Version 2.0. Effective 28 August 2026.
These Terms apply to business, education and public sector customers of TryHackMe Ltd. They replace the version last updated 01/10/2025.
TryHackMe Ltd is a company registered in England and Wales, company number 11673275, registered office 128 City Road, London EC1V 2NX.
Where you use TryHackMe as an individual rather than as an organisation, our Terms of Use apply instead. Everyone using the platform is also bound by our Acceptable Use Policy.
1. Rights of Use and Services
1.1 TryHackMe grants the Customer a non-exclusive, non-transferable right to permit its Authorised Users to use the Services during the subscription term, solely for the Customer's internal business operations, provided that this clause 1.1 does not restrict use expressly permitted under a Master Reseller Agreement, Service Provider Addendum or other written agreement signed by TryHackMe.
1.2 The Customer shall: (a) ensure that each Authorised User accepts, and is made aware of, the Acceptable Use Policy before being granted access to the Services; (b) be responsible for the acts and omissions of each Authorised User in relation to the Services as if they were the Customer's own; (c) not permit any person other than an Authorised User to access the Services; and (d) promptly notify TryHackMe if it becomes aware of any actual or suspected breach of the Acceptable Use Policy by an Authorised User, and cooperate with any investigation TryHackMe carries out, including by identifying the Authorised User concerned.
1.3 The number of Authorised Users shall not exceed the number of Authorised User accounts purchased. An Authorised User account may not be used by more than one individual, and may not be shared. The Customer shall not pool, rotate, time-share or reallocate accounts between individuals so as to permit more individuals to use the Services than the number of Authorised User accounts purchased.
1.4 The Customer acknowledges that access to the Services requires internet connectivity and associated infrastructure which TryHackMe does not provide, and that the Services do not include a dedicated backup or disaster recovery facility.
1.5 Supply through an Authorised Reseller. Where the Customer has obtained the Services through an Authorised Reseller:
(a) these Terms govern the Customer's and its Authorised Users' use of the Services, and apply in addition to any agreement between the Customer and the Authorised Reseller;
(b) the Authorised Reseller is not TryHackMe's agent, is not authorised to enter into any agreement on TryHackMe's behalf, and has no authority to vary, waive or supplement these Terms, the Acceptable Use Policy, the Data Processing Addendum, the availability commitment in clause 2.1 or any TryHackMe policy;
(c) TryHackMe is not party to, and has no liability under, the agreement between the Customer and the Authorised Reseller. Any service level, warranty, indemnity, support commitment, security assurance, certification claim or other undertaking given to the Customer by the Authorised Reseller which exceeds or differs from these Terms is the sole responsibility of that Authorised Reseller;
(d) TryHackMe may contact the Customer directly in relation to entitlement, provisioning, support, security, service and compliance matters, including notification of a security incident, and is not obliged to route such communications through the Authorised Reseller;
(e) TryHackMe shall act only on instructions given by the Customer or its authorised administrators in relation to the export, return or deletion of Customer Data, and shall not act on any such instruction given by the Authorised Reseller; and
(f) if the Authorised Reseller's appointment ends, TryHackMe may contract with the Customer directly, or transfer the arrangement to another Authorised Reseller, in each case for the remainder of the then-current subscription term and on these Terms.
1.6 Affiliate use. The Customer may permit its Affiliates to use the Services, and may designate employees and contractors of its Affiliates as Authorised Users, provided that the total number of Authorised Users does not exceed the number of Authorised User accounts purchased and the Customer remains responsible for compliance with these Terms by each such Affiliate and by each Authorised User as if it were the Customer.
2. Services
2.1 Availability.
(a) TryHackMe shall use commercially reasonable endeavours to make the Services available for at least 99.5% of each calendar month.
(b) The commitment in clause 2.1(a) does not apply to, and availability is calculated excluding: scheduled maintenance within a maintenance window notified by TryHackMe; emergency security maintenance; failure of an individual Lab Environment, lab instance or target machine, which is addressed through support rather than as an availability event; breakage of a Lab Environment caused by an Authorised User, and resets; queueing at periods of peak demand where the queue resolves within a reasonable period; failure of a third party hosting or infrastructure provider; the internet, or the Customer's own network, firewall, proxy, content filtering or TLS inspection configuration; denial of service or other attack; Force Majeure; suspension under clause 6B or for non-payment; beta, preview, trial and no-charge features; and any period during which the Customer is in material breach of these Terms.
(c) TryHackMe's monitoring records are the authoritative record of availability.
2.2 TryHackMe shall provide its standard customer support during Normal Business Hours at no additional charge, as part of the Services.
2.3 The Services may reference or link to third party products and services. TryHackMe does not endorse them and accepts no responsibility for them. Any transaction the Customer enters into with a third party is solely between the Customer and that third party.
