Legal

Service Terms and Conditions

Last updated: 3 July 2026

These Service Terms and Conditions explain how CyberSprouts provides services to clients.

Please read these terms carefully before buying or using a CyberSprouts service.

By placing an order, making a payment, accepting a quote, booking a service, completing an onboarding form, or otherwise asking CyberSprouts to provide a service, you agree to these terms.

These terms should be read alongside our:

1. Who we are

CyberSprouts is operated by CyberSprouts Limited, a company registered in England and Wales.

  • Company number: 13031873
  • Registered office: 61 Bridge Street, Kington, United Kingdom, HR5 3DJ
  • Contact email: hello@cybersprouts.com

In these terms, “CyberSprouts”, “we”, “us” and “our” mean CyberSprouts Limited.

“You” and “your” mean the person or organisation buying or using our services.

2. What CyberSprouts does

CyberSprouts provides cyber-safety, digital resilience and privacy support for individuals, families, households, older adults, vulnerable individuals and private clients.

Our services may include:

  • cyber-safety assessments;
  • digital safety reviews;
  • family cyber-safety support;
  • exposure checks;
  • public-source checks;
  • consultancy and advisory services;
  • private client security and privacy support;
  • incident, crisis-response and recovery support;
  • reports, recommendations and action plans;
  • related educational content, guidance and support.

The exact service you buy will be described on the relevant service page, order page, quote, proposal, invoice or order confirmation.

3. What CyberSprouts does not do

CyberSprouts provides advice, assessment, support and recommendations. We are not:

  • an emergency service;
  • a law-enforcement body;
  • a statutory safeguarding agency;
  • a social-care provider;
  • a medical provider;
  • a counselling or therapy provider;
  • a legal adviser;
  • a financial adviser;
  • a forensic investigation firm;
  • a 24-hour incident-response service, unless expressly agreed in writing.

We do not:

  • guarantee that all risks, threats, vulnerabilities or exposures will be found;
  • guarantee that every issue can be fixed;
  • guarantee that accounts, data, money or devices can be recovered;
  • guarantee that third-party platforms, providers, banks, schools, authorities or other organisations will act in a particular way;
  • access accounts, systems or devices without proper authority;
  • obtain, store or request passwords, recovery codes or security credentials;
  • bypass security controls;
  • carry out covert monitoring or surveillance;
  • provide offensive security, hacking, stalking, harassment, impersonation or unauthorised investigation services.

4. Service descriptions and scope

Each CyberSprouts service has a defined scope.

The service description, order page, quote, proposal or confirmation may explain:

  • what is included;
  • what is excluded;
  • what information we need from you;
  • whether a survey, consultation or exposure check is included;
  • whether a report, action plan or written recommendations are included;
  • expected timescales;
  • any assumptions or limitations;
  • the price;
  • cancellation and prompt-start information.

If something is not included in the service description, quote, proposal or order confirmation, it is not included unless we agree it in writing.

5. Fixed-price services

Many CyberSprouts services are sold on a fixed-price basis.

A fixed price means that you are paying for the agreed service or package described at the point of purchase. It does not mean that the service is returnable once completed.

Where a fixed-price service includes stages, those stages may be described in the service description, quote, proposal or order confirmation.

6. Ad-hoc, hourly or flexible-price services

Some CyberSprouts services may be provided on an ad-hoc, hourly, day-rate, capped-fee, staged or flexible-price basis.

Where this applies, the relevant quote, proposal, order confirmation or written agreement will normally explain:

  • the charging basis;
  • the hourly, daily, staged or capped rate, if applicable;
  • any minimum charge;
  • any estimated time or cost range;
  • whether payment is required in advance;
  • whether work will stop when an agreed cap is reached;
  • whether further approval is needed before additional work is carried out.

Any estimate is not a fixed price unless we clearly state that it is a fixed price.

For ad-hoc or flexible-price work, you agree to pay for the work properly carried out within the agreed scope, charging basis and any agreed cap.

7. Payment before work starts

Unless we agree otherwise in writing, CyberSprouts services must be paid for before work starts.

For fixed-price services, this will usually mean payment of the full fixed price before we begin work.

For ad-hoc, hourly, staged, capped-fee or flexible-price services, we may require one or more of the following before work starts:

  • payment in advance;
  • a deposit;
  • prepayment for an agreed number of hours;
  • payment for an agreed stage;
  • agreement to a spending cap;
  • written approval of the charging basis.

