PCI Cart Monitor Subscription Terms and Conditions

Last updated: [Insert date]

1. About these Terms

1.1 These Subscription Terms and Conditions (“Terms”) govern access to and use of the PCI Cart Monitor web application, website, monitoring services, dashboards, alerts, reports and related services (together, the “Service”).

1.2 The Service is provided by Edward Robertson Limited, trading as PCI Cart Monitor (“PCI Cart Monitor”, “we”, “us” or “our”). Edward Robertson Limited is registered in England and Wales under company number 03931089, with its registered office at Business Central, Central Park, Darlington, England, DL1 1GL.

1.3 In these Terms, “Customer”, “you” and “your” mean the business, organisation or other legal entity purchasing or using the Service.

1.4 By creating an account, selecting a subscription, clicking to accept these Terms or using the Service, you confirm that:

a. you have read and agree to these Terms;

b. you are acting for purposes relating to your trade, business, craft or profession;

c. you have authority to enter into these Terms on behalf of the Customer; and

d. the information you provide to us is complete and accurate.

1.5 The Service is intended for business customers and is not offered for personal or consumer use.

2. The Service

2.1 PCI Cart Monitor is a hosted web application designed to help Customers monitor payment and checkout pages, detect changes and produce evidence that may support PCI DSS compliance activities.

2.2 Depending on the subscription plan selected, the Service may include:

a. scheduled payment-page and checkout-page scans;

b. script, iframe, redirect and HTTP-header monitoring;

c. script hashing and change detection;

d. baseline approval and authorisation workflows;

e. domain and third-party vendor records;

f. alerts and review items;

g. screenshots, technical scan information and monitoring history;

h. dashboards and account-management tools; and

i. downloadable compliance and evidence reports.

2.3 Your subscription is subject to the features and limits stated on our pricing page, registration page, checkout page, order form or written quotation accepted by you (“Order”).

2.4 Subscription limits may include the number of websites, payment pages, users, scans, reports, storage capacity or other resources available under your selected plan.

2.5 If there is a conflict between an Order and these Terms, the Order will take priority only in relation to the specific commercial terms expressly stated in it. These Terms will apply in all other respects.

2.6 Unless expressly agreed otherwise in writing, the Service does not include:

a. legal advice;

b. PCI DSS consultancy or certification;

c. penetration testing;

d. vulnerability remediation;

e. security incident investigation;

f. services performed by a Qualified Security Assessor; or

g. a guarantee of PCI DSS compliance.

3. Accounts and Authorised Users

3.1 You must provide accurate registration, billing and contact information and keep that information up to date.

3.2 You are responsible for:

a. maintaining the confidentiality and security of account credentials;

b. ensuring that each account is used only by an authorised user;

c. all activity carried out through your account;

d. configuring appropriate user permissions; and

e. notifying us promptly if you know or suspect that an account or credential has been compromised.

3.3 You must not share individual login credentials between users unless the relevant account functionality expressly allows this.

3.4 We may require you to reset credentials or take other reasonable security measures where we believe this is necessary to protect the Service, your account or other users.

3.5 You are responsible for ensuring that all authorised users comply with these Terms.

4. Subscription Term and Automatic Renewal

4.1 Your subscription begins when:

a. your account is created and payment is successfully authorised;

b. a free trial is converted into a paid subscription; or

c. another commencement date stated in your Order is reached.

4.2 Unless your Order states otherwise, subscriptions are billed monthly.

4.3 Your subscription will automatically renew at the end of each billing period for a further billing period of the same duration unless:

a. you cancel the subscription in accordance with section 8; or

b. we terminate or elect not to renew the subscription in accordance with these Terms.

4.4 You authorise us and our payment processor to charge the applicable subscription fees and other agreed charges to your selected payment method on each renewal date.

4.5 You are responsible for ensuring that your payment method remains valid and that sufficient funds are available on each payment date.

5. Fees, VAT and Payment

5.1 You must pay the subscription fees displayed when you subscribe or otherwise stated in your Order.

5.2 All subscription prices displayed on our website, pricing page, checkout page or Order:

a. are quoted and payable in pounds sterling;

b. include VAT at the applicable rate; and

c. are payable in advance for the relevant billing period.

5.3 The price displayed at checkout or stated in your Order is the total amount payable for the relevant subscription period, including VAT.