2A. Nature of the Services
(a) The Services are a cyber security training environment. The Customer acknowledges, and shall ensure that each Authorised User acknowledges, that the Services by design incorporate: (i) Lab Environments, virtual machines, applications, configurations and network topologies which deliberately contain vulnerabilities, misconfigurations, weak credentials and exploitable conditions; (ii) tools, scripts, exploits, samples and artefacts, including malware samples and offensive security tooling, provided for training purposes; and (iii) content describing and demonstrating attack techniques. These are intended features of the Services and are not defects, errors, non-conformities or breaches of any warranty or undertaking.
(b) Boundary of TryHackMe's security undertakings. TryHackMe's undertakings in relation to security, malicious code and conformity with documentation apply to the Platform Control Plane and not to the content, configuration or behaviour of any Lab Environment or Lab Content.
(c) Isolation. TryHackMe warrants that it employs, and shall maintain, technical measures designed in accordance with good industry practice to isolate Lab Environments from (i) the Platform Control Plane, (ii) other customers' environments, and (iii) Customer networks and systems.
(d) Customer responsibilities. The Customer shall instruct its Authorised Users to access Lab Environments only by the means TryHackMe specifies, not to extract Lab Content from or execute it outside a Lab Environment, and not to connect a Lab Environment to any Customer production system, and shall not knowingly permit any Authorised User to do any of those things. The Customer is responsible for its own network controls governing access to the Services.
3. Security of Customer Data
3.1 Customer Data inputted to the Platform remains the property of the Customer.
3.2 The Customer is responsible for maintaining copies of any Customer Data it uploads, provided that TryHackMe shall maintain backups of the Services in accordance with good industry practice, and shall make Customer Data available for export through the administration console during the subscription term and for the period stated in clause 12.6.
4. Processing of Protected Data
Each party shall comply with all applicable Data Protection Laws in respect of Protected Data. The processing of Protected Data by TryHackMe is governed by the TryHackMe Data Processing Addendum, available at /legal/data-processing-addendum, which forms part of these Terms. This clause is in addition to, and does not relieve, remove or replace, either party's obligations under Data Protection Laws. Clause 8.7 sets out the purposes for which TryHackMe processes data as a controller for its own purposes.
5. TryHackMe's Obligations
5.1 TryHackMe undertakes to provide the Services with reasonable skill and care, so that they materially conform to their description, and to comply with laws applicable to its provision of the Services.
5.2 The undertaking in clause 5.1 does not apply to a non-conformance caused by the Customer's or an Authorised User's misuse of the Services, use contrary to TryHackMe's instructions, unauthorised modification, or breach of these Terms.
5.3 Where the Services do not conform to the undertaking in clause 5.1, TryHackMe shall at its expense use reasonable endeavours to correct the non-conformance promptly or provide a workaround, and this is the Customer's sole and exclusive remedy for such non-conformance. The Customer shall not represent to any Authorised User or third party that any remedy greater than that set out in this clause 5.3 is available in respect of the Services.
5.4 TryHackMe does not warrant that the Customer's use of the Services will be uninterrupted or error-free, that the Services will meet the Customer's own requirements, or that the Services or any Customer Data will be free from loss, corruption, interception or interference in transmission across any network or facility TryHackMe does not control.
5A. No undertaking as to outcomes
TryHackMe gives no representation, warranty or undertaking that use of the Services will result in any particular learning outcome, level of skill or competence, examination or certification result or pass rate, improvement in security posture, reduction in security incidents, compliance with any law, standard or framework, or return on investment. Any statistics, benchmarks, outcome figures or case studies published by TryHackMe are illustrative, are derived from other customers, and are not a prediction or undertaking as to the Customer's results. Completion of any content, path or certification is not a representation by TryHackMe as to the competence, trustworthiness or suitability for any role of any individual. TryHackMe does not warrant that the Services conform to any accessibility standard, including WCAG, EN 301 549 or the Revised Section 508 Standards.
6. Customer's Obligations
6.1 The Customer shall not, and shall ensure that no Authorised User does, access, store, distribute or transmit any material during the course of its use of the Services which is unlawful, harmful, threatening, defamatory, obscene, infringing, harassing or racially or ethnically offensive, facilitates unlawful activity, depicts sexually explicit images, promotes unlawful violence or discrimination, or which causes damage or injury to any person or property or adversely affects the operation of the Services or the use of the Services by any other person.
6.2 TryHackMe may disable access to any material that breaches clause 6.1, without liability to the Customer.
6.3 The Customer shall not, except as expressly permitted under a Master Reseller Agreement, Service Provider Addendum or other written agreement signed by TryHackMe, sell, license, lease, rent or otherwise commercially exploit all or any part of the Software, the Platform or the Services.