We do not normally begin assessments, exposure checks, consultancy, report preparation or support activity until payment has been received and the order or engagement has been confirmed.

Payment does not remove your cancellation rights, but cancellation rights may be affected once you ask us to begin work and we start or complete the service.

8. Consumer and business customers

If you buy a service mainly for personal, household or family use, you are likely to be a consumer.

If you buy a service wholly or mainly for business, professional or organisational purposes, you are likely to be a business customer.

Some rights and cancellation protections apply only to consumers. Business customers may not have the same statutory cancellation rights.

9. Prompt start during the cancellation period

CyberSprouts services are often intended to start promptly after payment and may be completed within a few days.

If you are a consumer buying at a distance, for example online, by email or by phone, you may have a 14-day cancellation period.

We do not normally wait 14 days before starting work. Instead, during checkout or order acceptance, we may ask you to confirm that:

  • you want CyberSprouts to begin work before the 14-day cancellation period has ended;
  • you understand that you are buying a service involving professional time, assessment work, advice, exposure checks, report preparation or support activity, not returnable goods;
  • you understand that if you cancel after work has started, you may have to pay for work already carried out;
  • you understand that if the agreed service is fully completed before you cancel, you may lose the right to cancel that completed service.

Cancellation is handled under our Cancellation Policy for Services.

10. Ordering and confirmation

When you place an order, accept a quote or buy a service, we will normally send confirmation by email.

The confirmation may include:

  • the service purchased;
  • the price paid;
  • the order date;
  • the expected next step;
  • a link to or copy of relevant terms and policies;
  • any prompt-start confirmation you gave;
  • any information we need from you to provide the service.

You should keep the confirmation email for your records.

11. Your responsibilities

You agree to:

  • provide accurate and complete information;
  • respond to reasonable requests for information;
  • only provide information you are entitled to share;
  • tell us if information you provided is incorrect or changes;
  • tell us about any urgent, sensitive or safeguarding-related concern;
  • avoid sending passwords, recovery codes, security credentials or unnecessary identity documents;
  • avoid sending unnecessary sensitive personal information;
  • follow reasonable safety instructions or recommendations where relevant;
  • keep copies of important information and documents;
  • make your own decision about whether to act on our recommendations.

You are responsible for your own accounts, devices, settings, subscriptions, backups and third-party services unless we have expressly agreed to provide a specific support activity.

12. Information about other people

Some services may involve information about children, family members, household members, older relatives, vulnerable individuals or other people.

You confirm that you have a proper reason and appropriate authority to provide information about another person.

Where information relates to a child or young person, we normally expect the information to be provided by a parent, guardian or responsible adult.

You must not use CyberSprouts services to monitor, investigate, control or interfere with another person unlawfully or without proper authority.

13. Children and family services

CyberSprouts may provide services designed to help parents, guardians and carers improve children’s online safety.

Where our work relates to children, we aim to minimise the information we collect.

We do not usually need:

  • children’s passwords;
  • private messages;
  • exact dates of birth;
  • school details;
  • identity documents;
  • unnecessary medical, disability or safeguarding information.

We do not use children’s information for marketing.

If a service raises a safeguarding concern, we may handle it in line with our Safeguarding Statement.

14. Exposure checks and public-source checks

Some CyberSprouts services may include exposure checks or public-source checks.

These may involve checking information such as email addresses, usernames, phone numbers or online handles against public sources, breach-notification services, public profiles or other open-source information.

By requesting an exposure check, you confirm that:

  • you have authority to provide the identifiers to be checked;
  • the request is for lawful, defensive and protective purposes;
  • you are not asking us to access private accounts;
  • you are not asking us to bypass security controls;
  • you are not asking us to carry out covert monitoring, surveillance, stalking, harassment or unauthorised investigation;
  • you understand that findings may be incomplete, out of date or affected by third-party data quality.

We may refuse or stop an exposure check if we believe the request is unlawful, unsafe, inappropriate or outside our role.

15. Incident, crisis-response and recovery support

CyberSprouts may offer incident, crisis-response or recovery support.

This support may include practical advice, triage, account-security guidance, recovery planning, signposting, evidence-preservation guidance or recommendations for next steps.

