Terms of Service

1. Definitions

In these Terms of Service ("Terms"), the following words have the meanings below:

• "Defy", "we", "us", "our" — Defy Technologies Pte Limited, a company operating from 58 Link Road, Lautoka, Fiji (P.O. Box 2521, Lautoka).
• "Customer", "you", "your" — the person or organization that holds a Defy account or is party to a Service Agreement with Defy.
• "Services" — collectively, Managed Services, Cyber Security, IT Consulting & Advisory, Web and Mobile Development, SaaS applications, software and Microsoft 365 licensing and management, backup and disaster recovery, integrations, technical support, and the Defy Cloud Platform, in each case to the extent included in your order or Service Agreement.
• "Cloud Platform" — the services bought and managed through Defy Console, Defy Billing and Defy Accounts, including Cloud Servers, Web Hosting, domains, DNS, SSL certificates and software licensing.
• "Service Terms" — the additional terms for a particular service, listed in section 2, together with the Billing, Credit & Refund terms, the Acceptable Use Policy and the Service Levels & Support terms.
• "Managed Environment" — infrastructure, hardware, or software that Defy has agreed in a Service Agreement to actively monitor, maintain, or administer on your behalf, as distinct from infrastructure you operate yourself.
• "Customer Data" — any data, content, or material you or your Authorised Users submit to, or generate through, the Services.
• "Authorised User" — an individual you permit to access the Services under your account.
• "Account credit" — prepaid credit held in your Defy Billing account and used to pay for Services, as described in the Billing, Credit & Refund terms.
• "Service Agreement" — a signed statement of work, order form, or managed services agreement between you and Defy.
• "Force Majeure Event" — an event outside a party's reasonable control, as described in section 15.
• "Business Day" — a day other than a Saturday, Sunday, or public holiday observed in Fiji.

2. Acceptance, structure and changes

By creating a Defy account, signing a Service Agreement, or otherwise using the Services, you enter into a binding agreement with Defy on these Terms. You must be at least 18 years old and have the legal capacity to enter into this agreement. If you are agreeing on behalf of a business or other organization, you confirm you have the authority to bind that organization, and "you" refers to that organization.

How our terms fit together

These Terms apply to all Services. The following Service Terms also apply, and form part of these Terms:

• Billing, Credit & Refund terms — for everything you pay for;
• Acceptable Use Policy — for everything you use;
• Service Levels & Support;
• Cloud Servers, Web Hosting, Domains & DNS and Managed Services terms — for those services.

If they conflict, this order applies: (1) a signed Service Agreement, for the matters it specifically addresses; (2) the terms for the specific service; (3) the Billing, Credit & Refund terms; (4) these Terms. Our Privacy Policy explains how we handle personal data.

Changes

We may amend these Terms or any Service Terms from time to time. Material changes take effect no sooner than 30 days after we give you written notice (by email or through the Services), except where a change is required to comply with law or to address an active security risk, in which case it may take effect immediately with notice given as soon as reasonably practicable. Changes that only affect new orders or new customers may apply to them straight away. Continued use of the Services after a change takes effect constitutes acceptance. If you do not accept a change, you may cancel the affected Service before it takes effect. Except where an earlier change is necessary for law or an active security risk, a materially adverse change to an existing fixed-term commitment applies from its next renewal unless you agree otherwise. Cancellation does not remove charges already incurred or a previously disclosed non-cancellable supplier commitment, subject to section 17.

The Acceptable Use Policy and Service Levels & Support terms also apply to their respective subject matter. If a conflict concerning those matters cannot be resolved by reading the documents together, they take priority over these Terms, subject to the signed Service Agreement. Mandatory rights and remedies preserved by section 17 prevail over every document in this agreement. We make the applicable terms available before an order is accepted.

3. Licence Grant & Restrictions

Subject to these Terms and payment of applicable fees, Defy grants you a limited, non-exclusive, non-transferable, non-sublicensable licence, terminable only in accordance with these Terms, to access and use the Services for your internal business purposes.

You must not, and must not permit any Authorised User or third party to:

• Reverse engineer, decompile, or attempt to derive the source code of any Defy platform software;
• Sublicense, resell, or provide the Services to a third party as a standalone offering, except where you are an agency or reseller under a separate written agreement with Defy;
• Circumvent or attempt to circumvent any authentication, rate-limiting, billing or security control on the Services; or
• Copy or misuse Defy's proprietary software or confidential information to build a directly competing product. This does not restrict independent development or legitimate competition using your own materials.

The restrictions above apply to the extent permitted by law and subject to applicable third-party and open-source licence rights. You may use hosting and compute to operate your websites, applications and services for your own customers; this does not authorise resale of Defy account access or standalone Defy services. Defy and its licensors retain ownership of their software, tools, templates and pre-existing materials. You retain ownership of Customer Data and grant Defy and its service providers permission to process it only as reasonably necessary to provide, secure and support the Services or comply with law. Custom development deliverables, source-code delivery and ownership or licence rights must be specified in the Service Agreement; payment alone does not transfer Defy's pre-existing technology.