The Customer shall not use the Services, the Platform, any Content, Documentation, Lab Environment, room, question, answer, flag, hint, walkthrough or output of the Services to train, fine-tune, ground, evaluate, benchmark or otherwise develop or improve any artificial intelligence or machine learning model, large language model, neural network, algorithm or system, or to create any dataset, corpus or embedding for any such purpose, whether or not the result competes with the Services.
6.4 The Customer shall: comply with all applicable laws in connection with its use of the Services; ensure that its Authorised Users do the same; obtain and maintain all licences, consents and permissions necessary for TryHackMe to perform its obligations; maintain suitable networks and systems; and procure and maintain its own network connections and telecommunications links.
6.5 Acceptable Use Policy. The Customer shall comply with, and shall ensure that each Authorised User complies with, the Acceptable Use Policy. The Acceptable Use Policy forms part of these Terms. Where TryHackMe amends the Acceptable Use Policy, the amended version applies from the date TryHackMe specifies, provided that no amendment shall materially reduce the Customer's rights during the then-current subscription term.
6.6 No real personal data in Lab Environments. The Customer shall instruct its Authorised Users not to, and shall not knowingly permit any Authorised User to, upload to, enter into or process within any Lab Environment any personal data relating to any identifiable individual other than the Authorised User themselves, and shall require the use of synthetic data for any exercise involving personal data.
6.7 Export control, sanctions and restricted use. The Customer warrants and undertakes that: (a) it is not, and no Authorised User is, a Restricted Party; (b) it will not access or use the Services from, or permit access by any person located in, any territory subject to comprehensive sanctions; (c) it will not use the Services, or permit them to be used, in breach of any applicable export control law, nor re-export or transfer access to the Services or any Content in breach of one; (d) it will not use the Services for the purpose of conducting or preparing offensive cyber operations against any third party, or in connection with internal repression or the violation of human rights; and (e) it will not, without TryHackMe's prior written approval, use the Services for or on behalf of any military, intelligence or state security body located in a country listed in Country Group D of Supplement No. 1 to Part 740 of the United States Export Administration Regulations.
6A. Learners under 18
(a) The Customer shall notify TryHackMe before granting access to any individual under the age of 18, and shall on request tell TryHackMe the approximate number of such Authorised Users and the jurisdictions in which they are located.
(b) Where the Customer's Authorised Users include individuals under the age of 18, the Customer is responsible for obtaining any consent, and for complying with any safeguarding, age verification and child protection requirement, applicable to it.
(c) The Customer shall not grant access to any individual under the age of 13.
(d) TryHackMe may apply additional account settings, content restrictions and community feature restrictions to any Authorised User whom it knows or reasonably believes to be under the age of 18, and may do so without the Customer's agreement. TryHackMe shall also apply such restrictions in respect of specified Authorised Users at the Customer's request.
6B. Suspension
(a) TryHackMe may suspend access to the Services by any Authorised User immediately, without notice and without liability, where TryHackMe reasonably suspects that Authorised User has breached the Acceptable Use Policy, and may suspend access by all Authorised Users of the Customer where TryHackMe reasonably considers the breach to be systemic or to present a risk to the Services, to other customers or to any third party.
(b) TryHackMe shall notify the Customer of a suspension under this clause as soon as reasonably practicable, and shall restore access promptly where it is satisfied that the risk has been addressed.
(c) Suspension under this clause does not entitle the Customer to any refund, credit or extension, and does not relieve the Customer of any payment obligation.
7. Charges and Payments
7.1 The Customer shall pay the Fees within 30 days of invoice, through TryHackMe's standard payment process or as otherwise agreed in the Order Form.
7.2 All Fees are stated in the currency specified in the Order Form, are non-cancellable and non-refundable save as expressly provided in these Terms, and are exclusive of value added tax and any other applicable transaction tax.
7.3 The Fees for the initial subscription term are fixed for that term. TryHackMe may increase the Fees for any renewal term on not less than 90 days' written notice before the start of that renewal term, and the Customer may cancel the renewal if it does not accept the increase.
7.4 Interest accrues daily on any overdue amount at the lower of 8% per annum above the base rate of the Bank of England and the maximum rate permitted by applicable law, from the due date until payment.
7.5 Any additional services are charged at TryHackMe's standard day rates or at the rates agreed in the Order Form.
7.6 Where the Customer pays in a currency other than that specified in the Order Form, the Customer bears any shortfall arising from the conversion and any associated costs and charges.
