Terms of Service

Website use, accounts and purchases

These Terms of Service cover use of this website, its free SSL tools and customer accounts, as well as purchases from us. Website-use rules apply to visitors even without an account or order; payment, delivery and cancellation obligations apply when you purchase. Please read the relevant sections before using the site or placing an order. The Acceptable Use section sets out prohibited activity and reporting routes. The Privacy & Cookie Policy explains data handling and browser storage; it does not turn browsing into marketing or optional-cookie consent.

Consumers and business customers

A "consumer" is an individual buying wholly or mainly outside their trade, business, craft or profession; a "business customer" is anyone else, including a person buying for a company, organisation or client. Consumer-protection wording in these terms applies to consumers. Where a clause applies only to business customers it says so. If you buy for an organisation you confirm that you are authorised to accept these terms on its behalf. Nothing in these terms limits rights that the law does not allow us to limit.

Purchasers in EU countries

We accept purchases from EU countries only from businesses buying exclusively for their business activities and providing their own EU VAT number valid in VIES. EU consumer purchases are not accepted. This restriction follows our tax position rather than a customer’s nationality or residence: we are established outside the EU and account for EU tax only through the business reverse charge, which requires a VAT number we can verify, and we are not registered to account for consumer VAT in the Member States. We keep that position under review. A VAT number or business label alone does not remove any mandatory consumer rights that actually apply. Provide the purchasing entity’s accurate legal name, establishment receiving the service, billing address and VAT number; these may differ from the certificate holder’s details. We verify the VAT number through VIES before payment and compare available business and payment-location evidence. Unconfirmed, inconsistent or unavailable verification prevents purchase. A successful check is not a guarantee of VAT exemption or of any particular tax treatment.

Using the website and free tools

Use the website and tools only for lawful purposes and systems you own or are authorised to manage. Follow the Acceptable Use section; do not bypass access controls, overload the service or access another person’s information. Tool results are technical guidance at the time of the check, not a complete security audit, a guarantee of CA approval or a substitute for your own configuration checks. Save and protect private keys generated in your browser. Do not send private keys in orders, messages or support tickets. Only the dedicated certificate format converter accepts a key or PFX file when needed for your requested conversion, as explained in the Privacy & Cookie Policy. Never send account passwords or full card details. Links to third-party websites do not mean we control or endorse their content. Paid-service responsibilities and mandatory legal rights remain as stated below.

Your purchase agreement

Your order details and all sections of these Terms of Service form our purchase agreement, including SSL certificate services, delivery and validation, refunds and cancellation, acceptable use, complaints and the Data Processing Agreement where its scope applies. The complete terms are linked before payment and saved with your acceptance. The Privacy & Cookie Policy explains data processing; buying does not give separate marketing consent. The issuing CA’s agreement governs its certificate relationship with the Subscriber. Mandatory legal rights take priority over conflicting wording. Privacy choices are separate from this agreement and from any request to begin performance. Objecting to usage statistics or refusing advertising measurement does not affect your purchase.

Your order

You must be at least 18 and authorised to place the order. The Certificate Subscriber is the person or organisation for whom the certificate is requested; it may differ from the account holder. Checkout records the purchaser, the billing address used for the order and the purchase acceptance. During certificate setup, provide the domains, administrative and technical contacts, and any required organisation details; confirm that the request is accurate and that you are authorised to bind the Subscriber to the issuing CA’s agreement. Administrative or technical contacts may act for the Subscriber and are not automatically the certificate holder. You must have permission to use every domain and provide accurate contact and validation information.

When we accept an order

Your payment request is an offer to buy the items shown in your cart. We accept it when payment is verified and the resulting order is made available in your account. We also send an order confirmation and a copy of the accepted contract by email. A bank authorisation or Stripe receipt alone does not mean we have accepted an order or issued a certificate. If we cannot accept a paid order, we refund the payment without undue delay. This includes an obvious pricing or description error on the website or in the cart that you could reasonably have recognised as a mistake: we tell you before or promptly after payment, do not perform the order at the wrong price, and refund any payment in full unless you agree to the correct price. Issuance remains subject to the issuing CA’s checks.

