Terms of Service

1. About SmartSec Academy

SmartSec Academy provides structured cybersecurity awareness training, completion tracking, certificate issuance, and certificate verification services for organisations and their users.

SmartSec Academy’s paid training is provided only to organisations and business customers. By proceeding with a purchase, you confirm that you are purchasing for business or professional purposes and are authorised to purchase for the named organisation.

The applicable contracting entity is identified before purchase and in the purchase confirmation, with further detail in Section 22.

SmartSec Academy focuses on cybersecurity awareness, human decision-making, and safer everyday behaviour. The training is not technical configuration training, legal advice, incident response advice, a professional cybersecurity qualification, or a guarantee against cybersecurity incidents.

SmartSec Academy operates independently and is not affiliated with any other organisation using the name “SmartSec” or similar variations.

By accessing or using the SmartSec Academy website, training platform, certificate verification system, or related services, you agree to these Terms.

2. Who May Use the Services

Paid training may be purchased only for business or professional purposes. If you access SmartSec Academy through an employer or organisation, you are also responsible for following that organisation’s internal policies.

If you believe you purchased wholly or mainly outside a business or professional activity, contact [email protected] promptly. Nothing in these Terms limits rights that cannot lawfully be excluded.

• you are authorised by your organisation, or you have been given valid access
• you use the services for lawful, professional, and intended purposes
• you comply with these Terms and applicable laws
• you do not misuse, copy, disrupt, or attempt to bypass the platform

3. Organisational Use

Where SmartSec Academy is purchased or managed by an organisation, that organisation is responsible for the points below.

SmartSec Academy may provide the organisation with limited visibility into user enrolment, progress, completion, and certificate status for training administration, assurance, and record-keeping purposes.

• providing accurate user information
• ensuring users are authorised to access the training
• managing internal communication with users
• reviewing training completion information where made available
• ensuring its own use of the services complies with internal policies and applicable requirements

4. Access Periods, Seats, and Users

Standard SmartSec Academy plans provide 12 months of access unless a written custom arrangement states otherwise.

One active learner assignment uses one seat. Before completion, an authorised customer administrator may remove a learner and reuse the released seat where the account controls permit.

Completed learner records, Final Check results, and certificates cannot be transferred, replaced, or rewritten.

• one active learner assignment equals one seat
• one seat is for one named learner at a time
• accounts and seats must not be shared
• completed learner records cannot be reassigned or transferred
• each eligible learner may receive one certificate after confirmed completion
• additional users above the purchased entitlement require another purchase, renewal, or custom arrangement

5. Account Access and Security

SmartSec Academy may suspend, restrict, or remove access where necessary to protect platform security, service integrity, users, or the business.

• you are responsible for keeping login details confidential
• accounts must not be shared, transferred, sold, or misused
• you must not allow unauthorised access to the platform
• suspected unauthorised access should be reported promptly
• you must not attempt to bypass access controls, completion tracking, or security features

6. Training Content and Acceptable Use

SmartSec Academy content is provided for cybersecurity awareness and educational purposes.

SmartSec Academy may investigate suspected misuse and take appropriate action, including suspension or termination of access.

• copy, reproduce, download, scrape, sell, or distribute training content without permission
• record, republish, or publicly share training materials without authorisation
• attempt to reverse engineer, bypass, or interfere with platform functionality
• manipulate assessments, completion tracking, certificates, or verification processes
• use the services to upload, transmit, or promote unlawful, harmful, misleading, or abusive content
• use the services in a way that disrupts other users, organisations, or systems

7. Certificates and Verification

Certificates may be issued after confirmed completion of the required training and any applicable assessment or completion steps. Certificate validity starts from completion or issue as shown on the certificate and lasts for 12 months.

Certificate validity is separate from the organisation’s training-access period. Organisation access expiry does not automatically invalidate an otherwise-valid certificate, and permitted historical certificate information remains available after organisation access expires.

Certificates confirm completion of a SmartSec Academy training programme. They do not represent professional licensing, technical certification, employment qualification, legal compliance certification, or a guarantee of cybersecurity competence.

Public verification returns certificate status only and does not identify the learner. SmartSec Academy may correct, suspend, revoke, or invalidate certificates issued in error, obtained improperly, misused, or affected by inaccurate information.

• alter certificates
• create false certificates
• misrepresent certificate status
• reuse certificates outside their intended context
• claim certification where training has not been completed
• use expired, revoked, or invalid certificates as current

8. CPD and Training Status

Where a SmartSec Academy programme is described as CPD Certified, this refers to the status of the relevant training programme and supporting learning structure.

CPD certification does not mean that an individual learner becomes professionally accredited, licensed, or formally qualified in cybersecurity.

Users and organisations are responsible for using certificate wording accurately and not overstating the meaning of completion.

9. Payments, Access, Pricing, and Renewals

Published Starter, Growth, and Business plans provide 12 months of access for the stated learner limit. Enterprise terms may be agreed separately in writing. Stripe processes hosted checkout and payment information.

Successful payment creates the purchased entitlement. The 12-month access period begins when the customer administrator activates the account or, if activation has not occurred, automatically 7 days after successful payment, whichever occurs first. Expiry is 12 months after that authoritative access-start date.

When the access period expires, the customer may continue to sign in to a read-only historical account view. Existing learner, completion, and permitted certificate information remains visible, but new learner allocation, new training access, and new seat consumption are blocked.