7.7 Excess usage. Where the number of individuals using the Services exceeds the number of Authorised User accounts purchased, TryHackMe shall notify the Customer and the Customer shall, within 15 days, either purchase the additional accounts or reduce usage to its entitlement. Additional accounts purchased under this clause are charged at the Customer's then-current rate, pro-rated from the date the excess usage began.
8. Intellectual Property Rights
8.1 TryHackMe and its licensors own all Intellectual Property Rights in the Platform, the Software, the Content and the Services. These Terms grant the Customer no Intellectual Property Rights except as expressly stated.
8.2 The Customer assigns to TryHackMe, with full title guarantee, any Intellectual Property Rights in the Platform, the Software or the Services which the Customer or any person acting on its behalf may acquire, including future Intellectual Property Rights.
8.3 TryHackMe confirms that it has all rights necessary to grant the rights it purports to grant under these Terms.
8.4 The Customer is solely responsible for the accuracy, quality, integrity and legality of Customer Data, and for ensuring that its use does not infringe the rights of any third party.
8.5 The Customer grants TryHackMe a royalty-free, non-transferable, non-exclusive, worldwide licence to use Customer Data to the extent necessary to provide the Services and to exercise its rights and perform its obligations under these Terms.
8.6 Customer indemnity. The Customer shall indemnify TryHackMe against all liabilities, costs, expenses, damages and losses, including reasonable legal costs, arising from or in connection with:
(a) any claim relating to Customer Data, including any claim that Customer Data infringes the rights of a third party;
(b) any use of the Services by the Customer or any Authorised User in breach of the Acceptable Use Policy, including any access to, attack on, or interference with any system, network, account or data other than a Lab Environment assigned to that Authorised User;
(c) the Customer's failure to procure acceptance of, or to comply with, the Acceptable Use Policy;
(d) any representation, warranty, service level, security assurance, certification claim, accessibility conformance claim or other commitment made by the Customer in relation to the Services which exceeds or is inconsistent with these Terms and TryHackMe's published documentation; and
(e) any breach of clause 6.6 or clause 6.7.
8.7 Data TryHackMe processes for its own purposes.
(a) TryHackMe processes certain data for its own purposes as a controller. Those purposes are exhaustive and are: (i) securing and maintaining the integrity of the Services, and detecting, preventing and investigating fraud, abuse, misuse and breaches of the Acceptable Use Policy; (ii) billing, account administration and credit control; (iii) service reliability, capacity planning and incident diagnosis; (iv) product improvement and feature development, using aggregated and de-identified data only; and (v) the production of aggregated and anonymised statistics and benchmarks.
(b) TryHackMe does not process personal data relating to identified or identifiable Authorised Users for the purpose in paragraph (a)(iv). Where TryHackMe needs to examine records relating to an individual Authorised User, it does so only for the purposes in paragraphs (a)(i) to (a)(iii).
(c) TryHackMe shall not: use Customer Data, or any personal data of Authorised Users, to train, fine-tune, ground, evaluate or otherwise develop or improve any artificial intelligence or machine learning model, large language model or algorithm, save that TryHackMe may use de-identified and aggregated usage data for that purpose in accordance with paragraph (a); sell personal data; carry out targeted advertising to Authorised Users; or identify an individual Authorised User across customers.
(d) Aggregated and anonymised outputs shall be produced so as to be genuinely anonymous, and to a minimum cohort size of not fewer than 20 organisations and 100 Authorised Users.
8.8 The Customer assigns to TryHackMe all Intellectual Property Rights in any feedback or suggestions it provides concerning the Services, at the time they are provided, and TryHackMe may use them without charge or restriction.
8.9 The Customer grants TryHackMe a limited, revocable, non-exclusive, non-transferable, worldwide, royalty-free licence to use the Customer's name and logos to identify the Customer as a customer of TryHackMe on its website and in promotional materials, subject to the Customer's reasonable usage instructions.
8.10 Content integrity.
(a) The Customer shall instruct its Authorised Users not to, and shall not knowingly permit any Authorised User to, publish, share or distribute any flag, answer, solution or walkthrough for any content designated by TryHackMe as active, or any part of any TryHackMe certification or examination at any time.
(b) The Customer shall not reproduce or adapt any Content, or any material derived from or reproducing the structure or substance of any Content, in order to develop or deliver any training, course or assessment outside the Services.
(c) Nothing in this clause restricts the Customer from applying the knowledge and skills its Authorised Users acquire through the Services in the ordinary course of its business, including internal briefings and knowledge sharing that do not reproduce Content.
9. Confidentiality
9.1 Each party shall keep the other's Confidential Information confidential, and shall not disclose, copy or modify it without the other's prior written consent, except as necessary to perform its obligations under these Terms.
