Skip to main content

Business Terms of Use

TryHackMe Ltd,
company number 11673275,
128 City Road, London EC1V 2NX

Effective Date: 10/11/2026

INTRODUCTION

These Terms govern the supply of the Services by TryHackMe Ltd to the Customer named in an Quote. Together with the Quote, the Acceptable Use Policy and the Data Processing Addendum, they form the entire agreement between the parties for the Services. Defined terms are set out in clause 25.

These Terms apply to organisations. Where an individual uses TryHackMe other than through an organisation, TryHackMe’s Terms of Use apply instead.

The Customer’s attention is drawn in particular to clause 8.6 (Customer indemnity) and clause 11 (limitation of liability).

These Terms are intended to be signed as issued. Where the Customer has a requirement that these Terms do not meet, it should be raised before the Quote is issued so that it can be dealt with as an agreed variation under clause 14.1.

Deal specific terms are recorded in the Quote and not in these Terms. A template Quote is at Schedule 1. Any variation to these Terms must be recorded in the Quote in accordance with clause 14.1.

  1. RIGHTS OF USE AND AUTHORISED USERS

    1. Licence. Subject to payment of the Fees and to these Terms, TryHackMe grants the Customer a right, which is not exclusive and which may not be transferred or sublicensed, to permit Authorised Users to use the Services during the Subscription Term solely for the Customer’s internal business, education and training purposes. This clause does not restrict any use expressly permitted under a Master Reseller Agreement, Service Provider Addendum or other written agreement signed by TryHackMe.

    2. Authorised Users. The Customer shall:

      1. ensure that each Authorised User is made aware of, and accepts, the Acceptable Use Policy before being given access to the Services;

      2. be responsible for the acts and omissions of each Authorised User in relation to the Services as if they were the Customer’s own;

      3. not permit any person other than an Authorised User to access the Services; and

      4. promptly notify TryHackMe if it becomes aware of any actual or suspected breach of the Acceptable Use Policy by an Authorised User, and cooperate with any investigation by TryHackMe, including by identifying the Authorised User concerned.

    3. Accounts. The number of Authorised Users shall not exceed the number of Authorised User accounts purchased. Each account is for use by one named individual and may not be shared. The Customer may reallocate an account to a different individual.

    4. Account security. The Customer shall keep, and shall ensure that each Authorised User keeps, all account credentials secure and confidential, shall not permit credentials to be disclosed to or used by any other person, and shall notify TryHackMe promptly on becoming aware of any unauthorised access to or use of an account. The Customer is responsible for all activity under its accounts until TryHackMe has been notified of unauthorised use.

    5. Affiliates. The Customer may permit its Affiliates to use the Services, and may designate employees and contractors of its Affiliates as Authorised Users, provided that the total number of Authorised Users does not exceed the number of accounts purchased and the Customer remains responsible for compliance with these Terms by each Affiliate and each Authorised User as if it were the Customer.

    6. Supply through an Authorised Reseller. Where the Customer obtains the Services through an Authorised Reseller:

      1. these Terms govern the Customer’s and its Authorised Users’ use of the Services, in addition to any agreement between the Customer and the Authorised Reseller;

      2. the Authorised Reseller is not TryHackMe’s agent and has no authority to vary, waive or supplement these Terms, the Acceptable Use Policy or the Data Processing Addendum;

      3. TryHackMe is not party to, and has no liability under, the agreement between the Customer and the Authorised Reseller, and any commitment given by the Authorised Reseller which exceeds or differs from these Terms is the sole responsibility of the Authorised Reseller;

      4. TryHackMe may contact the Customer directly about provisioning, support, security and compliance matters, including notification of a security incident;

      5. TryHackMe shall act only on the Customer’s instructions in relation to the export, return or deletion of Customer Data; and

      6. if the Authorised Reseller’s appointment ends, TryHackMe may contract with the Customer directly, or through another Authorised Reseller, for the remainder of the Subscription Term on these Terms.

    7. Connectivity. The Customer is responsible for the internet connectivity, devices, network configuration and security settings needed to access the Services, including any allow listing required for Lab Environments and VPN access. TryHackMe does not provide these.

  2. THE SERVICES

    1. Availability. TryHackMe shall use commercially reasonable endeavours to make the Services available for at least 99.5% of each calendar month. Availability is measured by TryHackMe’s monitoring and is calculated excluding any period of unavailability attributable to:

      1. planned maintenance under clause 2.2 or emergency security maintenance;

      2. failure, breakage or resetting of an individual Lab Environment or target machine, which is handled through support;

      3. queueing at periods of peak demand where the queue clears within a reasonable period;

      4. failure of a third party hosting, infrastructure or network provider, the internet, or the Customer’s own network or security configuration;

      5. denial of service or other attack, or Force Majeure;

      6. suspension under clause 6.8 or clause 7.9;

      7. free trial, beta and preview features; or

      8. any period during which the Customer is in material breach of these Terms.

      No service credits or other financial remedy applies to availability unless stated in the Quote. TryHackMe shall provide the Customer with its availability figures for any calendar month on written request.

    2. Maintenance. TryHackMe may suspend the Services for planned maintenance. TryHackMe shall use reasonable endeavours to schedule planned maintenance outside Normal Business Hours where practicable and to give the Customer not less than 48 hours’ advance notice through the Platform or by email. Emergency maintenance may be carried out at any time, with notice where practicable.

    3. Support. TryHackMe shall provide its standard customer support via help.tryhackme.com during Normal Business Hours at no additional charge, through the support channels published on the Platform. Standard support does not include training, consultancy, content customisation or integration services, which may be purchased separately.

    4. Changes to the Services. TryHackMe continually develops the Services and may add, update, replace or retire Content, Lab Environments and features from time to time, provided that no change materially reduces the overall functionality of the Services during the Subscription Term. Individual rooms, paths and Lab Environments may be retired or replaced with equivalent content, and retirement of individual Content where equivalent Content remains available is not a material reduction in functionality.

