Terms & Conditions

These terms apply to services supplied by THISISITUK LTD, trading as “this is IT”, company number 16807356, VAT number GB505250333, whose registered office is at 124 City Road, London EC1V 2NX (the Supplier), to the customer identified in the relevant signed agreement, proposal or service schedule (the Client).

1. Introduction

The Supplier provides managed business IT services in plain, practical terms. These Terms explain how service delivery, billing, risk allocation and responsibilities are handled.

This public page sets the standard baseline terms for all clients.

If the documents conflict, the Data Processing Agreement takes priority for matters concerning the processing of Client Personal Data only. For all other matters, the following order applies: (1) the signed agreement; (2) the signed proposal, commercial schedule or service schedule; and (3) these Terms. A later document takes priority over an earlier document of the same type.

2. Working Hours and Contact

Hours

• a) Standard service hours are Monday to Friday, 09:00 to 18:00, excluding public holidays in England and Wales.
• b) Standard support closes over Christmas and New Year. The Supplier will notify the Client of the exact closure dates each year. Emergency telephone cover continues during the closure.

Contact

• a) Support requests should normally be raised by email: support@thisisit.uk.
• b) For urgent follow-ups and emergencies, call +44 7445 006967.
• c) Ticket context, relevant email history and ongoing support communication history may be retained within the service desk and used to provide continuity and context when responding to requests.
• d) Emergency out-of-hours support is provided where included in the signed proposal or service schedule. Other out-of-hours work is subject to availability and, where agreed, is charged at £85 per hour with a minimum charge of one hour.
• e) Outside standard service hours, the Supplier will determine whether a request is an emergency requiring immediate response.

3. Service Headings and Scope

Managed IT

• a) The signed proposal or service schedule identifies the users, managed devices, locations and systems covered by the service. Pricing and scope are based on those agreed details.
• b) During standard service hours, Managed IT includes day-to-day user and device support; patch management; endpoint security monitoring and response; Microsoft 365 tenant administration; user onboarding and offboarding; asset and documentation management; third-party vendor liaison; and periodic service reporting at the frequency stated in the signed proposal or service schedule.
• c) Service delivery is remote-first, with site visits where reasonably required and included in the signed proposal or service schedule.
• d) Where support is described as “unlimited”, this means there is no fixed limit on the number of support tickets for the agreed users, managed devices and in-scope systems. Projects, material changes, unsupported systems and additional site visits are outside that scope unless agreed in writing.
• e) The Supplier will review annually how the services provided align with the Client’s needs.

Managed Backups

• a) Managed backups are provided only where included in the signed proposal or service schedule. Charges are based on the agreed protected data volume and service design.
• b) Managed backups can cover servers, virtual machines, infrastructure and file data, as well as data held in the Client’s Microsoft 365 or Google Workspace services (cloud backups).
• c) The protected systems and data, backup approach, retention and recovery arrangements are recorded in the signed proposal or service schedule. The Managed Backups (Scope and Recovery) section explains how the service operates and its limitations.
• d) Cloud backups are delivered using AFI Backup. Where Client Personal Data is processed, AFI Backup is authorised as a sub-processor under the Data Processing Agreement.

Managed Licensing

Includes

• a) Procurement, provisioning, assignment, removal and administration of agreed cloud licences.
• b) Reasonable day-to-day licence changes where applicable.
• c) Yearly review of the Client’s agreed cloud licensing to help ensure it remains aligned with user needs and the services in scope.

Excludes

• a) Third-party vendor warranties or performance commitments.
• b) Non-agreed licensing procurement outside the current service scope.
• c) Major tenant redesign, migration, remediation, licensing audit projects or project-led restructuring unless separately agreed in writing.

Onboarding and Offboarding

• a) Vendor liaison and reasonable transition-in support are included.
• b) Major remediation, migration, restructuring, major reconfiguration and project work are out of scope unless separately agreed in writing.
• c) On termination, reasonable offboarding assistance may be included where stated in the signed agreement or relevant schedules. Further exit assistance may be charged separately.

The Supplier may use approved AI tools to assist in delivering the Services, as described in its AI Policy. Where this involves processing Client Personal Data, the Data Processing Agreement applies.

4. Managed Backups (Scope and Recovery)

Backup service approach

• a) Managed backups may protect agreed servers, virtual machines, file data and cloud service data where expressly included in the signed proposal or service schedule.
• b) Backup frequency and retention depend on the protection arrangements agreed for the Client.
• c) The signed proposal or service schedule records the protected systems and data, backup frequency, retention, recovery method, any agreed recovery objectives, restore-testing frequency, exclusions and what happens to backups when the service ends.
• d) On-site and/or off-site backup approaches may be used depending on the agreed service design.
• e) Off-site backups are encrypted in transit and at rest.