5.4 Where required, we will issue a VAT invoice showing:

a. the total amount paid;

b. the net amount before VAT;

c. the applicable VAT rate; and

d. the VAT amount included in the total price.

5.5 If the applicable VAT rate changes, the VAT-inclusive subscription price may be adjusted to reflect the new rate. Where this results in an increase to the total amount payable, we will provide notice in accordance with section 6 where reasonably practicable.

5.6 Payments may be processed by Stripe or another third-party payment processor appointed by us. Your use of the payment processor may also be subject to that provider’s terms and privacy practices.

5.7 You must maintain a valid payment method throughout your subscription.

5.8 If payment cannot be collected when due, we may:

a. attempt to collect payment again;

b. contact you to request updated payment information;

c. restrict or suspend access to some or all of the Service; and

d. terminate the subscription if the outstanding amount is not paid within a reasonable period specified by us.

5.9 You remain responsible for all properly incurred fees up to the effective date of cancellation or termination.

5.10 You must notify us promptly if you believe that an invoice or payment is incorrect. Unless required otherwise by law, billing disputes should be raised within 30 days of the relevant payment.

6. Price Changes

6.1 We have the right to increase or otherwise change our subscription prices from time to time.

6.2 All new or revised prices displayed to Customers will include VAT at the applicable rate.

6.3 Where a price increase will apply to an active subscription, we will give you at least 30 days’ advance notice before the increase takes effect.

6.4 Notice of a price change may be provided:

a. by email to the primary email address associated with your account;

b. through a notification within the Service;

c. on an invoice or billing notification; or

d. by another reasonable written method.

6.5 A price increase will not take effect during a billing period for which you have already paid. It will take effect on the first renewal date occurring after the applicable notice period has expired.

6.6 Where fewer than 30 days remain before your next renewal date when notice is given, the price increase will apply from the following renewal date.

6.7 The price-change notice will explain:

a. the new VAT-inclusive subscription price or the basis on which it will be calculated;

b. the date from which the new price will apply; and

c. how you may cancel your subscription if you do not agree to the change.

6.8 You may cancel your subscription before the new price takes effect.

6.9 If you do not cancel your subscription and continue to use the Service after the effective date of the price change, you will be treated as having accepted the new price.

6.10 We may reduce prices, introduce promotional prices or make changes that do not increase the total subscription fee payable by you without providing 30 days’ notice.

6.11 Promotional or discounted pricing may be available for a limited period. When a promotional period ends, the subscription will renew at the standard VAT-inclusive price communicated to you when the promotion began, unless you cancel before the renewal date.

6.12 We may correct an obvious pricing or billing error. Where correcting an error would materially increase the amount payable for an active subscription, we will notify you and provide a reasonable opportunity to cancel before charging the corrected amount.

7. Plan Changes and Usage Limits

7.1 You may request an upgrade or downgrade through the Service, where that functionality is available, or by contacting us.

7.2 An upgrade may take effect immediately. We may charge a proportionate VAT-inclusive amount for the remainder of the current billing period.

7.3 Unless otherwise stated when the change is requested, a downgrade will take effect at the beginning of the next billing period.

7.4 A downgrade may result in reduced functionality, capacity, monitoring history, report availability or access to stored information.

7.5 You are responsible for exporting any information you require before a downgrade takes effect.

7.6 You must not intentionally exceed the usage limits of your plan.

7.7 If you exceed or repeatedly approach a plan limit, we may:

a. notify you that the limit has been reached;

b. restrict the relevant functionality;

c. ask you to upgrade your subscription; or

d. agree an additional VAT-inclusive charge with you.

7.8 We will not charge an additional fee solely for exceeding a limit unless the amount or charging basis has been communicated to and accepted by you.

8. Cancellation

8.1 You may cancel your subscription at any time through the account-management functionality, where available, or by contacting us using the contact details published on our website.

8.2 Unless we expressly agree otherwise, cancellation will take effect at the end of the billing period for which you have already paid.

8.3 You may continue to use the Service until the effective cancellation date, subject to these Terms.

8.4 Subscription fees are non-refundable, and we do not provide refunds or credits for:

a. partially used billing periods;

b. unused websites, pages, scans, users or other plan capacity;

c. periods during which you chose not to use the Service; or

d. a cancellation that takes effect part-way through a billing period,

except where a refund is required by law or expressly agreed by us in writing.

