# CORE DAEMON LTD
# Website, Services and Sales Terms and Conditions

**Effective date:** 25 October 2026
**Website:** https://coredaemon.co.uk
**Company:** CORE DAEMON LTD
**Company registration number:** 17463737
**Registered office:** 74a Pretoria Avenue, London, England, E17 7DL

## 1. Introduction and Acceptance

### 1.1 About these Terms

Welcome to CORE DAEMON LTD, trading online as CoreDaemon ("CoreDaemon", "we", "us" or "our").

These Terms and Conditions govern access to and use of our website, customer portal, online shop, digital platforms, software applications, subscriptions, professional technology services and associated products.

By accessing our website, registering an account, placing an order, accepting a quotation or entering into a service agreement, you agree to be bound by the applicable provisions of these Terms.

### 1.2 Legal Entity

CORE DAEMON LTD is a private limited company incorporated and registered in England and Wales under company number 17463737.

Our registered office is 74a Pretoria Avenue, London, England, E17 7DL.

### 1.3 Application of Terms

These Terms apply to both individual consumers and business customers, except where specific provisions distinguish between them.

A "Consumer" is an individual acting for purposes wholly or mainly outside their trade, business, craft or profession.

A "Business Customer" is a person or organisation purchasing primarily for business purposes.

Mandatory consumer rights shall take precedence over any conflicting provision in these Terms.

### 1.4 Additional Agreements

Certain products and services may be subject to separate agreements, including:

- Software licence agreements.
- Software development contracts.
- Website development agreements.
- Hosting and cloud service agreements.
- Managed IT support contracts.
- Service-level agreements.
- Subscription terms.
- Maintenance and support agreements.
- Data processing agreements.

Where there is a conflict, the specifically agreed contractual terms shall take precedence for the relevant service, except where prohibited by law.

## 2. Our Products and Services

### 2.1 Technology Services

CoreDaemon provides technology products and professional services which may include:

- Website design and development.
- Custom software development.
- Mobile application development.
- Business automation and AI integration.
- Cloud hosting and server administration.
- Linux and Windows infrastructure support.
- Cybersecurity and network security services.
- VoIP and telecommunications solutions.
- CCTV installation and related services.
- Electronic Point of Sale (EPOS) systems.
- Restaurant ordering and management systems.
- Customer relationship management systems.
- IT consultancy, maintenance and technical support.
- Computer hardware, software and related products.

### 2.2 Availability

All products and services are subject to availability, technical feasibility and acceptance by CoreDaemon.

We reserve the right to decline a project or order where lawful, including where the proposed work is technically unsuitable, unlawful, unsafe or beyond our available capacity.

### 2.3 Changes to Services

We may update, improve, replace or discontinue particular features or services.

Where a change materially affects an existing paid service, we will provide appropriate notice and honour applicable contractual and statutory rights.

## 3. Website Use

### 3.1 Permitted Use

Users must use our website and services lawfully and responsibly.

Users must not:

- Attempt unauthorised access to our systems.
- Introduce malware, ransomware or malicious code.
- Conduct unlawful security testing or scanning.
- Interfere with other customers' services.
- Circumvent authentication or security controls.
- Use our infrastructure for fraud, spam or unlawful activity.
- Infringe intellectual property or privacy rights.
- Misrepresent their identity or authority.

### 3.2 Suspension of Access

We may restrict or suspend access where reasonably necessary to protect security, investigate suspected misuse, comply with legal obligations or prevent harm.

Where practicable and appropriate, we will provide notice and an opportunity to resolve the issue.

### 3.3 Website Information

We take reasonable care to ensure information is accurate and current. However, general website content may change and should not be treated as a substitute for a specific written quotation or contractual commitment.

## 4. Customer Accounts

### 4.1 Registration

Customers may be required to create an account to access certain products, services, quotations, invoices, subscriptions and project management functions.

Customers must provide accurate and current information.

### 4.2 Account Security

Customers are responsible for maintaining the confidentiality of their credentials and taking reasonable steps to prevent unauthorised access.

Customers must notify us promptly if they suspect that their account has been compromised.

### 4.3 Authorised Users

Business Customers are responsible for ensuring that employees, agents and other authorised users comply with applicable account conditions.

### 4.4 Account Closure

Customers may request account closure, subject to outstanding contractual obligations and any lawful requirements to retain transaction or business records.

Closing an account does not automatically terminate an active subscription or separate service contract.

## 5. Quotations, Orders and Contract Formation

### 5.1 Quotations

A quotation describes the proposed scope, deliverables, estimated timescale, pricing and any relevant exclusions.

Unless otherwise stated, quotations are valid for 30 calendar days from issue.

### 5.2 Acceptance

A customer may accept a quotation through the customer portal, electronically or in writing.

Acceptance constitutes an offer to proceed on the quoted terms. A binding contract is formed when CoreDaemon confirms acceptance of that order or quotation, unless the quotation expressly provides otherwise.

### 5.3 Amendments

Requested changes after acceptance may affect price, scope, technical requirements and delivery times.

Additional work requires agreement on the relevant changes and charges before it proceeds.

### 5.4 Invoices

Invoices will identify the relevant goods or services, amounts payable, applicable taxes and payment deadlines.

### 5.5 Project Commencement

For services requiring advance payment, project scheduling and technical work may commence after payment has been received and any necessary information or access has been provided.

## 6. Pricing and Payments

### 6.1 Prices

Prices are displayed in pounds sterling (GBP) unless otherwise stated.