Monitoring and restore assistance

• a) The service includes routine job monitoring, investigation of failed jobs and reasonable day-to-day restore assistance.
• b) Recovery methods may include file-level, mailbox/item, image-level, snapshot-based, bare-metal or recovery to supported virtual targets, depending on workload and tooling.

Cloud backup scope and recovery

• a) Where cloud backups are included, the Supplier protects the agreed Microsoft 365 or Google Workspace services on the schedule recorded in the signed proposal or service schedule.
• b) Cloud backups can include email, cloud storage, calendars, Teams messages and Copilot content, as recorded in that proposal or schedule.
• c) For email, cloud storage and calendars, recovery may cover individual items, mailboxes, sites or whole accounts, restored back into the Client’s platform to the extent that platform supports it.
• d) Teams messages and Copilot content are backed up as exports. They can be provided to the Client as downloadable files but cannot be restored back into Teams or Copilot.
• e) What a cloud platform allows a backup tool to capture is set by the platform provider and can change. The Supplier will tell the Client where a change materially affects the agreed service.
• f) Cloud backup data is stored in the UK.
• g) Recovery depends on the cloud provider’s own interfaces, availability and retention, which are outside the Supplier’s control.
• h) The limitations below apply to cloud backups as they do to other managed backups.

Important limitations

• a) Backups reduce risk and improve resilience, but do not guarantee against every data loss event, recovery delay or interruption.
• b) Backups do not by themselves provide guaranteed failover, instant recovery or an always-on standby platform.
• c) Extra recovery effort outside normal managed delivery may be separately chargeable.
• d) Backup success and recovery outcomes may also be affected by source-system health, connectivity, credentials, storage availability, hardware availability, target-environment readiness and other dependencies outside the Supplier’s reasonable control.

5. Disaster Recovery

• a) Where client-specific disaster recovery scope, recovery priorities, target recovery environment or recovery objectives are expressly agreed, these will be recorded in the signed proposal, service schedule or client appendix.
• b) Following a major incident, the Supplier will assess affected systems, identify the latest viable recovery point or recovery state and coordinate the most appropriate recovery path available for the affected workload.
• c) Depending on agreed service design, recovery may involve backup restore, snapshot recovery, replication recovery, image-based recovery, recovery to supported virtual infrastructure, or rebuild to replacement infrastructure.
• d) Procurement of suitable replacement hardware and/or compatible recovery infrastructure may still be required.
• e) Unless expressly agreed in writing, these Terms do not create a guaranteed recovery timeframe, guaranteed recovery point, guaranteed failover capability or always-on standby environment.
• f) Any response time, target-fix time, recovery point or recovery time stated in a proposal or service schedule is a service target unless it is expressly described as guaranteed. Target times depend on access, Client cooperation, third-party services, replacement equipment and other matters outside the Supplier’s reasonable control.

6. Cloud / Third-Party Services

• a) The Supplier may use appropriate public cloud, private cloud, hosted platforms or third-party infrastructure to deliver services.
• b) Third-party services and platforms remain subject to each provider’s own terms, availability and operating rules.
• c) The Supplier does not provide warranties on behalf of third-party vendors.
• d) Restoring data or failing over to another environment may incur third-party charges, including data transfer charges. The Supplier will seek the Client’s approval before incurring these costs, except within the emergency spending allowance set out in the Fees and Payment section.
• e) Third-party services used by the Supplier include the AI providers named in its AI Policy.
• f) Where a third-party provider processes Client Personal Data on the Supplier’s behalf, its use is governed by the Data Processing Agreement, including its sub-processor arrangements.

7. Client Responsibilities

• a) Provide timely access, approvals and cooperation needed for delivery and recovery work.
• b) Keep user, asset and environment information accurate and current.
• c) Use software lawfully and maintain required subscriptions, warranties and vendor relationships.
• d) Notify the Supplier of material changes that affect risk, supportability or scope.
• e) Unsupported, end-of-life or undisclosed systems may materially affect service quality and recovery outcomes.

