General Terms
1. About these terms
These terms apply when a business buys a Corgenta DRA Project or DRA Professional licence from Corgenta Ltd (company number 04788104, registered office 1110 Elliott Court Business Park, Herald Ave, Coventry CV5 6UB, UK). You accept them by ticking the box at checkout. They are for business customers only, not consumers.
DRA as a Service (Corgenta performing the assessment) is covered by a separate statement of work and services terms.
2. Packages and limits
- DRA Project: £595, paid once. 12 months’ access. One system under consideration and one DRA. One user plus one reviewer/approver seat. No automatic renewal.
- DRA Professional, 1 user: £300 a month or £3,000 a year.
- DRA Professional, up to 3 users: £600 a month or £6,000 a year.
- DRA Professional includes multiple concurrent projects, each with one system and one DRA, plus one reviewer/approver seat.
- The reviewer/approver seat can review and approve a DRA but cannot author one.
- Reassessments of a licensed DRA are unlimited within the paid term.
3. Setting up your licence
After payment we set up your access within one working day and email your login details. Your term starts on the activation date.
4. Prices and payment
Prices are in pounds sterling, exclude VAT and are paid in advance through Stripe. Where VAT applies, it is added at checkout.
5. Renewal and cancellation
- DRA Professional monthly renews automatically each calendar month on your billing date. If that date does not exist in a month, it renews on the last day of the month.
- DRA Professional annual renews automatically each year.
- We email you 3 days before each monthly renewal and 30 days before each annual renewal, with the date, the price and how to cancel.
- You can cancel at any time in the customer portal. Cancelling stops the next renewal; your access continues until the end of the period you have paid for. We confirm the end date by email.
- DRA Project does not renew. It ends 12 months after it starts.
- Refunds: we do not refund part periods. You can cancel a DRA Project purchase for a full refund until we activate it.
6. Failed payments
If a payment fails, we tell you and Stripe tries again. You can update your payment details in the customer portal. If the payment is still unpaid 7 days after the end of the paid period, we suspend your licence. We restore access when you pay.
7. Your data
- You own the assessment data you put into Corgenta DRA and the outputs you create.
- We process your data only to provide the service, under the Data Processing Annex (Annex A below).
- You can export your results as structured data (JSON) at any time during your term.
- When your licence ends, you have 30 days to export your results. We then delete your data.
- Your data is hosted by Hetzner in Finland. Each customer’s data is logically separated in its own tenant, and access is restricted by user role. Data is encrypted in transit (HTTPS), and we keep an audit record of key actions, which cannot be changed once written.
8. Your responsibilities
- Give accurate information and keep your login details secure.
- Only invite users within your licence.
- Use the service lawfully and do not test or attack its security without our written permission.
- You make and own the risk decisions. Your named approver accepts residual risk.
9. No certification or compliance guarantee
Corgenta DRA supports a Detailed Risk Assessment aligned with IEC 62443-3-2. It does not certify any system and does not guarantee compliance with IEC 62443 or any other standard or law.
10. Availability and support
We aim to keep the service available but do not offer a service level agreement at launch. We give notice of planned maintenance by email. Support is by email on UK working days.
11. Intellectual property and confidentiality
Corgenta owns the software and its content. We give you a licence to use it during your term within the limits above. Each of us keeps the other’s confidential information confidential and uses it only for this agreement.
12. Liability
Our total liability under these terms is limited to the fees you paid in the 12 months before the claim. We are not liable for indirect or consequential loss, or for loss of profit, revenue or data. Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot be limited by law.
13. Suspension and ending
We may suspend or end your licence if you do not pay or if you seriously break these terms. When your licence ends, your access stops; see section 7 for export and deletion.
14. Changes, law and contact
We may change these terms by giving you 30 days’ notice; changes apply from your next renewal. These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. Contact: legal@corgenta.com.
Annex A. Data Processing
This annex applies when we process personal data in your assessment data on your behalf. You are the controller and Corgenta is the processor under UK GDPR.
- Subject matter and duration: providing Corgenta DRA during your licence term and the 30-day export window.
- Nature and purpose: hosting, storing and processing assessment records so you can carry out, review and release DRAs.
- Personal data: names, work email addresses, roles and activity records of your users, and any personal data you choose to include in assessment records.
- Data subjects: your users and reviewers, and people named in your assessment records.
- You are responsible for having a lawful basis for the personal data you give us, and for the instructions you give us.
- We act only on your documented instructions, including these terms, unless the law requires otherwise. We tell you if we think an instruction breaks data protection law.
- Everyone we allow to process the data is bound by confidentiality.
- We apply appropriate technical and organisational security measures (UK GDPR Article 32).
- Sub-processors: Hetzner (hosting, Finland) and Microsoft 365 (email). You authorise these. We tell you before adding or replacing a sub-processor so you can object, and we bind each one to equivalent data protection terms.
- We help you respond to requests from data subjects and meet your duties on security, breach notification, impact assessments and consultation with the ICO.
- We tell you without undue delay after becoming aware of a personal data breach affecting your data.
- When the service ends, we delete the data after the 30-day export window, unless the law requires us to keep it.
- We give you the information needed to show compliance with this annex, and allow audits and inspections by you or an auditor you appoint, with reasonable notice.
- We transfer the data outside the UK only with appropriate safeguards (see Privacy Notice, section 6).