MSA - Master Services Agreement for Members (Customers) of Cyber Rescue

1 Introduction to Membership Terms

  1. 1.1  Membership Terms – These Membership Terms apply to all Services you engage us to provide during your Membership of Cyber Rescue. If anything in these Terms is inconsistent with any Other Agreement made between us, these Membership Terms take precedence unless the Other Agreement specifically amends these Terms.
  2. 1.2  Membership – Your Membership of Cyber Rescue entitles you to privileged access to the Services provided by Cyber Rescue, and also entitles you to the Discounts and Rebates that may be made available to our Members from time to time.
  3. 1.3  Authorised Person – An Authorised Person within your Organisation may instruct Cyber Rescue to deliver our Services, using the funds held in your Membership Account or to be paid against a separate invoice. Unless otherwise agreed, the Authorised Persons in your organisation are: the budget holder who originally approved payment for Membership of Cyber Rescue, plus the Chief Information Security Officer or nearest equivalent and Chief Risk Officer or nearest equivalent.

2 Payment of Fees for Membership and Services

  1. 2.1  Qualification – To qualify for the discounts and enhanced service levels available to Members, an organisation must purchase services worth at least £10,000 (+ VAT or similar taxes applicable in your jurisdiction) during each Membership Period, unless this requirement is waived in writing by a Director of Cyber Rescue. If no specific services are needed on the day Membership starts, you can pay the £10,000 as a “Membership Top-up” that is held in your Membership Account, for services you want later on.
  2. 2.2  Membership Account – Your Membership Account is the value of any funds you have paid to us, plus any rebates you have earned as a Member, less the cost of any Services requested by an Authorised Person in your organisation. Half of any funds still held in your Membership Account is rolled over into the next Membership Period, if a Membership Top Up or other purchase of services worth at least £10,000 + VAT is received during the current Membership Period.
  3. 2.3  Membership Period - Your Membership Period is the date range to which your Membership applies, typically 365 days. The Membership Period begins on the “Effective Date,” which is the earlier of either (a) when Cyber Rescue begins work requested by an Authorised Person under a subsequently agreed Membership, or (b) when you issue a Purchase Order worth £10,000, or (c) when you pay a “Membership Top-up” into your Membership Account.


  1. 2.4  Membership Renewal – Your Membership of Cyber Rescue can be renewed by payment of a new Membership Fee. The Membership Renewal is reduced by 10% if payment is made at least 30 days before the expiry of the existing Membership Period, and if the amount of the payment is not less than for the existing Membership Period.
  2. 2.5  Service Fees & Discounts – Members may benefit from reduced fees for services, as described in the “Cyber Rescue – Services Overview” brochure and as updated by Cyber Rescue from time to time. This fee reduction is only available to Members during their Membership Period. Where Service Fees will exceed the value remaining in the Membership Account, an invoice will be raised by Cyber Rescue to cover these Service Fees, upon request of an Authorised Person in the Member organisation. This invoice must be paid within 30 days of receipt by the Member, or interest at the rate of 3% per annum will apply and non-Member rates will apply in respect of any future services requested by You until such time as payment of outstanding fees is made.
  3. 2.6  Expenses – You will pay any agreed expenses that we incur in connection with delivering the Services. For the avoidance of doubt, any expense will always be agreed in advance.
  4. 2.7  Taxes - Fees are net of any applicable withholding taxes, customs, levies, excise taxes (including without limitation value added tax, goods and services tax, use tax and sales tax), deductions or similar charges imposed by any jurisdiction on Cyber Rescue or its services.
  5. 2.8  Contingency - The Member's obligation to pay Membership Fees, Service Fees and Expenses is not contingent upon the outcome of any insurance or third party claim.

3 Services

  1. 3.1  Services – We will perform the Services agreed with the Authorised Person at your organisation with reasonable skill and care. The services (including deliverables) are provided solely for the benefit of the Member organisation that requested them, and may not be shared or transferred to any other, except for your affiliates (where for the purposes of this agreement, affiliate means any subsidiary, subsidiary undertaking and holding company of you (as those terms are defined in sections 1159 and 1162 of the Companies Act 2006) and any subsidiary or subsidiary undertaking of such holding company).
  2. 3.2  Support not advice – The nature of our services is support and not advice.
  3. 3.3  Deliverables – You may not disclose a deliverable or make the benefit of the services available to anyone else or refer to the contents of a deliverable or the findings of our work, except with our prior written consent on terms to be agreed, or to your lawyers, auditors and regulators as long as you tell them, in advance, that we accept no liability to them and that no onward disclosure may be made, or as required by law of regulation. Notwithstanding the remainder of this clause, You may disclose deliverables to any affiliate who may benefit from the same.
  4. 3.4  Liability to you alone – We accept no liability to anyone, other than you, in connection with our services, unless otherwise agreed by us in writing.
  5. 3.5  Changes – Either party may request a change to the services or this agreement. A change will be effective only when agreed in writing by a Director of Cyber Rescue Ltd and a Director of your organization.
  6. 3.6  Oral advice and draft deliverables – You may rely only on our final written deliverables and not on oral advice or draft deliverables. If you wish to rely on something we have


said to you, please let us know so that we may prepare a written deliverable on which you can rely.