Prices presented to consumers will include applicable VAT and other unavoidable taxes. Business quotations will state whether VAT is included or additional.

Delivery charges, installation charges and other compulsory costs will be disclosed before an order is confirmed.

### 6.2 Payment Methods

Payments may be processed using supported payment providers, including Stripe where enabled.

Payment information is handled in accordance with the relevant payment provider's security arrangements and our Privacy Policy.

### 6.3 Payment Obligations

Customers must pay the agreed charges by the specified due date.

Business Customers may be subject to applicable statutory interest and recovery costs for qualifying overdue commercial debts, where permitted by law and the contract.

### 6.4 Failed Payments

If a recurring payment fails, we may request updated payment information and make further authorised payment attempts.

Service restrictions for non-payment will be proportionate, subject to contractual notice requirements and applicable law.

### 6.5 Payment Disputes

Customers should contact us promptly about suspected billing errors.

Nothing in these Terms restricts lawful card chargeback rights or other statutory remedies.

## 7. Software Development and Digital Projects

### 7.1 Project Scope

The agreed quotation or statement of work determines the scope of a development project.

Work outside the agreed scope may require a revised quotation.

### 7.2 Customer Responsibilities

Customers must provide accurate project requirements, lawful content, required approvals, access credentials and reasonable cooperation.

Delays caused by missing information or approvals may affect delivery schedules.

### 7.3 Testing and Acceptance

Where agreed, CoreDaemon will provide an opportunity for the customer to test deliverables against the agreed specifications.

Acceptance criteria, testing periods and procedures for correcting defects should be defined in the project agreement.

### 7.4 Intellectual Property Ownership

Unless expressly agreed otherwise in writing:

- CoreDaemon retains ownership of its pre-existing software, frameworks, tools, libraries, templates and proprietary technology.
- Customers retain ownership of content and materials they lawfully supply.
- Custom deliverables are licensed or assigned according to the relevant project agreement.
- Third-party and open-source components remain subject to their applicable licences.

Payment for development work does not automatically transfer copyright in CoreDaemon's pre-existing technology.

### 7.5 Third-Party Components

Projects may depend on third-party software, APIs, hosting platforms, payment services and external integrations.

CoreDaemon is not responsible for changes to third-party services outside its reasonable control, but will comply with its own contractual obligations.

### 7.6 Project Delays

Estimated completion dates depend on project complexity, agreed scope, customer cooperation and third-party dependencies.

Any material delay will be communicated as soon as reasonably practicable.

## 8. Hosting, Cloud Services and Subscriptions

### 8.1 Subscription Services

Certain services may be provided on a monthly, annual or other recurring subscription basis.

Before purchase, customers will be informed of the subscription price, billing interval, minimum commitment, renewal arrangements and cancellation procedure.

### 8.2 Automatic Renewal

Where automatic renewal applies, this will be disclosed clearly before purchase and customers will provide the required authorisation.

Renewals and reminder communications will comply with applicable UK subscription and consumer protection requirements.

### 8.3 Subscription Cancellation

Customers may cancel subscriptions through the available account controls or by contacting CoreDaemon.

Cancellation stops future renewals in accordance with the applicable agreement. Any minimum term, notice period or early termination charge must have been fairly and clearly disclosed and must comply with consumer law.

### 8.4 Availability and Maintenance

We aim to maintain reliable service availability.

However, services may be interrupted by scheduled maintenance, emergency security work, infrastructure faults, internet connectivity problems or third-party outages.

Any guaranteed uptime or service credits apply only where expressly included in an agreed service-level agreement.

### 8.5 Backups and Data Export

Backup frequency, retention, restoration arrangements and data export rights will be determined by the relevant service agreement.

Customers should maintain independent copies of business-critical information unless managed backups have been expressly contracted.

### 8.6 Service Termination

Where a hosted service ends, the applicable agreement will determine any reasonable data retrieval period, subject to data protection law and technical limitations.

## 9. Hardware, Equipment and Installation

### 9.1 Product Descriptions

We endeavour to describe hardware and equipment accurately, including key specifications, compatibility requirements and relevant limitations.

### 9.2 Delivery

Delivery times and charges will be confirmed before purchase.

Consumer goods will be delivered within the agreed period or, where no period is agreed, within the statutory period.

### 9.3 Installation

Installation services may require safe access to the premises, suitable power, connectivity, permissions and other necessary facilities.

Customers must disclose known site hazards and relevant technical constraints.

### 9.4 Risk and Ownership

For consumer goods, risk passes in accordance with applicable consumer law, generally when the consumer or their nominated recipient takes physical possession.

Ownership passes in accordance with the sale contract and applicable law.

### 9.5 Faults and Warranties

All applicable statutory consumer rights remain unaffected.

Any additional manufacturer or commercial warranty is supplementary and does not replace statutory remedies.

## 10. Consumer Cancellation Rights

### 10.1 Statutory Rights

Consumers entering qualifying distance contracts may have a 14-day cancellation right under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013.

The commencement of the cancellation period depends on whether the contract concerns goods, services or digital content.

### 10.2 Services Started During the Cancellation Period

Where a consumer expressly requests that services begin during the cancellation period, cancellation may result in a proportionate charge for services already supplied, where legally permitted and the required information has been provided.

If the service has been fully performed following the legally required express request and acknowledgement, the statutory cancellation right may be lost.