9.2 Clause 9.1 does not apply to information which: enters the public domain other than through a breach of these Terms; is lawfully received from a third party without an obligation of confidence; is independently developed without access to the Confidential Information; or is required to be disclosed by law or by a court or regulator of competent jurisdiction.
9.3 The obligations in this clause 9 continue for five years from the date of disclosure in respect of Confidential Information generally, and continue for so long as the information remains confidential in respect of: source code and system architecture; Content, Lab Environments, lab images and configurations; certification blueprints, question banks and answer keys; unreleased content and the content roadmap; pricing models and cost data; security documentation, penetration test reports and vulnerability information; and Customer Data.
10. IP Indemnity
10.1 TryHackMe shall defend the Customer against any claim that the Customer's use of the Services in accordance with these Terms infringes a third party's Intellectual Property Rights, and shall indemnify the Customer against amounts finally awarded and reasonable legal costs, provided that the Customer notifies TryHackMe promptly, makes no admission, provides reasonable cooperation at TryHackMe's expense, and gives TryHackMe sole authority to defend and settle the claim.
10.2 In defending or settling a claim under clause 10.1, TryHackMe may obtain for the Customer the right to continue using the Services, or modify or replace them so that they do not infringe, and where neither is available on commercially reasonable terms may terminate the affected subscription on 30 days' written notice, in which case TryHackMe shall refund the Fees prepaid for the unexpired term.
10.3 Clause 10.1 does not apply to a claim arising from: modification of the Services other than by TryHackMe; combination of the Services with the Customer's own materials or any item not supplied by TryHackMe, where the claim would not have arisen but for the combination; use of the Services otherwise than in accordance with these Terms or TryHackMe's documentation; continued use after a non-infringing alternative has been made available or after notice to stop; use of a superseded release where the current release would not infringe; or third party contributed or user created content, or Lab Content.
10.4 This clause 10 sets out the Customer's sole and exclusive rights and remedies, and TryHackMe's entire obligations and liability, in respect of the infringement of any third party's Intellectual Property Rights.
11. Limitation of Liability
This clause 11 is subject to clause 11.4, which sets out liability that is not excluded or limited by these Terms.
11.1 TryHackMe has no liability for any damage caused by an error or omission in any information, instruction or script provided to TryHackMe by the Customer. Except as expressly stated in clauses 2A(c), 5.1 and 10.1, and to the fullest extent permitted by law, all warranties, conditions and terms implied by statute or common law are excluded from these Terms.
11.2 Subject to clause 11.4, neither party is liable for any of the following, in each case whether direct or indirect: (a) loss of profit; (b) loss of revenue; (c) loss of anticipated savings; (d) loss of or damage to goodwill or reputation; (e) loss of business, business opportunity, contract or customers; (f) business interruption; (g) loss, corruption or unavailability of data, save for the cost of restoring from the most recent available backup; (h) wasted management or staff time; (i) loss of use; and (j) the cost of substitute goods, services or technology. Each of paragraphs (a) to (j) is a separate and independent head of excluded loss, is severable from the others, and is not qualified or limited by the words "indirect" or "consequential" wherever they appear in these Terms.
11.3 Subject to clauses 11.4 and 11.5, TryHackMe's total aggregate liability arising out of or in connection with these Terms, whether in contract, tort including negligence, breach of statutory duty or otherwise, is limited to the total Fees paid by the Customer under these Terms, provided that TryHackMe's total aggregate liability shall in no event be less than £25,000.
11.4 Liability that is not excluded or limited. Nothing in these Terms excludes or limits either party's liability for: death or personal injury caused by negligence; fraud or fraudulent misrepresentation; deliberate or wilful default; breach of the terms implied by section 12 of the Sale of Goods Act 1979 or section 2 of the Supply of Goods and Services Act 1982; or any other liability which cannot lawfully be excluded or limited.
11.5 Carve-outs from the cap. The limit in clause 11.3 does not apply to: the Customer's payment obligations; the Customer's obligations under clauses 8.6(b), (c), (d) and (e); infringement or misappropriation by either party of the other's Intellectual Property Rights; the Customer's breach of clause 8.10; either party's fraud or deliberate default; or breach by the Customer of clause 6.7.
12. Subscriptions, Term and Termination
12.1 Unless the Order Form provides otherwise, a subscription runs for 12 months from the date stated in the Order Form.
12.2 A subscription renews automatically for successive periods of 12 months unless the Customer gives not less than one month's written notice before the end of the then-current period cancelling the renewal. TryHackMe charges renewal Fees using the same payment method as the initial subscription.
12.3 The Customer may terminate a subscription at any time on not less than one month's written notice. Fees prepaid for the remainder of the subscription term are non-refundable.