How the contract is concluded online

Add a product to your cart, review the order and total, accept these Terms of Service and the named CA agreement, then complete payment on Stripe Checkout. Before payment, you can correct your entries, remove cart items or return from Stripe Checkout. Acceptance occurs as described above. We store the exact accepted terms and their version with your order; you can keep the order record from your account or the confirmation email attachment. Our contract is available in English and German. The version displayed and accepted in your chosen checkout language governs your order. Both versions are intended to have the same meaning; we will not rely on a different translation to reduce your rights. Any ambiguity in consumer terms is interpreted in the consumer’s favour. The CA’s separately identified agreement is supplied as an English original and governs its own relationship with the Subscriber.

Price and payment

Prices and payments are in USD. The total payable is shown before payment, including any tax we collect. Your bank may apply its own conversion or transaction charges. Only the domains and SAN allowance listed for your chosen product are included. Where a product offers additional names, each one is sold at the per-name price shown before you pay, either with the certificate or later for an issued certificate still in its service period; names bought later are a separate purchase and do not extend that service period. Once the certificate authority has added a name, its refund follows the rules for additional names under Refunds & Cancellation. Stripe processes payment on behalf of Solkrone Ltd. We do not receive or store your full card number or CVC.

Payment collection and eligibility checks

Stripe collects the card amount when you complete Checkout, and a Stripe receipt or invoice is issued for that collection. Our sale checks run after collection: we verify purchase eligibility and payment details, including the billing country, before the order is accepted and made available in your account. For example, a changed or missing billing country, conflicting EU location evidence, a VAT check that is no longer current, a changed VAT number or cart, an amount that does not match the order, a restriction on the account, a sales or payment pause, a card issued in a country the issuing CA may not serve under its sanctions rules, or a card issuer’s report that the payment is unauthorised can prevent acceptance. In that case we tell you why by email and refund the collected amount in full without undue delay. Where a card issuer has reported the payment, we refund it at once; other refunds are released after a manual review that checks the payment but does not withhold the refund. If our payment provider holds an accepted payment for a fraud review, your order is shown in your account but its setup opens only once the review is cleared; if the review ends in a refund, the order is cancelled. Where our payment configuration instead only authorises the amount first, we collect it only after those checks, no Stripe invoice is issued for a cancelled authorisation, and the card issuer determines when the hold is released.

Support and service improvement

We may process support correspondence and other information you provide to handle your enquiry and improve our own customer experience, including the limited AI-assisted activities described in the Privacy & Cookie Policy. This may involve selected external AI services receiving limited, prepared content under the safeguards explained there. This is not an unrestricted licence over your information or a change to the purposes and instructions governing data processed under the DPA.

A plan, not a single year-long certificate

The sale is a 1-year certificate service plan. Individual certificates have shorter validity under CA and browser rules. You must complete required validation and install replacements during the plan. The service period and each certificate’s expiry are shown separately in your account. For new purchases, submit a valid CSR and the required validation details within 12 calendar months of payment so that the application enters validation. The deadline falls at 23:59:59 UTC on the corresponding calendar date. If that date does not exist, the last day of that month applies. Opening setup alone does not meet this deadline. The service period starts after setup, not at payment. The deadline shown in your account and in our reminder emails is the one accepted for your order or a later extension. This deadline does not shorten validation already in progress or the purchased service period. If no application is in validation when the deadline passes, the order expires: the plan ends without a certificate and is not refunded, except where the law requires it. Contact support before the deadline if you cannot proceed in time: we may extend it, and we do so where our own interruption prevented activation. Statutory rights that the law does not allow us to limit remain unaffected.