### 10.3 Digital Content

Where downloadable digital content is supplied immediately, the statutory cancellation right may be lost only where the legal requirements for express consent, acknowledgement and contract confirmation have been satisfied.

### 10.4 Shop Purchases

Consumer returns and refunds for products purchased through our online shop are explained in our separate Shop Refund and Returns Policy.

### 10.5 Preservation of Rights

Nothing in these Terms excludes or limits statutory rights concerning faulty goods, defective digital content, services performed without reasonable care and skill or other mandatory consumer protections.

## 11. Technical Support and Maintenance

### 11.1 Support Scope

Technical support is provided according to the purchased support plan or relevant service agreement.

### 11.2 Response Times

Response and resolution targets are contractual only where expressly agreed.

### 11.3 Remote Access

Where remote support is required, customers must authorise the access and ensure they have the necessary rights to permit it.

We will use reasonable security measures when accessing customer systems.

### 11.4 Customer Systems

Customers are responsible for maintaining lawful software licences, appropriate access permissions and reasonable security safeguards within systems under their control.

## 12. Cybersecurity Services

### 12.1 Authorised Testing

Security assessments, vulnerability scanning and penetration testing will be undertaken only with appropriate written authorisation.

### 12.2 Security Limitations

No cybersecurity product or service can guarantee complete protection against every possible threat.

We will perform contracted services with reasonable care and skill and comply with any agreed security standards.

### 12.3 Incident Response

Incident response obligations, reporting arrangements and service boundaries will be defined in the relevant agreement.

## 13. Artificial Intelligence and Automated Services

### 13.1 AI Functionality

Certain products may include AI-assisted content generation, automated workflows, virtual assistants or analytical features.

### 13.2 Output Limitations

AI-generated output may be incomplete, inaccurate or unsuitable for a particular purpose.

Customers should apply appropriate human review before relying on outputs for significant business, legal, financial or safety-related decisions.

### 13.3 Data Handling

Personal data processed through AI services will be handled in accordance with applicable data protection law, our Privacy Policy and any relevant data processing agreement.

### 13.4 Third-Party AI Providers

Where external AI providers are used, relevant contractual, security and data protection arrangements will apply.

## 14. Confidentiality and Data Protection

### 14.1 Confidential Information

Each party must take reasonable steps to protect the other party's confidential business information obtained through a contractual relationship.

### 14.2 Permitted Disclosure

Confidential information may be disclosed where authorised, necessary to perform the agreement or legally required.

### 14.3 Data Protection

Each party must comply with applicable data protection legislation.

Where CoreDaemon processes personal data on behalf of a business customer, an appropriate data processing agreement will be entered into where required by Article 28 UK GDPR.

## 15. Intellectual Property

### 15.1 Website Materials

Unless otherwise indicated, our website design, branding, text, software, graphics and original materials are owned by or licensed to CoreDaemon.

### 15.2 Restrictions

Users must not reproduce, distribute, commercially exploit or reverse-engineer protected materials except where authorised or permitted by law.

### 15.3 Customer Content

Customers grant CoreDaemon the permissions reasonably necessary to process, host and use customer-supplied materials to deliver contracted services.

## 16. Third-Party Websites and Integrations

Our website may contain links to third-party websites and services.

Third-party providers operate under their own contractual terms and privacy notices.

We are not responsible for third-party content or services merely because we provide a link, but remain responsible for our own legal and contractual obligations.

## 17. Liability

### 17.1 Non-Excludable Liability

Nothing in these Terms excludes or restricts liability for:

- Death or personal injury caused by negligence.
- Fraud or fraudulent misrepresentation.
- Any liability that cannot lawfully be excluded.
- Mandatory statutory consumer remedies.

### 17.2 Consumer Customers

We are responsible for foreseeable loss and damage caused by our breach of contract or failure to use reasonable care and skill.

We do not seek to exclude liability where doing so would be unlawful or unfair under consumer protection legislation.

### 17.3 Business Customers

Subject to applicable law and any separately negotiated agreement, CoreDaemon will not be liable for indirect or consequential commercial losses that are not recoverable under the applicable contract.

Any negotiated financial cap or exclusion must be expressly agreed and satisfy applicable legal requirements, including statutory controls on unreasonable exclusions.

### 17.4 Customer Responsibility

Customers must take reasonable steps to mitigate loss and maintain appropriate backups and security measures where these responsibilities have been allocated to them.

## 18. Complaints and Dispute Resolution

### 18.1 Complaints

Customers may submit complaints using the contact details published on our website.

We will acknowledge complaints and aim to investigate them fairly and within a reasonable period.

### 18.2 Resolution

Where possible, both parties should attempt to resolve disputes through direct communication before commencing formal proceedings.

### 18.3 Statutory Remedies

This procedure does not prevent consumers from exercising statutory rights or accessing the courts.

## 19. Force Majeure

Neither party shall be responsible for delays caused by events beyond its reasonable control, to the extent permitted by law.

Examples may include major infrastructure outages, natural disasters, widespread telecommunications failures or government restrictions.

The affected party must take reasonable steps to minimise disruption.

Consumer rights concerning delayed or undelivered goods and services remain unaffected.

## 20. Changes to These Terms

We may update these Terms to reflect legal, operational or service changes.

Updated Terms will be published on our website with a revised effective date.

Material changes affecting existing contracts will be communicated where required, and will not retrospectively remove accrued rights or impose new contractual obligations without a lawful basis.

