Terms of Services

Your agreement with cimply is made up of: (1) the Proposal you sign, which records what you are buying, the fees, the start date and the term, (2) Schedule 1, a one-page table of the commercial particulars that apply to you, (3) these Terms and Conditions, which apply to every client, (4) the Rate Card at Schedule 2, and (5) the Service Levels and Scope schedules at Schedules 3 and 4. If they conflict, a Statement of Work prevails for its Project, then the Proposal and Schedule 1, then these Terms, then Schedules 2 to 4. This document is published at cimply.com.au/terms, and the version identified in your Proposal is the one that applies to you.

Agreement means the Proposal, Schedule 1, these Terms and Schedules 2 to 4, together with any Statement of Work.

Business Day means a day other than a Saturday, Sunday or public holiday in Western Australia.

Business Hours means 7:00am to 5:00pm AWST on a Business Day, unless Schedule 1 states otherwise.

Client Data means data, files, mailboxes and credentials belonging to you or your users that cimply handles in providing the Services.

Covered Work means support of any system, device, service or user that exists in your environment at the time of the request, as described in clause 5.

Fees means the Recurring Fees, Rate Card charges, Project fees and pass-through charges payable under this Agreement.

Go-live means the date the service levels commence, confirmed in writing at the end of transition.

Managed Device means a workstation, laptop, server or virtual machine on which cimply’s management agent is installed and that is counted in Schedule 1.

Managed User means a person with an account cimply administers, whether or not they have a Managed Device.

Minimum Environment Standards means the standards in clause 12.

Primary Service Area means the Perth metropolitan area, unless Schedule 1 states otherwise.

Project means net new work exceeding eight hours, scoped and approved in a Statement of Work.

Proposal means the document you sign that incorporates this Agreement.

Recurring Fees means the monthly fees for Managed Devices, Managed Users and server coverage, excluding pass-through licensing.

Services means the managed services described in the Proposal and clause 4.

Supported System means a system that meets the Minimum Environment Standards and is not excluded under clause 12 or a Risk Acceptance.

Work Item means net new implementation or integration work that can be completed in eight hours or less.

we, us, cimply means cimply IT Group Pty Ltd, ABN 57 639 316 028, of Unit 2, 907 Canning Highway, Mount Pleasant WA 6153.

you, the Client means the party named in the Proposal.

2.1 Acceptance. This Agreement begins when you sign or electronically accept the Proposal, or when you first use the Services after receiving it, whichever comes first.

2.2 Precedence. If documents conflict: a Statement of Work (for its Project), then the Proposal and Schedule 1, then these Terms, then Schedules 2 to 4.

2.3 Changes to these Terms. We may publish a new version at cimply.com.au/terms. Where the Proposal states a fixed term, the version identified in your Proposal applies for that term and any exercised extension unless we both agree otherwise in writing. Otherwise a new version applies to you from the next anniversary of your start date, or sooner if you tell us you are happy to adopt it. We will give you at least 60 days’ notice either way, and every version stays available in the archive so you can always see what changed.

3.1 Term. The term is stated in the Proposal. If it states a fixed term with extension options, the Agreement continues for that term and any exercised extensions, then month to month. If it does not state a term, the Agreement runs for an initial three months and then month to month.

3.2 Termination for convenience. Once month to month, either party may end this Agreement on 30 days’ written notice. During a fixed term you may still end it on 30 days’ notice. The Recurring Fees for the balance of the term remain payable unless the Proposal says otherwise.

3.3 Termination for cause. Either party may end this Agreement immediately if the other commits a material breach not remedied within 14 days of written notice, or becomes insolvent. You may also end it immediately under clause 9.6.

3.4 Effect. Fees accrued to the termination date remain payable. Clauses 14 to 17, 19, 20 and 22 survive.

4.1 What we provide. Service desk, endpoint and server management, patching, endpoint protection and managed detection and response, backup, network management, Microsoft 365 administration, onboarding and offboarding, onsite attendance within the Primary Service Area, licence management and vendor escalation, as described in the Proposal.

4.2 Standard of care. We perform the Services with due care and skill, using suitably qualified personnel, and in line with our Security Assurance baseline (ASD Essential Eight Maturity Level 2) where the environment permits it.

4.3 Subcontractors. We may engage subcontractors, for example for onsite work outside Western Australia. We will let you know before a subcontractor works on your environment, and we remain responsible for their work as if it were our own.