    5. Nature of the Services. The Services are a cyber security training environment. The Customer acknowledges, and shall ensure that each Authorised User understands, that:

      1. the Services by design include Lab Environments, virtual machines, applications, configurations and network topologies which deliberately contain vulnerabilities, misconfigurations, weak credentials and exploitable conditions; tools, scripts, exploits, samples and artefacts, including malware samples and offensive security tooling, provided for training purposes; and content describing and demonstrating attack techniques. These are intended features and are not defects or breaches of any warranty;

      2. TryHackMe’s undertakings as to security and malicious code apply to the Platform save for the content, configuration or behaviour of any Lab Environment or Lab Content;

      3. TryHackMe employs technical measures designed in accordance with good industry practice to isolate Lab Environments from the Platform, from other customers’ environments and from the Customer’s own networks and systems; and

      4. the Customer shall instruct its Authorised Users to access Lab Environments only by the means TryHackMe specifies, not to extract or execute Lab Content outside a Lab Environment, and not to connect a Lab Environment to any Customer production system, and shall not knowingly permit any Authorised User to do so.

    6. No undertaking as to outcomes. TryHackMe gives no warranty that use of the Services will result in any particular learning outcome, level of skill, examination or certification result, improvement in security posture, reduction in security incidents, compliance with any law, standard or framework, or return on investment. Statistics, benchmarks and case studies published by TryHackMe are illustrative and are not a prediction of the Customer’s results. Completion of any content, path or certification is not a representation by TryHackMe as to the competence or suitability of any individual.

    7. Accessibility. TryHackMe does not warrant conformance with any accessibility standard. TryHackMe shall on request provide information about the accessibility of the Services and any known cases where the Services do not conform, and shall use commercially reasonable endeavours to improve accessibility over time.

    8. Third party products. The Services may reference or link to third party products and services. TryHackMe does not endorse them and accepts no responsibility for them. Any transaction between the Customer and a third party is solely between them.

    9. Trials, beta and preview features. Any free trial, beta, preview or free feature is provided as is, may be modified or withdrawn at any time, and is excluded from the availability commitment in clause 2.1, the warranties in clause 5 and the indemnity in clause 10.

    10. AI enabled features.

      1. The Services include features that use artificial intelligence, including a guided learning assistant, adaptive learning that adjusts content and difficulty, and simulators and exercises that generate scenarios and feedback. The Documentation describes the AI enabled features available from time to time.

      2. Some AI enabled features send content entered by an Authorised User to external model providers through a gateway service. Those providers are listed in the subprocessor list published by TryHackMe in the Data Processing Addendum and TryHackMe uses only providers whose terms prohibit them from using that content to train their models and require them to keep it confidential.

      3. TryHackMe does not use Customer Data or the personal data of Authorised Users to train, fine tune or improve any artificial intelligence or machine learning model. TryHackMe may use Usage Data and Anonymous Data for adaptive learning and to improve the Services, as set out in clause 8.7.

      4. Output generated by an AI enabled feature is provided for training purposes only, may be inaccurate or incomplete, and is not advice. As between the parties the Customer owns that output, subject to TryHackMe’s rights in the Content and the Platform. AI enabled features do not make decisions about an Authorised User that have legal or similarly significant effects.

      5. The Customer shall instruct its Authorised Users not to enter into any AI enabled feature any personal data relating to a person other than the Authorised User, any Confidential Information of the Customer, or any credentials, keys or other secrets.

      6. In relation to Authorised Users, these Terms and the Acceptable Use Policy apply to AI enabled features in place of the AI Terms of Use.

  3. CUSTOMER DATA

    1. Ownership. Customer Data remains the property of the Customer. TryHackMe acquires no rights in Customer Data except the licence in clause 3.2 and the rights in clause 8.7. Material the Customer or an Authorised User creates within the Platform is Customer Data, save that any part of it consisting of or derived from Content remains TryHackMe’s.

    2. Licence to TryHackMe. The Customer grants TryHackMe a worldwide, royalty free licence, which is not exclusive, during the Subscription Term and the period in clause 12.6 to host, copy, process, transmit and display Customer Data to the extent necessary to provide the Services, to exercise its rights and perform its obligations under these Terms, and to comply with law.

    3. Customer responsibility. The Customer is solely responsible for the accuracy, quality, integrity and legality of Customer Data, for the means by which it was acquired, and for ensuring that Customer Data and its use in accordance with these Terms do not infringe the rights of any third party or breach any law.

    4. Backups and copies. TryHackMe maintains backups of the Platform for service continuity in accordance with good industry practice. The Services are not designed as a system of record or an archive, and the Customer is responsible for keeping its own copies of any Customer Data it needs to retain. The Customer may export Customer Data through the administration console during the Subscription Term and for the period in clause 12.6.

    5. Removal of material. TryHackMe may remove or disable access to any Customer Data or other material which breaches clause 6.1 or the Acceptable Use Policy, and shall notify the Customer where it does so unless prevented by law.

  4. DATA PROTECTION AND SECURITY

    1. Data protection. Each party shall comply with Data Protection Laws in respect of Protected Data. TryHackMe processes Protected Data as a processor on the Customer’s behalf in accordance with the Data Processing Addendum, which forms part of these Terms. Clause 8.7 sets out the data TryHackMe uses for its own purposes. This clause 4 does not relieve either party of its obligations under Data Protection Laws.

