iShield Cyber Security Warranty

1. Definitions

Capitalised terms not defined in these terms shall have the meaning ascribed to them in the General Terms. In these terms:

1.1 Business Email Compromise means the unrecoverable, actual direct financial loss of money, as confirmed in writing by the relevant financial institution following the Client’s reasonable attempts at recovery, which belongs to the Client, as a direct result of a Network Security Breach by a Third Party.

1.2 Client means the Cloud Group customer who holds an iShield Subscription that includes the Warranty.

1.3 Client Contribution means the first amount of each claim, as stated in the Client’s signed iShield Cyber Security Warranty quote, which is borne by the Client.

1.4 Cloud Group means Cloud Group Solutions (Pty) Ltd, trading as Cloud Group, the provider of iShield and of the Warranty.

1.5 Computer System means any computer, communications system, server, cloud infrastructure, microcontroller, interconnected electronic, wireless, web or similar system (including all hardware, software and physical components thereof and the data stored thereon) used to process data or information in analogue, digital, electronic or wireless format.

1.6 Warranty Start Date means the date, confirmed by Cloud Group to the Client in writing, from which the Client is enrolled for the Warranty.

1.7 Cyber Extortion Threat means a credible threat or series of related threats, including a demand for funds or property, directed at the Client to intentionally damage, destroy or corrupt, introduce Malicious Code to, or commit a theft of data from the Client’s Computer System, and includes ransomware events of that nature.

1.8 Data Breach means an incident, arising from a Network Security Breach, in which sensitive, protected or confidential data (including personal information, financial records and proprietary company information) is accessed, disclosed or stolen by unauthorised parties.

1.9 General Terms means Cloud Group’s General Terms and Conditions, as amended from time to time.

1.10 Internet of Things Event means unauthorised access to, or transmission of Malicious Code to, any internet-connected device forming part of the Client’s Computer System that collects, exchanges or processes data, including smart building systems, industrial control systems and wearable technology, by a Third Party.

1.11 iShield Subscription means the Client’s subscription to Cloud Group’s iShield product.

1.12 Malicious Code means software designed to infiltrate or damage the Client’s Computer System without the Client’s consent.

1.13 Network Security Breach means unauthorised access to, unauthorised use of, theft of data from, or transmission of Malicious Code to the Client’s Computer System.

1.14 Senior Officer means any owner, shareholder, member, partner, principal or director of the Client, and any chief executive, financial, operating, technology, information or privacy officer, risk manager or general counsel of the Client (or any equivalent position).

1.15 Third Party means any person or entity other than: (a) the Client or any of its subsidiaries; (b) any past or present director, officer, trustee, employee, partner, principal or natural-person independent contractor of the Client, Cloud Group or any of their subsidiaries; or (c) any person or entity having a financial interest or executive role in Cloud Group.

1.16 Warranty means the iShield Cyber Security Warranty described in these terms.

1.17 Warranty Event means a Data Breach, Cyber Extortion Threat, Internet of Things Event or Business Email Compromise.

1.18 [Intentionally deleted.]

1.19 Warranty Period means the period commencing on the Warranty Start Date and continuing for successive monthly periods for as long as the Client’s iShield Subscription, which includes the Warranty, remains active and paid up, ending on the earliest of the cancellation, suspension or non-payment of the iShield Subscription, or the termination of the Warranty under clause 8.

2. About the Warranty

2.1 The Warranty is a product warranty given by Cloud Group in respect of its iShield product. It is included in, and forms part of, the iShield Subscription tiers that carry the Warranty, and is not sold individually. It contributes towards the costs of responding to specified cyber security incidents, up to the limits set out in clause 3.

2.2 Should a Warranty Event occur while iShield is actively implemented and maintained in accordance with Cloud Group’s recommendations, and be notified to Cloud Group in accordance with clause 6, during the Warranty Period, Cloud Group shall provide specialist services up to, or pay up to, the maximum cumulative amount applicable to the warranty tier selected by the Client, subject to these terms, including the Client Contribution.

3. Warranty tiers and limits

3.1 The level of warranty protection depends on the warranty tier selected by the Client at sign-up. The Warranty is available under three warranty tiers:

* Billed together with, and not available separately from, the Client’s iShield Subscription. See clause 2.1.