8.5 Cancelling a direct debit, card payment or payment instruction does not by itself cancel the subscription. You must cancel using the cancellation process described in this section.

8.6 After cancellation takes effect, you will no longer be entitled to access the Service or any Customer Data stored within it.

8.7 You should download or export any reports, evidence or other information you require before the cancellation takes effect.

9. Customer Responsibilities

9.1 You are responsible for deciding which websites and pages are monitored and for configuring the Service appropriately for your business.

9.2 You confirm and warrant that:

a. you own, operate or control each website and page submitted for monitoring, or have the owner’s express authority to monitor it;

b. monitoring the submitted URLs will not breach any contract, law, intellectual-property right, confidentiality obligation or third-party right;

c. you are authorised to permit our systems and service providers to access and scan the submitted URLs;

d. you have provided any notices and obtained any permissions required in relation to the monitoring; and

e. your use of the Service complies with applicable law.

9.3 You must not submit a URL for monitoring where scanning it could reasonably be expected to damage, disrupt or compromise a system.

9.4 Unless expressly agreed with us in writing, you must not provide through the Service:

a. complete payment-card details;

b. card security codes;

c. live payment credentials;

d. passwords or authentication secrets;

e. special-category personal data; or

f. other sensitive information that is not reasonably necessary for use of the Service.

9.5 You remain responsible for:

a. reviewing scan results, changes, alerts and reports;

b. investigating and responding to identified issues;

c. approving or rejecting scripts, domains, headers and baselines;

d. maintaining the security of your websites and systems;

e. maintaining appropriate backups and business-continuity procedures;

f. engaging appropriately qualified security or compliance professionals where necessary; and

g. meeting all legal, contractual and PCI DSS obligations applicable to your organisation.

10. Acceptable Use

10.1 You must not use, or permit anyone else to use, the Service:

a. unlawfully, fraudulently or maliciously;

b. to scan, monitor or access systems without appropriate authority;

c. to introduce malware, harmful code or damaging content;

d. to attempt to gain unauthorised access to the Service or another user’s account;

e. to interfere with the security, integrity, availability or performance of the Service;

f. to circumvent subscription, security or usage controls;

g. to conduct excessive, abusive or automated activity outside the intended operation of the Service;

h. to copy, reverse engineer, decompile or attempt to extract the source code of the Service, except to the limited extent that such restriction is prohibited by law;

i. to resell, sublicense or provide the Service to a third party without our written permission; or

j. in a manner that could expose us or another person to legal, regulatory, financial or security risk.

10.2 We may investigate suspected misuse and cooperate with law-enforcement authorities, regulators, payment brands, acquiring banks or other competent bodies where legally required or reasonably necessary.

11. Service Availability, Maintenance and Changes

11.1 We will use reasonable care and skill in providing the Service.

11.2 Unless a separate written service-level agreement applies, we do not guarantee that the Service will:

a. be available continuously or without interruption;

b. detect every script, change, vulnerability, configuration issue or unauthorised activity;

c. operate without delay or error;

d. be compatible with every website, browser, security control or third-party service; or

e. retain every item of monitoring information indefinitely.

11.3 Scans may be affected by:

a. login or authentication requirements;

b. bot protection;

c. cookie or consent-management tools;

d. geographic restrictions;

e. network conditions;

f. website configuration;

g. browser behaviour;

h. third-party outages; or

i. changes outside our reasonable control.

11.4 We may carry out planned or emergency maintenance and may temporarily restrict access where reasonably necessary.

11.5 We may update or modify the Service to:

a. improve functionality, performance or security;

b. address technical or legal requirements;

c. respond to changes in PCI DSS or related guidance;

d. prevent fraud or misuse; or

e. replace, update or discontinue features.

11.6 We will give reasonable advance notice of a change that materially reduces the core functionality of a paid subscription, unless urgent legal, security or technical circumstances make advance notice impracticable.

12. PCI DSS and Compliance Disclaimer

12.1 The Service is a monitoring and evidence-management tool. It is intended to support your compliance processes but does not itself make you compliant with PCI DSS or any other standard, law or contractual requirement.