8. Fees and Payment

• a) Recurring fees begin on the service commencement date and are invoiced monthly in advance. Invoices are due within 14 days of the invoice date, unless the signed agreement or proposal states otherwise. All prices exclude VAT unless expressly stated.
• b) Project work, out-of-hours activity, hardware and materially expanded scope are charged separately unless included in the signed proposal or service schedule.
• c) Payment is due by Direct Debit or another agreed payment method by the invoice due date.
• d) Microsoft licence charges are passed through at the vendor’s list price, reconciled quarterly and notified to the Client in writing. The Client controls the licence quantities. Other changes to the Supplier’s fees require written agreement.
• e) Unplanned third-party costs require prior written approval from the Client contact named in the service schedule. Where waiting for approval would extend an outage or security incident, the Supplier may incur up to £250 per incident, subject to a maximum of £500 per calendar month and will report the cost to the Client within one business day.
• f) The Client must notify the Supplier of an invoice dispute in writing within 10 business days of the invoice date, giving reasons. The Client must pay any undisputed amount by the due date and the parties will seek to resolve the dispute in good faith.
• g) If an undisputed amount remains overdue, the Supplier may claim statutory interest and fixed recovery costs where permitted by law. The Supplier may suspend affected services after giving at least 30 business days’ written notice. Suspension for non-payment will not prevent the Supplier from providing contracted emergency support for an active business-wide outage or security incident.

9. Term, Notice and Termination

• a) Services start on the service commencement date stated in the signed proposal and continue for an initial term of 12 months. Neither party may terminate for convenience during the initial term.
• b) After the initial term, services continue on a rolling basis.
• c) Either party may terminate by giving at least 90 days’ written notice. Notice may be given during the initial term, but termination cannot take effect before that term ends.
• d) The Supplier may suspend affected services immediately where reasonably necessary to address a serious security, legal or operational risk, or where the Client’s refusal to provide essential access prevents safe delivery of the services. Suspension for non-payment follows the notice process under Fees and Payment.
• e) Either party may terminate for a material breach that the other party does not remedy within 30 days of written notice. Either party may also terminate if the other becomes insolvent or ceases business.
• f) On termination, the Client remains responsible for the balance of any non-cancellable third-party subscription commitment entered into for the Client and for hardware ordered for the Client, which is non-cancellable once ordered and payable in full.

10. Liability and Insurance

• a) Nothing in these Terms limits or excludes liability that cannot lawfully be excluded or limited.
• b) The Supplier’s total liability to the Client is limited to £1,000,000 in any 12-month period for claims other than those relating to the processing of Client Personal Data. For claims relating to the processing of Client Personal Data, the Supplier’s total liability to the Client is limited to £100,000 in any 12-month period. Different limits apply only if expressly agreed in the signed agreement or proposal.
• c) Indirect or consequential loss is excluded to the fullest extent permitted by law.
• d) The Supplier maintains insurance appropriate to the services provided, currently including professional indemnity, cyber/data cover and public and products liability.
• e) All insurance remains subject to the applicable policy terms, limits and exclusions.
• f) Details and evidence of current insurance cover will be provided with the proposal.
• g) Where the Supplier accepts responsibility for work it has delivered, including work produced with AI assistance, that responsibility does not vary or displace the limits agreed under this section.

11. Confidentiality and Data Protection

Confidential Information

• a) Each party must keep the other party’s confidential information confidential and secure.
• b) Confidential information includes information about a party’s:
  • business, operations and finances;
  • clients, suppliers and staff;
  • systems, networks and technical arrangements;
  • security controls, risks and incidents;
  • accounts, credentials and access arrangements;
  • prices, proposals and commercial plans; and
  • other information that is marked confidential or would reasonably be understood to be confidential.
• c) Each party may use the other party’s confidential information only to:
  • provide or receive the Services;
  • manage the agreement; or
  • meet a legal or regulatory requirement.
• d) Confidential information may be disclosed only to:
  • staff, contractors and representatives who need it for the Services and are bound by confidentiality;
  • any group company of either party, where it needs the information for the Services and is bound by confidentiality;
  • professional advisers and insurers who need it for their work;
  • approved service providers who need it to support the Services and are bound by appropriate confidentiality obligations;
  • a prospective purchaser of a party, or of the whole or part of its business, under written confidentiality obligations; or
  • a court, regulator or other authority where disclosure is required by law.
• e) Where an approved service provider processes Client Personal Data on the Supplier’s behalf, it must also be identified and authorised under the Data Processing Agreement.
• f) Where disclosure is required by law, the party making the disclosure will, where legally permitted:
  • inform the other party before disclosing the information;
  • disclose only the information required; and
  • take reasonable steps to protect the information.
• g) Information is not confidential where the receiving party can show that it:
  • is already publicly available other than because of a breach of confidence;
  • was already lawfully known to the receiving party;
  • was lawfully received from another person without a confidentiality restriction; or
  • was independently developed without using the other party’s confidential information.
• h) Each party must apply reasonable security measures to protect the other party’s confidential information against unauthorised access, use or disclosure.
• i) When the information is no longer reasonably needed, or when the agreement ends, each party will return or securely destroy the other party’s confidential information on request, where reasonably possible. Information may be retained where:
  • the law requires it;
  • it is needed to establish or defend legal rights; or
  • it remains in backups until the normal backup-retention period expires.

