Hosting Terms

• Part A: Hosted Service Terms
• Part B: Data Processing Agreement (UK GDPR Article 28)
• Part C: Exit promise ("your site is yours")

Part A: Hosted Service Terms

1. Who we are, and words used here

1.1 CompKit Hosting is provided by AlfieLucas Ltd, trading as KrisCreates and CompKit, a company registered in England and Wales, number 16916815, registered office Alexandra Road, Cas-Gwent, NP16 5QU, United Kingdom ("we", "us"). Contact: hello@kriscreates.co.uk; support: support@kriscreates.co.uk.

1.2 "You" is the business that orders hosting. "Site" is your competition website on our servers. "Your Data" is everything you or your customers put into the Site: competitions, pages, images, orders, entries, tickets, customer and winner details. "Service" is the hosting described in section 4. "Software" is CompKit Themes, CompKit Extra, Ticket Machine, the Game Engine and our compkit-host control plugin.

2. Who can buy

2.1 The Service is for businesses and sole traders running prize competitions, not for consumers. By ordering you confirm you are acting for your business and are 18 or over.

2.2 If the law treats you as a consumer anyway, nothing here takes away rights the law gives you.

3. How the contract starts

3.1 The contract starts when we confirm your order in writing (email counts) or when we first create your Site, whichever is first.

3.2 It is made up of: these terms (Part A), the data processing agreement (Part B), the exit promise (Part C), your order confirmation (plan, fee, start date, minimum term), and the CompKit software terms. If they conflict, the order confirmation wins on price and term, Part B wins on personal data, then Part A, then the software terms.

4. What the Service includes

4.1 A WordPress competition website on a server in a UK data centre, built and kept running by us, with its own isolated user, database and PHP pool.

4.2 Installed and kept up to date by us: WordPress, WooCommerce and the Software.

4.3 An owner login (and staff logins on request) to run competitions, orders, customers, winners, pages, the look of the Site and CompKit settings.

4.4 A free address at yourname.compkit.site and, when you want it, your own domain with an HTTPS certificate we obtain and renew.

4.5 Sending of the Site's own emails (order receipts, password links, entry and winner emails) from our sending address, with replies going to your email address.

4.6 Nightly backups kept on the server and copied off-site to a separate company, with a restore tested every month (section 11).

4.7 Security monitoring, firewall, software and security updates.

4.8 Email support (section 10).

5. What it does not include

5.1 Your business and your competitions. We provide the website, not the competition. See section 6.

5.2 Payments and their costs. You hold your own account with your payment provider. Money from your sales goes to you. Your payment provider's fees are not part of any CompKit plan. They are charged to you by the provider and are an extra cost on top of your plan. See section 5A.

5.3 Your domain name. You register, own and renew it (unless we register one for you; then section C4 applies).

5.4 An email inbox. We send the Site's emails; we don't provide mailboxes.

5.5 Marketing email. Newsletters and bulk marketing aren't sent through our servers. Use a mailing service in your own name.

5.6 Other plugins, themes or custom code. You can't install them yourself; this keeps every Site fast and safe. Ask and we'll say whether something can be added and what it costs.

5.7 Legal, tax, accounting or gambling-law advice. Our compliance tools help; they are not advice.

5A. Payment providers

5A.1 To take card payments you need your own account with a payment provider that accepts prize competitions. You apply to it, it decides whether to approve you, and your agreement for payments is with it, not with us. 5A.2 Its costs are yours. That includes any set-up or application fee, monthly fee, percentage and per-payment fees, chargeback fees, reserves, minimum terms and leaving fees. You pay these to the provider. They are in addition to our fees, aren't included in any plan, and we don't refund, reduce or pay them. 5A.3 What we do: we explain what providers usually ask for, make sure your Site has the pages they look for, connect the provider to your Site once you're approved, and run a test payment with you. Our payments guide (shown in your Site's admin under Taking payments) sets this out. 5A.4 What we don't do or promise: we don't apply for you, and we don't promise that any provider will approve you, how long it will take, or what it will charge. We don't hold, handle or have access to your money, and we aren't responsible for refunds, chargebacks or disputes. 5A.5 Not our liability: a provider refusing, delaying, limiting or closing your account, holding back funds, or changing its fees or terms is not our fault and doesn't reduce, pause or change your CompKit fees or minimum term. While you have no working payment account, you still pay your plan; the Site and its other features keep working. 5A.6 Introductions and referral payments. If we introduce you to a provider, you're free to use a different one. We may receive a referral payment from a provider we introduce you to. It never changes what the provider charges you. 5A.7 Your keys. When we connect your provider, send its keys or settings only in the secure way we tell you. We store them only in your Site's settings and use them only to connect payments.