3.2 The Annual Warranty Limit is the maximum cumulative amount payable under the Warranty for all Warranty Events notified during any period of 12 months starting on the Warranty Start Date or an anniversary of it, including the cost of any specialist services provided by or on behalf of Cloud Group. The limits shown for each event type are sub-limits that apply within, and do not add to, the Annual Warranty Limit. Every payment reduces the remaining limit.

3.3 All Warranty Events arising from the same originating cause, or from a series of related or connected acts or incidents, shall be treated as a single Warranty Event, notified on the date the first of them was notified, and shall be subject to one Client Contribution and one set of limits.

3.4 Client Contribution. Each Warranty Event is subject to the Client Contribution. Cloud Group shall only be liable for the amount of a valid claim that exceeds the Client Contribution.

3.5 Multi-client incidents. Where a single incident, or a series of related incidents, affecting the systems, software, tools or services of Cloud Group (including iShield) gives rise to Warranty Events for more than one Client, Cloud Group’s total liability to all affected Clients combined shall not exceed R1 million, which shall be shared between the affected Clients in proportion to their valid claims.

3.6 The R1 million breach warranty advertised for iShield corresponds to the Data Breach limit under Option 3 and is subject to these terms, including the Client Contribution and clause 3.5.

4. Warranty Events and covered costs

4.1 Data Breach. In respect of a Data Breach, the Warranty provides for the following reasonable and necessary costs and expenses incurred by the Client within 30 days of notifying Cloud Group of the underlying Network Security Breach:

4.1.1 obtaining professional legal advice, through advisers approved by Cloud Group, reasonably necessary to comply with governmental privacy legislation in respect of the Data Breach, including making representations to regulatory bodies;

4.1.2 incident triage and forensic investigation by IT experts retained by Cloud Group to confirm and determine the cause of the incident, the extent of the damage (including the nature and volume of data compromised), and how to contain the Network Security Breach;

4.1.3 communications to notify affected parties, as required by or recommended as best practice under governmental privacy legislation or guidelines;

4.1.4 remediation services, being customer support services including credit monitoring and identity theft education and assistance, provided to affected parties as required by or recommended as best practice under governmental privacy legislation or guidelines;

4.1.5 restoring, re-collecting or replacing data, including expenses for materials, working time and overhead cost allocation at the affected location; and, if it is determined that data cannot be restored, re-collected or replaced, the actual costs incurred up to such determination;

4.1.6 certified specialists, investigators, forensic auditors or loss adjusters retained by Cloud Group to substantiate that a Network Security Breach is occurring or has occurred, or to determine the scope, cause or extent of any theft or unauthorised disclosure of information or data;

4.1.7 containing the Network Security Breach;

4.1.8 complying with governmental privacy legislation, or guidelines mandating or recommending best practice, including reasonable and necessary legal expenses, and communication expenses by mail, call centre (for a period of up to 30 days, unless otherwise required by applicable law or regulation or agreed to by Cloud Group) and website; and

4.1.9 with the prior written approval of Cloud Group, retaining a public relations consultant, and related advertising or communication expenses at the direction of that consultant, solely to avert or mitigate material damage to the Client’s brand or reputation as a result of an actual Network Security Breach.

4.2 Costs not covered in respect of a Data Breach. The costs in clause 4.1 do not include costs or expenses incurred by the Client to:

4.2.1 identify or remediate any software errors or vulnerabilities;

4.2.2 update, replace, upgrade, recreate or enhance any part of the Client’s Computer System to a level beyond that which existed prior to the Warranty Event;

4.2.3 research or develop any data, including trade secrets or other proprietary information; or

4.2.4 establish, implement, maintain, improve or remediate security or privacy practices, procedures or policies.

4.3 Cyber Extortion Threat. In respect of a Cyber Extortion Threat, the Warranty provides for:

4.3.1 funds or property paid by the Client, with the prior written consent of Cloud Group, to a person reasonably believed to be responsible for the Cyber Extortion Threat for the purpose of terminating that threat, up to the lesser of 50% of such payment or the remaining balance of the applicable limit;

4.3.2 the reasonable and necessary fees and expenses of a cyber extortion negotiator to investigate and determine the cause of, and to end, the Cyber Extortion Threat;

4.3.3 all other reasonable and necessary expenses incurred by the Client, with the prior written consent of Cloud Group, within the Warranty Period as a direct result of the Cyber Extortion Threat, provided that the overall payment for such expenses and to terminate the threat does not exceed the expenses the Client would have incurred had those payments not been made; and

4.3.4 where the Cyber Extortion Threat also constitutes a Network Security Breach, the costs described in clause 4.1, subject to clause 4.2.