4. Your Account & Responsibilities

You must give accurate and complete information when you create your account and keep it up to date, including your contact, billing and domain registrant details. We use the email address on your account for important notices, such as renewal and deletion warnings, so you must keep it working and read it.

You are responsible for the accuracy of information you submit to the Services and any configuration data you enter into Console. Where the Services generate reports, invoices, or other outputs derived from data you or your integrations provide, those outputs are only as accurate and complete as the underlying data — Defy is not responsible for decisions made on the basis of incomplete or inaccurate Customer Data.

You are responsible for the conduct of your Authorised Users and for ensuring they comply with these Terms, including the Acceptable Use Policy.

Your responsibility for inaccurate Customer Data and account activity does not exclude Defy's responsibility for its own breach of this agreement, subject to sections 12 and 17.

5. Access Control & Password Policy

Defy Accounts supports multi-factor authentication via authenticator app or passkey, and mandatory enrollment is enforced platform-wide. You are responsible for keeping your login credentials and registered MFA method confidential, and for activity under your account except to the extent caused by Defy's breach of this agreement. Where you or your Authorised Users manage systems we don't administer ourselves, we strongly recommend the same standard: MFA wherever it's supported, and unique credentials per person rather than shared logins.

For any Managed Environment, Defy applies the following internally:

• Least privilege — staff and automated tooling are granted only the access needed to perform a given task, not standing access to everything by default.
• No shared credentials — Defy does not use generic or shared administrative accounts across customers; access is attributable to an individual or a specific automated process.
• Periodic review — standing administrative access to a Managed Environment is reviewed on a reasonable schedule, and revoked promptly when no longer needed — including immediately upon a change in which staff member holds it.
• One-off task credentials aren't retained — where you provide a credential for a single task (for example, a manual deployment), it is encrypted while the task runs and is not kept afterward.

Defy staff will never ask you for your account password, MFA codes, or a domain registry auth code over phone, email, or chat. Report suspected unauthorized access or a compromised credential immediately to support@defy.com.fj.

6. Data Hosting, Privacy & Security

Cloud Servers run on our global cloud compute network, in the location you select at checkout; Defy does not relocate your data to a different location without your action. Web Hosting runs on Defy-operated hosting infrastructure.

Data in transit to and from the Services is encrypted using TLS. Sensitive stored data — including identity verification documents — is encrypted at rest using AES-256. Access to administrative and customer-data systems requires multi-factor authentication and is scoped by role, consistent with section 5.

Further detail on what personal data we collect and how it's used is set out in our Privacy Policy.

The selected location describes the primary hosting location of your Cloud Server, rather than every location in which account information, support records, service metadata or authorised backups may be processed. Those activities are described in the Privacy Policy and applicable Service Terms. Security controls described in this agreement concern systems Defy administers; security of customer-administered workloads remains your responsibility unless included in a Service Agreement.

7. Data Retention & Backups

We keep Customer Data for as long as the Service holding it is active. When a Service ends — because you delete or cancel it, it is not renewed, or it is suspended and then deleted under its Service Terms — the data in it is deleted on the timetable set out in those Service Terms, and recovery after deletion is not promised. Separately purchased snapshots follow their own retention and billing rules. In particular:

• Cloud Servers are deleted 3 days after an unpaid renewal date, or immediately when you delete them;
• Web Hosting accounts are deleted 30 days after an unpaid renewal date, or at the end of the paid year when cancelled;
• free DNS zones are deleted 30 days after the service that included them ends.

You are responsible for keeping your own backups of all Customer Data you cannot afford to lose. Backup options offered with a Service are a safety measure, not a guarantee. For customers under a Managed Services engagement that includes backup oversight, we periodically verify that backup jobs are completing successfully and, on a reasonable schedule, that a sample restore is actually achievable.

Billing and tax records are kept for the period required by law regardless of account status.

The Privacy Policy describes retention of account and personal records and does not extend the life of a Cloud Server, website, DNS zone or its workload data. Service deletion timelines do not require deletion of records retained by law, security logs or residual copies pending normal backup rotation. Such retained records do not create an ongoing hosting or restoration service. Deletion is subject to lawful preservation obligations.

8. Data Export & Leaving Defy

While a Service is active, you can take your data with you at any time using the tools it provides (for example, downloading files and databases from Web Hosting, or copying data from your Cloud Server), and you can transfer your domains to another provider. For a planned exit from a Managed Services engagement, see the Managed Services terms.

Domain names remain yours and are portable — we provide the transfer authorisation code for any domain registered through us on request, subject to the registry's own transfer rules.