6. Your responsibilities

6.1 Competition law. You are solely responsible for every competition on your Site being lawful, including that it is a genuine prize competition or free draw and not unlawful gambling under the Gambling Act 2005 (for example a proper skill question and/or a genuine free entry route), that it follows the CAP Code and ASA rules on promotions, and that you hold any licence or permission you need.

6.2 Your customers. You check entrants are 18 or over where your competitions need it, run draws fairly and as advertised, deliver prizes, and handle complaints and refunds.

6.3 Legal pages. You publish your own competition terms, privacy notice and cookie notice on the Site, under your business name. CompKit Extra provides starting templates; you are responsible for their content.

6.4 Data protection. For Your Data you are the controller under UK GDPR (Part B). You must have a lawful basis for what you collect and tell your customers about us as your hosting provider.

6.5 Logins. Keep passwords private, use a strong one, give staff their own login, and tell us straight away if you think a login has been misused.

6.6 Content. You have the right to everything you upload (images, prize photos, videos, text) and it doesn't infringe anyone's rights or break the law.

6.7 Contact details. Keep your email and phone up to date with us; important notices go there.

6.8 Tell us about big nights. Give us 7 days' notice of any launch, promotion or draw you expect to be much busier than usual (section 9.3).

7. Acceptable use

You must not use the Site or our servers to: break any law; run anything other than the competition business you told us about; sell or promote anything illegal, adult, or harmful; send spam or unsolicited bulk email; host malware or phishing; try to get round the limits on your login, access other customers' sites, or test our security without written permission; or put an unfair load on the server outside normal competition trading. Section 13 says what happens if you do.

8. Fees and payment

8.1 Your plan, its fee, billing period and minimum term are in your order confirmation. Our monthly plans (Starter, Growth, Pro and Elite) include hosting and have a 12-month minimum term. You can upgrade at any time, with the new price from your next bill; a downgrade takes effect at renewal. If hosting came included with a one-off build, it is included for the first 12 months, then continues at the hosting price in your order confirmation unless you leave under Part C. None of our prices include payment provider fees (section 5A).

8.2 Fees are paid in advance by card or Direct Debit through our billing provider, each month or year, as your order confirmation says. Prices are shown with VAT where we charge it. If we are VAT registered, VAT is added at the current rate.

8.3 Late payment. If a payment fails we tell you and try again. If anything is still unpaid 14 days after we remind you, we may suspend the Site (section 13) and charge interest and compensation under the Late Payment of Commercial Debts (Interest) Act 1998.

8.4 Price changes. We give you at least 30 days' written notice. You can leave before the new price applies, without an exit fee, even during a minimum term.

8.5 Refunds. In line with our website terms, fees already paid are not refunded, except where: we end the Service early for a reason that isn't your fault (we refund the unused part), or the law requires a refund.

9. Availability and capacity

9.1 We aim to keep the Site available all the time, but we don't promise a percentage, and no hosting is ever 100% available.

9.2 Maintenance. Routine updates normally cause no downtime. Work that takes the Site offline is done between 23:00 and 07:00 UK time, not on Fridays, Saturdays or Sundays where we can, with at least 48 hours' notice unless it's an urgent security fix.

9.3 Capacity. Each server is shared by several sites, each walled off from the others. Our tests show a site on our standard server handles roughly one completed order per second at its busiest. If you give us notice under 6.8, we'll make sure there is room at no extra charge, for example by moving you to a bigger server for the night.

9.4 Limits per Site: 10GB of storage and normal transactional email, which is the receipts and account emails your customers trigger up to 300 a day across the plan until we upgrade the email service. If you get near a limit we'll talk to you before anything changes.

9.5 If we're at fault. If the Site is down for more than 4 hours in a row because of something within our control (not your actions, your domain or DNS, your payment provider, or section 21 events), we'll credit one week's hosting fee for each such outage, up to one month's fee in a month. Credits are the only money remedy for downtime.

10. Support

10.1 Email support@kriscreates.co.uk, Monday to Friday 9:00-17:00 UK time, excluding bank holidays. We aim to reply within one working day.

10.2 Site down: email with "SITE DOWN" in the subject at any time. We aim to start work within 1 hour between 08:00 and 22:00 UK time, every day, and as soon as we can otherwise.