12.2 Use of the Service does not constitute:

a. PCI DSS certification or validation;

b. approval by a Qualified Security Assessor, acquiring bank or payment brand;

c. legal, regulatory, cybersecurity or compliance advice;

d. a guarantee that your payment pages or systems are secure; or

e. a guarantee that all relevant changes, scripts, domains, headers, vulnerabilities or security incidents will be detected.

12.3 You remain solely responsible for determining the requirements that apply to your organisation and for obtaining any required assessment, approval, certification or professional advice.

12.4 Final acceptance of evidence and compliance status rests with your Qualified Security Assessor, acquiring bank, payment service provider, payment brand, regulator or other relevant authority.

12.5 You must not represent that PCI Cart Monitor has certified, approved or guaranteed your compliance unless we have expressly confirmed this in writing.

13. Alerts and Reports

13.1 Alerts and reports depend on the information available to the Service at the time a scan is performed.

13.2 An alert does not necessarily mean that a security incident, compromise or compliance breach has occurred.

13.3 The absence of an alert does not confirm that a website is secure or compliant.

13.4 You are responsible for reviewing alerts promptly and determining what investigation or remediation is appropriate.

13.5 Reports are generated for informational and evidential purposes. You should review reports for accuracy and suitability before providing them to a third party.

13.6 We are not responsible for decisions made by an assessor, acquiring bank, payment provider, regulator or other third party based on a report generated by the Service.

14. Customer Data

14.1 “Customer Data” means information, URLs, configurations, approval records, notes and other content submitted to the Service by or on behalf of the Customer, together with monitoring data generated specifically from the Customer’s submitted pages.

14.2 As between the parties, you retain ownership of Customer Data.

14.3 You grant us a non-exclusive licence to host, copy, process, transmit, display and otherwise use Customer Data to the extent reasonably necessary to:

a. provide and secure the Service;

b. provide technical and customer support;

c. prevent fraud and misuse;

d. comply with legal obligations; and

e. enforce these Terms.

14.4 You are responsible for the legality, accuracy and quality of Customer Data and for maintaining copies of any information you cannot afford to lose.

14.5 We may create and use statistical, analytical or aggregated information derived from use of the Service, provided that the information does not identify the Customer or any individual.

14.6 Following termination or expiry, we may delete or anonymise Customer Data in accordance with our retention practices and legal obligations.

14.7 You should export any reports, evidence or records you need before your subscription ends.

15. Data Protection

15.1 Each party must comply with the data-protection laws applicable to it.

15.2 Our processing of personal data relating to account users, billing contacts, website visitors and prospective customers is described in our Privacy Policy.

15.3 Where we process personal data on your behalf as a processor, the parties will comply with any applicable data-processing agreement entered into between them.

15.4 You are responsible for ensuring that:

a. you have a lawful basis for providing personal data to us;

b. appropriate privacy notices have been provided;

c. any necessary consents or permissions have been obtained; and

d. the Service is configured so that no unnecessary personal data is collected.

15.5 We may use suitable hosting, payment, communications, security and other service providers to help operate the Service.

16. Confidentiality

16.1 Each party must keep the other party’s confidential information confidential and use it only for the purposes of performing or receiving the Service.

16.2 This obligation does not apply to information that:

a. is or becomes public other than through a breach of these Terms;

b. was lawfully known to the receiving party before disclosure;

c. is received lawfully from a third party without a duty of confidentiality;

d. is independently developed without using the confidential information; or

e. must be disclosed by law, court order or a competent authority.

16.3 Where disclosure is legally required, the receiving party will, where legally permitted, give the other party reasonable advance notice.

17. Intellectual Property

17.1 We and our licensors own all intellectual-property rights in the Service, including its software, design, databases, documentation, branding and underlying technology.

17.2 Subject to payment of the applicable fees and compliance with these Terms, we grant you a limited, non-exclusive, non-transferable and revocable right to access and use the Service for your internal business purposes during your subscription.

17.3 No intellectual-property rights are transferred to you except for the limited right of use expressly granted in these Terms.

17.4 You may use reports generated for your account for your internal business, audit, compliance and professional-adviser purposes.

17.5 You must not remove or alter any copyright, trade mark or proprietary notice included in the Service or its reports.

17.6 Where you provide suggestions or feedback, you grant us permission to use that feedback to improve the Service without payment or restriction, provided that we do not publicly identify you without permission.

