Terms of service

1. About these terms

1.1 These terms are an agreement between Under Bridges Entity (Pty) Ltd, trading as Underwing, registration number 2016/469951/07 ("Underwing", "we", "us"), and the organisation that signs up to use Underwing (the "client", "you").

1.2 You accept these terms when you create an account, start a Team Spot Check, start a subscription, or sign an order form that refers to them. If you accept on behalf of an organisation, you confirm that you have the authority to bind it.

1.3 Our data processing agreement forms part of these terms. If you sign a separate order form or quote, its specific terms (such as price, team size or payment terms) apply where they differ from these terms.

1.4 Underwing is for organisations. It is not sold to individuals for personal use.

2. Words we use

• Manager: a person at the client who has a manager account, as an owner or an admin.
• Learner: a person the client enrols to receive the programme.
• Programme: the security awareness training we provide: video lessons, quizzes, challenges, scam alerts, reports and certificates.
• Band: the team size your subscription covers.
• Results: a learner's completion record and scores by field mark.

3. Accounts and roles

3.1 Owners and admins. The person who signs up becomes the owner. Owners can add admins, manage billing and close the account. Admins can manage learners and see results.

3.2 Signing in. Managers sign in with an email link plus a passkey on their phone or computer. Two-factor authentication is mandatory because managers can see sensitive results. There are no passwords.

3.3 Keeping accounts secure. Each manager account is for one named person. Don't share it. Tell us at security@underwing.co.za straight away if you think someone else has used it.

3.4 Learners. Learners don't have passwords. They open lessons through short-lived personal links. You may enrol only your own employees, contractors or volunteers, or other people you are authorised to train.

3.5 Accurate details. Keep your organisation, billing and manager details up to date.

4. The service

4.1 What you get. A subscription includes twelve training modules a year (three starter modules in the first fortnight, then one module a month). Each module includes a video lesson and quiz, a short challenge, a written briefing and a summary card. The subscription also includes scam alerts, a manager dashboard, monthly reports, certificates of completion and an evidence export.

4.2 Content changes. We may update, replace or reorder lessons and other content to keep them current and accurate. We won't reduce the overall programme you have paid for during a paid period.

4.3 Certificates. A certificate of completion records that a learner completed the programme. It is not an accreditation, qualification or professional certification.

4.4 Emails. The programme is delivered mainly by email. We give you a one-page guide for your IT team so our emails reach inboxes. We aren't responsible for emails your own systems block or filter.

5. The free Team Spot Check

5.1 Each organisation may run one free Team Spot Check, for up to 30 people.

5.2 You may invite only addresses on your organisation's verified email domain. Teams on free email services get tighter limits and a manual check.

5.3 These terms, including the data processing agreement and the rules on how results may be used, apply to the Spot Check.

5.4 We may refuse, limit or stop a Spot Check that looks like abuse, for example an attempt to send email to people outside your organisation.

6. Subscriptions and bands

6.1 You pay one flat fee for your whole team, based on the band:

Band	Monthly	Yearly
Up to 25 people	R1,500	R15,000
Up to 50 people	R2,750	R27,500
Up to 100 people	R5,000	R50,000
More than 100 people	Quoted	Quoted

6.2 The yearly price is ten times the monthly price.

6.3 Prices are in rand. VAT is added only if and when Underwing is registered for VAT. If that happens, we'll give you at least 30 days' notice, as for any price change in clause 9.

6.4 Counting people. Your band covers the number of learners enrolled at the same time. Removing a learner frees up their place. To enrol more people than your band allows, move to a larger band first.

6.5 Moving up a band takes effect immediately. We charge the difference for the rest of the current billing period to your saved card, and the new band's price applies from your next renewal.

6.6 Moving down a band takes effect at your next renewal. You must reduce your learners to the new band's limit by then.

7. Billing and payment

7.1 Card payments. Self-serve subscriptions are paid by card through Paystack. By subscribing, you authorise us, through Paystack, to charge your card at the start of each billing period until you cancel. Paystack handles your card details. We never see or store your card number.