4.4 Access and cooperation. We will ask for the access, information, decisions and approvals we reasonably need, and we rely on you to provide them. While we are waiting on something from you, the service level clock pauses.

5.1 The principle. Everything that already exists is supported within the Recurring Fees, with no ticket cap. Building something that does not yet exist is charged. Once built, it is supported within the Recurring Fees like everything else.

5.2 Covered Work includes password resets, onboarding and offboarding, replacing and rebuilding failed devices, server and network faults, mailbox and permission changes, patch failures, security incidents, advice, vendor escalation, and onsite attendance in the Primary Service Area.

5.3 Work Items are charged hourly at the Rate Card. A Work Item that will exceed eight hours stops and becomes a Project.

5.4 Projects are scoped, quoted and approved in writing before work starts. No chargeable work of any size proceeds without your written approval of scope and cost.

5.5 Not included. The items listed in Schedule 4 Part B, and anything excluded under clause 12.

5.6 Doubt. Where a request sits on the boundary, we treat it as Covered Work and talk it through with you at the next review rather than stopping to argue about it.

6.1 Invoicing. Recurring Fees are invoiced monthly in advance on the 1st, on counts taken on the last Business Day of the prior month. Increases and decreases are treated identically. Each invoice states the counts and rates applied. Rate Card charges and pass-through licensing are invoiced monthly in arrears.

6.2 Payment. Invoices are due 14 days from issue by direct debit, PayTo or EFT. No surcharge applies to card payments. Fees exclude GST.

6.3 Rate stability and annual review. Recurring Fee and Rate Card rates are held for the first 12 months from go-live. After that we may adjust them once in each 12-month period, by no more than the percentage change in the Consumer Price Index (All Groups, Perth) published by the Australian Bureau of Statistics for the most recent four quarters, on at least 60 days’ written notice. Where the index is nil or negative, rates do not change. Any increase beyond CPI requires your agreement. Third-party licensing follows the vendor’s pricing and commitment terms and is passed through at the vendor’s rate.

6.4 Queries. If something on an invoice does not look right, tell us in writing within 10 Business Days and pay the part that is not in question. We will work through the rest with you promptly, and under clause 22 if we cannot agree.

7.1 What to expect. We would much rather talk than send notices, so if you are expecting difficulty paying, tell us early and we will work something out. If an invoice remains unpaid, we send a reminder at day 1 and day 10 after the due date, a formal notice at day 30 stating the whole account balance, and a final notice at day 40, each to your nominated contact and your accounts contact.

7.2 Interest. We may charge interest at 10% per annum, calculated daily, on amounts more than 30 days overdue. We do not always charge it, and choosing not to on one occasion does not mean we have given it up.

7.3 Suspension. If an amount is more than 40 days overdue after the day-40 notice, we may suspend non-essential Services on 5 Business Days’ notice. During suspension we stop charging the labour component of the Recurring Fees (60% unless Schedule 1 states otherwise) and we are not liable for loss arising from the suspension. We never suspend security monitoring, backups, or your access to your own data and credentials.

7.4 Reactivation is charged at two hours at the standard hourly rate, being our cost of suspending and restoring.

7.5 Telecommunications services are never restricted under this clause except as clause 13 permits.

8.1 Pass-through. Where we supply Microsoft or other subscriptions, you are bound by the vendor’s terms, and the subscription runs for the vendor’s commitment period. Reductions take effect at the next renewal the vendor allows.

8.2 Hardware. Title to hardware passes on payment in full. Until then we retain title and may register our interest under the Personal Property Securities Act 2009 (Cth). You will not sell or encumber it. Risk passes on delivery.

8.3 Vendor support. Where we supply or manage the product or service, vendor escalation is included in the Recurring Fees without a time limit. We raise the case, manage it and drive it to resolution for as long as it takes. Where the product or service is one you hold directly and we neither supply nor manage, we escalate to and manage the vendor for up to 60 minutes per incident within the Recurring Fees, and beyond that work is a Work Item. Where no vendor support exists, work is a Work Item. We own the escalation in every case. You are never asked to chase a vendor yourself.

9.1 Priority. Every request is rated for impact and urgency when logged, and the combination sets its priority automatically under the matrix in Schedule 3. Both ratings are recorded on the request so you can see why it was rated as it was and challenge it.

9.2 Targets. Response is the time to a human acknowledgement and triage. Restoration is the time to restore service or provide an acceptable workaround. The targets are in Schedule 3. Response targets are commitments. Restoration targets are objectives, not guarantees, because resolution can depend on vendors, hardware lead times and your availability.