18. Third-Party Services

18.1 The Service may rely on or interact with third-party services, including:

a. payment processors;

b. hosting providers;

c. communications providers;

d. browser technologies;

e. security tools; and

f. websites submitted for monitoring.

18.2 We are not responsible for a failure or interruption caused by a third-party service outside our reasonable control.

18.3 References or links to third-party services do not constitute an endorsement or warranty by us.

18.4 Your use of third-party products and services may be subject to separate terms between you and the relevant third-party provider.

19. Suspension

19.1 We may suspend access to all or part of the Service where:

a. fees are overdue;

b. you breach these Terms;

c. your use creates or may create a security, legal or operational risk;

d. suspension is required by law or a competent authority;

e. we reasonably suspect fraud, unauthorised access or misuse; or

f. emergency maintenance is required.

19.2 Where reasonably practicable, we will notify you of the suspension and explain what is required to restore access.

19.3 Suspension does not remove your obligation to pay fees that became due before or during the suspension where the suspension resulted from your breach or non-payment.

19.4 We may restore access once the reason for suspension has been resolved to our reasonable satisfaction.

20. Termination

20.1 Either party may terminate the subscription by giving notice not to renew it at the end of the current billing period.

20.2 Either party may terminate immediately by written notice if the other party:

a. commits a material breach that cannot be remedied;

b. commits a material breach capable of remedy and fails to remedy it within 14 days after receiving written notice;

c. becomes insolvent, enters liquidation or administration, ceases trading or becomes subject to an equivalent insolvency event; or

d. is required to terminate by law or a competent authority.

20.3 We may terminate the subscription immediately where you:

a. use the Service unlawfully;

b. scan systems without proper authority;

c. attempt to compromise the Service;

d. engage in fraudulent activity; or

e. create a serious security, operational or legal risk.

20.4 We may decide not to renew a subscription by giving you reasonable notice before the next renewal date.

21. Effect of Termination

21.1 On termination or expiry:

a. your right to access and use the Service ends;

b. all outstanding amounts become payable;

c. you should export any reports and Customer Data you require;

d. we may disable the account and subsequently delete or anonymise Customer Data; and

e. provisions intended to continue after termination will remain in effect.

21.2 Termination does not affect any rights or liabilities that arose before the effective termination date.

21.3 Sections relating to confidentiality, intellectual property, payment obligations, disclaimers, liability and governing law will continue after termination.

22. Warranties and Disclaimers

22.1 We warrant that we will provide the Service with reasonable care and skill.

22.2 Except as expressly stated in these Terms and to the fullest extent permitted by law, the Service is provided on an “as available” basis and all implied warranties, conditions and terms are excluded.

22.3 We do not warrant that:

a. the Service will meet every individual requirement;

b. the Service will be uninterrupted, error-free or entirely secure;

c. every change, vulnerability or security issue will be detected;

d. reports will be accepted by every assessor, bank, payment provider or authority; or

e. using the Service will prevent a data breach, security incident, penalty or compliance failure.

22.4 You acknowledge that internet-based services may be affected by delays, interruptions and events outside our reasonable control.

23. Limitation of Liability

23.1 Nothing in these Terms excludes or limits liability for:

a. death or personal injury caused by negligence;

b. fraud or fraudulent misrepresentation;

c. breach of any liability that cannot lawfully be excluded or limited; or

d. any other matter for which exclusion or limitation is prohibited by law.

23.2 Subject to section 23.1, neither party will be liable to the other for:

a. loss of profit;

b. loss of revenue;

c. loss of business or contracts;

d. loss of anticipated savings;

e. loss of goodwill or reputation;

f. business interruption;

g. loss or corruption of data, except for reasonable restoration costs where directly caused by that party’s breach;

h. regulatory penalties or assessments imposed on the other party; or

i. indirect or consequential loss.

23.3 Subject to sections 23.1 and 23.2, our total aggregate liability arising out of or relating to the Service, these Terms or an Order will not exceed the total subscription fees paid or payable by you during the 12 months immediately preceding the event giving rise to the claim.

23.4 Where the subscription has existed for fewer than 12 months, the liability cap will be the total fees paid or payable from the subscription commencement date to the date of the event giving rise to the claim.