7.2 Invoiced clients. Organisations with a quote or order form may pay by invoice and EFT on the payment terms agreed in writing. If no terms are agreed, invoices are due within 30 days.

7.3 Our banking details never change by email. If you receive a message saying our banking details have changed, don't pay. Call us on the number you already have for us, or email hello@underwing.co.za, and check.

7.4 Failed payments. If a renewal payment fails, we'll email you a link to update your card and try again. If payment hasn't been made 7 days after the renewal date, we may pause access until it is.

7.5 Invoices. You can download invoices from your account.

8. Renewal and cancellation

8.1 Renewal. Monthly subscriptions renew each month and yearly subscriptions renew each year, on the same date, until you cancel.

8.2 Monthly plans can be cancelled at any time in your account. Cancellation takes effect at the end of the period you have paid for, and you keep access until then.

8.3 Yearly plans run for the year you have paid for. You can turn off renewal at any time, and the plan ends at the end of that year. Where the law gives you a right to end a fixed-term agreement early, we'll honour it.

8.4 Refunds. We don't refund partial months or unused periods, except where the law requires it.

8.5 Your statutory rights. Nothing in these terms takes away any right you have under the Consumer Protection Act or the Electronic Communications and Transactions Act, where those Acts apply to you.

8.6 Pausing. Instead of cancelling, an owner can ask us by email to pause a subscription for up to three months. Learners don't receive new lessons while it is paused.

9. Price changes

9.1 We may change our prices by giving you at least 30 days' written notice by email.

9.2 A new price applies from your first renewal after the notice period ends. For yearly plans, that means your next yearly renewal. If you don't accept the new price, you can cancel before it applies.

9.3 Prices agreed in a signed quote or order form apply for the term stated there.

10. Your responsibilities

10.1 Tell your people. Before enrolling anyone, tell them about the programme: what it is, what information it uses, and what managers can see. We provide wording you can use, and we also tell each learner directly in their welcome email.

10.2 Lawful basis. You are the responsible party for your people's personal information under POPIA. You must have a lawful basis to enrol them and to give us their details.

10.3 Lawful instructions. Your instructions to us about personal information must comply with the law.

10.4 Results are for learning, never discipline. See clause 11.

10.5 Manager access. Give manager access only to people who need it, and remove it when they leave or change role.

11. How results may be used

11.1 The programme exists to help people learn. Scams are designed to work on smart people, and people learn faster when they aren't afraid of being caught out.

11.2 You must not use any individual's results in disciplinary action, in performance reviews, or in decisions about pay, promotion or dismissal.

11.3 You may use results to decide who needs more support, to plan training, and as evidence that your organisation provides awareness training (for example, for an audit or a POPIA review).

11.4 The dashboard labels people as "needs support", never as "failed". We tell learners what managers can see. Every time a manager opens an individual's results, it is recorded in the audit log.

11.5 If you breach this clause, we may suspend manager access to individual results, or end the agreement under clause 20.

12. Acceptable use

You must not, and must not let anyone else:

• use Underwing, its content or its techniques to carry out real phishing, fraud, impersonation or any other attack;
• run simulated phishing or other simulated attacks through Underwing without the written authorisation described in clause 13;
• enrol people you are not authorised to train, or use the Spot Check to email people outside your organisation;
• try to get into another client's data, or into parts of the service you aren't authorised to use;
• probe, scan or test the security of the service, except under our vulnerability disclosure policy (report to security@underwing.co.za);
• interfere with the service, overload it, or get around rate limits or bot checks;
• copy, scrape or download content in bulk, or use it to train artificial intelligence models;
• impersonate Underwing, or send messages that look like they come from us;
• use the service in a way that breaks the law.