    2. Security. TryHackMe shall:

      1. maintain an information security programme appropriate to the Services, including the technical and organisational measures described in the security documentation made available under clause 4.3, and maintain certification to ISO/IEC 27001:2022 (or its successor) and Cyber Essentials during the Subscription Term, providing copies of the certificates and the ISO Statement of Applicability on request;

      2. encrypt Customer Data in transit and at rest, restrict access to Customer Data to personnel who need it to provide the Services, and maintain logging and monitoring of access to the Platform;

      3. ensure that its personnel with access to Customer Data are bound by written confidentiality obligations;

      4. use reasonable endeavours, in accordance with good industry practice, to ensure that the Platform does not contain or introduce malicious code, other than Lab Content provided for training purposes within a Lab Environment; and

      5. notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Protected Data, and provide the information reasonably required by the Customer to meet its own notification obligations.

    3. Security information. On the Customer’s written request, not more than once in any 12 month period, TryHackMe shall make available:

      1. its current information security certifications and attestations, where held;

      2. a security overview or a completed security questionnaire;

      3. an executive summary of its most recent independent penetration test, where one has been carried out; and

      4. its current list of subprocessors.

      This information is TryHackMe’s Confidential Information. TryHackMe’s ISO/IEC 27001 certification and the information available under this clause satisfy any right of the Customer to audit TryHackMe’s information security controls, save that where the Customer has a specific, documented concern which that information does not address, or a regulator requires it, TryHackMe shall permit an audit on reasonable notice, during Normal Business Hours, no more than once in any 12 month period, at the Customer’s cost, limited in scope to the concern identified, excluding access to data of other customers, and subject to TryHackMe’s reasonable security and confidentiality requirements. Audit of TryHackMe’s processing of personal data is governed by the Data Processing Addendum.

    4. Subprocessors and data location. TryHackMe may engage subprocessors to process Protected Data. The current subprocessors, their locations and the safeguards for any transfer outside the United Kingdom are set out in the subprocessor list published by TryHackMe in the Data Processing Addendum. TryHackMe shall give the Customer not less than 30 days’ notice of any new subprocessor by updating the list and notifying the Customer’s administrator, and the Customer may object on reasonable data protection grounds within that period, in which case the parties shall discuss the objection in good faith and, if it is not resolved, the Customer may terminate the affected subscription on written notice and receive a refund of Fees prepaid for the unexpired part of the Subscription Term. Transfers of Protected Data outside the United Kingdom are made under the UK International Data Transfer Addendum or the International Data Transfer Agreement or, where the Customer is established in the European Economic Area, the standard contractual clauses adopted by the European Commission, or another mechanism recognised under Data Protection Laws.

    5. Regulatory cooperation. Where the Customer is subject to regulatory supervision, TryHackMe shall provide reasonable cooperation and information to enable the Customer to respond to a request from its regulator relating to the Services, at the Customer’s reasonable cost where the request goes beyond the information available under clause 4.3. Where the Customer is a financial entity subject to Regulation (EU) 2022/2554 (DORA) or an equivalent regime requiring specific contractual terms for ICT service providers, those terms shall be set out in an addendum agreed under clause 14.1 and shall not be implied into these Terms.

  5. TRYHACKME’S OBLIGATIONS

    1. Warranty. TryHackMe undertakes that the Services will be provided with reasonable skill and care, will conform in all material respects with the Documentation, and will be provided in compliance with laws applicable to TryHackMe’s provision of the Services.

    2. Exclusions. The undertaking in clause 5.1 does not apply to any failure to conform caused by use of the Services contrary to these Terms, the Documentation or TryHackMe’s instructions, by misuse by the Customer or an Authorised User, or by any modification not made by TryHackMe.

    3. Remedy. If the Services do not conform with clause 5.1, TryHackMe shall, at its own expense, use reasonable endeavours to correct the failure to conform promptly or to provide a workaround. This is the Customer’s sole and exclusive remedy for breach of clause 5.1, without prejudice to the Customer’s right to terminate under clause 12.4 for material breach.

    4. No other warranty. TryHackMe does not warrant that the Services will be uninterrupted or free from errors, that they will meet the Customer’s own requirements, or that the Services or Customer Data will be free from loss, corruption, interception or interference in transmission across any network or facility that TryHackMe does not control.

    5. Compliance. Each party shall comply with all laws applicable to it in connection with these Terms, including laws on bribery, corruption, modern slavery and sanctions, and shall maintain policies and procedures reasonably designed to ensure that compliance.

  6. CUSTOMER’S OBLIGATIONS

    1. Prohibited material. The Customer shall not, and shall ensure that no Authorised User does, use the Services to access, store, distribute or transmit any material that is unlawful, harmful, threatening, defamatory, obscene, infringing, harassing or discriminatory, that facilitates unlawful activity, or that damages or interferes with the Services or their use by any other person.

    2. Prohibited acts. The Customer shall not, and shall ensure that no Authorised User does, except as expressly permitted by these Terms or by law:

      1. sell, license, rent, lease or otherwise commercially exploit the Services, the Platform or any Content;

      2. copy, reproduce, adapt or create derivative works of any Content other than for the Authorised User’s own learning within the Services;

      3. reverse engineer, decompile or attempt to derive the source code of the Software or the Platform;

      4. use any automated means to access, scrape or extract Content or data from the Services;

      5. circumvent or attempt to circumvent any security, isolation or access control in the Services;

      6. use the Services, or any tool, exploit or technique learned or obtained through the Services, to access, attack or interfere with any system, network, account or data other than a Lab Environment assigned to that Authorised User;

      7. use the Services, the Content or any output of the Services to train, fine tune, evaluate or otherwise develop any artificial intelligence or machine learning model, or to build any dataset for that purpose, provided that use of AI enabled features as intended is not a breach of this paragraph; or

      8. access the Services in order to build or benchmark a competing product.

    3. Compliance. The Customer shall comply with all laws applicable to its use of the Services, ensure that its Authorised Users do the same, obtain and maintain any licences, consents and permissions needed for TryHackMe to perform its obligations, and maintain suitable networks, systems and connections for access to the Services.