Unless expressly agreed in writing, CyberSprouts does not provide guaranteed emergency response, 24-hour availability, forensic investigation, legal advice, financial advice, law-enforcement support or direct recovery from third-party platforms.

If someone is in immediate danger, contact emergency services. In the United Kingdom, call 999 in an emergency.

If a situation involves crime, fraud, abuse, exploitation, coercion, stalking, harassment, safeguarding risk or financial loss, you may also need to contact the relevant authority, bank, platform, school, local authority, police or specialist support organisation.

16. Reports, recommendations and action plans

Some services include a report, recommendation document, findings summary or action plan.

Reports and recommendations are based on:

  • the information available to us at the time;
  • the information you provide;
  • the checks we agree to perform;
  • the scope of the service purchased;
  • our professional judgement.

Reports and recommendations are not a guarantee that all risks have been found or that all risks can be removed.

You are responsible for deciding whether and how to implement recommendations, unless we have expressly agreed to perform a specific implementation activity.

17. Timescales

We will aim to provide services within the timescale described in the relevant service description, order page, quote, proposal or order confirmation.

Timescales may depend on:

  • when payment is received;
  • when you provide required information;
  • your availability for consultations;
  • the complexity of the issue;
  • the availability and performance of third-party platforms or tools;
  • whether safeguarding, legal, ethical or security concerns arise.

If delay is caused by missing, incomplete or inaccurate information, we may pause work until the required information is provided.

18. Consultations and appointments

If your service includes a consultation, call or meeting, you are responsible for attending at the agreed time and providing any required preparation information.

If you need to reschedule, contact hello@cybersprouts.com as soon as possible.

Missed appointments, late cancellations or repeated rescheduling may be handled under our Cancellation Policy for Services.

19. Communication

We normally communicate by email unless another method is agreed.

You are responsible for giving us a correct email address and checking your inbox, spam or junk folders.

We may use online forms, surveys, document-sharing tools, newsletter platforms, payment platforms, booking tools or other third-party services where appropriate.

You should not send passwords, recovery codes or security credentials by email or through forms.

20. Confidentiality

We will treat client information carefully and confidentially.

However, confidentiality is not absolute. We may need to share information where:

  • you ask us to do so;
  • it is necessary to provide the service;
  • it is required by law;
  • it is necessary to protect our rights, systems, business or clients;
  • there is a serious or immediate risk of harm;
  • safeguarding concerns require action or signposting;
  • a regulator, authority, court, insurer or professional adviser reasonably requires it.

Personal information is handled in line with our Privacy Policy.

21. Privacy and data protection

We collect and use personal information in line with our Privacy Policy.

You agree not to send unnecessary personal information, sensitive information, passwords, recovery codes or security credentials.

Where you provide personal information about another person, you confirm that you have a proper reason and appropriate authority to do so.

22. Third-party platforms, tools and services

CyberSprouts may use or recommend third-party platforms, tools or services.

These may include, for example, email providers, password managers, parental-control tools, device settings, operating-system features, breach-notification services, public-source tools, cloud services, reporting tools, payment providers, newsletter platforms or support organisations.

Third-party services are not controlled by CyberSprouts unless we expressly say otherwise.

You are responsible for reviewing and accepting any third-party terms, privacy policies, costs, limitations or risks.

We are not responsible for third-party outages, errors, delays, data practices, security failures, account decisions, platform rules or refusal to act.

23. Client implementation and risk decisions

CyberSprouts may provide recommendations, priorities and practical steps.

You are responsible for deciding whether to follow those recommendations.

You are also responsible for:

  • backing up important data before making changes;
  • checking that changes are suitable for your household or circumstances;
  • ensuring that account recovery options remain available;
  • understanding the effect of changing settings;
  • obtaining help where a change is outside your confidence or ability.

CyberSprouts is not responsible for loss caused by you implementing advice incorrectly, ignoring warnings, failing to back up information, providing inaccurate information, or making changes outside the agreed service scope.

24. No guarantee of outcome

CyberSprouts will provide services with reasonable care and skill.

However, we do not guarantee any particular outcome.

In particular, we do not guarantee that:

  • all cyber risks will be identified;
  • all privacy exposures will be found;
  • all accounts, devices or services can be secured;
  • compromised accounts can be recovered;
  • scams, fraud, harassment, stalking, grooming or abuse can be stopped;
  • third-party platforms will remove content or close accounts;
  • banks, police, schools, regulators or other bodies will act in a particular way;
  • recommendations will remove all future risk.