Renewals and promotions

Automatic renewal is off. We do not charge your card for another period without a new purchase. A manual renewal is a separate order at the price you approve. You can renew an issued certificate from your account during the last 30 days of its service period, while we still sell the product; once the service period has ended, you can buy a new plan instead. No continuing discount is implied. Any promotion must state its eligibility, duration and price before you use it; absent a stated promotion, the displayed price applies. Discount codes and reduced prices. One discount code can be used per order, and only while you are signed in. A code cannot be exchanged for cash or credit, and its conditions (what it takes off, any minimum order, its validity period and how often it can be used) are shown before you pay; it may take less off a certificate that cannot be sold for less. We may offer a lower price to customers we invite to a customer group; the price that applies to you is shown before you buy, and only one reduced price applies to an item at a time. Where a reduced price is shown beside a struck-through price, the crossed-out amount is the regular catalogue price of the displayed offer for the same service term and domain capacity. A refund returns the amount you actually paid.

Our service and your account

We will provide our service with reasonable care and skill. Keep account and contact details current, protect your login, and tell us promptly about suspected unauthorised access. Only give instructions you are authorised to give for the named Subscriber. We may request reasonable identity or authority checks before changing access or acting on sensitive instructions. Support covers the purchase and certificate workflow; hosting, server administration and managed installation are not included unless separately agreed in writing.

When we may restrict or end service

We may restrict account access, refuse new orders, pause affected processing or terminate affected services where there are reasonable, evidence-based grounds to suspect account or key compromise, fraudulent or unauthorised payment, materially false validation information, or a serious or repeated breach of these terms. This includes deliberate exploitation of refund or promotion rules, repeated orders or reissues intended to consume resources without legitimate certificate use, evasion of an earlier restriction, attacks, threats or other prohibited conduct causing or threatening material harm to us, other customers or third parties. We may also act where necessary identity or authority checks are refused, or where law, a binding authority instruction or applicable CA rules require it. A customer being unprofitable, ordinary use within the purchased service, criticism, a genuine refund request or a good-faith payment dispute is not by itself a ground for termination.

Notice, correction and review

For a remediable issue, we normally explain the problem and allow a reasonable opportunity to correct it. We may act immediately where delay would expose others to phishing, malware, compromised credentials, payment fraud or another serious security risk, or where the law requires action. Where lawful, we explain the reason, affected services and next steps as soon as practicable. We review temporary restrictions and lift them when their grounds are resolved; serious, repeated or unremedied breaches may lead to closure.

What a restriction means

Restricted access can prevent new orders, setup or reissues; it is not by itself certificate revocation. Revocation is carried out by the CA: it may revoke under its own rules, and we may ask it to revoke where the payment for an order is reported unauthorised or charged back, or where these terms are otherwise seriously breached. Either route can interrupt secure connections, so remove a revoked certificate from your systems. Where we ask for revocation because a card issuer reported the payment as unauthorised, we refund the order in full and tell you, so you are not left both out of pocket and without an explanation; a charged-back payment has already been returned to you through your bank. Contact support@zuperssl.com to challenge a decision or obtain available order records through an identity-checked route if you cannot sign in. We limit restrictions to what is reasonably necessary and consider unaffected orders separately. Refunds and statutory remedies are assessed under the Refunds & Cancellation section.

Pausing new orders and payments

We may temporarily stop accepting new orders or initiating new payments, across the shop or for affected products, payment methods or territories, for maintenance, security incidents, suspected fraud, payment-provider or CA outages, supply or capacity problems, or legal and compliance requirements. We may decline an offer before acceptance on those grounds. Where practicable, we explain the interruption and review when sales can resume. This does not change already accepted prices, erase paid orders or suspend refunds, complaints or statutory rights. A payment already initiated with the payment provider may still settle; we reconcile it and either honour an accepted order or refund a payment for an order we cannot accept. Disruption to an existing paid service is handled under the service-interruption and refund provisions, not treated as permission to retain payment without supplying the service.

Closing your account

You may ask support@zuperssl.com to close your account. We first explain how any active orders and certificates will be handled. Closing an account does not itself request revocation or erase records that must be kept for legal obligations or unresolved matters. Tell us separately if you want to cancel an order or revoke a certificate. Valid cancellation rights, accrued payment obligations and provisions needed to resolve existing disputes continue after closure.