13. Add-ons

13.1 Live sessions, custom lessons, language versions, content licensing, the Voice Test and simulations are add-ons. Each needs a separate written order, and may have its own terms.

13.2 Simulations. We run simulated phishing or other simulated attacks only with the client's written authorisation, which sets out the scope, channels, dates and people involved. Staff are told in advance that simulations happen, and nobody is punished for a click. Simulations aren't available yet.

13.3 The Voice Test. A voice recording or clone is treated as special personal information (biometric). We record or clone a voice only with that person's explicit written consent for a stated purpose, and delete the recording and the clone on the same day.

14. Content and licence

14.1 Our content. Underwing, its lessons, quizzes, characters, the Field Guide, reports, designs and software belong to Underwing or its licensors.

14.2 Your licence. While your subscription is active, we give you a non-exclusive, non-transferable licence for your enrolled learners and managers to view and use the content for your organisation's internal training only.

14.3 No redistribution. You must not copy, download (other than through the offline viewing feature), publish, broadcast, share outside your organisation, resell, sublicense, edit or make new works from the content. Loading lessons into your own learning management system needs a separate content licence.

14.4 Your data. You own the information you give us about your organisation and your people. You give us permission to use it to provide the service, as set out in the data processing agreement.

14.5 Anonymised benchmarks. We may combine results across clients into anonymised statistics that don't identify any person or organisation, and use them to provide benchmarks and improve the programme. We are the responsible party for these benchmarks.

14.6 Feedback. If you send us suggestions, we may use them without owing you anything.

14.7 Names and logos. Neither of us may use the other's name or logo in marketing without written permission.

15. Availability and support

15.1 We aim to keep Underwing available at all times, but we don't guarantee uninterrupted or error-free service. We may need to take it down for maintenance, which we'll schedule outside South African business hours where we can.

15.2 We tell owners by email about planned maintenance that may affect them, and about any major incident.

15.3 Support is by email at hello@underwing.co.za during South African business hours. We aim to reply within one business day.

16. Data protection

16.1 For your learners' and Spot Check participants' personal information, you are the responsible party and Underwing is your operator under POPIA sections 20 and 21. Our data processing agreement sets out how we process it, including security measures, sub-processors, breach notification and deletion.

16.2 Underwing is the responsible party for managers' account and billing information, its own marketing, and anonymised benchmarks. Our privacy policy explains how we handle them.

16.3 Personal information is stored in South Africa.

17. Confidentiality

17.1 Each of us will keep the other's confidential information confidential, use it only for this agreement, and share it only with people who need it and are bound by similar duties.

17.2 Confidential information includes your results and reports, our security documents, and any non-public pricing.

17.3 This doesn't apply to information that is public through no fault of the receiver, was already known to the receiver, is independently developed, or must be disclosed by law. Where the law requires disclosure, the receiver will give notice first if it is allowed to.

17.4 These duties continue for 3 years after the agreement ends, and indefinitely for personal information and security information.

18. Warranties and disclaimers

18.1 We will provide the service with reasonable care and skill.

18.2 Underwing is awareness training. It aims to change how people respond to scams. It isn't a technical security service, and it doesn't replace your own security controls, policies, payment approvals or professional advice.

18.3 No guaranteed outcome. We don't guarantee that your organisation or your people won't be scammed, defrauded or breached, or that any particular result will be achieved.

18.4 Scam alerts and Field Notes describe threats as we understand them at the time. Scams change quickly, so check anything important through official channels.

18.5 Except as set out in these terms, and to the extent the law allows, the service is provided without other warranties, express or implied.

19. Liability

19.1 To the extent the law allows, our total liability to you under or in connection with this agreement, however it arises, is limited to the fees you paid us in the 12 months before the event that gave rise to the claim.

19.2 To the extent the law allows, neither of us is liable for indirect or consequential loss, or for loss of profit, revenue, business or goodwill.