    4. Acceptable Use Policy. The Customer shall comply with, and shall ensure that each Authorised User complies with, the Acceptable Use Policy, which forms part of these Terms. TryHackMe may amend the Acceptable Use Policy from time to time, provided that no amendment materially reduces the Customer’s rights during the Subscription Term.

    5. No real personal data in Lab Environments or AI features. The Customer shall instruct its Authorised Users not to upload to, enter into or process within any Lab Environment or AI enabled feature any personal data relating to an identifiable individual other than the Authorised User themselves, shall require the use of synthetic data for any exercise involving personal data, and shall not knowingly permit any Authorised User to breach this clause.

    6. Export control and sanctions. The Customer warrants and undertakes that:

      1. to the best of its knowledge, neither it nor any Authorised User is a Restricted Party under applicable sanctions laws;

      2. it will not access or use the Services from, or permit access by any person located in, any territory subject to comprehensive sanctions;

      3. it will not use, export or transfer the Services or any Content in breach of applicable export control or sanctions laws; and

      4. it will not use the Services for the purpose of preparing or conducting offensive cyber operations against any third party.

    7. Customer statements about the Services. The Customer shall not make any representation to an Authorised User or any third party that a remedy, service level, security assurance or certification greater than or different from that set out in these Terms and the Documentation is available in respect of the Services.

    8. Suspension. TryHackMe may suspend access to the Services by any Authorised User immediately, without liability, where TryHackMe reasonably suspects that the Authorised User has breached the Acceptable Use Policy (https://tryhackme.com/legal/acceptable-use-policy) or clause 6.2, and may suspend access by all of the Customer’s Authorised Users where TryHackMe reasonably considers the breach to be systemic or to present a risk to the Services, to other customers or to any third party. TryHackMe shall, where practicable, notify the Customer before suspending and in any event as soon as reasonably practicable afterwards, shall limit the suspension to what is reasonably necessary, and shall restore access promptly once satisfied that the risk has been addressed. Suspension does not entitle the Customer to any refund, credit or extension and does not relieve the Customer of any payment obligation.

  7. FEES AND PAYMENT

    1. Payment. The Customer shall pay the Fees within 30 days of the date of invoice, unless the Quote states otherwise. TryHackMe shall invoice the Fees in advance in accordance with the invoicing schedule in the Quote.

    2. Committed Fees. The Fees for the Subscription Term are committed and are payable in full regardless of the level of use of the Services. Fees are not cancellable and not refundable except as expressly provided in these Terms.

    3. Price adjustment. Unless the Quote states otherwise: (a) on each anniversary of the Subscription Start Date during the Initial Term, and at the start of each Renewal Term, the Fees increase by the most recent 12 month percentage increase in the UK Consumer Prices Index (all items) published by the Office for National Statistics before the date of the adjustment, plus 3%; and (b) TryHackMe may apply a greater increase for a Renewal Term by giving written notice not less than 60 days before the start of that Renewal Term, in which case the Customer may give notice under clause 12.2 that it does not wish to renew. The Quote may fix the Fees for the Initial Term or specify a different annual adjustment.

    4. Taxes and deductions. The Fees are stated in the currency specified in the Quote and are exclusive of value added tax and any other applicable transaction tax, which the Customer shall pay in addition at the applicable rate. All payments shall be made in full without any deduction or withholding by way of set off or otherwise. If the Customer is required by law to withhold any tax from a payment, the Customer shall notify TryHackMe before payment, provide a certificate or other evidence of the tax withheld, and cooperate reasonably with TryHackMe to enable it to obtain any available credit or relief.

    5. Interest. Interest accrues daily on any overdue amount at 8% per annum above the Bank of England base rate from the due date until payment, whether before or after judgment.

    6. Additional services. Any additional services are charged at the rates stated in the Quote or, where none are stated, at TryHackMe’s standard rates notified to the Customer in advance.

    7. Currency. Where the Customer pays in a currency other than that stated in the Quote, the Customer bears any shortfall on conversion and any associated bank charges.

    8. Additional accounts and excess use. The Customer may purchase additional Authorised User accounts during the Subscription Term at the rate stated in the Quote, prorated to the end of the current Subscription Term. Where the number of individuals using the Services exceeds the number of accounts purchased, TryHackMe shall notify the Customer and the Customer shall, within 15 days, either purchase the additional accounts or reduce usage to its entitlement.

    9. Disputed invoices and failure to pay. The Customer shall notify TryHackMe of any invoice it disputes in good faith within 30 days of the invoice date, giving reasons, and shall pay the undisputed part. If any undisputed amount remains unpaid 14 days after TryHackMe has given written notice of failure to pay, TryHackMe may suspend the Services until payment is received, without prejudice to its other rights.

  8. INTELLECTUAL PROPERTY RIGHTS

    1. TryHackMe ownership. TryHackMe and its licensors own all Intellectual Property Rights in the Platform, the Software, the Content, the Documentation and the Services, including all improvements and modifications. These Terms grant the Customer no Intellectual Property Rights except the right of use in clause 1.1.

    2. Assignment of acquired rights. If the Customer, an Authorised User or any person acting on the Customer’s behalf acquires any Intellectual Property Rights in the Platform, the Software, the Content or the Services, the Customer shall assign, and shall procure the assignment of, those rights to TryHackMe on request.

    3. Authority. TryHackMe confirms that it has the rights necessary to grant the rights it grants under these Terms.

    4. Customer Data. As between the parties, the Customer owns the Intellectual Property Rights in Customer Data. The Customer’s responsibilities for Customer Data are set out in clause 3.