Cyber-safety and privacy risk can change over time. A report or recommendation reflects the position and information available at the time it was provided.

25. Refusing, pausing or stopping work

We may refuse, pause or stop work where:

  • the request is outside the agreed scope;
  • payment has not been received;
  • required information is missing, incomplete or inaccurate;
  • the request appears unlawful, unsafe or inappropriate;
  • we are asked to access accounts, systems, devices or information without proper authority;
  • we are asked to obtain passwords, recovery codes or security credentials;
  • we are asked to bypass security controls;
  • we are asked to carry out covert monitoring, surveillance, stalking, harassment, impersonation or unauthorised investigation;
  • the service may increase risk to a child, vulnerable person or person at risk;
  • safeguarding concerns require a different response;
  • continuing would create an unacceptable legal, ethical, security or operational risk.

Where cancellation or refund issues arise, these will be handled under our Cancellation Policy for Services.

26. Your legal rights

If you are a consumer, you have statutory rights.

Nothing in these terms affects your statutory rights.

CyberSprouts must provide services with reasonable care and skill. If a service is not provided with reasonable care and skill, you may have rights under consumer law.

27. Liability

Nothing in these terms limits or excludes liability where it would be unlawful to do so.

This includes liability for:

  • death or personal injury caused by negligence;
  • fraud or fraudulent misrepresentation;
  • breach of statutory rights where liability cannot lawfully be limited or excluded;
  • any other liability that cannot lawfully be limited or excluded.

Subject to the above, CyberSprouts is not responsible for:

  • losses that were not reasonably foreseeable;
  • loss caused by inaccurate, incomplete or misleading information provided to us;
  • loss caused by unauthorised use of our services;
  • loss caused by failure to follow advice or warnings;
  • loss caused by changes you make outside the agreed scope;
  • loss caused by third-party platforms, providers, tools, systems or services;
  • loss caused by pre-existing account, device, security, privacy or household issues;
  • business losses where you purchased as a consumer.

If you are a business customer, subject to the exclusions above and unless otherwise agreed in writing, our total liability for a service will not exceed the amount paid for that service.

28. Intellectual property

CyberSprouts owns or licenses the intellectual property in our website content, templates, frameworks, reports, guides, recommendations, processes, documents and materials unless we state otherwise.

When we provide a report, action plan or document to you as part of a paid service, you may use it for your own personal, household or internal business purposes.

You must not copy, publish, resell, distribute, sublicense, train systems on, or commercially exploit CyberSprouts materials without our written permission.

29. Feedback and testimonials

If you provide feedback, we may use it to improve our services.

We will not publish your name, household details, case details or testimonial without your permission.

30. Complaints

If you are unhappy with a CyberSprouts service, contact hello@cybersprouts.com.

Complaints are handled under our Complaints Policy.

A complaint will not automatically result in a refund. Cancellation and refund matters are handled under our Cancellation Policy for Services and your statutory rights.

31. Changes to services or terms

We may update our services, prices, terms or policies from time to time.

The terms that apply to your purchase are normally the terms in place when you place your order, unless a change is required by law, regulation, security need, safeguarding concern or by agreement with you.

32. Events outside our control

We are not responsible for delay or failure caused by events outside our reasonable control.

This may include:

  • internet, hosting or platform outages;
  • third-party service failures;
  • payment platform issues;
  • email delivery problems;
  • cyber incidents;
  • illness or emergency;
  • legal or regulatory restrictions;
  • acts or omissions of third parties;
  • events that make it unsafe, unlawful or impractical to continue.

Where this affects a service, we will try to contact you and take reasonable steps to reduce the impact.

33. Transfer of rights

You may not transfer your rights or obligations under these terms to another person without our written agreement.

We may transfer our rights or obligations where reasonably necessary as part of business administration, restructuring, legal compliance or service delivery, provided your rights are not materially reduced.

34. Severance

If any part of these terms is found to be invalid, unlawful or unenforceable, the remaining parts will continue to apply.

35. Governing law

These terms are governed by the law of England and Wales.

If you are a consumer living elsewhere in the United Kingdom, you may also have the right to bring proceedings in your local courts.

36. Contact

For questions about these terms, contact:

hello@cybersprouts.com