Export your data before a Service ends. Once it is deleted under section 7, it cannot be exported.

Suspension may prevent self-service access. An export or assistance request does not pause a published deletion deadline unless Defy agrees in writing. Any assisted migration, restoration, special export or extended storage must be separately agreed, including its scope and charges; there is no indefinite storage obligation. Registry-specific transfer rules apply only to the relevant domain type.

9. Billing & Payment

Prices include VAT and most Services are prepaid from account credit. How charges, renewals, account credit, refunds and non-payment work is set out in the Billing, Credit & Refund terms and in each service's terms.

A subscription's commitment term is distinct from its billing frequency. An annual licence paid monthly remains an annual commitment where disclosed and accepted in the order. Cancellation or suspension does not release charges for services already supplied or previously disclosed non-cancellable third-party commitments, subject to section 17 and any supplier cancellation rights stated in the order. Usage-based charges, minimum commitments, renewal dates and cancellation deadlines must be disclosed in the order or applicable Service Terms.

10. Confidentiality

Each party will use the other's confidential information only to perform its obligations under these Terms or an applicable Service Agreement, and will protect it with at least reasonable care and no less than the care it uses to protect its own confidential information of similar importance. This obligation survives termination of the relationship for 5 years, except for information that constitutes a trade secret, which remains protected for as long as it retains that status.

This section does not apply to information that is or becomes publicly available through no fault of the receiving party, or that must be disclosed by law, provided the disclosing party gives notice where legally permitted.

Confidential information may be shared with personnel, professional advisers and service providers who need it for the permitted purpose and are subject to appropriate confidentiality duties. The receiving party remains responsible for its compliance with this section. Information demonstrably already lawfully known, independently developed without use of the confidential information, or lawfully received without restriction is excluded. Personal data remains subject to the Privacy Policy and applicable law after this confidentiality period ends.

11. Representations & Warranties

Defy warrants that the Services will perform materially in accordance with their published documentation. You warrant that you have the authority to enter into these Terms, that your use of the Services will comply with applicable law, and that you own or have the necessary rights to Customer Data you submit.

Except as expressly stated in this section or a signed Service Agreement, the Services are provided "as is" and "as available", and Defy disclaims all other warranties, including implied warranties of fitness for a particular purpose and uninterrupted or error-free operation, to the maximum extent permitted by law.

The express warranty above concerns the agreed Service and its applicable documentation, subject to stated dependencies and exclusions. Marketing descriptions do not create a guaranteed outcome, availability level or resolution time beyond the express agreement. Any disclaimer is subject to section 17 and does not remove an express obligation in the Service Terms or Service Agreement.

12. Limitation of Liability

To the maximum extent permitted by law, neither party is liable to the other for indirect, incidental, consequential, or special damages, and, whether direct or indirect, loss of profits, loss of revenue, loss of business, or loss of data, arising out of or relating to these Terms or the Services.

Defy is not liable for loss of Customer Data, or for loss of a domain name, that results from a Service being deleted or not renewed in accordance with its Service Terms, from your own actions or instructions, or from your failure to keep backups, but only to the extent the loss was caused by those matters rather than Defy's failure to perform an expressly agreed renewal, backup or management duty.

Defy's total aggregate liability arising out of or relating to the Services will not exceed the fees actually received by Defy for the specific affected Service, less any amounts refunded or credited back to you, for the three-month period immediately preceding the event giving rise to the claim. Fees received in advance for a longer recurring period are allocated evenly across that period, and fees received for a shorter elapsed period are counted for that elapsed period. For a one-time project, the cap is the fees actually received for the affected project, less any refunds. Where no fees were received for the affected Service, including a Service provided without charge, Defy has no liability under this paragraph, subject to section 17. Claims arising from the same or related events are treated as one claim arising at the first event; the cap applies in aggregate across contract, negligence and other legal bases. This limitation does not apply to liability that cannot be excluded by law, including liability for death or personal injury caused by negligence, or for fraud.

Nothing in this section limits amounts properly payable for Services or non-cancellable commitments, or overrides a refund expressly due under the Billing, Credit & Refund terms. Service credits are available only as expressly provided in those terms or an agreed SLA. The exclusions and cap are subject to section 17, including every right or remedy that cannot lawfully be limited. A different cap applies only where expressly agreed in a signed Service Agreement.

13. Term, Cancellation & Termination

Services renew automatically for the same period until you cancel them or turn off auto-renew in Console, which you can do at any time. A cancelled Service continues until the end of the period you have paid for, unless its Service Terms allow it to be ended earlier (for example, deleting a Cloud Server). Managed Services and other engagements under a Service Agreement end as that agreement sets out, or, if it is silent, on 30 days' written notice by either party, or immediately for the other party's uncured material breach following 30 days' written notice of that breach.