    5. Notices. The Customer shall not remove or obscure any proprietary notice on the Platform or the Content.

    6. Customer indemnity. The Customer shall indemnify TryHackMe against all losses, damages, costs (including reasonable legal costs) and expenses incurred by TryHackMe arising out of or in connection with any claim, action or proceeding brought by a third party, including a regulator, arising from:

      1. Customer Data, including any claim that Customer Data, or its use by TryHackMe in accordance with these Terms, infringes the Intellectual Property Rights of a third party, is unlawful or breaches Data Protection Laws;

      2. any use of the Services by the Customer or an Authorised User in breach of the Acceptable Use Policy or clause 6.2, including any access to, attack on or interference with any system, network, account or data other than a Lab Environment assigned to that Authorised User; or

      3. any breach by the Customer of clause 6.5 or clause 6.6,

      except in each case to the extent that the claim results from TryHackMe’s breach of these Terms or negligence, and subject to clause 11. TryHackMe shall notify the Customer promptly of any such claim, shall not make any admission in relation to it without the Customer’s consent (not to be unreasonably withheld or delayed), and shall allow the Customer, at the Customer’s cost, to conduct the defence and settlement of the claim, provided that the Customer keeps TryHackMe informed and does not, without TryHackMe’s consent, settle any claim on terms that impose an obligation on, or admit fault by, TryHackMe.

    7. Usage Data and Anonymous Data.

      1. TryHackMe may collect and use Usage Data, and may aggregate and anonymise Customer Data to produce Anonymous Data, for the purposes of operating, securing, supporting, maintaining and improving the Services, detecting, preventing and investigating fraud, abuse and breaches of the Acceptable Use Policy, billing and account administration, and producing aggregated statistics and benchmarks.

      2. Anonymous Data shall not identify the Customer or any individual. TryHackMe shall not attempt to identify the Customer or any individual from Anonymous Data or disclose it in a form that identifies the Customer.

      3. TryHackMe shall not use Customer Data or the personal data of Authorised Users to train, fine tune or improve any artificial intelligence or machine learning model, save that it may use Usage Data and Anonymous Data for that purpose, and shall not sell the personal data of Authorised Users or use it for targeted advertising.

      4. TryHackMe owns all rights in Usage Data and Anonymous Data. TryHackMe’s processing of personal data for its own purposes is described in its Privacy Policy.

    8. Feedback. The Customer assigns to TryHackMe all Intellectual Property Rights in any feedback or suggestions it or its Authorised Users provide concerning the Services, and TryHackMe may use them without restriction or payment.

    9. Name and logo. Unless the Quote states that logo use is not permitted, the Customer grants TryHackMe a royalty free licence, which is not exclusive, to use the Customer’s name and logo to identify the Customer as a customer of TryHackMe on TryHackMe’s website and in its marketing materials, in accordance with any reasonable brand guidelines the Customer provides. The Customer may withdraw this licence by written notice, and TryHackMe shall stop new uses within 30 days of receipt, except in materials already printed or distributed. Any case study, press release or other public statement about the Customer requires the Customer’s prior written approval. TryHackMe shall not otherwise use the Customer’s name or logo without the Customer’s prior written consent.

    10. Content integrity.

      1. The Customer shall instruct its Authorised Users not to publish, share or distribute any flag, answer, solution or walkthrough for any Content that TryHackMe designates as active, or any part of any TryHackMe certification or examination, and shall not knowingly permit any Authorised User to do so.

      2. The Customer shall not reproduce or adapt any Content, or any material derived from the structure or substance of any Content, to develop or deliver any training, course or assessment outside the Services.

      3. Nothing in this clause restricts the Customer from applying the knowledge and skills its Authorised Users acquire through the Services in the ordinary course of its business, including internal briefings and knowledge sharing that do not reproduce Content.

  9. CONFIDENTIALITY

    1. Obligation. Each party shall keep the other party’s Confidential Information confidential, shall use it only for the purposes of these Terms, and shall not disclose it to any person except:

      1. to its employees, officers, professional advisers, Affiliates and subcontractors who need to know it for those purposes and who are bound by obligations of confidentiality no less protective than this clause 9, the receiving party being responsible for their compliance; or

      2. with the other party’s prior written consent.

    2. Exceptions. Clause 9.1 does not apply to information which:

      1. is or becomes public other than through a breach of these Terms;

      2. was lawfully in the receiving party’s possession before disclosure;

      3. is lawfully received from a third party without an obligation of confidence;

      4. is independently developed without use of the Confidential Information; or

      5. is required to be disclosed by law, a court or a regulator, provided that the receiving party, where lawful, notifies the other party promptly and limits the disclosure to what is required.

    3. TryHackMe Confidential Information. The terms of the Quote, including the Fees, are TryHackMe’s Confidential Information. The Content, Lab Environments, certification blueprints and question banks, security documentation and penetration test information are TryHackMe’s Confidential Information whether or not marked as such.

    4. Duration. The obligations in this clause 9 continue for five years after expiry or termination of these Terms, and for so long as the information remains confidential in respect of Customer Data and the items listed in clause 9.3.

  10. IP INDEMNITY

    1. Indemnity. TryHackMe shall defend the Customer against any claim that the Customer’s use of the Services in accordance with these Terms infringes the Intellectual Property Rights of a third party, and shall indemnify the Customer against damages and costs finally awarded against the Customer, or agreed by TryHackMe in settlement, and the Customer’s reasonable legal costs of complying with this clause 10.1, provided that the Customer:

      1. notifies TryHackMe promptly in writing of the claim;

      2. makes no admission or settlement without TryHackMe’s prior written consent;

      3. gives TryHackMe sole authority to defend and settle the claim; and

      4. provides reasonable cooperation at TryHackMe’s expense.

      The Customer may participate in the defence at its own cost.

    2. Remedies. In defending or settling a claim under clause 10.1, TryHackMe may procure the right for the Customer to continue using the Services, or modify or replace the affected part of the Services so that it is not infringing without material loss of functionality. Where neither is available on commercially reasonable terms, TryHackMe may terminate the affected subscription on 30 days’ written notice and shall refund the Fees prepaid for the unexpired part of the Subscription Term.