## 21. Governing Law and Jurisdiction

These Terms are governed by the laws of England and Wales, subject to mandatory consumer protections.

Consumers resident in Scotland or Northern Ireland retain applicable rights to bring proceedings in the courts available to them under relevant law.

Business disputes will be subject to the jurisdiction agreed in the relevant commercial contract or otherwise determined by applicable law.

## 22. Contact Information

**CORE DAEMON LTD**
Company number: 17463737
Registered office: 74a Pretoria Avenue, London, England, E17 7DL
Website: https://coredaemon.co.uk

For contractual enquiries, complaints, account assistance or service issues, please use the contact channels published on our website.

---

**Consumer Rights Statement**

Nothing in these Terms and Conditions affects your statutory rights under applicable United Kingdom consumer protection legislation.

# CORE DAEMON LTD
# Online Shop Refund and Returns Policy

**Effective date:** 25 October 2026
**Applies to:** Purchases made through the CoreDaemon online shop
**Website:** https://coredaemon.co.uk

## 1. Purpose and Scope

### 1.1 Introduction

CORE DAEMON LTD ("CoreDaemon", "we", "us" or "our") is committed to providing customers with clear, fair and lawful returns and refund procedures.

This policy applies to eligible purchases made directly through the CoreDaemon online shop.

### 1.2 Products Covered

The policy may cover:

- Computer hardware and accessories.
- Networking equipment.
- IT peripherals.
- CCTV equipment and accessories.
- Physical software products.
- Downloadable software and digital products.
- Other goods specifically listed for sale in our online shop.

### 1.3 Excluded Transactions

This shop-specific policy does not govern separate contracts for bespoke software development, consultancy, installation, hosting, managed support or other professional services.

Such contracts remain subject to their own terms and applicable statutory rights.

## 2. Consumer Right to Cancel

### 2.1 Fourteen-Day Cancellation Period

For most goods purchased online, consumers have the legal right to cancel without giving a reason within 14 days after the day they receive the goods.

Where an order contains several items delivered separately, the cancellation period normally runs from receipt of the final item.

### 2.2 How to Cancel

Customers may notify CoreDaemon of their decision to cancel by submitting a clear statement through our published contact channels.

The notification should include:

- Customer name.
- Order number.
- Product details.
- Date of purchase.
- Date of delivery.
- Clear statement requesting cancellation.

Customers do not have to provide a reason for exercising a statutory cancellation right.

### 2.3 Returning Goods

After notifying us of cancellation, customers must return the goods within 14 days.

We will provide the appropriate return address or instructions following the cancellation request.

### 2.4 Return Postage

For a change-of-mind cancellation, customers may be responsible for direct return postage costs where this was clearly disclosed before purchase.

Where goods are faulty, incorrectly supplied or not as described, we will meet reasonable return costs where required by law.

## 3. Refunds for Cancelled Orders

### 3.1 Refund Amount

For a valid statutory cancellation, we will refund the price paid for the returned goods together with the original standard delivery charge, where applicable.

Any additional charge paid for an enhanced delivery option need not be refunded beyond the standard delivery cost.

### 3.2 Refund Deadline

Where we have not offered to collect the goods, refunds will be made within 14 days after we receive the goods back or receive satisfactory evidence that the goods have been sent back, whichever is earlier.

Where we collect the goods or other statutory rules apply, we will follow the applicable legal refund deadline.

### 3.3 Refund Method

Refunds will normally be made using the original payment method unless the customer expressly agrees otherwise.

We will not charge an administration fee for a statutory cancellation refund.

### 3.4 Handling and Inspection

Consumers may examine goods as they reasonably would in a physical shop.

Where handling goes beyond what is necessary to establish the nature, characteristics and functioning of the goods, a lawful deduction may be made for diminished value.

Opening packaging alone does not automatically remove the statutory cancellation right.

## 4. Faulty, Damaged or Misdescribed Goods

### 4.1 Statutory Rights

All goods supplied to consumers must meet the standards required by the Consumer Rights Act 2015, including being:

- Of satisfactory quality.
- Fit for their intended purpose where legally required.
- As described.

### 4.2 Short-Term Right to Reject

Where goods do not conform to the contract, consumers may have a statutory short-term right to reject them within 30 days, subject to applicable legal rules.

### 4.3 Repair or Replacement

After the initial rejection period, consumers may be entitled to a repair or replacement.

Where statutory conditions are met, a price reduction or final right to reject may also be available.

### 4.4 Faults Within Six Months

Where a fault becomes apparent within the first six months, the statutory presumption concerning whether it existed at delivery may apply, subject to the relevant legal exceptions.

### 4.5 Longer-Term Rights

Statutory claims may remain available beyond six months, depending on the circumstances and applicable limitation periods.

An expired manufacturer warranty does not automatically end statutory consumer rights.

### 4.6 Incorrect or Damaged Deliveries

Customers should contact us as soon as reasonably possible after discovering damaged or incorrectly supplied goods.

Prompt notification helps us investigate the issue but does not replace or reduce statutory rights.

## 5. Digital Products and Downloadable Software

### 5.1 Digital Content

Digital products may include downloadable software, software licence files, electronic templates and other digital content.

### 5.2 Immediate Digital Delivery

Where a consumer wishes to receive digital content before the end of the statutory 14-day cancellation period, we will obtain the legally required express consent and acknowledgement concerning loss of the cancellation right.

We will also provide the required contract confirmation.