4.4 Payments to terminate a Cyber Extortion Threat, and the fees of a cyber extortion negotiator, will not be covered where such payments are illegal in any jurisdiction in which the Client or Cloud Group has operations, where they would breach any sanction, prohibition or restriction under United Nations resolutions or the trade or economic sanctions, laws or regulations of the European Union, United Kingdom or United States of America, or where the Cyber Extortion Threat is made by any government entity or public authority.

4.5 Internet of Things Event. In respect of an Internet of Things Event, the Warranty provides for:

4.5.1 the reasonable and necessary costs to replace or repair direct physical damage to, and/or impairment, corruption or destruction of, tangible property belonging to or rented, leased or hired by the Client, including loss of use thereof, caused solely and directly by the Internet of Things Event, regardless of any other cause or event contributing concurrently or in any other sequence; and

4.5.2 where the Internet of Things Event also constitutes a Network Security Breach, the costs described in clause 4.1, subject to clause 4.2.

4.6 Cloud Group shall not be liable for physical damage to tangible property in excess of the actual cash value of that property at the time of the Internet of Things Event, whether for the cost of repairing the property or of replacing it with property or material of like quality and value. Covered property damage does not include costs to improve the Client’s damaged, impaired, corrupted or destroyed tangible property. A claim in respect of an Internet of Things Event must be accompanied by details of how the amount claimed has been calculated, the assumptions made, and supporting documents (including reports, books of account, bills and invoices), all prepared at the Client’s own cost.

4.7 Business Email Compromise. In respect of a Business Email Compromise, the Warranty reimburses the Client for the unrecoverable, actual direct financial loss of money, as confirmed in writing by the relevant financial institution following the Client’s reasonable attempts at recovery.

5. Eligibility and conditions of cover

5.1 The Warranty shall only be payable if the Client:

5.1.1 holds an active, fully paid-up iShield Subscription that includes the Warranty, both at the time the Warranty Event occurs and at the time the claim is submitted;

5.1.2 signed the iShield Cyber Security Warranty quote and agreed to this document’s terms and conditions;

5.1.3 had iShield actively implemented and up to date at the time of the Warranty Event;

5.1.4 implemented and maintained the security configurations and recommendations provided by Cloud Group; and

5.1.5 did not cause or contribute to the Warranty Event through wilful misconduct, fraud, gross negligence or breach of these terms.

6. Claims process

6.1 The Client must notify Cloud Group of a Warranty Event as soon as practicable and in any event within 48 hours of becoming aware of it (and, in the case of a Cyber Extortion Threat, immediately), by email to [email protected] and by telephoning Cloud Group on 010 593 4493. Notification within these periods is a condition precedent to cover, and no claim will be accepted for a Warranty Event first notified after the end of the Warranty Period.

6.2 Supporting documentation including the SAPS CAS number is required to process any claim, including written confirmation from the relevant financial institution in the case of a Business Email Compromise claim and Data Breach.

6.3 Where the Client raises a valid claim under the Warranty, Cloud Group’s Cyber Incident Response process will be followed.

6.4 Where these terms require the prior written consent or approval of Cloud Group, Cloud Group will not unreasonably withhold or delay it. The Client shall not admit liability, make any payment, assume any obligation, incur any expense, enter into any settlement or engage any service provider in connection with a Warranty Event without Cloud Group’s prior written consent, and costs incurred without that consent or approval will not be covered.

6.5 The Client must provide all information and documents needed to establish the amount and validity of its claim as soon as practicable and in any event within one month of notifying Cloud Group of the Warranty Event, failing which the claim will lapse.

6.6 The Client shall give Cloud Group (and its appointed representatives) all information, assistance and cooperation it reasonably requires to investigate, contain, defend or settle a Warranty Event, including permitting it to inspect relevant systems, property and records and to inform the appropriate regulatory or law enforcement authorities of a Cyber Extortion Threat. The Client shall do nothing to prejudice any right of recovery. On any payment under the Warranty, Cloud Group, and any person nominated by Cloud Group, shall be subrogated to the Client’s rights of recovery against any person, and the Client shall sign all documents needed to give effect to this.