12.4 Either party may terminate these Terms or any subscription immediately on written notice where the other commits a material breach and fails to remedy it within 30 days of written notice specifying the breach and requiring its remedy, or within 14 days in the case of non-payment. TryHackMe may terminate immediately, with no cure period, where the Customer breaches clause 6.7 or commits a serious breach of the Acceptable Use Policy. Either party may terminate immediately on written notice where the other becomes insolvent, is unable to pay its debts as they fall due, enters into any arrangement with its creditors, or has a receiver, administrator or liquidator appointed, or is subject to any analogous event in any jurisdiction.
12.5 Survival. Clauses 2A, 5A, 6.6, 6.7, 8 including 8.10, 9, 10, 11, 12.6, 22 to 25 and 28 survive expiry or termination, together with any other provision which by its nature is intended to survive.
12.6 Customer Data on exit.
(a) The Customer may export Customer Data through the administration console during the subscription term and for 30 days after expiry or termination.
(b) TryHackMe shall delete Customer Data from its production systems within 30 days after the end of that export window, save as set out in paragraphs (c) and (d).
(c) Customer Data contained in encrypted backups is deleted in accordance with TryHackMe's ordinary backup rotation cycle, details of which are available on request. Backup data is not accessed or processed for any purpose during that period.
(d) TryHackMe may retain records of breaches of the Acceptable Use Policy, security incidents and enforcement action, including account identifiers necessary to give effect to a suspension or ban, for so long as necessary for those purposes, and may retain any data it is required by law to retain.
(e) TryHackMe shall provide a certificate of deletion on written request.
13. Relief
Neither party is liable for any breach, delay or failure to perform its obligations under these Terms caused by a Force Majeure event or by any circumstance beyond its reasonable control, save that this clause does not excuse any obligation to pay.
14. Variation
14.1 No variation of these Terms agreed between the parties is effective unless it is in writing and signed by the parties or their authorised representatives.
14.2 TryHackMe may publish an updated version of these Terms. An updated version applies to the Customer from the start of the Customer's next subscription term, and TryHackMe shall give not less than 30 days' notice before that date. No updated version reduces the Customer's rights or increases its obligations during the then-current subscription term. Where the Customer does not wish to accept an updated version, it may give notice under clause 12.2 not to renew.
14.3 TryHackMe may amend the Acceptable Use Policy in accordance with clause 6.5.
15. Waiver
A failure or delay by either party in exercising any right or remedy under these Terms is not a waiver of that or any other right or remedy, and no single or partial exercise prevents any further exercise.
16. Rights and Remedies
The rights and remedies provided under these Terms are in addition to, and not exclusive of, any rights or remedies provided by law.
17. Severance
If any provision of these Terms is or becomes invalid, illegal or unenforceable, it shall be deemed deleted, and that deletion does not affect the validity or enforceability of the rest of these Terms. The parties shall negotiate in good faith a replacement provision which achieves, to the greatest extent possible, the original commercial intention.
18. Entire Agreement
18.1 These Terms constitute the entire agreement between the parties in relation to their subject matter and supersede all previous agreements, representations and understandings relating to it.
18.2 Each party acknowledges that it does not rely on any statement, representation or warranty not set out in these Terms, and waives any claim for innocent or negligent misrepresentation, save that this clause does not apply to any written answer given by TryHackMe to a written pre-contract enquiry from the Customer, and does not limit liability for fraud or fraudulent misrepresentation.
19. Assignment
The Customer may not assign, transfer, charge, subcontract or deal in any other manner with any of its rights or obligations under these Terms without TryHackMe's prior written consent. TryHackMe may assign, transfer or novate its rights and obligations under these Terms.
20. No Partnership or Agency
Nothing in these Terms creates a partnership or joint venture between the parties, or constitutes either party the agent of the other. Neither party has authority to make any representation, assume any obligation or exercise any right on behalf of the other.
21. Third Party Rights
These Terms do not confer any rights on any person other than the parties and, where applicable, their successors and permitted assigns, under the Contracts (Rights of Third Parties) Act 1999, save that TryHackMe's Affiliates may enforce clauses 6.6, 6.7, 8, 9 and 11 as if they were parties to these Terms.
22. Notices
22.1 A notice given under these Terms shall be in writing and delivered by hand, by prepaid first class post, by recorded delivery, by courier, or by email to the address or email address of the recipient stated in the Order Form or otherwise customarily used between the parties. Email notices to TryHackMe shall be sent to support@tryhackme.com.
22.2 A notice delivered by hand or courier takes effect on receipt, or at 9.00 am on the next Business Day if delivered outside Normal Business Hours. A notice sent by post takes effect at the time it would be delivered in the ordinary course of post. A notice sent by email takes effect on transmission, provided no delivery failure notification is received.
