PHP upgrade service terms

The service and the orderDraft: clause awaiting legal review

ELASTO TECHNOLOGIES S.R.L. ("ELASTO", company details) provides two services under these terms: the emergency PHP patch and upgrade of one website ("the job"), and an optional monthly care plan. The client is the person or company that pays.

The order is placed on the Stripe checkout page, which shows the package, the price and the currency, links these terms, and asks for their acceptance before payment. The contract is formed when the payment succeeds and is governed by the version of these terms in force on that date. Before any work starts, ELASTO confirms the contract by email, with the text of these terms and the withdrawal information attached. ELASTO issues an invoice for every payment. One package covers one website on one domain.

Ownership and authority over the siteDraft: clause awaiting legal review

The person ordering the work confirms that they own the website and its hosting account, or hold the owner's authority to order changes and grant access. ELASTO may ask for proof, such as access through the hosting account registered to the owner, and declines the job without it, with a full refund.

If that confirmation proves false, the person who gave it answers for the resulting loss, including claims by the actual owner against ELASTO.

The free checkDraft: clause awaiting legal review

The free check reads only public responses: headers, page source and public file versions. It is informational; it is neither a security audit nor a penetration test. A server can carry fixes that its version number does not show, so a report states what the server advertises and makes no finding of compromise. Decisions taken on a report alone are the reader's own.

What the upgrade coversDraft: clause awaiting legal review

The job moves the site to a PHP version that upstream still supports, chosen by ELASTO for compatibility with the site, and fixes what that move breaks in WordPress, plugins and the theme. It does not make a site immune to attacks, and it does not guarantee that the site, its plugins or its host have no other weaknesses.

Before any change, ELASTO reviews the site. If it needs more than the paid package covers, for example a shop on a Basic package, custom code that has to be rewritten, or a host that offers no supported PHP version, ELASTO says so before starting. The client then chooses: move to the right package by paying the difference, or cancel with a full refund.

If the review finds signs that the site has been compromised, ELASTO stops and informs the client. Cleaning a compromised site is not part of the upgrade; it is quoted separately, and if the client declines, the fee is refunded in full.

The client's partDraft: clause awaiting legal review

Grant the access the job needs and keep it valid while ELASTO works on the site.
Give accurate information about the site, the host and any other provider working on it.
Supply the licences of paid plugins and themes, where an update needs them.
Make no changes to the site between the start of the job and go-live, unless agreed.

Delivery times run only while ELASTO has everything the job needs; time spent waiting for the client does not count. If the access the job needs has not arrived within 60 days of payment, either side may cancel, and ELASTO refunds the fee in full.

Delivery and warrantyDraft: clause awaiting legal review

A full backup of files and database is taken before any change.
The upgrade is done and tested on a staging copy first; an engineer reviews every change before the live site moves.
For 30 days after go-live, anything the upgrade breaks is fixed at no extra charge, once reported to ELASTO within that period. The job closes when this warranty ends, or on the day it is declined, cancelled or withdrawn from.
The warranty does not cover changes made by others after go-live, plugins or themes installed or updated later, faults of third-party software, or outages of the hosting provider.

Rollback and refundDraft: clause awaiting legal review

If the upgrade breaks the site and the fix is not possible within the warranty, the site is restored from the backup and the fee for the upgrade is refunded in full to the original payment method. Refunds are made within 14 days of the decision.

Express deliveryDraft: clause awaiting legal review

Express is an optional add-on to an upgrade. The 24 hours start when every access the job needs has been received, or on the start date the client chose at checkout if that is later, and pause while ELASTO waits for the client or for the client's choice after the scope review. If the upgrade is not live within those 24 hours, the Express fee is refunded; the upgrade price and the warranty are unaffected.

Care planDraft: clause awaiting legal review

The care plan is billed monthly in advance. It covers WordPress, plugin and theme updates, uptime and security monitoring, backups, and the upgrade when the site's PHP version next reaches end of support. Other work, such as new features, content changes or cleaning a compromised site, is quoted separately.

A monthly plan can be cancelled at any time; cancellation takes effect at the end of the paid month. With a 12-month plan the upgrade is included at no charge, and the plan has a minimum term of 12 months. If the client ends it earlier, the regular price of the upgrade package becomes due, less the amounts paid for the months after the first, and never below zero. This charge repays the included upgrade; it is not a penalty, and it never applies to a consumer's withdrawal within 14 days.

During a minimum term, the monthly price and these terms stay as agreed. Outside it, ELASTO may change the monthly price only to reflect changes in its costs or in the services included, with 30 days' notice by email; the client may cancel before the new price applies, without any charge. If a payment fails, ELASTO tells the client and may pause the plan until it is paid.

Outside a minimum term, ELASTO may end a plan with 30 days' notice. During a minimum term, ELASTO may end it only for non-payment after a reminder or a serious breach by the client.

Consumers: the right to withdrawDraft: clause awaiting legal review

A consumer, meaning a person buying outside their trade, business or profession, may withdraw from the contract within 14 days of the day it is formed, the day of payment, without giving a reason. The simplest way is the online function on this page: withdraw from the contract here. A clear statement sent to contact@elastoapps.com also works, and the EU model withdrawal form may be used but is not required. Every withdrawal is acknowledged by email without delay. ELASTO refunds every payment due within 14 days of the statement, to the original payment method, at no cost to the consumer.