23.5 The limitations in this section apply whether the claim arises in contract, tort, negligence, breach of statutory duty, misrepresentation or otherwise.

24. Customer Indemnity

24.1 You will indemnify us against reasonable losses, liabilities, damages, costs and expenses arising from a third-party claim resulting from:

a. your monitoring of a website or system without proper authority;

b. Customer Data infringing a third party’s rights;

c. your unlawful or fraudulent use of the Service; or

d. your material breach of sections 9 or 10.

24.2 We will notify you promptly of a relevant claim and allow you reasonable control of its defence, provided that you must not settle a claim in a way that admits liability by us or imposes an obligation on us without our written consent.

25. Changes to these Terms

25.1 We may update these Terms from time to time to reflect changes to:

a. the Service;

b. applicable law or regulation;

c. PCI DSS requirements or guidance;

d. security requirements; or

e. our reasonable business practices.

25.2 We will provide at least 30 days’ advance notice of a change that materially and adversely affects an active paid subscription.

25.3 We may make a change with less notice where necessary to:

a. comply with law or a binding regulatory requirement;

b. address an urgent security risk;

c. prevent fraud or abuse; or

d. correct an obvious error.

25.4 Where you do not agree to a material change, you may cancel your subscription before the change takes effect.

25.5 Continued use of the Service after the effective date of the updated Terms constitutes acceptance of the updated Terms.

25.6 Changes to subscription pricing will be handled in accordance with section 6.

26. Notices

26.1 We may send notices to:

a. the email address associated with your account;

b. the primary billing contact;

c. the account dashboard within the Service; or

d. another contact method reasonably provided by you.

26.2 You are responsible for keeping your contact details current and for monitoring the email address associated with your account.

26.3 A notice sent by email will be treated as received on the next business day after it is sent, unless the sender receives a delivery-failure notification.

26.4 Notices to us should be sent using the contact details published on our website.

27. Events Outside Our Control

27.1 Neither party will be liable for delay or failure caused by circumstances beyond its reasonable control, including:

a. internet or telecommunications failures;

b. utility failures;

c. cyberattacks or denial-of-service attacks;

d. third-party service failures;

e. natural disasters;

f. epidemics or pandemics;

g. industrial disputes;

h. war, terrorism or civil unrest;

i. governmental action; or

j. changes in law.

27.2 The affected party must take reasonable steps to minimise the effects of the event.

28. General Provisions

28.1 Entire agreement. These Terms, the applicable Order, our Privacy Policy and any data-processing agreement constitute the entire agreement relating to the subscription and replace prior discussions or representations concerning it.

28.2 No reliance. Each party confirms that it has not relied on a statement not expressly included in the agreement, without limiting liability for fraud.

28.3 Assignment. You may not assign or transfer your rights or obligations without our written consent. We may assign the agreement as part of a corporate reorganisation, sale of business or transfer of the Service, provided that this does not materially reduce your rights.

28.4 Subcontracting. We may use subcontractors and service providers to perform parts of the Service, but we remain responsible for our obligations under these Terms.

28.5 No partnership. Nothing in these Terms creates a partnership, joint venture, agency or employment relationship between the parties.

28.6 Third-party rights. A person who is not a party to these Terms has no right to enforce them under the Contracts (Rights of Third Parties) Act 1999.

28.7 Waiver. A delay or failure to exercise a right does not waive that right.

28.8 Severability. If any provision is found invalid or unenforceable, it will be modified to the minimum extent necessary or deleted, and the remaining provisions will continue in effect.

28.9 Headings. Headings are included for convenience and do not affect interpretation.

28.10 Electronic acceptance. Acceptance of these Terms through an online checkbox, account registration or electronic ordering process will have the same effect as a handwritten signature.

29. Governing Law and Jurisdiction

29.1 These Terms and any dispute or non-contractual obligation arising from them are governed by the laws of England and Wales.

29.2 The courts of England and Wales will have exclusive jurisdiction to resolve any dispute arising out of or relating to these Terms, an Order or the Service.

30. Contact Details

Questions, notices and cancellation requests may be submitted using the contact details published on our website.

PCI Cart Monitor
A trading name of Edward Robertson Limited
Company number: 03931089
Registered office: Business Central, Central Park, Darlington, England, DL1 1GL

Website: www.pcicartmonitor.com
Telephone: 01325 489300