parts of that Deliverable we created specifically for you. Until then, you may use the Deliverable only to review it.

We keep our pre-existing tools, libraries, templates, and know-how, and anything we develop that is not specific to you. Where they form part of a Deliverable, we give you a perpetual, non-exclusive, royalty-free licence to use them as part of it.

Open-source components stay under their own licences, which you must comply with. We will list the material ones on request. Third-party services in a Deliverable, such as hosting, APIs, or AI models, are governed by their providers' terms, and we do not transfer any rights in them.

Portfolio use

We would like to name you as a client and show non-confidential Deliverables, such as screenshots, your logo, and a short description, on our website, in proposals, and on social media. We do this only with your consent, which we ask for in the Proposal or separately in writing.

You may withdraw consent at any time by emailing info@nyctosys.com. We will remove the material from channels we control within 30 days of your email.

Confidentiality

Each of us will keep the other's confidential information secret, use it only for the Agreement, and share it only with staff, contractors, and advisers who need it and are bound to keep it confidential. Confidential information is anything marked confidential or that a reasonable person would treat as confidential, including Client Materials, pricing, and security findings.

This does not cover information that is public through no fault of the receiving party, that the receiving party already had or develops independently, or that a court or regulator requires it to disclose. In that last case, the receiving party tells the other first where the law allows.

These duties last for three years after the Agreement ends. For trade secrets, personal data, and security findings, they last as long as the information stays confidential. On request, each of us returns or deletes the other's confidential information, except copies the law requires us to keep.

Data protection

Each of us complies with the GDPR, the UK GDPR where it applies, and any other data protection law that applies to us. Each of us is a controller of the business contact details of the other's staff that we use to manage the relationship.

Where we process personal data on your behalf, for example when we build, host, support, or monitor a system that holds your customers' or employees' data, we act as your processor. Before that processing starts, we sign a data processing agreement with you that meets Article 28 GDPR. It covers the subject matter, duration, purpose, and data types, our security measures under Article 32, sub-processors, breach notification, help with data subject requests, and deletion or return of the data at the end.

Our team works from Pakistan, which has no adequacy decision from the EU or the UK. So the data processing agreement includes the Standard Contractual Clauses in Commission Decision (EU) 2021/914, using the controller-to-processor module, or the processor-to-processor module if you are a processor yourself, together with a transfer impact assessment where required. For UK clients, we add the UK International Data Transfer Addendum. The same protections apply under the UK GDPR.

You will not give us more personal data than the Services need, and you are responsible for having a lawful basis to share it. We do not accept special category data, criminal offence data, or data about children unless the Proposal says so. How we handle personal data on our own website and in our own business is described in our privacy policy.

Security services

For penetration testing, vulnerability assessment, threat monitoring, and similar work:

• We test only systems you own, or that you have written authority from the owner to have tested. You warrant that this is true for every target in scope, and you will indemnify us against claims that arise because it was not.
• Before testing starts, we agree the rules of engagement in writing: targets, exclusions, testing windows, contacts, and how to stop a test.
• Testing can slow, crash, or corrupt systems. You accept the risks inherent in the testing you agreed to, and you keep backups. We are not liable for disruption that is an inherent effect of agreed testing carried out within the rules of engagement.
• A test is a snapshot. We do not promise to find every vulnerability, and passing a test does not mean a system is secure.
• Findings are confidential. We do not publish them or name you in connection with them. We keep them only as long as the Proposal or the data processing agreement allows.
• Compliance assistance is practical help with standards and controls. It is not legal advice and it is not a certification.
• If we believe continuing a test would break the law, we stop and tell you.

AI and automation services

For chatbots, assistants, data analysis, workflow automation, and other services that use AI models:

• AI outputs are probabilistic. They can be wrong, incomplete, biased, or infringe someone's rights. We do not guarantee their accuracy.
• You review outputs before you rely on them, and you keep a person in the loop for decisions with legal, financial, medical, safety, or employment effects, or where the law requires it, including Article 22 GDPR and the EU AI Act.
• We may build on models and APIs from third-party providers. The Proposal names them. Their terms, usage policies, availability, and pricing apply and may change, and we are not responsible for their behaviour. Unless the Proposal says otherwise, you hold the provider accounts and pay their charges.
• We do not train or fine-tune models on your data unless the Proposal says so. If you supply data for training, you warrant that you have the rights and a lawful basis to do so. The Proposal says who owns the resulting model weights.
• When you deploy an AI system to your staff or customers, you are its deployer. You are responsible for telling users when they are interacting with an AI system, and for your other deployer duties under the EU AI Act. We help with documentation where the Proposal covers it.

