Terms of Service

Last updated 27 October 2026. These terms govern your use of the Basal Systems website and are the starting point of any engagement with Basal Systems Limited (“Basal Systems”, “we”, “us”), a company registered in Kenya and based in Mombasa. Our full company details appear in each proposal and agreement. By using this site you accept these terms.

1. Using this website

You may use this site for lawful purposes only. Content here is general information about our services and is not a binding offer or professional advice. You must not disrupt the site, probe or scan it for vulnerabilities without our written permission, attempt unauthorised access, or use it in breach of the Computer Misuse and Cybercrimes Act, 2018.

The site, its text, design and code are owned by Basal Systems or our licensors. You may view and share links to it, but may not copy or reuse it commercially without our written consent.

We try to keep the site accurate and available but provide it as is, without warranty. We are not liable for loss arising from your use of it, except where the law does not allow us to exclude liability. Links to other sites are provided for convenience and we do not control or endorse them.

2. How engagements work

Each project runs through Audit, Design, Build and Handover. Work is governed by a written proposal or agreement (the “Agreement”) that sets out scope, deliverables, fixed phased pricing in KES, timeline, acceptance criteria and any support terms. You may stop after any phase.

A Starter Website is the exception. It is delivered as a single fixed-price phase with no Audit stage, invoiced 50% at the start and 50% on delivery, and the rest of these terms apply to it as they apply to any other phase.

These terms apply to every engagement unless the Agreement says otherwise. Where these terms and a signed Agreement differ, the signed Agreement prevails.

Changes to scope are agreed in writing, with any effect on price and timeline, before the changed work begins.

You will give us timely access to the systems, information and people we reasonably need, and you confirm that the information you give us is accurate. Delays caused by missing access or late feedback may move dates and, where they add work, fees.

The engineers who scope your work deliver it. We do not subcontract delivery to third parties without your prior written consent.

3. Acceptance

When we deliver a phase, you have 10 business days to review it against the agreed acceptance criteria and tell us in writing about any material non-conformity. We will correct genuine non-conformities within a reasonable time. If you do not respond, or you use the deliverable in production, the phase is treated as accepted.

4. Fees and payment

Fees are fixed per phase in Kenya shillings, as stated in your Agreement, with no hourly billing. Value added tax and any other applicable taxes are charged in addition unless the Agreement says the price includes them. If you must withhold tax, you will account for it in line with the law and send us the withholding certificate.

Unless your Agreement says otherwise, we invoice 50% at the start of each phase and 50% on delivery. Invoices are payable within 14 days. Pre-agreed third-party costs, such as cloud usage or licences, are charged at cost and only with your approval.

If an invoice is overdue, we may charge interest at 1.5% per month on the unpaid amount and, after written notice, pause work until the account is current. We are not responsible for delays caused by a pause for non-payment.

5. Intellectual property and handover

On full payment for a phase, you own the bespoke code, documents and configuration we create for you in that phase (the “Deliverables”). Until then you have a licence to use them for the agreed purpose.

We keep ownership of our pre-existing tools, libraries, templates and know-how (“Background IP”) and of general skills and techniques we develop. Where Background IP is built into a Deliverable, we grant you a perpetual, non-exclusive, royalty-free licence to use it as part of that Deliverable.

Third-party and open-source components stay under their own licences, which we will identify in the handover. Handover includes runbooks and documented reasoning for key decisions, and we do not create lock-in.

We will not use your name or logo, or describe your project publicly, without your written permission.

6. Confidentiality

Each party will keep the other’s confidential information private, use it only for the engagement, and disclose it only to people who need it and are bound to the same duty, or where the law requires. This does not cover information that is public through no fault of the recipient, was already known to it, or is independently developed. These duties continue for five years after the engagement ends, and indefinitely for security findings, credentials and system architecture.

Security findings are reported only to you and kept private.

7. Personal data

If we process personal data on your behalf, you are the data controller and we are the data processor. We will do so only on your documented instructions, keep it secure, tell you without undue delay if we become aware of a breach affecting it, and sign a data processing agreement on request, in line with the Data Protection Act, 2019.

8. Security testing

Pentesting and similar work is carried out only on systems you own or are authorised to test, under written authorisation and an agreed scope and rules of engagement. You confirm that you have the authority to give this permission, including from any third-party host or cloud provider whose terms require it.

Testing can cause disruption, slow systems or expose data. You are responsible for backups and for choosing testing windows with us, and we will take reasonable care to limit impact. Testing cannot prove a system is free of vulnerabilities, and we do not guarantee that every weakness will be found.

Work done within the agreed scope and authorisation is not a breach of these terms by us. We will stop testing at your written request.

9. Compliance preparation

We help you prepare for standards and laws such as ISO 27001, SOC 2, PCI-DSS, the GDPR and the Kenya Data Protection Act. We do not issue certifications or legal opinions. Whether you pass an audit or are compliant is decided by the certifying body, auditor or regulator, and we do not guarantee any result.

10. Warranties

We deliver services with reasonable skill and care. For 30 days after acceptance of a phase, we will fix defects in the Deliverables that do not meet the agreed specification, at no extra charge. This is your remedy for such defects.

Apart from this, and to the extent the law allows, we give no other warranties, including that the Deliverables will be uninterrupted or error free, or that third-party components will remain available. Support after launch (monitoring, iteration, advice) is provided only if the Agreement says so.

11. Liability

To the extent the law allows, we are not liable for indirect or consequential loss, or for loss of profit, revenue, data or goodwill. Our total liability for all claims arising from an Agreement is limited to the fees paid or payable for the phase to which the claim relates, unless your Agreement states otherwise.

Nothing in these terms limits liability that cannot be limited by law, including for fraud, wilful misconduct, or death or personal injury caused by negligence.

12. Ending an engagement

You may stop after any phase, as set out in your Agreement, by telling us in writing. Either of us may end an Agreement by written notice if the other materially breaches it and does not fix the breach within 14 days of notice, or becomes insolvent.

On ending, you pay for work done and agreed costs incurred up to that date, we hand over the Deliverables completed so far (subject to payment), and each of us returns or deletes the other’s confidential information on request. Clauses that by their nature should continue, including payment, intellectual property, confidentiality, liability and governing law, continue after the engagement ends.

13. Events beyond our control

Neither of us is liable for delay or failure caused by events beyond reasonable control, such as natural disaster, power or internet outage, government action, or failure of a third-party provider. This does not excuse payment obligations. If the event lasts more than 60 days, either of us may end the affected work.

14. General

Notices must be in writing and sent to the email address in the Agreement (or hello@basalsys.com for us). Neither of us may assign an Agreement without the other’s written consent, except that we may assign it to a successor to our business. If a provision is found unenforceable, the rest continues. A delay in enforcing a right is not a waiver of it. The Agreement and these terms are the whole agreement and replace earlier discussions and proposals. Only people who sign an Agreement may enforce it.

15. Governing law and disputes

These terms and any Agreement are governed by the laws of Kenya. We will first try to settle a dispute by good-faith discussion for 30 days after written notice. If that fails, the dispute will be finally resolved by arbitration under the rules of the Nairobi Centre for International Arbitration, seated in Nairobi, in English, before one arbitrator. Either of us may go to the Kenyan courts for urgent interim relief or to enforce an arbitral award or intellectual property or confidentiality rights.

16. Changes to these terms

We may update these terms and will change the date above when we do. Changes do not affect an Agreement already signed.