9.3 Hours. Targets are measured in Business Hours. A P1 (a whole-site or tenant outage, or an active security incident) is actioned at any hour, including weekends and public holidays. Where it arises on systems or services we manage and that meet the Minimum Environment Standards, there is no charge. Otherwise after-hours rates apply. Other after-hours work is available to your authorised contacts at the after-hours rate, agreed before it starts.

9.4 Escalation is automatic at the points in Schedule 3, and available to you on request at any time.

9.5 Exclusions. Targets do not apply to systems outside the Minimum Environment Standards, faults in third-party or carrier services, Force Majeure, work outside the Services, failures you or your contractors cause, risks you have accepted under clause 11, notified maintenance, or periods of suspension.

9.6 Remedy. No service credits apply. If we miss the P1 response target three times, or the P2 response target five times, in any rolling three months, we will issue you a written remediation plan within ten Business Days setting out the cause and what we are changing. If the same threshold is reached again in the following three months, you may end this Agreement immediately without paying out the term.

10.1 Change management. Changes are classified by risk. Standard changes (user creation, software deployment, routine patching) are pre-approved under this Agreement. Normal changes (anything affecting a shared system, a site or more than one user) require your nominated contact’s approval and five Business Days’ notice with a scheduled window. Major changes (architecture, migration, or an outage of a critical system) require your approval of a documented plan and rollback and ten Business Days’ notice. Emergency changes needed to restore service or close an active security exposure proceed on verbal approval from any authorised contact, documented within 24 hours. Every change carries a rollback position.

10.2 Root cause analysis. We produce a written root cause analysis within five Business Days for every P1, any P2 that recurs within 30 days, any incident affecting a whole site or critical system, and any incident you ask for one on. It states what happened, why, what was done and what prevents recurrence, and the preventive actions are tracked to completion.

10.3 Security incidents. On a confirmed or suspected compromise we contain first and investigate second, keep you updated at an agreed interval (hourly by default during an active P1), and recover on a plan in which you decide the order services return. The first four hours of incident response per incident are within the Recurring Fees. Beyond that, work is at the Rate Card unless the incident arose from a failure of ours.

10.4 Monthly report. Within 10 Business Days of month end we issue a written report covering: active users and the licensing assigned to each, request volumes, categories and trends, performance against every target in Schedule 3, normal and major changes completed, security posture, patch compliance and backup status, open recommendations and the Risk Acceptance Register, and any root cause analyses issued.

10.5 Reviews. We offer a service review quarterly, available on request at any time and schedulable monthly, at no charge. The Risk Acceptance Register is re-confirmed at each review.

11.1 What we can and cannot promise. No provider can guarantee that systems or data will never be compromised, and we do not. What we do is reduce the likelihood and the impact through the controls in the Services, and respond quickly when something does happen.

11.2 Shared responsibility. We are responsible for the controls we operate. You are responsible for your users’ conduct, your content, your business decisions, and any control Schedule 1 allocates to you. Where Schedule 1 is silent, a control is yours.

11.3 Declined recommendations. From time to time we will recommend a security control or upgrade in writing. It is always your decision. If you decide not to proceed, we record that on a Risk Acceptance Register so both of us have a clear picture. The affected systems then sit outside the targets in clause 9 and our security obligations to the extent of that recommendation, and we are not liable for loss it would have prevented.

11.4 Work at your direction. If you ask us to do something we have advised against, we will set out the advice and the risk in writing and proceed once you confirm in writing. The outcome is then at your risk, but we remain responsible for doing the work competently.

11.5 Administrative access. Keeping day-to-day accounts free of administrative rights is one of the most effective protections we operate, so no user holds local administrator rights on a Managed Device, including executives. Administrative access to the platforms we manage is held by us and by any Client administrators named in Schedule 1. A named Client administrator works to the same standard as our own staff: least privilege for the duties held, multi-factor authentication enforced, no standing privilege where just-in-time elevation is available, and all activity logged. Access held on that basis does not affect clause 9 or our security obligations. Where you require administrative access outside that standard, we will accommodate it, and the platform or device concerned then sits outside clause 9 and our security obligations. The credentials are always yours: we release them to your authorised representative on request, promptly, at any time.

12.1 Standards. Supported Systems meet the Minimum Environment Standards in Schedule 4 Part C. They exist so that the service levels and security commitments in this Agreement rest on an environment that can actually support them.