    3. Exclusions. Clause 10.1 does not apply to a claim arising from:

      1. modification of the Services other than by TryHackMe;

      2. combination of the Services with any item not supplied by TryHackMe, where the claim would not have arisen but for the combination;

      3. use of the Services otherwise than in accordance with these Terms or the Documentation;

      4. continued use after notice from TryHackMe to stop or after a not infringing alternative has been made available;

      5. Customer Data; or

      6. third party or user contributed content.

    4. Sole remedy. This clause 10 states the Customer’s sole and exclusive remedy, and TryHackMe’s entire liability, for any claim that the Services infringe the Intellectual Property Rights of a third party, and is subject to clause 11.

  11. LIMITATION OF LIABILITY

    1. Liability that is not limited. Nothing in these Terms excludes or limits either party’s liability for:

      1. death or personal injury caused by its negligence;

      2. fraud or fraudulent misrepresentation;

      3. breach of clause 6.2 (Prohibited Acts); or

      4. any other liability which cannot lawfully be excluded or limited.

    2. Excluded losses. Subject to clause 11.1, neither party is liable to the other, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for any:

      1. loss of profit;

      2. loss of revenue;

      3. loss of anticipated savings;

      4. loss of business, business opportunity, contracts or customers;

      5. loss of or damage to goodwill or reputation;

      6. loss, corruption or unavailability of data, except for the reasonable cost of restoring data from the most recent available backup;

      7. wasted management or staff time; or

      8. indirect or consequential loss.

      Each of paragraphs (a) to (h) is a separate exclusion, and paragraphs (a) to (g) apply whether the loss is direct or indirect.

    3. Cap. Subject to clauses 11.1 and 11.3A, each party’s total aggregate liability arising out of or in connection with these Terms and the Quote, whether in contract, tort (including negligence), breach of statutory duty or otherwise, shall not exceed 100% of the Fees paid or payable by the Customer under the Quote in the 12 months immediately preceding the event giving rise to the claim or, where the event occurs during the first 12 months of the Initial Term, the Fees payable for the first 12 months of the Initial Term.

    4. Enhanced cap. Subject to clause 11.1, and notwithstanding clause 11.3, each party’s total aggregate liability for: (a) breach of clause 4 (data protection and security), clause 9 (confidentiality) or the Data Processing Addendum; (b) the indemnities in clause 8.6 and clause 10; and (c) infringement or misappropriation of the other party’s Intellectual Property Rights, including any material or systematic breach by the Customer of clause 8.10 which infringes, misappropriates or unlawfully extracts TryHackMe’s Intellectual Property Rights, shall not exceed 200% of the amount calculated under clause 11.3. Liability under this clause 11.3A is not additional to the limit in clause 11.3; any amount paid under clause 11.3 counts towards the limit in this clause 11.3A.

    5. Implied terms and Customer instructions. Except as expressly stated in these Terms, and to the fullest extent permitted by law, all warranties, conditions and other terms implied by statute or common law are excluded. Nothing in this clause 11.4 excludes the express warranties and undertakings in these Terms. TryHackMe has no liability for any loss caused by an error or omission in any information, instruction or material provided by the Customer.

    6. Fees. Nothing in this clause 11 limits the Customer’s obligation to pay the Fees.

    7. Data Processing Addendum. Each party’s liability under the Data Processing Addendum forms part of, and is subject to, the exclusions and limits in this clause 11, including clause 11.3A.

  12. SUBSCRIPTIONS, TERM AND TERMINATION

    1. Initial Term. Each subscription starts on the Subscription Start Date and continues for the Initial Term stated in the Quote or, where none is stated, for 12 months.

    2. Renewal. Unless the Quote states that the subscription does not renew automatically, each subscription renews at the end of the Initial Term and each Renewal Term for successive Renewal Terms of 12 months, unless either party gives the other written notice that it does not wish to renew not less than 30 days before the end of the current term. Renewal Fees are the Fees for the expiring term, adjusted in accordance with clause 7.3, and are invoiced at the start of the Renewal Term. The renewal invoice shall state the index figure applied. TryHackMe is not required to give notice of an automatic renewal.

    3. No early termination for convenience. Neither party may terminate a subscription for convenience during the Subscription Term. The Customer may reduce the number of Authorised User accounts only with effect from the start of a Renewal Term and by giving notice under clause 12.2.

    4. Termination for cause. Either party may terminate these Terms or any subscription immediately by written notice if the other party:

      1. commits a material breach which is incapable of remedy, or which is capable of remedy and is not remedied within 30 days after written notice specifying the breach and requiring it to be remedied;

      2. fails to pay any undisputed amount within 14 days after written notice of failure to pay; or

      3. becomes insolvent, is unable to pay its debts as they fall due, enters into any arrangement with its creditors, has a receiver, administrator or liquidator appointed, ceases to carry on business, or suffers any analogous event in any jurisdiction.

      TryHackMe may also terminate immediately by written notice where the Customer breaches clause 6.6 or commits a serious or repeated breach of the Acceptable Use Policy or clause 6.2.

    5. Consequences of termination. On expiry or termination of a subscription:

      1. the rights granted under clause 1.1 in respect of that subscription end and Authorised Users shall stop using the Services;

      2. the Customer shall pay all Fees accrued and unpaid at that date; where TryHackMe terminates under clause 12.4 for the Customer’s breach or insolvency, the Fees for the remainder of the Subscription Term shall also become immediately payable as a debt. Where the Customer terminates under clause 12.4(a) or (c) for TryHackMe’s breach or insolvency, or TryHackMe terminates under clause 10.2 or clause 13.1, TryHackMe shall refund any Fees prepaid for the unexpired part of the Subscription Term; and

      3. clauses 2.5, 2.6, 3, 4, 6.2, 6.5, 6.6, 6.7, 7, 8, 9, 10, 11, 12.5, 12.6 and 14 to 25, and any other provision which is expressed or intended to survive, continue in force.