3.7 Deemed knowledge – In performing the Services your Authorised Person requests, Cyber Rescue will not be deemed to have information from other services provided to You.

4 Your responsibilities

  1. 4.1  Information – In order for us to properly assist you, you will make sure that (i) any information given to us by you, or anyone else working with or for you, is (a) given promptly, (b) accurate and (c) complete; and (d) any assumptions are appropriate. We will not verify any information given to us relating to the services, unless requested to by you.
  2. 4.2  Your obligations – Our performance depends on you performing your obligations under this agreement. We are not liable for any loss arising from you not fulfilling your obligations.

5 Confidentiality

  1. 5.1  Confidential information – Both parties agree to use the other’s confidential information only in relation to the Services, and not to disclose it except where required by law or regulation. However, we may give confidential information to our relevant subcontractors as long as they are bound by confidentiality obligations, and to your advisers who are involved the Service you have purchased. Additionally, either party may disclose confidential information received from the other party to its affiliates provided they are bound by suitable obligations of confidentiality.
  2. 5.2  Performing services for others – You agree that we may perform services for your competitors or other parties whose interests may conflict with yours, as long as we do not disclose your confidential information.
  3. 5.3  For the purposes of the above, ‘confidential information’ means all confidential information disclosed or made available directly or indirectly by a party and/or its affiliates (the “Disclosing Party”) or its employees, officers, contractors and professional advisers of a party and/or its affiliates (“Representatives”) to the other party and its Representatives (the “Recipient”) including and not limited to:
    • -  the fact that discussions and negotiations are taking place concerning the services (“Purpose”) and the status of those discussions and negotiations;
    • -  the existence and terms of the parties’ agreement;
    • -  all information relating to the business operations, know how, technical information, people, products, customers, suppliers, finances and future plans of the Disclosing Party;
    • -  in connection with You, any details relating to Your and your affiliates preparedness for a data breach;
    • -  any information, findings, data or analysis derived from confidential information; and
    • -  any information about or received from the other party in connection with the Purpose that can reasonably be expected to be commercially sensitive or confidential.


6 Intellectual property rights

  1. 6.1  Subject to 6.2, we will own the intellectual property rights in the deliverables and any materials created under this agreement, and you will have a non-exclusive, non- transferable licence to use the deliverables for your, and your affiliates’, own internal purposes (subject to the permitted disclosures under clause 5).
  2. 6.2  In connection with any reports prepared by us which relate entirely or partly to You (“Bespoke IP”), we assign all intellectual property rights, and waive moral rights, in such Bespoke IP. We will also execute any further documentation as is reasonably requested by you to perfect such assignment. We acknowledge that the report to be prepared by us relating to Your preparedness for a data breach will be Bespoke IP for the purposes of this clause.

7 Data protection

  1. 7.1  Personal data – You agree that we may process your personal data for the purposes of any of (i) providing the services including with our Alliance Partners, (ii) maintaining our administrative or client relationship management systems, (iii) quality and risk management reviews, and (iv) providing you with information about us and our range of services.
  2. 7.2  Data processor – Unless otherwise agreed between the parties, it is not expected that we will act as a processor for your organisation. Where we act as your data processor, we will act only on your lawful instructions and we will comply with obligations equivalent to those imposed on you (and us) by the Data Protection Act 2018 (as may be amended).
  3. 7.3  Data transfers – We may, for the purposes in clause 7.1, transfer the personal data outside the UK (but only to a recipient who (i) is in a country which provides an adequate level of protection for personal data (ii) is under an agreement with us which covers the UK requirements for the transfer of personal data to data processors).