6.7 Where a Warranty Event, cost or loss is also covered by any other insurance, warranty or indemnity available to the Client, the Warranty shall apply only in excess of the amount recoverable under that other cover. The Client must disclose any such cover when notifying a claim.

6.8 The Client shall use its best efforts not to disclose the existence or terms of the Warranty to any person posing a Cyber Extortion Threat. If the existence of the Warranty is disclosed to such a person other than through the fault of Cloud Group, Cloud Group may withdraw the Warranty for that Cyber Extortion Threat with immediate effect.

6.9 As a condition precedent to cover for a Data Breach, the Client must report the Data Breach to the South African Police Service and to any relevant regulatory authority as soon as practicable and in any event within 72 hours of any Senior Officer becoming aware of it.

6.10 As a condition precedent to cover for a Business Email Compromise, the Client must report the Business Email Compromise to its financial institution, to the South African Police Service and to any relevant regulatory authority as soon as practicable and in any event within 72 hours of any Senior Officer becoming aware of it.

7. Exclusions

7.1 The Warranty does not cover any matter not expressly included in these terms. Without limiting that, the Warranty does not extend to:

7.1.1 indirect, consequential or special losses, including loss of revenue, profits or business opportunity;

7.1.2 fines, penalties or punitive damages, except where permitted by law;

7.1.3 incidents that occurred, originated or were known to the Client before the Warranty Start Date, or which the Client should reasonably have foreseen before the Warranty Start Date could give rise to a claim;

7.1.4 losses resulting from the Client’s failure to apply security updates or follow Cloud Group’s guidance;

7.1.5 the costs listed in clause 4.2 and payments excluded under clause 4.4;

7.1.6 any incident, cost or loss falling outside the Warranty Events defined in clause 1;

7.1.7 war, invasion, act of foreign enemy, hostilities or warlike operations (whether declared or not), civil war, mutiny, rebellion, revolution, insurrection, military or usurped power, riot, strike, lockout, civil commotion, confiscation, nationalisation or requisition by any government or authority, terrorism or cyberterrorism, or any cyber operation carried out by, at the direction of or under the control of a sovereign state (including cyberwar);

7.1.8 any Cyber Extortion Threat made by any government entity or public authority, and any payment or benefit that would breach any sanction, prohibition or restriction under United Nations resolutions or the trade or economic sanctions, laws or regulations of the European Union, United Kingdom or United States of America;

7.1.9 any matter in which relief is sought, or legal action is threatened or pursued, in the United States of America or Canada (or any territory operating under their laws), any matter arising out of activities carried on there, and any action or proceeding brought in a court outside South Africa or brought in South Africa to enforce a foreign judgment;

7.1.10 the use of pirated software, or of software that has not been released from its development stage or has not passed all test runs and proven successful in daily operations;

7.1.11 wear and tear, drop in performance, gradual deterioration or ageing of electronic equipment or hardware, or the Client’s failure to maintain any computer, Computer System, software or other equipment;

7.1.12 any failure to rectify or improve a weakness or defect in the Client’s Computer System or processes that had come to the attention of a Senior Officer with sufficient time to rectify it, whether or not the weakness or defect was identified by Cloud Group;

7.1.13 electrical or mechanical failure or interruption (including electrical disturbance, spike, brownout, blackout or load-shedding), interruption or failure of satellite services, failure, deterioration or theft of transmission or distribution lines or cabling, or outage of or interruption to the supply of fuel, water, telephone, cable, telecommunications or other infrastructure or services, save, in the case of an outage or interruption of supply, where the infrastructure or service is under the Client’s operational control or the outage arises from a Network Security Breach;

7.1.14 fire, smoke, explosion, lightning, wind, water, flood, storm, earthquake, volcanic eruption, tidal wave, landslide, hail, an act of God or any other physical event outside the Client’s control, however caused;

7.1.15 bodily injury, mental injury, mental anguish, emotional distress, sickness, disease or death of any person, and physical damage to, or loss of use of, tangible property other than as expressly covered for an Internet of Things Event under clause 4.5;

7.1.16 the loss, theft or misappropriation of cryptocurrency, and impersonation fraud not involving a Network Security Breach by a Third Party;

7.1.17 trading losses, trading liabilities or changes in the value of accounts; the loss, transfer or theft of money, securities or property of others in the care, custody or control of the Client; the monetary value of electronic fund transfers or transactions lost, diminished or damaged during transfer from, into or between accounts; and the face value of coupons, discounts, prizes or awards given in excess of the contracted or expected amount;