22.3 A notice of termination, of material breach or of a claim under clause 8.6 or clause 10.1 shall also be given by courier or recorded delivery, and takes effect on the later of the two deliveries.
23. Governing Law
These Terms, and any dispute or claim arising out of or in connection with them or their subject matter or formation, are governed by and construed in accordance with the law of England and Wales, subject to clause 28.
24. Jurisdiction
Subject to clause 28, the courts of England and Wales have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with these Terms or their subject matter or formation. Nothing in this clause prevents either party from applying to any court of competent jurisdiction for interim or injunctive relief.
25. Interpretation
25.1 Definitions.
Acceptable Use Policy means the policy published at /legal/acceptable-use-policy, as amended in accordance with clause 6.5.
Affiliate means any entity that directly or indirectly controls, is controlled by, or is under common control with a party, where control means ownership of more than 50% of the voting securities or the power to direct the management of that entity.
Anonymous Data means data derived from Customer Data which has been aggregated and de-identified so that no individual and no customer is identifiable from it, produced to the minimum cohort size in clause 8.7(d).
Authorised Reseller means a person appointed by TryHackMe under a Master Reseller Agreement to resell the Services.
Authorised User means an employee or contractor of the Customer whom the Customer has authorised to use the Services, or such other person as is expressly permitted under a Service Provider Addendum signed by TryHackMe.
Business Day means a day other than a Saturday, Sunday or public holiday in England on which banks in London are open for business.
Confidential Information means information disclosed by either party to the other in any form which is identified as confidential or would reasonably be understood to be confidential, including know-how and trade secrets.
Content means the rooms, learning paths, questions, answers, flags, hints, walkthroughs, lab images and virtual machine configurations, network topologies, scoring and progression logic, certification blueprints and question banks, badges and other materials made available through the Services by TryHackMe.
Controller, Processor, Data Subject, Personal Data, Personal Data Breach, processing, Sub-Processor and appropriate technical and organisational measures have the meanings given in Data Protection Laws.
Customer means the corporate, education or public sector body which has registered to purchase the Services.
Customer Data means the data, content and material inputted to the Platform by the Customer, by an Authorised User, or by TryHackMe on the Customer's behalf.
Data Protection Laws means all applicable data protection and privacy legislation, including the UK GDPR, the GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.
Documentation means the documentation for the Services published or made available by TryHackMe.
Fees means the fees stated in the Order Form.
Force Majeure means any event beyond a party's reasonable control which prevents it from performing its obligations, excluding an inability to pay, and including a failure of any network used to transfer data.
GDPR means Regulation (EU) 2016/679.
Intellectual Property Rights means all copyright, patents, know-how, trade secrets, trade marks, design rights, database rights, domain names and all similar rights, whether registered, capable of registration, applied for or future.
Lab Content means the images, virtual machines, applications, configurations, network topologies, tools, scripts, exploits, samples and artefacts made available within a Lab Environment.
Lab Environment means an isolated environment made available through the Services in which Lab Content runs.
Master Reseller Agreement means an agreement signed by TryHackMe appointing a person as an Authorised Reseller.
Normal Business Hours means 8.00 am to 6.00 pm local UK time on each Business Day.
Order Form means the electronic or physical document by which the Customer orders the Services, incorporating these Terms.
Platform means the online management portal for business users, incorporating the Software.
Platform Control Plane means TryHackMe's identity, account management, billing, reporting, content delivery and lab orchestration systems, together with the controls that isolate Lab Environments from each other, from the Platform Control Plane, and from Customer networks.
Protected Data means personal data received by TryHackMe from or on behalf of the Customer in connection with the Services.
Restricted Party means a person subject to sanctions imposed by the United Kingdom, European Union, United States or United Nations, or owned or controlled by such a person.
Service Provider Addendum means an addendum signed by TryHackMe permitting the Customer to make the Services available to persons who are not its own employees or contractors.
Services means the provision of the Software via the Platform.
Software means the online cyber security training and testing applications provided by TryHackMe via the Platform.
TryHackMe means TryHackMe Ltd, company number 11673275.
UK GDPR means the GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018.
25.2 Order of priority. Where there is a conflict between the documents forming the agreement between the parties, they take precedence in the following order: the Data Processing Addendum; an Order Form, but only where it expressly identifies the clause of these Terms that it varies and is signed by an authorised signatory of TryHackMe; these Terms, including the Acceptable Use Policy; any other document referred to in these Terms.
25.3 Clause headings do not affect the interpretation of these Terms.
25.4 A reference to a statute or statutory provision includes any subordinate legislation made under it and any amendment or re-enactment of it.
25.5 Words in the singular include the plural and words in the plural include the singular.
25.6 A reference to writing includes email.
25.7 "Including", "in particular" and similar expressions are illustrative and do not limit the words preceding them.