8 Liability

  1. 8.1  Specific types of loss – You agree that we will not be liable for (i) loss of profit, goodwill, business opportunity, anticipated savings or benefits or (ii) indirect or consequential loss, including without limitation, lossof profits, loss of income, loss of business or loss of use.
  2. 8.2  Our liability – Each party agrees that its total liability (including interest) to the other for all claims connected with the services or this agreement (including but not limited to negligence) is limited to the agreed fees payable for the services (excluding VAT).
  3. 8.3  Unlimited liability – Nothing in this agreement will limit a person’s liability for (i) death or personal injury caused by that person’s negligence, (ii) that person’s fraud or wilful misconduct or (iii) anything else that cannot by law be limited.
  4. 8.4  Force Majeure: No party shall be liable to the other for failure to provide services, delays and / or failure to comply with its contractual obligations caused by acts of God, strikes, or conditions beyond its control, including but not limited to pandemics or medical incapacity, riot, war, invasion, act of foreign enemies, hostilities (whether war be declared or not) acts of terrorism, civil war, rebellion, revolution, insurrection of military or usurped power, ionising radiation or contamination, radio activity from any nuclear fuel or from any nuclear waste from the combustion of nuclear fuel, radio active toxic explosive, earthquakes, flood, fire, hurricane or other physical natural disaster, strikes at national level or industrial disputes at a national level, situations where rendering


services is prohibited or delayed by local laws, regulators or regulatory agencies. Cyber Rescue shall notify the Member of any circumstance likely tocause such failure or delay as soon as reasonably practicable.

8.5 No claims against individuals – You agree to bring any claim in connection with the services only against us, and not against any individual.

9 Our Subcontractors and Your Affiliates

  1. 9.1  Our Subcontractors (Alliance Partners) – We may use subcontractors to provide the services. We remain solely responsible for the services and shall be fully liable to you for the performance of the services notwithstanding that we may use subcontractors. Our subcontractors are sometimes referred to as our Alliance Partners.
  2. 9.2  Restriction on claims – You agree not to bring any claim (including one in negligence) against our subcontractors in connection with the services, any such claim shall be brought directly against Cyber Rescue.
  3. 9.3  Your Group Affiliates – We agree that your affiliates may take advantage of the benefits conferred upon you by this agreement provided that any enforcement by affiliates of such rights and benefits, shall be subject to all of the Terms of this agreement and shall be bought solely by you and the parties to this agreement may vary or terminate this agreement by agreement between them without requiring the consent of any affiliate. You will ensure that no affiliate of yours, both while they are a group member and thereafter, brings any claim against us or our subcontractors in respect of any liability relating to the services or this agreement.

10 Materials

  1. 10.1  Policy – We may retain copies of all materials relevant to the services but, upon request or upon termination of this agreement, will return and / or delete any materials given to us by you.
  2. 10.2  Release – We will not release materials which belong to us (including our working papers) unless we have specifically agreed to do so. We may require a release letter from a recipient before disclosure.

11 Termination

  1. 11.1  Immediate notice – Either we or you may end this agreement immediately by giving written notice to the other if (i) the other materially breaches it and does not remedy the breach within 14 days, (ii) the other is or appears likely to be unable to pay its debts or becomes insolvent or (iii) the performance of it (including the application of any fee arrangements) may breach a legal or regulatory requirement.
  2. 11.2  30 days’ notice – Either we or you may end this agreement on 30 days’ written notice.
  3. 11.3  Fees payable on termination – Where any Service Fees exceed the Membership Fees, You agree to pay us for all services we perform up to the date of termination. You agree to pay us for the services that we have performed on the basis of the time spent at our then current daily rates, up to the amount of the agreed fee.

12 Dispute resolution

  1. 12.1  Mediation – If a dispute arises, the parties will attempt to resolve it by discussion, negotiation and mediation before commencing legal proceedings.
  2. 12.2  Law and jurisdiction – This agreement and any dispute arising from it, whether contractual or noncontractual, will be governed by English law and be subject to the exclusive jurisdiction of the English courts.

13 General

  1. 13.1  Matters beyond reasonable control – No party will be liable to another if it fails to meet its obligations due to matters beyond its reasonable control.
  2. 13.2  Your actions – Where you consist of more than one party, an act or omission of one party will be regarded as an act or omission of all.
  3. 13.3  Assignment – No party may assign, transfer or deal with their rights or obligations under this agreement without prior written consent.
  4. 13.4  Rights of third parties –A person who is not a party to this agreement has no rights under the Contracts (Rights of Third Parties) Act 1999 (as may be amended) to enforce any term of this agreement.
  5. 13.5  Quality of service – We want you to be delighted with our services. If you are not satisfied, or have suggestions for improvement, please contact the Managing Director of Cyber Rescue. We will look carefully and promptly at any complaint or suggestion.
  6. 13.6  Entire agreement – This agreement forms the entire agreement between the parties in relation to the services. It replaces any earlier agreements, representations or discussions. Subject to clause 8.3, no party is liable to any other party (whether for negligence or otherwise) for a representation that is not in this agreement.

Last Updated:  April 2023