19.3 We are not liable for losses caused by a scam, fraud or attack on your organisation or your people, unless our breach of this agreement caused that loss.

19.4 Nothing in these terms limits liability for fraud, for gross negligence or wilful misconduct, or for anything else that can't be limited by law.

19.5 You are responsible for, and will compensate us for reasonable losses arising from, enrolling people unlawfully or using results in breach of clause 11.

20. Suspension and termination

20.1 By you. You can cancel as set out in clause 8.

20.2 By us, with notice. We may end a subscription by giving you at least 30 days' written notice. If we do, we'll refund any fees you have paid for the period after it ends.

20.3 For breach. Either of us may end the agreement by written notice if the other materially breaches it and doesn't fix the breach within 14 days of being asked to.

20.4 Suspension. We may suspend access straight away, in whole or in part, if we reasonably believe it is needed to stop a security threat, a breach of clause 12, or harm to learners or other clients. We'll tell you why and restore access as soon as the problem is resolved.

20.5 Non-payment. We may pause access as set out in clause 7.4, and end the agreement if payment is still outstanding 30 days after the due date.

21. When the agreement ends

21.1 Learners stop receiving lessons and lose access to the library.

21.2 Before the end date, managers can download completion records and certificates using the evidence export.

21.3 We delete learner information within 90 days after the contract ends, as set out in the data processing agreement. We may keep anonymised aggregates.

21.4 We keep billing records for 5 years, as tax law requires, and audit logs for 2 years.

21.5 Clauses that by their nature should continue (including 11, 14, 17, 18, 19 and 22) continue after the agreement ends.

22. Governing law and disputes

22.1 These terms are governed by the law of the Republic of South Africa.

22.2 If there is a dispute, we'll both first try in good faith to resolve it by talking. Either of us may start the process by written notice.

22.3 If it isn't resolved within 20 business days, either of us may take it to the High Court of South Africa, Gauteng Division, Johannesburg, and we both submit to that court's jurisdiction.

23. Changes to these terms

23.1 We may update these terms. We'll give you at least 30 days' notice by email of any change that materially affects you, and the new terms apply from your next renewal after that period.

23.2 Changes needed to comply with the law, or to address a security risk, may apply sooner. We'll tell you why.

23.3 The date at the top shows when these terms last changed.

24. General

24.1 Notices. We send notices to the owner's email address. You send notices to hello@underwing.co.za, or to privacy@underwing.co.za for data protection matters.

24.2 Whole agreement. These terms, the data processing agreement and any signed order form are the whole agreement between us about Underwing.

24.3 Transfer. You may not transfer this agreement without our written consent. We may transfer it to a company that takes over Underwing, including a separate Underwing entity, if we give you notice and the data processing agreement continues on the same terms.

24.4 Events beyond control. Neither of us is liable for a delay or failure caused by events beyond reasonable control, such as a major outage at a supplier, extended power or network failure, or natural disaster. Payment obligations still apply.

24.5 Severability. If a court finds any part of these terms invalid, the rest still applies.

24.6 No waiver. If we don't enforce a right straight away, we haven't given it up.

24.7 Relaxations. A favour or extension we give you once doesn't change these terms.

25. Supplier information

As required by section 43 of the Electronic Communications and Transactions Act:

• Full name and legal status: Under Bridges Entity (Pty) Ltd, trading as Underwing, a private company
• Registration number: 2016/469951/07
• Directors: P.J. Mbedzi and K.M. Mbedzi
• Physical address (and address for service of legal documents): 127 East Road, 47 3rd on East, Pomona, Kempton Park, South Africa
• Telephone: 071 095 0660
• Email: hello@underwing.co.za
• Website: underwing.co.za
• VAT: not registered for VAT
• Privacy policy: underwing.co.za/legal/privacy
• Payment security: card payments are processed by Paystack. Underwing does not receive or store card numbers.
• Complaints: hello@underwing.co.za