10.3 Support covers the Service and the Software. It doesn't cover writing your content, running your competitions, or third-party services you add yourself.

11. Backups and restores

11.1 Every night we back up your database and files. They are encrypted, kept on the server and copied to a separate storage company. We keep 14 daily, 8 weekly and 6 monthly copies.

11.2 We test restoring a site from backup every month.

11.3 If you need something restored (a deleted competition, the whole Site as it was yesterday), ask support. Restores needed because of our fault are free. Your first restore in any month is free; after that we tell you the cost before we start.

11.4 Backups are for disaster recovery. You can download your own exports at any time (Part C) and we recommend you keep your own copy of anything you can't afford to lose.

12. Security

12.1 We protect the servers with the measures in Annex 2 of Part B and keep them up to date.

12.2 If we find a security incident affecting your Site, we tell you as set out in Part B clause 7. We'll work with you on any notification to your customers or the ICO.

13. Suspension

13.1 We may suspend all or part of the Site if: a fee is still unpaid after the reminder period in 8.3; you break section 6 or 7 in a serious way; your Site is attacking or putting other sites at risk; or the law, a court or a regulator requires it.

13.2 We will warn you first and give you a chance to fix it, unless it's an emergency (an attack, illegal content, or serious risk to other customers). In that case we suspend first and tell you straight away.

13.3 We suspend only as much as needed and restore the Site as soon as the reason is fixed. Suspension never stops you getting your data back (Part C).

14. Changes

14.1 To the Service. We may improve or change how the Service works, including moving your Site to another server, so long as the Service you get isn't materially worse. Server moves are designed to be invisible to you.

14.2 To these terms. We tell you at least 30 days before a change that is worse for you. If you don't accept it, you can leave before it applies, with no exit fee and a pro-rata refund of anything you paid in advance. Changes required by law, or that don't disadvantage you, can apply sooner.

15. Ownership and licences

15.1 Your Data is yours. We claim no ownership of it. You let us store, copy, back up and display it only so we can provide the Service.

15.2 The Software is ours (or our licensors'). While your Service is active you get the right to use it on your Site. GPL-licensed parts remain under the GPL. Part C3 says what happens to licences when you leave.

15.3 Your name and logo. We won't use them in our marketing without your written permission.

16. Confidentiality

Each of us keeps private what we learn about the other's business that isn't public, uses it only for this contract, and shares it only with people who need it to do their job here and are bound to keep it private. This doesn't apply to information we must disclose by law, which we'll tell you about where we're allowed to.

17. Other companies we use

We use the providers listed in Annex 3 of Part B to run the Service. We choose them carefully and are responsible for their work as if it were ours, within section 19.

18. Warranties

18.1 We will provide the Service with reasonable care and skill.

18.2 Apart from that, and anything the law doesn't let us exclude, the Service is provided as it is. We don't promise it will be uninterrupted or error-free, or that it will make your competitions successful or lawful.

19. Liability

19.1 Nothing here limits liability for death or personal injury caused by negligence, for fraud, or anything else the law doesn't allow to be limited.

19.2 We are not liable for: loss of profits, sales, revenue, business, goodwill or anticipated savings; indirect or consequential loss; the outcome or legality of your competitions; any act or decision of your payment provider; or loss of data beyond our duty to restore it from our latest good backup.

19.3 Our total liability for everything arising out of this contract in any 12-month period is capped at the hosting fees you paid us in that period, or £500, whichever is higher.

19.4 You must tell us about a claim within 12 months of becoming aware of it.

20. Your indemnity

You will cover our reasonable losses and costs (including legal costs) from any claim against us by a third party or a regulator caused by: your competitions, prizes or draws; your content; your breach of sections 6 or 7; or your breach of data protection law as controller. We'll tell you promptly about any such claim and let you take part in handling it.

21. Events outside anyone's control

Neither of us is liable for delay or failure caused by events beyond reasonable control: for example a major failure at a data centre or internet provider, a cyber-attack that reasonable precautions couldn't stop, power or network failure, fire, flood, war, government action or pandemic. The affected side tells the other and does what it reasonably can to limit the effect. If it lasts more than 30 days, either side can end the contract by written notice, and Part C still applies.

22. Length of the contract and ending it

22.1 The contract runs from the start date until either side ends it.

22.2 You can end it with 30 days' written notice. If you're in a minimum term, the fees for the rest of the minimum term are still due, except where 8.4, 14.2 or 22.4 applies.