    6. Customer Data on exit.

      1. The Customer may export Customer Data through the administration console during the Subscription Term and for 30 days after expiry or termination.

      2. TryHackMe shall delete Customer Data from its production systems within 90 days after the end of that export period, except as set out in paragraphs (c) and (d).

      3. Customer Data in backups is deleted in accordance with TryHackMe’s backup rotation cycle and is not accessed or used for any other purpose during that period.

      4. TryHackMe may retain records of breaches of the Acceptable Use Policy, security incidents and enforcement action, including account identifiers needed to give effect to a suspension or ban, for so long as necessary for those purposes, and may retain any data it is required by law to retain.

      5. TryHackMe shall confirm deletion in writing on request.

      6. Where the Customer requires assistance with export beyond the standard functionality of the administration console, TryHackMe shall provide reasonable assistance at the rates in clause 7.6.

  13. FORCE MAJEURE

    1. Neither party is liable for any failure or delay in performing its obligations under these Terms caused by Force Majeure, provided that it notifies the other party promptly and uses reasonable endeavours to mitigate the effect. This clause does not excuse any obligation to pay. If Force Majeure prevents performance of a material part of the Services for more than 60 consecutive days, either party may terminate the affected subscription by written notice and TryHackMe shall refund any Fees prepaid for the unexpired part of the Subscription Term.

  14. VARIATION

    1. Subject to clauses 14.2 and 14.3, no variation of these Terms or a Quote is effective unless it is in writing and signed by authorised representatives of both parties. A variation set out in a Quote is effective only where the Quote expressly identifies the clause it varies.

    2. TryHackMe may publish an updated version of these Terms. An updated version applies to the Customer from the start of the next Renewal Term, provided TryHackMe has given not less than 30 days’ notice before that date. No update reduces the Customer’s rights or increases its obligations during the current Subscription Term. If the Customer does not accept an updated version, it may give notice under clause 12.2 that it does not wish to renewon the proposed terms.

    3. TryHackMe may amend the Acceptable Use Policy in accordance with clause 6.4.

  15. WAIVER

    1. A failure or delay by either party in exercising any right or remedy under these Terms is not a waiver of that or any other right or remedy, and no single or partial exercise prevents any further exercise.

  16. RIGHTS AND REMEDIES

    1. Except where these Terms state that a remedy is sole and exclusive, the rights and remedies under these Terms are in addition to, and not exclusive of, any rights or remedies provided by law.

  17. SEVERANCE

    1. If any provision of these Terms is or becomes invalid, illegal or unenforceable, it shall be deemed modified to the minimum extent necessary to make it valid, legal and enforceable or, if that is not possible, deleted. That modification or deletion does not affect the rest of these Terms.

  18. ENTIRE AGREEMENT

    1. These Terms, the Quote, the Acceptable Use Policy and the Data Processing Addendum constitute the entire agreement between the parties in relation to their subject matter and supersede all previous agreements, representations and understandings relating to it.

    2. Each party acknowledges that it has not relied on any statement, representation or warranty not set out in the documents listed in clause 18.1, and waives any claim for innocent or negligent misrepresentation, save that this clause does not limit liability for fraud or fraudulent misrepresentation and does not apply to any written answer given by TryHackMe to a written enquiry from the Customer made before the date of the contract.

    3. Any terms contained in a purchase order, supplier portal or other document issued by the Customer are excluded and have no effect, even if TryHackMe accepts or references the purchase order, unless TryHackMe has expressly agreed to them in writing in accordance with clause 14.1.

  19. ASSIGNMENT AND SUBCONTRACTING

    1. Neither party may assign, transfer, charge or subcontract any of its rights or obligations under these Terms without the other party’s prior written consent, not to be unreasonably withheld or delayed, except that:

      1. either party may assign these Terms in whole to an Affiliate or to a successor in connection with a merger, acquisition or sale of all or substantially all of its relevant business or assets, on written notice to the other party; and

      2. TryHackMe may subcontract the performance of its obligations, remaining responsible for the acts and omissions of its subcontractors.

  20. NO PARTNERSHIP OR AGENCY

    1. Nothing in these Terms creates a partnership or joint venture between the parties, or makes either party the agent of the other. Neither party has authority to bind the other in any way.

  21. THIRD PARTY RIGHTS

    1. No person other than the parties and their permitted successors and assigns has any right under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of these Terms.

  22. NOTICES

    1. A notice under these Terms shall be in writing and sent by email, by hand, by courier or by prepaid recorded delivery to the address or email address for notices stated in the Quote, or to any replacement address notified in writing. Notices to TryHackMe shall be sent to contractsupport@tryhackme.com and marked for the attention of Legal.

    2. A notice takes effect:

      1. if sent by email, at the time of transmission, unless a delivery failure notification is received, or at 9.00 am on the next Business Day if transmitted outside Normal Business Hours;

      2. if delivered by hand or courier, on delivery; and

      3. if sent by recorded delivery, on the second Business Day after posting.

    3. A notice of termination or of material breach sent by email shall also be sent by one of the other methods in clause 22.1, but takes effect in accordance with clause 22.2 on the email being sent.

  23. GOVERNING LAW

    1. These Terms, the Quote and any dispute or claim (including any non-contractual dispute or claim) arising out of or in connection with them or their subject matter or formation are governed by the law of England and Wales.

  24. DISPUTES AND JURISDICTION

    1. Escalation. Before starting proceedings (other than for interim or injunctive relief or to recover undisputed sums), either party may refer a dispute in writing to a senior representative of each party, who shall meet or confer in good faith within 15 Business Days of the referral to try to resolve it. If the dispute is not resolved within 30 days of the referral, either party may proceed.

    2. Jurisdiction. The courts of England and Wales have exclusive jurisdiction to settle any dispute or claim (including any non-contractual dispute or claim) arising out of or in connection with these Terms, the Quote or their subject matter or formation. Nothing in this clause prevents either party from applying to any court of competent jurisdiction for interim or injunctive relief.