### 5.3 Cancellation Rights

Where the legal requirements for immediate digital supply and loss of cancellation rights have been satisfied, the consumer may lose the statutory change-of-mind cancellation right once supply begins.

If those requirements have not been satisfied, the consumer's cancellation rights remain as provided by law.

### 5.4 Faulty Digital Content

Digital content must meet applicable statutory standards.

Where digital content is faulty, not as described or otherwise fails to conform to the contract, consumers retain applicable rights to repair, replacement or a price reduction.

### 5.5 Licence Activation

Activation of a software licence does not remove statutory remedies for defective digital content.

Any additional contractual restrictions on cancellation must be lawful and clearly disclosed before purchase.

## 6. Products Exempt from Change-of-Mind Cancellation

Certain products may be excluded from statutory change-of-mind cancellation rights where a specific legal exception applies.

Examples may include:

- Goods made to the consumer's specifications or clearly personalised.
- Certain sealed goods unsuitable for return for health protection or hygiene reasons once unsealed.
- Sealed audio, video or software products where the statutory exception applies after unsealing.
- Digital content supplied following the legally required consent and acknowledgement.

An exception will apply only where its legal conditions are met.

These exceptions do not remove statutory remedies for faulty, damaged or misdescribed goods.

## 7. Business-to-Business Purchases

### 7.1 Business Customers

The statutory 14-day consumer change-of-mind cancellation right generally does not apply to purchases made wholly or mainly for business purposes.

### 7.2 Business Returns

Returns of non-faulty goods by Business Customers require agreement by CoreDaemon or an express contractual returns arrangement.

### 7.3 Faulty Business Goods

Business Customers retain rights and remedies under applicable law and their purchase contracts.

Nothing in this policy excludes liability where exclusion would be unlawful.

## 8. Delivery Problems and Lost Parcels

### 8.1 Non-Delivery

If an order is not delivered, customers should contact us using the website's published support channels.

We will investigate with the delivery provider and provide the remedy required by law.

### 8.2 Delivery Responsibility

For consumer purchases, we remain responsible for goods until risk passes to the consumer under applicable law.

### 8.3 Delayed Delivery

Where delivery does not take place within the agreed period or applicable statutory deadline, customers may have rights to require delivery within an additional appropriate period or to cancel.

## 9. Order Cancellation Before Dispatch

Customers may request cancellation before an order has been dispatched.

Where the order has not been dispatched or supplied, we will process the cancellation and any refund due under the applicable contract and statutory rules.

Custom-made products and digital content may be subject to specific lawful exceptions.

## 10. Exchanges and Replacements

Where available, customers may request a replacement product instead of a refund.

Exchanges for non-faulty goods are discretionary unless expressly offered.

Statutory repair, replacement and refund rights remain unaffected.

## 11. Refund Processing

Approved refunds will be initiated within the applicable legal deadline.

The time taken for the funds to appear in the customer's account may depend on their card issuer or payment provider.

A payment provider's processing delay does not alter our obligation to issue refunds on time.

## 12. Returns Procedure

To request a return:

1. Contact CoreDaemon through the published website contact channels.
2. Provide the order number and relevant product details.
3. State whether the request concerns cancellation, a fault, damage or an incorrect item.
4. Follow the return instructions provided.
5. Retain proof of postage where applicable.

For statutory cancellations, the customer may use the model cancellation form below, but is not required to do so.

## 13. Model Cancellation Form

**To:** CORE DAEMON LTD
**Registered office:** 74a Pretoria Avenue, London, England, E17 7DL

I hereby give notice that I cancel my contract for the sale of the following goods or supply of the following digital content:

**Product or order details:**
**Order number:**
**Ordered on:**
**Received on:**
**Consumer name:**
**Consumer address:**
**Date:**

**Signature:** Only required if submitted on paper.

## 14. Policy Amendments

We may update this policy to reflect changes in law, products or operational arrangements.

The policy applicable to a purchase will be determined by the terms and mandatory legal rights relevant to that transaction.

## 15. Contact Information

**CORE DAEMON LTD**
Company number: 17463737
Registered office: 74a Pretoria Avenue, London, England, E17 7DL
Website: https://coredaemon.co.uk

Customers may submit returns and refund enquiries through the contact channels published on our website.

---

**Your Statutory Rights**

This policy does not exclude, restrict or replace any rights available under the Consumer Rights Act 2015, Consumer Contracts Regulations 2013 or other applicable UK legislation.

# CORE DAEMON LTD
# Privacy and Cookie Policy

**Effective date:** 25 October 2026
**Website:** https://coredaemon.co.uk
**Company registration number:** 17463737
**Registered office:** 74a Pretoria Avenue, London, England, E17 7DL

## 1. Introduction

### 1.1 Our Commitment

CORE DAEMON LTD ("CoreDaemon", "we", "us" or "our") is committed to protecting personal information and respecting individuals' privacy.

This Privacy and Cookie Policy explains how we collect, use, store, disclose and protect personal data when individuals interact with our website, online shop, customer portal, software products and professional technology services.

### 1.2 Applicable Legislation

We process personal data in accordance with applicable UK legislation, including:

- The UK General Data Protection Regulation (UK GDPR).
- The Data Protection Act 2018, as amended.
- The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended.
- Relevant provisions of the Data (Use and Access) Act 2025.
- Other applicable UK privacy, consumer and electronic communications legislation.