22.3 We can end it with 90 days' written notice, for example if we stop offering hosting. We refund any fee you paid in advance for the period after it ends.

22.4 Either side can end it straight away by written notice if the other: seriously breaks the contract and doesn't fix it within 14 days of being asked (or can't fix it); or becomes insolvent, enters administration or liquidation, or stops trading.

22.5 We can also end it straight away if fees are unpaid 30 days after suspension under 8.3, or if the Site is used for something illegal.

22.6 When it ends for any reason, Part C applies. Sections 15, 16, 19, 20, 23 and Part C continue after it ends.

23. General

23.1 Notices. Formal notices are sent by email: to you at the address on your account; to us at hello@kriscreates.co.uk. They count as received on the next working day.

23.2 Transfer. You may not transfer this contract without our consent. We may transfer it to a company that takes over our hosting business, telling you first. Your rights under Part C stay the same.

23.3 Subcontractors. We may use subcontractors, and we remain responsible for them (see 17 and Part B).

23.4 Whole agreement. This contract is the whole agreement about hosting and replaces anything said before. Neither of us is relying on anything not written in it. This doesn't limit liability for fraudulent misrepresentation.

23.5 If one part is invalid, the rest still applies.

23.6 Not enforcing a right straight away doesn't mean we've given it up.

23.7 Third parties. Only you and we can enforce this contract. The Contracts (Rights of Third Parties) Act 1999 does not apply.

23.8 Law. English law applies, and the courts of England and Wales decide disputes. Before going to court, we'll each try for 30 days to settle the dispute by talking.

Part B: Data Processing Agreement (UK GDPR Article 28)

1. Roles

1.1 For Your Data, you are the controller and we are your processor. Annex 1 sets out what we process.

1.2 For your account with us (your name, business details, contact details, billing records, support emails), we are the controller and our privacy policy applies, not this Part.

1.3 This Part applies for as long as we hold Your Data, including after the contract ends.

2. Your instructions

2.1 We process Your Data only on your documented instructions. These are: this contract; the way you set up and use the Site; and anything else you ask in writing that we agree to.

2.2 If the law requires us to process it in another way, we tell you first, unless the law forbids that.

2.3 If we think an instruction breaks data protection law, we tell you straight away and may refuse it.

2.4 You confirm that your instructions are lawful, that you have a lawful basis for the data you collect, and that your privacy notice tells your customers about this processing and about us as your hosting provider.

3. Confidentiality

Everyone we allow to access Your Data is bound to keep it confidential. Access is limited to those who need it to run the Service. Today that is the director of AlfieLucas Ltd. We'll keep this list current.

3A. Software tools we use to look after the Site

We may use software tools, including AI assistants, to maintain the servers and fix problems. These tools are set up so that they don't read Your Data: they work from counts and statuses, logs with personal details removed, our own test site with made-up data, or an order number you give us (looking only at that order's status, items and tickets). Because of this, they are not sub-processors. If we ever need a tool that would read Your Data, we treat it as a new sub-processor under clause 5 and tell you first.

4. Security (Article 32)

4.1 We keep the measures in Annex 2 in place, appropriate to the risk, and review them at least once a year and after any incident.

4.2 We may improve them; we won't make them weaker overall.

5. Sub-processors (Article 28(2) and (4))

5.1 You give us general permission to use the sub-processors in Annex 3.

5.2 We tell you at least 30 days before adding or replacing one, by email. If you object on reasonable data protection grounds and we can't resolve it, you may end the contract before the change, with no exit fee, a pro-rata refund of fees paid in advance, and Part C.

5.3 Each sub-processor is bound by written terms giving at least the same protection as this Part. We remain fully responsible to you for their work.

6. Helping you

6.1 Your customers' rights. Most requests (access, correction, deletion, export) you can handle from your owner login. For anything you can't, we help within 5 working days. If a customer contacts us directly, we pass the request to you and don't answer it ourselves unless you ask.

6.2 Other duties. We help you, as far as the information we hold allows, with security, breach notifications, data protection impact assessments and consulting the ICO (Articles 32 to 36). Reasonable help is free. If it takes more than 2 hours in a year, we tell you the cost before doing more.

7. Personal data breaches (Article 33)

7.1 We tell you without undue delay, and in any case within 48 hours, after we become aware of a breach affecting Your Data. (You then have 72 hours from when you're aware to tell the ICO where required.)

7.2 We tell you as much as we know of: what happened; the kinds and rough number of people and records affected; the likely consequences; what we've done and will do; and who to contact. If we don't know everything yet, we send what we have and update you.