12.2 Below standard. A system below these standards, or end-of-life, unlicensed or unsupported by its vendor, is a Non-Standard Operating Environment. We will still help with it, on a time-and-materials basis at the Rate Card, but it sits outside clause 9 and our security obligations, and you indemnify us for claims arising from it. We will always tell you when something falls into this category and what it would take to bring it back within standard.

13.1 Application. This clause applies where we supply internet, SIP or telephony services in our own name. We are a carriage service provider and comply with the Telecommunications Consumer Protections Code and the Telecommunications (Financial Hardship) Industry Standard 2024, which prevail over anything inconsistent in this Agreement.

13.2 Restriction and disconnection. We will not restrict or disconnect a telecommunications service for non-payment without the notices and hardship assessment those instruments require, and never without a named person confirming the process was followed. Calls to 000, 112 and 106 remain available at all times. Our Payment Assistance Policy is at cimply.com.au/payment-assistance.

13.3 Call charges. You are responsible for calls made from your services, including fraudulent calls where the fraud originates from your equipment or credentials. We monitor for unusual patterns and will contact you if we see them. International dialling is barred by default and enabled on written request.

14.1 Your data is yours. You own Client Data. We access it only to provide the Services and as you direct.

14.2 Privacy. Each party complies with the Privacy Act 1988 (Cth) as amended from time to time. You are the entity responsible for notifying eligible data breaches involving your data. We will assist with assessment and containment for up to 4 hours per incident within the Recurring Fees, then at the Rate Card.

14.3 Data locations. The platforms we use and where each hosts data are listed in Schedule 4 Part D. By accepting this Agreement you consent to hosting in those locations. We will notify you 30 days before a material change.

14.4 Confidentiality. Each party keeps the other’s confidential information confidential, uses it only for this Agreement, and returns or destroys it on request, subject to legal retention obligations.

14.5 Backup. We back up the systems and data listed in the Proposal. Recovery point and recovery time objectives in Schedule 1 are targets. We test restores at least monthly. Anything not listed is not protected.

15.1 Each party keeps what it owned before this Agreement. Documentation, scripts, configurations and tooling we create in delivering the Services remain ours. You have a perpetual licence to use them for your business, and any documentation we build about your environment is yours on exit.

15.2 Name and logo. We may name you as a client and use your logo in our materials unless you withdraw permission in writing.

16.1 Cap. Each party’s total aggregate liability to the other arising out of or in connection with this Agreement, however arising, is limited to the greater of the Recurring Fees you paid in the 12 months before the first event giving rise to the liability, and 12 times the monthly Recurring Fee at that date. A higher cap is available on request for an additional fee.

16.2 Consequential loss. Neither party is liable for loss of profit, revenue, business, contracts, goodwill or anticipated savings, business interruption, wasted expenditure, or loss of or corruption to data, except that our liability for the reasonable cost of restoring data from a backup we were contracted to maintain is capped at $50,000 in addition to the cap.

16.3 Not limited. Clauses 16.1 and 16.2 do not limit liability for death or personal injury, fraud or wilful misconduct, breach of clause 14.4, infringement of a third party’s intellectual property, your obligation to pay Fees, or any liability that cannot be limited at law.

16.4 Consumer guarantees. Nothing in this Agreement excludes the guarantees under the Australian Consumer Law. Where those guarantees apply and the law permits, our liability is limited to resupplying the Services or paying the cost of resupply.

16.5 Property in our care. Our liability for loss of or damage to your equipment in our physical possession is limited to the care, custody and control sub-limit of our Public Liability policy stated in Schedule 1, in addition to the cap.

16.6 Indemnities. We indemnify you against third-party claims that our materials infringe intellectual property or that we breached clause 14.4. You indemnify us against third-party claims arising from Client Data, your use of the Services, breach of software licence terms, breach of privacy law, a Non-Standard Operating Environment, or work at your direction under clause 11.4, in each case except to the extent we caused it.

16.7 Proportionate liability legislation applies. Claims must be brought within 24 months of the party becoming aware of the facts.

17.1 Ours. We maintain Professional Indemnity, Cyber Liability, and Public and Products Liability insurance with an insurer authorised to carry on insurance business in Australia, at not less than the limits in Schedule 1, plus workers’ compensation as required by law. Where a policy is claims-made, we will maintain cover or run-off cover responding to acts during the term for six years after termination, where available on reasonable commercial terms. Certificates of currency are provided on request.