25.8 A reference to a person includes a body corporate, an unincorporated association and a partnership.
25.9 A reference to a party includes that party's successors and permitted assigns.
26. Security and compliance information
(a) TryHackMe maintains an information security programme aligned to recognised industry frameworks. TryHackMe shall make available to the Customer, on request and no more than once in each 12 month period: its current information security certifications and attestations, where held, and the scope statements for them, subject to any applicable confidentiality obligation; a security overview or a completed security questionnaire; an executive summary of its most recent independent penetration test, where one has been conducted; and information about the sub-processors it uses.
(b) TryHackMe's standard Data Processing Addendum is available for review before contracting and does not require negotiation.
(c) Any audit or inspection of TryHackMe's processing of personal data is governed by the Data Processing Addendum.
27. Accessibility
TryHackMe shall make available to the Customer on request, including for the purposes of a procurement or tender process, information as to the accessibility of the Services, any known non-conformances and any alternative means of access. TryHackMe shall use commercially reasonable endeavours to improve the accessibility of the Services. TryHackMe does not warrant conformance with any accessibility standard. Where a specific accessibility requirement is material to the Customer, the Customer shall raise it before placing an Order and TryHackMe may agree specific accommodations in that Order.
28. Public sector customers
28.1 Application. This clause applies where the Customer is an agency or instrumentality of the United States federal government, or a state, local, tribal or territorial government entity of the United States, or is acquiring the Services for the use of any such entity, whether directly or through an Authorised Reseller, aggregator or contract vehicle. Where it applies, this clause prevails over any inconsistent provision of these Terms.
28.2 Terms that cannot bind a public body. Any provision of these Terms that is unenforceable against the Customer under applicable federal or state law, or that would require the Customer to act beyond its lawful authority, does not apply to that Customer. The remainder of these Terms continues in full force. Neither party's failure to enforce such a provision is a waiver of any other provision.
28.3 Indemnities. Clause 8.6 does not apply to the extent the Customer lacks legal authority to give an indemnity. In place of it, the Customer's liability for the matters described in clause 8.6 is as provided by applicable law, and nothing in these Terms requires the Customer to indemnify TryHackMe in excess of that authority.
28.4 No automatic renewal. Notwithstanding clause 12.2, a subscription does not renew automatically. The subscription expires at the end of the term stated in the Order Form and continues only where the Customer places a further Order Form. No provision of these Terms obligates the Customer to expend or commit funds in advance of an appropriation, and TryHackMe's remedies for non-payment do not arise where funds have not been appropriated.
28.5 Governing law and disputes. Clauses 23 and 24 do not apply. Where the Customer is a United States federal entity, these Terms are governed by the federal law of the United States and any dispute is resolved in accordance with the Contract Disputes Act of 1978. Where the Customer is a state, local, tribal or territorial entity, these Terms are governed by the law of the Customer's jurisdiction and neither party submits to the exclusive jurisdiction of the courts of England and Wales.
28.6 Payment and interest. Clause 7.4 does not apply. Payment and any interest on late payment are governed by the Prompt Payment Act, 31 U.S.C. chapter 39, where the Customer is a federal entity, and otherwise by the applicable prompt payment law of the Customer's jurisdiction.
28.7 Assignment and novation. Clause 19 does not restrict any right of the Customer under the Anti-Assignment Act, 41 U.S.C. 6305, or any applicable novation or successor-in-interest procedure.
28.8 Termination for convenience. Where the Services are acquired under a contract incorporating FAR 52.212-4, the termination for convenience and termination for cause provisions of that clause apply in place of any inconsistent provision of clause 12.
28.9 Confidentiality and disclosure. Clause 9 does not require the Customer to withhold any record it is required to disclose under the Freedom of Information Act, 5 U.S.C. 552, or under the applicable public records law of its jurisdiction, provided that the Customer notifies TryHackMe before disclosing information TryHackMe has marked as confidential, where it is permitted to do so.
28.10 Rights in the Services. The Services are commercial computer software developed at private expense. The Customer acquires only the rights granted by these Terms, in accordance with FAR 12.212 and FAR 27.405-3, and where acquired by or for the Department of Defense, DFARS 227.7202. No greater or different rights arise by operation of any other clause.
28.11 Contract vehicles. Where the Services are acquired through a General Services Administration schedule, a government-wide acquisition contract or another contract vehicle, the terms of that vehicle prevail over these Terms to the extent of any conflict, and clause 1.5 applies to the Authorised Reseller or aggregator through which the Services are supplied.
TryHackMe Ltd, 128 City Road, London EC1V 2NX, United Kingdom. Company number 11673275. Questions about these Terms: support@tryhackme.com.