7.3 We take reasonable steps to contain the breach and keep records of it. We won't name you in any public statement about a breach without your agreement, unless the law requires it.

8. Transfers outside the UK

8.1 Your Data is hosted in the UK. Some sub-processors (Annex 3) process it in the EU/EEA, which the UK treats as adequate.

8.2 We won't transfer Your Data to any other country without a lawful safeguard: UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework for certified US companies, or the UK International Data Transfer Agreement or Addendum. Annex 3 shows the safeguard for each provider.

9. Government and legal requests

If a public authority or court asks us for Your Data, we tell you and give you the chance to object, unless the law forbids it. We hand over only what we are legally required to.

10. End of processing

10.1 When the contract ends, we return Your Data under Part C, then delete it from the live server within 30 days after the end of the handover period in C5.

10.2 Copies in backups expire on the normal schedule (no more than 6 months). Until then they stay encrypted and are not used, except to restore at your request.

10.3 We confirm deletion in writing if you ask. We may keep data only where the law requires.

11. Records and audits

11.1 We keep the record of processing required by Article 30(2).

11.2 We give you the information needed to show we meet this Part, including a summary of our security measures and sub-processors on request.

11.3 You (or an independent auditor bound by confidentiality) may audit our compliance once a year on 30 days' notice, during business hours, at your cost, and not in a way that exposes other customers' data. Extra audits are allowed after a breach or when a regulator requires one.

12. Liability

Each side's liability under this Part is subject to Part A section 19. Nothing in it limits what either side owes the ICO or your customers under the law.

Annex 1: what we process

Annex 2: security measures (as built, November 2026)

• Isolation: each Site has its own Linux user, database and PHP pool. Sites can't read each other's files or data.
• Server: firewall allowing only the web ports, plus SSH. Server login by SSH key only, with no passwords allowed. The control panel is locked to our own IP address. fail2ban blocks repeated failed logins. Security updates install automatically.
• Encryption in transit: HTTPS on every site with Let's Encrypt certificates, renewed automatically. Email is sent to our provider over an encrypted, authenticated connection, and our sending domain is DKIM-signed.
• Encryption of backups: backups are encrypted (restic) before they leave the server. Only we hold the key, and it is stored separately from the backups.
• Access control: owner logins can't install code or edit files. Only our support login is an administrator. Our own access uses unique keys and passwords kept in a password manager.
• Backups: nightly copies kept on the server and off-site, retained 14 daily, 8 weekly and 6 monthly. A restore is tested every month.
• Monitoring: backup results are reported to our management system every night. certificates renew automatically and are checked before they expire.
• Updates: WordPress, WooCommerce and CompKit software are kept on current published versions.

Annex 3: sub-processors

Part C: Exit promise ("your site is yours")

C1. Export any time. While you're with us, and when you leave, you can ask for an export. Within 5 working days we provide:

You can also download customers and orders yourself from your owner login at any time.

• a full database export (every order, customer, competition, ticket, entry and winner);
• all your files (images, uploads, pages, settings);
• your customers and orders as CSV files you can open in a spreadsheet;
• a short written guide to moving the Site to another WordPress host.

C2. No exit fee. The export when you leave is free. Extra exports while you're still with us: the first in any 3 months is free, then we tell you the cost first. Hands-on help moving to a new host: quoted first.

C3. Your data, even in a dispute. We never hold Your Data back to make you pay a bill or settle a dispute. You get the export whatever the state of your account. Only hands-on migration help waits for unpaid fees.

C4. Domains. If your own domain points at us, you just point it at your new host. There is nothing for us to release. If we registered a domain for you, we transfer it to you free of charge, with the transfer code, within 5 working days of your request.

C5. No gap. After the contract ends, the Site stays up for 14 days so you can switch over without downtime. We then delete it under Part B clause 10.

C6. Software after you leave. Your Site keeps working on its new host. The CompKit Software licences that came with hosting end, so premium features (such as the games) switch off until you buy normal CompKit licences, which keep the updates and premium features. Free and GPL parts keep working.

C7. If we stop. If we stop offering hosting or stop trading, you get at least 90 days' notice (or as much as we can give in insolvency) and the same export. If we sell the hosting business, the buyer must keep this promise.

C8. Emails and links. Emails your customers already received keep working, because links point at your domain. If you've been using a yourname.compkit.site address, it redirects to your new address for the 14 days in C5 if you ask.

Questions about these terms? Email hello@kriscreates.co.uk.