### 1.3 Scope

This policy applies to personal data processed by CoreDaemon as a controller in connection with:

- Website visitors.
- Registered customers.
- Online shop customers.
- Business clients and their representatives.
- Service enquiries and quotations.
- Software subscriptions.
- Customer support.
- Marketing subscribers.
- Sales agents and business partners.
- Individuals communicating with us.

Where CoreDaemon processes personal data solely on behalf of another organisation through a hosted software product or managed service, that organisation may be the controller and CoreDaemon may act as its processor.

## 2. Data Controller Information

For personal data processed for our own business purposes, the data controller is:

**CORE DAEMON LTD**
Company number: 17463737
Registered office: 74a Pretoria Avenue, London, England, E17 7DL
Website: https://coredaemon.co.uk

Privacy enquiries and requests concerning personal information may be submitted through the contact channels published on our website.

Where required, we will publish additional contact information for the person responsible for data protection or our appointed Data Protection Officer.

## 3. Personal Information We Collect

### 3.1 Identity and Contact Information

We may collect:

- Full name.
- Business or organisation name.
- Billing and delivery addresses.
- Email address.
- Telephone number.
- Job title or professional role.
- Account and customer identifiers.

### 3.2 Account Information

When users register for an account, we may process:

- Username and account identifier.
- Password authentication information.
- Account preferences.
- Login and authentication records.
- Access permissions and user roles.
- Account activity and security events.

Passwords should be stored using appropriate cryptographic password-hashing mechanisms rather than in readable form.

### 3.3 Transaction and Billing Information

We may process:

- Order and purchase history.
- Quotations and invoices.
- Payment status.
- Subscription details.
- Transaction identifiers.
- Billing correspondence.
- Refund and dispute records.

Where a third-party payment processor handles card payments, payment card information will be processed under the applicable payment arrangements.

We do not require customers to provide complete payment card details through ordinary support messages.

### 3.4 Technical and Device Information

When individuals use our website or digital services, we may collect:

- IP address.
- Browser type and version.
- Operating system.
- Device identifiers.
- Website navigation activity.
- Access timestamps.
- Security logs.
- Error and diagnostic information.
- Cookie preferences.

### 3.5 Project and Support Information

For professional technology services, we may process:

- Project specifications.
- Support requests.
- Technical system information.
- Server and infrastructure configurations.
- Troubleshooting logs.
- Authorised access details.
- Relevant service correspondence.

We will seek to limit access to personal data within customer systems to what is necessary for the agreed service.

### 3.6 Marketing Information

Where applicable, we may process:

- Marketing subscription preferences.
- Consent records.
- Communication history.
- Campaign engagement information.
- Unsubscribe and suppression records.

### 3.7 Information from Third Parties

We may receive relevant information from payment providers, authorised business representatives, referral partners, service providers or publicly available business sources where lawful.

Where personal information has not been obtained directly from the individual, we will provide the required privacy information in accordance with applicable law.

## 4. How and Why We Use Personal Information

We process personal information only where an appropriate lawful basis applies.

### 4.1 Contractual Necessity

We may process personal data to:

- Register and administer customer accounts.
- Process orders.
- Deliver purchased goods and digital products.
- Prepare quotations.
- Issue invoices.
- Provide contracted technical services.
- Manage subscriptions.
- Respond to contractual support requests.

### 4.2 Legal Obligations

We may process personal information to:

- Maintain required accounting and tax records.
- Comply with applicable legal obligations.
- Respond to lawful regulatory requests.
- Fulfil data protection obligations.
- Maintain legally required transaction records.

### 4.3 Legitimate Interests

Where appropriate, we may process information for legitimate business interests, including:

- Protecting website and network security.
- Preventing fraud and misuse.
- Maintaining reliable systems.
- Investigating technical incidents.
- Managing business relationships.
- Improving customer service.
- Establishing, exercising or defending legal claims.

We will assess and balance our interests against individuals' rights and freedoms where required.

### 4.4 Consent

Where consent is required, we may use personal information for:

- Certain direct marketing communications.
- Non-essential cookies.
- Optional analytics and advertising technologies.
- Other specifically disclosed optional activities.

Individuals may withdraw consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

### 4.5 Vital Interests and Public Tasks

Other lawful bases will be used only where genuinely applicable to the particular processing activity.

## 5. Lawful Basis Summary

| Processing purpose | Principal lawful basis |
|---|---|
| Customer account administration | Contract |
| Processing purchases and subscriptions | Contract |
| Delivering professional services | Contract or legitimate interests, as appropriate |
| Invoicing and statutory accounting | Contract and legal obligation |
| Fraud prevention and security | Legitimate interests or legal obligation |
| Responding to general enquiries | Legitimate interests or steps towards a contract |
| Optional marketing | Consent or legitimate interests where lawful, subject to PECR |
| Non-essential cookies | Consent, except where a statutory exception applies |
| Compliance with lawful requests | Legal obligation where applicable |
| Handling disputes | Legitimate interests or legal obligation |

The precise lawful basis will depend on the processing circumstances. We will not rely on consent where another basis is more appropriate merely because a person uses our website.

## 6. Payment Processing

### 6.1 Payment Providers

Where enabled, CoreDaemon uses Stripe or other authorised payment providers to process payments securely.

### 6.2 Payment Data

Payment processors may collect and process:

- Cardholder information.
- Payment card details.
- Transaction information.
- Billing details.
- Fraud prevention information.

### 6.3 Our Access

CoreDaemon may receive payment confirmation, transaction references, limited card information and billing status.