17.2 Yours. You maintain Cyber Liability insurance of at least $1,000,000, or the amount in Schedule 1. Our insurance covers our liability to you. It does not cover your own losses from a cyber event.

18.1 Neither party is liable for delay or failure caused by events beyond its reasonable control, including natural disaster, carrier or utility failure, outage of a cloud or SaaS platform including Microsoft 365, a cyber attack on a third party or supply chain, or industrial action not involving its own staff. The affected party notifies the other promptly and resumes as soon as practicable. If the event continues for 60 days either party may terminate.

19.1 During the term and for 12 months after, neither of us will approach the other’s staff who worked on the Services with an offer of employment, without the other’s written consent. Responding to a general advertisement is not an approach. If either party breaches this clause it will pay the other 25% of the person’s annual remuneration, which both parties agree is a genuine pre-estimate of the cost of replacing them.

20.1 Handover. On termination we hand over to you or your nominated provider, unconditionally and without fee: global administrator and all other credentials, the environment documentation and asset register, licence and subscription details and, where we hold them, transfer of the subscriptions, backup data in a standard format, and DNS, domain and certificate control. We remove our agents and access only after you confirm handover is complete. We cooperate reasonably with an incoming provider for 30 days. Transition work beyond handover is charged at the Rate Card.

20.2 Retention. We keep Client Data in our systems for 30 days after termination so nothing is lost in the transition, then delete it and, if you ask, confirm the deletion in writing. If you would like us to hold it longer, we will quote for that.

21.1 Neither party may assign this Agreement without the other’s consent, not unreasonably withheld. Either party may assign to a successor of substantially all of its business on notice. If you undergo a change of control, tell us within 30 days. We may end the Agreement on 60 days’ notice if the new controller is a competitor of ours.

22.1 Disputes. If a disagreement arises, our nominated contacts will talk first, and if that does not resolve it, the principals of each business will meet within 10 Business Days. If unresolved, either party may refer it to mediation in Perth before litigating. Either party may still seek urgent court relief where it is needed.

22.2 Notices are in writing to the addresses in the Proposal, by email with confirmation of receipt, or by post. Notices under clauses 3 and 7 go to both your nominated contact and your accounts contact.

22.3 General. This Agreement is governed by the law of Western Australia. It is the entire agreement and replaces all prior terms. A provision that is unenforceable is severed to the extent required. No waiver is effective unless in writing. The parties are independent contractors. We are not exclusive to you and you are not exclusive to us.

Completed for each client and attached to the Proposal. Where an item is blank, the default in the right-hand column applies.

All amounts exclude GST. Remote work is billed in 15-minute increments with a 15-minute minimum. Onsite work has a one-hour minimum then 15-minute increments. No chargeable work proceeds without written approval of scope and cost.

Recurring Fees for Managed Devices and Managed Users are stated in your Proposal.

Referenced by clause 9. Priority is set from impact and urgency at the time a request is logged. Response targets are commitments. Restoration targets are objectives.

A. Impact and urgency

B. Priority matrix

C. Targets

Response is the time to a human acknowledgement and triage, not an automated receipt. Restoration is the time to restore service or provide an acceptable workaround. Targets run in Business Hours. A request logged late on a Friday does not consume its target over the weekend. Where a third party controls resolution the clock pauses and we manage the escalation. A P1 is actioned at any hour. Any staff member may raise a P1 at any time. Other after-hours requests come from your authorised contacts.

D. Escalation

E. Chronic failure (clause 9.6)

The P1 response target missed on three or more occasions, or the P2 response target on five or more, in any rolling three-month period, excluding requests removed from measurement under clause 9.5. The first occurrence triggers a written remediation plan within ten Business Days. A second occurrence in the following three months gives you the right to terminate under clause 9.6.

Referenced by clauses 5, 12 and 14.3. The principle: everything that already exists is supported within the Recurring Fees. Building something that does not yet exist is charged. Once built, it is supported.

A. How work is classified

A Work Item that will exceed eight hours stops and becomes a quoted Project. Anything delivered as a Work Item or Project becomes Covered on completion at no change to the Recurring Fees. Where a request sits on the boundary we treat it as Covered and raise it at the next review.

B. Not included

C. Minimum Environment Standards (clause 12)

A system that does not meet these standards is a Non-Standard Operating Environment under clause 12.2. We will tell you when something falls below standard and what it would take to bring it back.

D. Data locations (clause 14.3)

Specific Platforms in use to be disclosed upon request.