Any retained information remains protected by this section.

These confidentiality obligations continue after the agreement ends for as long as the information remains confidential.

Data Protection

• a) Each party must comply with the data-protection laws that apply to it.
• b) Where the Supplier processes personal data on the Client’s behalf, that processing is governed by the applicable Data Processing Agreement and DPA Execution Sheet.
• c) If there is a conflict concerning the processing of Client Personal Data, the Data Processing Agreement takes priority over this section.
• d) Nothing in this section transfers ownership of, or grants any licence in, either party’s intellectual property or confidential information.
• e) Each party may seek an injunction or other urgent relief for an actual or threatened breach of this section, without needing to show financial loss.
• f) The Supplier may use the general knowledge, skills and experience gained while providing the Services and anonymised aggregated data that does not identify the Client or disclose its confidential information, for service improvement, benchmarking and reporting.

12. Information Security

• a) The Supplier applies reasonable technical and organisational security measures appropriate to the services, agreed scope and risks reasonably known to the Supplier.
• b) The Supplier’s current security certification and its expiry date are stated in the proposal or the certificate provided with it. The Supplier will use reasonable efforts to maintain appropriate security controls and will notify the Client if its certification status changes.
• c) Where included in scope and supported by the Client’s licensing, the Supplier may configure, administer or advise on Microsoft security controls (including Defender for Business, Conditional Access and Intune) and may provide general security awareness guidance.
• d) Information security is a shared responsibility. The Client remains responsible for its governance, internal policies, staff behaviour, approvals, licensing, supported devices and timely implementation of agreed recommendations.
• e) The Client must ensure staff follow appropriate security practices and must promptly notify the Supplier of suspected compromise, unauthorised access, lost or stolen devices, staff changes or other material events that may affect security.
• f) Unless expressly agreed in writing, the Supplier does not guarantee prevention of all cyber incidents and will not be responsible for losses to the extent caused or materially contributed to by matters outside its reasonable control, including Client delay, refusal of recommended controls, unsupported systems, inadequate licensing, user action or inaction, compromised credentials, undisclosed systems or third-party platform failure.

13. Supplier Incapacity / Continuity Cover

• a) The Supplier’s continuity partner is IT Select. If the Supplier is temporarily unable to deliver services directly, IT Select may be used to maintain normal service cover, essential monitoring and reasonable actions to help keep critical systems online. Any replacement continuity partner will be notified and authorised in accordance with the Data Processing Agreement before being given access to Client Personal Data.
• b) This continuity cover does not create an additional continuity fee for the Client.
• c) Any out-of-hours activity or project work delivered by the continuity partner is charged separately where applicable.
• d) The continuity partner must be bound by written confidentiality and data-protection obligations appropriate to the services it provides.
• e) Only information reasonably required to deliver continuity support will be shared.
• f) Where the continuity partner may access Client Personal Data, it must be identified and authorised under the Data Processing Agreement before it is used. Its access will be granted only when continuity cover is needed, through named accounts with multi-factor authentication. Access will be logged and revoked when the cover ends.

14. Changes to Services / Terms

• a) Changes to scope, user count, platforms, infrastructure dependencies, data volumes or third-party rules may require service and pricing updates.
• b) The Supplier may update its support processes, security controls or tooling on written notice to the Client, provided the update does not materially reduce the agreed service levels, security protections or the Client’s rights. Where practical, the Supplier will give at least 30 days’ written notice.
• c) Changes to fees, scope, service levels, the contract term, liability or data-protection arrangements require written agreement between the parties and must be recorded in the relevant signed agreement, proposal or service schedule, except where the Data Processing Agreement sets out a specific process for changes to sub-processors or changes required by law. The agreed Microsoft licence price process under Fees and Payment continues to apply.
• d) If the parties do not agree a proposed material change, the existing terms continue unless the agreement ends in accordance with Term, Notice and Termination.

15. Website Content and External Links

• a) The Supplier may link to external websites and support pages. The Supplier is not responsible for the content, security, privacy practices or availability of external sites it does not operate.
• b) The Supplier aims to keep website content accurate and up to date but does not guarantee completeness or uninterrupted availability.
• c) Website calculator figures are estimates only. All prices exclude VAT unless stated otherwise.

16. Governing Law

These Terms (and any non-contractual disputes connected with them) are governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction unless otherwise required by law.

17. Document Control