• Starter includes up to 10 learner seats
• Growth includes up to 20 learner seats; earlier purchases retain the learner limit confirmed for that purchase
• Business includes up to 50 learner seats
• Enterprise is for more than 50 learners or a custom arrangement
• purchases do not automatically renew or automatically upgrade
• renewal is optional and requires a new purchase or written renewal arrangement
• access expiry does not itself delete historical records or invalidate an otherwise-valid certificate

10. Refunds and Cancellations

Business-customer refund requests should be submitted to [email protected] within 14 days of purchase. Refunds are not automatic.

A full refund may be provided where no learner has started training and no certificate has been issued. Once training has started, refunds are considered where required by law, where SmartSec Academy cannot provide the purchased service, or where otherwise agreed in writing.

Approved refunds are handled through Stripe. Nothing in these Terms limits rights that cannot lawfully be excluded.

11. Public Awareness Resources

SmartSec Academy may provide free public awareness resources, including videos, articles, guides, or educational materials.

These resources are provided for general awareness only. They are not personalised advice, legal advice, technical security advice, financial advice, or incident response support.

Public resources may be shared for genuine awareness and educational purposes, provided they are not altered, misrepresented, sold, or presented as created by another party.

12. AI-Assisted Tools

13. Intellectual Property

All SmartSec Academy content, materials, videos, scripts, text, designs, logos, trademarks, platform elements, certificates, systems, and related intellectual property belong to SmartSec Academy or its licensors.

Nothing in these Terms gives users or organisations ownership of SmartSec Academy intellectual property.

Users receive only a limited, non-exclusive, non-transferable right to access and use the services for their intended purpose during the applicable access period.

14. Service Availability and Changes

SmartSec Academy aims to provide reliable access to its website, training materials, and related services.

However, we do not guarantee uninterrupted, error-free, or permanently available service.

Where practical, material service changes will be communicated appropriately.

• update or modify training content
• improve or change platform features
• suspend access for maintenance, security, or operational reasons
• remove, replace, or update services where necessary
• correct errors or inaccuracies

15. Third-Party Services

SmartSec Academy relies on third-party services for website and Worker infrastructure, hosted checkout, authentication, database records, service email, consent management, video delivery, security, and AI-assisted tools.

Third-party services may be subject to their own terms, privacy notices, availability, and technical limitations. Their specific privacy roles are described in the Privacy Policy.

An outbound link to a third-party website, including YouTube or Stripe-hosted checkout, does not make that destination part of the SmartSec Academy website. The destination’s own terms apply after the link is followed.

16. Privacy and Data Protection

Use of SmartSec Academy is subject to our Privacy Policy, which explains how personal information is collected, used, stored, shared, and protected.

Use of cookies and similar technologies is explained in our Cookies Policy.

By using the services, you acknowledge that personal information may be processed as described in those policies.

17. Security and Responsible Use

Users and organisations must not use SmartSec Academy in a way that compromises security, platform integrity, or other users.

SmartSec Academy may take reasonable steps to investigate, prevent, restrict, or report suspected misuse.

• attempt unauthorised access
• test, scan, or attack the platform without written permission
• introduce malware or harmful code
• interfere with service availability
• abuse support, forms, chat tools, or account systems
• attempt to obtain other users’ data or credentials

18. Disclaimers

SmartSec Academy provides behavioural cybersecurity awareness training designed to support better judgement and decision-making.

The services do not guarantee that users or organisations will avoid cyber incidents, fraud, scams, phishing, social engineering, data loss, or security failures, and they do not guarantee legal or regulatory compliance.

Training does not replace technical controls, organisational policies, incident response arrangements, or appropriate professional advice. Organisations remain responsible for their own security decisions, employee management, compliance obligations, and operational risk management.

AI-assisted outputs may be incomplete or inaccurate and should be checked where the answer matters.

19. Liability

SmartSec Academy does not promise that awareness training will prevent an incident, that every service will be uninterrupted, or that third-party systems will always be available. These statements describe the limits of the service and do not remove responsibility that applicable law places on SmartSec Academy.

Nothing in these Terms excludes or limits liability where doing so would be prohibited by applicable law, including liability that cannot lawfully be excluded for fraud, intentional misconduct, death, or personal injury.

20. Suspension, Termination, and Expiry

Users may stop using the services at any time, subject to any organisational agreement, access arrangement, or payment terms.

At ordinary access expiry, training and account-management functions end, but permitted historical learner, completion, and certificate information remains available read-only. Suspension or termination for misuse or security reasons may restrict more access where reasonably necessary.

• these Terms are breached
• payment is not completed or is reversed
• access is misused
• false or inaccurate information is provided
• continued access creates legal, security, operational, or reputational risk
• the applicable access period has ended

21. Changes to These Terms

SmartSec Academy may update these Terms to reflect changes in services, platform operations, legal requirements, or business practices.

The current version and effective date will be published on the SmartSec Academy website. Where practical, material changes affecting an active customer service will be communicated through an appropriate account or service channel.

An update does not retrospectively change a completed purchase or written customer agreement except where the customer agrees or applicable law requires the change.

22. Contracting Entity and Governing Law

GBP checkout purchases are supplied by SmartSec Academy Ltd. EUR checkout purchases are supplied by SmartSec Academy OÜ. A separately signed written agreement may identify different arrangements for that agreement.

Purchases supplied by SmartSec Academy Ltd are governed by the law of England and Wales. Purchases supplied by SmartSec Academy OÜ are governed by Estonian law.

This does not affect mandatory rights or jurisdiction rules that cannot lawfully be excluded.

23. Contact

For questions about these Terms, contact: [email protected]