Defy may suspend or terminate a Service, or your account, immediately: for non-payment as described in the Billing, Credit & Refund terms and the relevant Service Terms; for a breach of the Acceptable Use Policy; where continued provision would expose Defy or other customers to legal or security risk; or if you become insolvent or enter administration or liquidation. What happens to your data after a Service ends is set out in sections 7 and 8.

Immediate action is limited to the grounds above and applicable Service Terms. Where practicable and consistent with the urgency, law and security risk, we give reasons and an opportunity to remedy an ordinary remediable breach before permanent termination. Immediate suspension for non-payment, abuse or a security risk remains available. A suspension does not itself authorise earlier deletion than the applicable deletion rule, except where urgent deletion is legally required or reasonably necessary to prevent serious ongoing harm. The cancellation provisions above do not override an accepted fixed-term commitment or supplier cancellation deadline under section 9.

14. Third-Party Providers

Some Services rely on vetted third parties behind our platform — for example, network, payment and domain-registry providers. Their own terms and policies may also apply to those Services, as described in the relevant Service Terms. Defy remains your point of contact and is responsible for the Services it sells you, within the limits of these Terms.

Applicable supplier terms, licence restrictions and dependencies will be identified in the order, relevant Service Terms or a linked supplier policy before purchase where they impose obligations on you. Subject to section 17, Defy does not guarantee a supplier's continued availability, functionality or resolution time and is not responsible for a failure caused solely by that supplier and outside Defy's reasonable control. This does not exclude responsibility for Defy's own configuration, implementation or management duties, subject to section 12. Supplier credits do not create an equivalent customer credit unless the applicable Service Terms or Service Agreement provide for it.

15. Force Majeure

Neither party is liable for a failure or delay in performance caused by events outside its reasonable control, including acts of God, war, civil unrest, pandemic, government action, failures of public utilities or international connectivity, and cyberattacks of exceptional scale directed at critical infrastructure providers rather than a result of either party's own security failure. If a Force Majeure Event continues for more than 60 consecutive days, either party may terminate the affected Service without further liability, other than payment for fees already accrued.

The affected party must give notice as soon as reasonably practicable and take reasonable steps to mitigate the effects. This section does not excuse payment for Services already supplied or disclosed non-cancellable supplier commitments. Termination does not affect a refund due under the Billing, Credit & Refund terms or a mandatory remedy preserved by section 17.

16. Dispute Resolution

If a dispute arises out of or relating to these Terms or the Services, the parties will first attempt in good faith to resolve it through direct negotiation between authorized representatives for at least 14 days. If unresolved, the parties will attempt non-binding mediation in Suva, Fiji, with the cost of the mediator shared equally, before either party commences court proceedings.

These Terms are governed by the laws of the Republic of Fiji, and any dispute not resolved under this section is subject to the exclusive jurisdiction of the courts of Fiji.

The negotiation and mediation steps do not prevent an urgent application for interim relief, a complaint to a regulator or the Consumer Council of Fiji, use of a statutory tribunal or remedy, or proceedings needed to preserve a limitation period. If the parties cannot agree mediation arrangements within 14 days after a written request to mediate, either may commence proceedings. Nothing here excludes a mandatory jurisdiction or complaint right.

17. General Provisions

Entire agreement. These Terms, the Service Terms, any applicable Service Agreement and our Privacy Policy constitute the entire agreement between you and Defy regarding the Services, superseding any prior discussions or agreements on the same subject.

Consumer law. Nothing in these Terms excludes, restricts or modifies any right or remedy you have under the Fijian Competition and Consumer Commission Act 2010 or other law that cannot lawfully be excluded. Where the law allows our liability to be limited, it is limited as these Terms set out.

Severability. If any provision of these Terms is found unenforceable, the remaining provisions continue in full effect, and the unenforceable provision is severed or modified only to the extent permitted by law.

Waiver. A failure to enforce any provision is not a waiver of the right to enforce it later.

Assignment. You may not assign or transfer your rights under these Terms without Defy's prior written consent. Defy may assign these Terms in connection with a merger, acquisition, or sale of substantially all of its relevant assets.

Notices. Notices to Defy should be sent to info@defy.com.fj. Notices to you will be sent to the email address associated with your Defy account, or shown in Console, and are treated as received when available to you in the ordinary course. A notice that we know has failed is not treated as delivered merely because it was sent. Keeping your contact details current remains your responsibility.

Electronic acceptance. Your electronic acceptance of these Terms (including by creating an account, placing an order, or clicking to accept) is legally binding to the same extent as a handwritten signature, in accordance with applicable Fijian law.

Accrued payment obligations and provisions intended to survive termination, including ownership, confidentiality, lawful record retention, liability and dispute provisions, survive to the extent needed to give them effect. The consumer-law preservation above applies regardless of whether you are an individual or a business whenever the relevant law protects your transaction.