7.1.18 the insolvency, liquidation, business rescue or bankruptcy of the Client or Cloud Group;

7.1.19 the unauthorised or unlawful collection by the Client of any third party’s proprietary, personal or confidential information, whether in paper or electronic form;

7.1.20 the rendering of, or failure to render, professional services by the Client; defects in, or the recall of, goods or products supplied by the Client; fees, commissions or costs charged by the Client; and any breach of contract, warranty or guarantee other than the Warranty itself;

7.1.21 pollution or contamination of any kind (other than Malicious Code), asbestos, nuclear material or radiation, mould or fungi, or electromagnetic fields or radiation;

7.1.22 the purchase or sale of securities, loss of value of securities, racketeering or money laundering, anti-trust or unfair competition, employee benefit, pension or investment schemes, or the infringement or misappropriation of intellectual property rights;

7.1.23 any deliberately fraudulent, criminal, dishonest or malicious act of the Client or its personnel, any advantage to which they were not legally entitled, or any involvement in “State Capture”, bribery or corruption as referred to in any report, inquiry or proceeding of an official body; and

7.1.24 [Intentionally deleted.]

8. Subscription dependency

8.1 The Warranty is valid only while the iShield Subscription is active and in good standing. The Warranty ceases immediately on cancellation, suspension or non-payment of the iShield Subscription, and no claim may be made in respect of incidents occurring, or first notified to Cloud Group, after such lapse.

8.2 Cloud Group may amend, suspend or terminate the Warranty, or any part of it, on not less than 30 days’ written notice to the Client. If Cloud Group terminates the Warranty or materially reduces it, the Client may change its iShield Subscription tier, or cancel its iShield Subscription, without penalty. Only Warranty Events notified to Cloud Group before the termination date will be considered.

9. Client obligations

9.1 The Client agrees that, during the provision of Cyber Incident Response Handling, Cloud Group will be granted the authorised access to the Client’s IT environment required to contain and investigate cyber security incidents and threats.

10. Ownership

10.1 The Client’s rights are limited to those stated in, or incorporated by reference into, these terms and the General Terms.

10.2 Cloud Group and its third-party providers retain all ownership and other rights and interests in and to the tools and technologies that Cloud Group uses in its Cyber Incident Response Handling and containment services, including underlying intellectual property rights, equipment and licences, and any systems comprising any of them.

11. Data protection

11.1 The Client owns and controls all rights, title and interest in all cyber incident reports, forensic data and related information generated by Cloud Group arising from a Warranty Event.

11.2 Cloud Group will use and process such cyber incident reports, forensic data and related information solely to the extent necessary to perform Cyber Incident Response Handling.

11.3 Cyber incident reports, forensic data and related information may be retained and disclosed by Cloud Group as required to comply with applicable laws, regulations, subpoenas or court orders. Where allowed by law, Cloud Group will give the Client reasonable prior written notice so that the Client may seek a protective order, and will cooperate in the Client’s activities under this clause at the Client’s expense. With the Client’s written authorisation, Cloud Group will disclose only the information reasonably necessary to meet the applicable legal order or requirement.

12. Disclaimer

12.1 Without limiting Cloud Group’s express obligations under these terms, Cloud Group disclaims all warranties, conditions and representations, whether express, implied, statutory or otherwise, concerning any other cyber security service, software, documentation or other materials unrelated to the Warranty, including implied warranties of merchantability, satisfactory quality, fitness for a purpose and non-infringement. Cloud Group does not represent that the Warranty or any related service will be uninterrupted, error-free or meet the Client’s requirements.

13. Issuer, contact and amendments

13.1 The Warranty is offered by Cloud Group, the trading name of Cloud Group Solutions (Pty) Ltd (Reg. No. 2019/564241/07; VAT No. 4260306131).

13.2 Queries about the Warranty may be directed to [email protected].

13.3 Cloud Group reserves the right to amend these terms on reasonable notice. This is Version 4 of these terms, effective from 30 September 2026. The version of these terms in force at the date of a Warranty Event applies to that Warranty Event.

13.4 Cloud Group may, at its own cost, insure its obligations under the Warranty. Any such insurance is solely for Cloud Group’s benefit. The Client is not a party to it and has no rights against, or claim on, any insurer of Cloud Group.