Hardware

Where we supply hardware:

• Title passes to you when you have paid in full. Risk passes when we deliver to your address or, if you arrange transport, when we hand the goods to your carrier.
• The manufacturer's warranty passes to you, and we help you make claims under it. We give no other warranty on hardware, except that our installation and configuration work is done with reasonable skill.
• Delivery dates are estimates. Import duties, customs charges, and local compliance for cross-border shipments are your responsibility unless the Proposal says otherwise.
• Report goods that are damaged or faulty on arrival within seven days of delivery. Consumables and normal wear are excluded.

Acceptance and warranties

When we deliver a Deliverable, you have ten business days to test it against the Proposal and tell us in writing about any material non-conformity. We fix it and redeliver. A Deliverable is accepted when you tell us it is, when the ten days pass without a written report, or when you put it into production use, whichever comes first.

For 30 days after acceptance, we warrant that each Deliverable materially conforms to the Proposal. We also warrant that we perform the Services with reasonable skill and care. If a Deliverable does not conform, we fix it at no charge. That is your only remedy for breach of this warranty.

The warranty does not cover problems caused by changes you or a third party make, by third-party services or platforms, by Client Materials, by use outside the agreed purpose, or by your environment. Beyond what is written here, we give no other warranties. We do not promise uninterrupted operation, specific business results, or compatibility with future changes to browsers, operating systems, or third-party platforms.

Liability

Neither of us is liable to the other for indirect or consequential loss, or for loss of profit, revenue, business, goodwill, or anticipated savings, or for loss of data other than as set out in the data processing agreement.

Each party's total liability under an Agreement, whether in contract, tort, or otherwise, is capped at the Fees you paid under that Agreement in the 12 months before the event giving rise to the claim.

Nothing in the Agreement excludes or limits liability that cannot be excluded by law, including liability for death or personal injury caused by negligence, or for fraud. The cap does not limit your obligation to pay Fees, or your warranty and indemnity in the security services section.

We hold professional indemnity insurance of [insurance limits].

Term and termination

An Agreement starts when you accept the Proposal and ends when the Services are delivered and paid for, or when it is terminated. Recurring services, such as monitoring, support, or hosting, run for the term in the Proposal and renew for the same period unless either of us gives 30 days' written notice before the renewal date.

Either of us may end an Agreement for convenience on 30 days' written notice. If you do, you pay for work done, approved expenses, and commitments we cannot cancel, up to the end of the notice period, and we hand over work in progress once paid.

Either of us may end an Agreement at once by written notice if the other materially breaches it and does not put it right within 14 days of being asked, or becomes insolvent. We may also end it at once if you breach the authority warranty in the security services section.

When an Agreement ends, you pay for work done to that date, we deliver what you have paid for, and each of us returns or deletes the other's confidential information and handles personal data as the data processing agreement says. Sections that by their nature should survive, including intellectual property, confidentiality, data protection, liability, payment, and governing law, survive.

Non-solicitation

For 12 months after an Agreement ends, neither of us will solicit for employment or engagement any employee or contractor of the other who worked on the Services, without the other's written consent. This does not stop either of us from hiring someone who responds to a public job advert or applies on their own initiative.

Force majeure

Neither of us is liable for delay or failure caused by events beyond our reasonable control, such as natural disaster, war, government action, epidemic, or failures of power, telecoms, or third-party platforms that we do not control. The affected party tells the other promptly and does what it reasonably can to reduce the effect. If the event lasts more than 60 days, either of us may end the Agreement on written notice. This section does not excuse payment for work already done.

Governing law and disputes

The Agreement is governed by the law of [governing law]. The courts of [venue] have exclusive jurisdiction, or, if the Proposal says so, disputes go to arbitration under [arbitration rules and seat].

If you are established in an EU member state, the Proposal may instead choose the law and courts of your member state, or arbitration seated there. We are open to that. The choice is one for counsel on both sides, and the Proposal's choice prevails over this section.

Before starting proceedings, each of us refers the dispute to a senior manager and tries in good faith to settle it within 30 days. Either of us may seek urgent court relief at any time to protect intellectual property or confidential information. If you are a consumer, nothing here removes the protection of mandatory law in your country of residence.

General

A few rules apply across the Agreement:

• The Agreement is the entire agreement between us on its subject and replaces earlier discussions. This does not exclude liability for fraud.
• Neither of us may assign the Agreement without the other's written consent. We may use subcontractors, and we stay responsible for their work. Subcontractors who process personal data are listed in the data processing agreement.
• Notices must be in writing. Send ours to info@nyctosys.com and to [registered address]. We send yours to the addresses in the Proposal. Email notices count as received on the next business day.
• If part of the Agreement is unenforceable, the rest still applies.
• Not enforcing a right is not a waiver of it.
• We are independent contractors. Nothing creates a partnership, joint venture, or employment relationship.
• No one other than you and us has rights under the Agreement.
• Each of us complies with the anti-bribery, sanctions, and export control laws that apply to it.
• The English version of these terms governs.