We do not intend to store complete payment card numbers or card security codes in our ordinary website database.

### 6.4 Provider Policies

Payment processors may act as independent controllers or processors for different activities. Their own privacy notices may also apply.

## 7. Customer Portals and Business Applications

### 7.1 Account Management

Our customer portal may contain account details, quotations, invoices, project updates, support requests and service history.

### 7.2 Role-Based Access

We aim to restrict access to personal data according to legitimate business responsibilities and authorised user roles.

### 7.3 Business Software Platforms

Where customers use our EPOS, restaurant management, CRM or other hosted business applications, CoreDaemon may process personal data on behalf of those customers.

### 7.4 Controller and Processor Responsibilities

Where a customer determines the purposes and means of processing within their own application, that customer will normally be responsible for the relevant privacy notice and lawful basis.

CoreDaemon will process such information under documented instructions and applicable data processing agreements.

### 7.5 Data Processing Agreements

Where required by Article 28 UK GDPR, our agreements will address:

- Subject matter and duration of processing.
- Nature and purpose of processing.
- Categories of personal data and individuals.
- Confidentiality.
- Security measures.
- Sub-processors.
- Assistance with data subject rights.
- Personal data breaches.
- Deletion or return of data.
- Audit and compliance arrangements.

## 8. Artificial Intelligence and Automation

### 8.1 AI Services

Some CoreDaemon products may provide AI-powered assistants, automated responses, document processing, analytics or workflow automation.

### 8.2 Information Submitted to AI Systems

Information submitted to an AI-enabled service may be processed by CoreDaemon or an authorised external technology provider.

### 8.3 Data Minimisation

We aim to limit personal information submitted to AI services to what is reasonably necessary.

### 8.4 Third-Party AI Providers

Where external providers process personal data, appropriate contracts, security assessments and international transfer safeguards will be considered and implemented where required.

### 8.5 Automated Decision-Making

We will provide any additional information and safeguards required where decisions producing legal or similarly significant effects are made solely through automated processing.

We do not claim that all AI-generated outputs are accurate or appropriate for every purpose.

## 9. Marketing and Promotional Communications

### 9.1 Marketing Activities

CoreDaemon may promote its products and services through email, SMS or other electronic communications.

### 9.2 Individual Subscribers

We will send unsolicited electronic marketing to individual subscribers only where valid consent has been obtained or a relevant statutory exception, such as the products and services soft opt-in, applies.

### 9.3 Existing Customer Marketing

Where the soft opt-in applies, marketing will be limited to our own similar products and services, and individuals will be offered an appropriate opportunity to opt out when their details are collected and in each subsequent marketing message.

### 9.4 Business Marketing

Business-to-business marketing will comply with applicable PECR and UK GDPR requirements, including the rules applying to corporate subscribers, sole traders and partnerships.

### 9.5 Unsubscribe Rights

Every unsolicited electronic marketing communication will provide a clear and appropriate method of opting out.

We will respect objections to direct marketing and maintain necessary suppression records.

### 9.6 Marketing Preferences

Users may request changes to their communication preferences through the available account controls, unsubscribe links or published contact channels.

## 10. Cookies and Similar Technologies

### 10.1 What Are Cookies?

Cookies are small files or identifiers stored on or accessed through a user's device.

They may help websites maintain sessions, remember preferences, measure usage or provide other functionality.

### 10.2 Strictly Necessary Cookies

These may support:

- Authentication.
- Account sessions.
- Shopping basket functionality.
- Security.
- Fraud prevention.
- Checkout processes.
- Cookie preference storage.

Where the relevant statutory exemption applies, consent may not be required.

### 10.3 Analytics Cookies

Where used, analytics cookies may help us understand website traffic, performance and visitor interactions.

We will obtain consent where required before placing or accessing non-exempt analytics technologies.

### 10.4 Marketing Cookies

Where used, marketing cookies or similar tracking technologies may support advertising measurement and campaign analysis.

We will obtain the required consent before activating non-exempt technologies.

### 10.5 Cookie Choices

Visitors will be provided with appropriate controls to:

- Accept optional cookies.
- Reject optional cookies.
- Manage cookie categories.
- Change their preferences later.

### 10.6 Consent Requirements

Where consent is required, non-essential cookies will not be activated before valid consent is obtained.

Consent will not be inferred merely from continued browsing.

### 10.7 Cookie Register

A current cookie register should identify each relevant cookie or technology, its provider, purpose, duration and category.

The published register must reflect the technologies actually deployed on the website.

## 11. Sharing Personal Information

We may share personal information where reasonably necessary with:

- Payment processing providers.
- Website and cloud hosting providers.
- IT infrastructure and security providers.
- Email and communication service providers.
- Delivery and logistics providers.
- Authorised subcontractors.
- Accountants and professional advisers.
- Customer support providers.
- Relevant public authorities where legally required.

We will not sell personal information to third-party data brokers.

We will require appropriate contractual protections where third parties process personal data on our behalf.

## 12. International Data Transfers

### 12.1 Transfers Outside the United Kingdom

Some technology providers may process or access personal information outside the UK.

### 12.2 Safeguards

Where restricted transfers occur, we will use an appropriate lawful transfer mechanism, which may include:

- UK adequacy regulations.
- The UK International Data Transfer Agreement.
- The UK Addendum to EU Standard Contractual Clauses.
- Other legally recognised safeguards or exceptions.