  25. DEFINITIONS AND INTERPRETATION

    1. Definitions. In these Terms the following words have the following meanings:

      Acceptable Use Policy means the policy published at tryhackme.com/legal/acceptable-use-policy, as amended in accordance with clause 6.4.

      Affiliate means any entity that directly or indirectly controls, is controlled by, or is under common control with a party, where control means ownership of more than 50% of the voting rights or the power to direct the management of that entity.

      Anonymous Data means data derived from Customer Data which has been aggregated and anonymised so that neither the Customer nor any individual is identified or identifiable from it.

      Authorised Reseller means a person appointed by TryHackMe under a Master Reseller Agreement to resell the Services.

      Authorised User means an employee, contractor, student or other individual whom the Customer has authorised to use the Services under these Terms, or such other person as is expressly permitted under a Service Provider Addendum signed by TryHackMe.

      Business Day means a day other than a Saturday, Sunday or public holiday in England on which banks in London are open for business.

      Confidential Information means information disclosed by one party to the other in any form which is marked as confidential or which would reasonably be understood to be confidential, including the information identified in clause 9.3.

      Content means the rooms, learning paths, questions, answers, flags, hints, walkthroughs, Lab Content, scoring and progression logic, certification blueprints and question banks, badges and other materials made available through the Services by TryHackMe.

      Customer means the entity identified as the customer in the Quote.

      Customer Data means the data, content and material inputted to the Platform by the Customer, by an Authorised User, or by TryHackMe on the Customer’s behalf, excluding Usage Data.

      Data Processing Addendum means TryHackMe’s data processing addendum published at tryhackme.com/legal/data-processing-addendum, in the version current at the Subscription Start Date, as updated by TryHackMe on notice to the Customer where required by Data Protection Laws or where the update does not materially reduce the Customer’s rights, or any Data Processing Addendum signed by both parties in place of it.

      Data Protection Laws means all applicable data protection and privacy laws, including the UK GDPR, the Data Protection Act 2018, Regulation (EU) 2016/679 (GDPR) where applicable, and the Privacy and Electronic Communications (EC Directive) Regulations 2003.

      Documentation means the description of the Services and the user documentation published or made available by TryHackMe from time to time.

      Fees means the fees stated in the Quote and any other amounts payable under these Terms.

      Force Majeure means any event beyond a party’s reasonable control, including failure of a third party network or hosting provider, but excluding an inability to pay or a failure of the party’s own subcontractors that could reasonably have been avoided.

      Initial Term means the period stated as such in the Quote or, where none is stated, 12 months from the Subscription Start Date.

      Intellectual Property Rights means copyright, patents, confidential know how, trade secrets, trade marks, design rights, database rights, domain names and all similar rights anywhere in the world, whether registered or unregistered, including applications and rights to apply.

      Lab Content means the images, virtual machines, applications, configurations, network topologies, tools, scripts, exploits, samples and artefacts made available within a Lab Environment.

      Lab Environment means an isolated environment made available through the Services in which Lab Content runs.

      Master Reseller Agreement means an agreement signed by TryHackMe appointing a person as an Authorised Reseller.

      Normal Business Hours means 9.00 am to 5.30 pm UK time on each Business Day.

      Quote means the quotation or other ordering document which identifies the Services ordered, incorporates these Terms, and is either signed by both parties or signed by the Customer and accepted by TryHackMe in writing or through its ordering process.

      Personal Data Breach, personal data, processor and related terms have the meanings given in Data Protection Laws.

      Platform means TryHackMe’s online platform and business management portal through which the Services are provided, including the Software.

      Privacy Policy means TryHackMe’s privacy policy published at tryhackme.com/legal/privacy-policy.

      Protected Data means personal data received by TryHackMe from or on behalf of the Customer in connection with the Services, excluding personal data that TryHackMe processes for its own purposes as described in clause 8.7 and the Privacy Policy.

      Renewal Term means each successive 12 month period for which a subscription renews under clause 12.2.

      Restricted Party means a person subject to sanctions imposed by the United Kingdom, the European Union, the United States or the United Nations, or owned or controlled by such a person.

      Service Provider Addendum means an addendum signed by TryHackMe permitting the Customer to make the Services available to persons who are not its own employees, contractors or students.

      Services means the cyber security training and testing services provided by TryHackMe through the Platform, as described in the Quote and the Documentation.

      Software means the online applications, tools and Lab Environments provided by TryHackMe through the Platform.

      Subscription Start Date means the date stated as such in the Quote.

      Subscription Term means the Initial Term and each Renewal Term.

      TryHackMe means TryHackMe Ltd, company number 11673275.

      UK GDPR has the meaning given in section 3(10) of the Data Protection Act 2018.

      Usage Data means technical, operational and analytical data generated by the Services about their use and performance, including log data, telemetry, feature usage, activity and completion data, but excluding the content of Customer Data.

    2. Order of priority. If there is a conflict between the documents forming the agreement between the parties, they take precedence in the following order:

      1. the Data Processing Addendum, in relation to the processing of personal data, except that in relation to the timing of notification of a Personal Data Breach, international transfers and subprocessors, and the export, deletion and return of Customer Data, clauses 4.2(e), 4.4 and 12.6 of these Terms prevail;

      2. the Quote, but only in respect of a variation which meets the requirements of clause 14.1;

      3. these Terms;

      4. the Acceptable Use Policy; and

      5. the Documentation and any other document referred to in these Terms.

    3. Interpretation. Clause headings do not affect interpretation. A reference to a statute includes any subordinate legislation made under it and any amendment or replacement of it. Words in the singular include the plural and vice versa. A reference to writing includes email. “Including” and similar expressions are illustrative and do not limit the words preceding them. A reference to a person includes a body corporate, an unincorporated association and a partnership, and a reference to a party includes its successors and permitted assigns.