At checkout, a consumer chooses when the work starts: as soon as access arrives, which is an express request to start within the 14 days, or after the 14 days. Access can be sent either way. Where the work started at the consumer's request:

once an upgrade bought on its own is fully done, the right to withdraw from it is lost, as the law provides;
if it is partly done, the consumer pays for the part done up to the withdrawal, in proportion to the total price, and the rest is refunded;
for a care plan, the included upgrade being done does not end the right to withdraw from the plan; the consumer pays only, in proportion to the total price of the plan, for what was provided up to the withdrawal.

Limitation of liabilityDraft: clause awaiting legal review

ELASTO's total liability for a job, in contract or otherwise, is capped at the regular price of its package, also when the upgrade is included in a care plan. For the care plan it is capped at the greater of that price and the fees paid in the 12 months before the event. ELASTO is not liable for indirect loss, lost profit or lost revenue, nor for loss caused by the client's information, by third-party software or by the hosting provider. Where data is lost, ELASTO restores the most recent backup it took or the client provided.

These limits do not apply to harm to life, body or health, to loss caused by intent or gross negligence, or wherever the law does not allow a limit. They do not restrict a consumer's remedies under the legal guarantee of conformity, such as repair, a price reduction or ending the contract with a refund, nor any other right that mandatory law gives consumers.

Access, credentials and backupsDraft: clause awaiting legal review

Credentials are exchanged only through the encrypted form, a collaborator invite or a call, never by plain email, and are used only for the job. They are deleted when the work no longer needs them, and at the latest 30 days after they were received; warranty fixes after that may need access again. Changing the passwords after the job is recommended.

Staging copies are deleted when the job closes. The backup is kept until the job closes, or for as long as a care plan runs, and then deleted.

Personal data on the client's siteDraft: clause awaiting legal review

Where a site holds personal data, the client is the controller and ELASTO acts as processor under Article 28 GDPR. This section is the processing agreement between them; a separately signed agreement is available on request.

Subject and duration: the job or the care plan, for as long as it lasts and until deletion as described below.
Nature and purpose: copying, testing, upgrading and backing up the site, only to carry out the job or the plan.
Data and people: whatever the site stores, typically names, contact and delivery details, orders, form entries and user accounts of the site's customers, users and visitors.
Instructions: ELASTO processes the data only on the client's documented instructions, which these terms and the order record, and says so at once if it considers an instruction unlawful.
Confidentiality and security: everyone who works on the job is bound to confidentiality; the measures in this page apply (encrypted credentials, staging copies and backups deleted on schedule, access only for the people doing the work), and the data stays in the EU or under the safeguards of Chapter V GDPR.
Sub-processors: hosting and storage providers, under the same obligations, with the client's general authorisation. ELASTO emails the client before adding or replacing one; the client may object, and if the objection cannot be resolved, may end the job or the plan with a refund of what was not yet provided.
Assistance: ELASTO helps the client answer data subject requests and meet Articles 32 to 36, and reports a personal data breach without undue delay.
End: when the job closes or the plan ends, ELASTO deletes the data, or returns it if the client asks and then deletes its remaining copies, including those held by sub-processors, unless the law requires keeping them; backups follow the schedule above.
Audits: ELASTO gives the client the information needed to show compliance and allows audits and inspections by the client or an auditor it mandates, on reasonable notice.

Data about the client as a customer of ELASTO is covered by the privacy notice.

Tools, ownership and confidentialityDraft: clause awaiting legal review

ELASTO may use subcontractors and software tools, including automated ones, to do the work, and remains responsible for them. The client keeps every right in the site; the changes made for the job belong to the client once paid. ELASTO keeps its general know-how and tooling.

Both sides keep the other's non-public information confidential. ELASTO names a client or shows its site as a case study only with the client's written consent.

Changes, notices and languageDraft: clause awaiting legal review

An order is governed by the terms in force on the date of payment. ELASTO may change these terms only to follow a change in the law, a security need or a change in the services offered. For a running care plan, a change applies from the first billing month that starts at least 30 days after ELASTO emails it, never to the client's detriment during a minimum term; the client may cancel before it applies, without any charge.

Notices go by email: to the address given at checkout, and to ELASTO at the address below. Neither side answers for a delay caused by events beyond its reasonable control, such as a hosting provider outage, for as long as the event lasts. If a clause is held invalid, the rest stays in force. The English and Romanian versions have the same value; for clients in Romania, the Romanian version prevails.

Complaints, governing law and courtsDraft: clause awaiting legal review

Complaints go to contact@elastoapps.com and are answered in writing. Consumers may also turn to the Romanian consumer protection authority, ANPC, and its alternative dispute resolution service.

Romanian law applies. Disputes with business clients go to the competent courts of Cluj-Napoca. Consumers keep the protection of the mandatory law and the courts of the country where they live.

Clauses accepted expresslyDraft: clause awaiting legal review

On the checkout page, before payment and before any access is given, the client confirms the authority over the site and accepts these terms, and expressly the following clauses, in the sense of article 1203 of the Romanian Civil Code:

the limitation of liability and the limits of the warranty;
ELASTO's right to decline or stop the job, with a full refund;
the charge on early exit from a 12-month care plan, and ELASTO's rights to pause a plan for non-payment, to change its price and to end it in the cases set out there;
ELASTO's right to change these terms in the cases and with the notice set out there;
the liability for a false confirmation of authority;
the choice of the courts of Cluj-Napoca for business clients.

ELASTO keeps the record of that acceptance, and of the consumer's choice of when the work starts, for as long as claims under the contract can be brought.