### 12.3 Transfer Assessments

Where required, we will assess relevant transfer risks and implement appropriate supplementary protections.

### 12.4 Transparency

Information about relevant overseas recipients, transfer destinations and safeguards will be made available as required by law.

## 13. Data Security

### 13.1 Security Measures

We apply security measures appropriate to the risks associated with the personal information processed.

These may include:

- Encrypted connections.
- Access controls.
- Multi-factor authentication where supported.
- Secure password storage.
- Network security controls.
- System monitoring.
- Security updates.
- Access logging.
- Backups and recovery arrangements.
- Staff and contractor confidentiality requirements.

### 13.2 Security Limitations

No internet-based system can be guaranteed to be entirely secure.

We continually assess security measures appropriate to our operations and legal responsibilities.

### 13.3 Personal Data Breaches

We maintain procedures to identify, investigate and respond to suspected personal data breaches.

Where required, we will notify the Information Commissioner's Office and affected individuals within the applicable statutory timeframes.

## 14. Data Retention

### 14.1 General Principle

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including applicable legal, accounting, security and contractual requirements.

### 14.2 Retention Categories

Our retention arrangements may include:

- Customer account information: while the account is active and for a justified period afterwards.
- Order and invoice records: for applicable accounting, tax and legal retention periods.
- Support correspondence: for the period necessary to provide support, manage disputes and maintain appropriate service records.
- Security logs: for a proportionate period based on security needs and risk.
- Marketing preferences: until consent is withdrawn or marketing is otherwise discontinued, subject to necessary suppression records.
- Contract records: for the applicable contractual and legal limitation periods.
- Customer-hosted application data: according to the applicable customer agreement and data processing instructions.

### 14.3 Retention Schedule

We maintain or will establish an internal retention schedule specifying appropriate retention periods and deletion or anonymisation procedures for each processing activity.

### 14.4 Deletion

At the end of the relevant retention period, personal information will be securely deleted, anonymised or otherwise handled in accordance with legal requirements.

## 15. Your Data Protection Rights

Subject to applicable conditions and exemptions, individuals may have the following rights.

### 15.1 Right to Be Informed

To receive clear information about how their personal data is used.

### 15.2 Right of Access

To request access to personal information held about them.

### 15.3 Right to Rectification

To request correction of inaccurate personal information.

### 15.4 Right to Erasure

To request deletion of personal information where the relevant legal conditions are met.

### 15.5 Right to Restrict Processing

To request restrictions on certain processing activities.

### 15.6 Right to Data Portability

To receive certain personal information in a structured, commonly used and machine-readable format, where applicable.

### 15.7 Right to Object

To object to processing based on legitimate interests in appropriate circumstances.

Individuals have an absolute right to object to processing of their personal information for direct marketing purposes.

### 15.8 Rights Concerning Automated Decisions

To exercise applicable rights relating to qualifying solely automated decisions, including any safeguards and opportunities for human involvement required by law.

### 15.9 Withdrawal of Consent

To withdraw consent at any time where processing is based on consent.

## 16. Exercising Your Rights

### 16.1 Submitting Requests

Individuals may submit data protection requests using the contact channels published on our website.

### 16.2 Identity Verification

We may request information reasonably necessary to verify identity or authority before disclosing personal information.

### 16.3 Response Period

We will respond without undue delay and within the applicable statutory period, normally one calendar month, subject to lawful extensions, clarification procedures and other applicable rules.

### 16.4 Fees

Requests will generally be handled without charge, except where applicable law permits a reasonable fee.

### 16.5 Complaints

Individuals may raise concerns directly with CoreDaemon.

They also have the right to complain to the Information Commissioner's Office.

**Information Commissioner's Office (ICO)**
Website: https://ico.org.uk

## 17. Children's Privacy

Our professional technology services and business platforms are not specifically directed towards children.

Where we knowingly process children's personal information, we will apply appropriate safeguards and comply with relevant legal requirements.

Where online services are likely to be accessed by children, we will assess any applicable obligations under the Children's Code and other relevant legislation.

## 18. External Websites and Third-Party Services

Our website may link to external websites or integrate with third-party platforms.

Those services may operate under separate privacy notices.

Users should review the privacy information provided by relevant third parties.

## 19. Data Accuracy

We take reasonable steps to ensure that personal information is accurate and updated where necessary.

Customers are encouraged to keep their account and contact information current.

## 20. Data Protection by Design and Default

We aim to incorporate data protection considerations into the design and operation of our systems.

This includes assessing appropriate access controls, data minimisation, security measures, retention and privacy risks.

Where legally required, we will undertake data protection impact assessments before commencing high-risk processing.

## 21. Changes to This Privacy Policy

We may update this policy to reflect changes in legislation, technology, service arrangements or processing activities.

The current version will be published on our website with its effective date.

Where material changes require additional notice or consent, we will take the appropriate steps before implementing the relevant processing.

## 22. Contact and Regulatory Information

**CORE DAEMON LTD**
Company number: 17463737
Registered office: 74a Pretoria Avenue, London, England, E17 7DL
Website: https://coredaemon.co.uk

For privacy enquiries, personal data requests, complaints or concerns, please contact us through the official channels published on our website.

You may also contact the UK Information Commissioner's Office at https://ico.org.uk.

---

**Privacy Commitment**

CoreDaemon is committed to processing personal information lawfully, fairly and transparently, implementing appropriate security measures and respecting individuals' rights under applicable UK data protection legislation.