Problems, cancellation and responsibility

The Refunds & Cancellation section explains the 14-day commercial refund window and other remedies. Nothing in these terms excludes or limits liability for fraud or fraudulent misrepresentation, intentional misconduct or gross negligence, death or personal injury caused by negligence, or any other liability that cannot lawfully be excluded or limited. Consumer statutory rights, including rights concerning services and digital content, remain intact. We remain responsible to consumers for foreseeable loss caused by our breach; a loss is foreseeable if it is an obvious consequence or we and you contemplated it when making the contract. We do not accept responsibility for loss caused solely by your failure to protect keys, complete validation or install certificates, or by an unrelated third party, where we have met our own obligations. A CA’s warranty is separate and does not replace our duties as seller.

Business liability and misuse claims

For business customers only, subject to the exclusions from limitation above, our liability for ordinary negligence is limited to loss that was reasonably foreseeable and typical for the certificate service when the contract was made. We are not liable for indirect or consequential business loss outside that scope. For business customers only, our total liability for all claims arising out of or in connection with these terms, the website or our services is limited in aggregate to the amount that business paid us in the twelve months before the event giving rise to the claim. Where that amount is nil, including where the business has used only the free tools or the website, our total liability to it is limited to USD 50. The free tools are supplied without charge and without a warranty that they are accurate, uninterrupted or fit for any particular purpose. Neither limit applies to the liabilities excluded from limitation above or to consumers. Responsibility for an essential obligation needed to provide the contracted service is not excluded; for such an obligation our liability for ordinary negligence is limited to the loss that was reasonably foreseeable and typical for the certificate service when the contract was made. A business customer is responsible for reasonable, documented direct losses, third-party claims, the reasonable legal and investigation costs of defending such a claim, and amounts an issuing CA or our upstream supplier charges or recovers from us, caused by the business customer's deliberate or negligent provision of false validation information, unauthorised certificate requests or other material misuse. We must take reasonable steps to mitigate loss, promptly notify you of a claim and allow you to participate in its defence. You are not responsible for loss caused by our own breach or negligence, or for a settlement made without your reasonable consent. No automatic penalty, unlimited indemnity or duplicate recovery applies; you may dispute liability and the amount claimed.

Service interruptions and events beyond our control

Maintenance, network failures, CA incidents or legal restrictions may affect availability. We do not promise an uptime service level unless separately agreed. We take reasonable steps to reduce disruption and inform affected customers about material delays and available options. An interruption is not an unlimited extension of time to perform. If a material delay cannot be resolved within a reasonable time, you may contact us to end the affected service and receive the refund due for the unprovided service; further statutory remedies remain available. If an event beyond our reasonable control prevents us from supplying the affected service for more than 60 days in total, either of us may end that service by notice on a durable medium, and we refund the amount due for the service not provided. Ending a service on that ground does not affect a claim either of us already has or any further statutory remedy. Where our interruption prevents activation, contact support and we extend the setup deadline rather than treat it as your failure. This does not excuse our own failure to use reasonable care and skill or transfer our seller obligations to the CA.

Website materials and general provisions

Our website content, software and branding belong to us or their respective owners. You may use them to evaluate and manage legitimate purchases, but may not copy them to impersonate us or claim an unauthorised affiliation. Third-party certificate and seal licences remain governed by their own terms. These Terms of Service, your order details and the named CA agreement are the entire agreement for your purchase; this does not exclude liability for fraud or limit statutory rights, and pre-contract information required by law forms part of the contract. Only you and we can enforce these terms; no third party has rights under the Contracts (Rights of Third Parties) Act 1999. We may transfer our rights and obligations in a reorganisation or business sale only if the transfer preserves your contractual rights and service. We will identify the new contracting company and give advance notice on a durable medium. Consumers may end the affected contract before the transfer without penalty and receive any refund due for unprovided service. You may transfer contractual rights with our consent, which we will not unreasonably withhold; any separate CA eligibility checks still apply. If a provision is unenforceable, the remaining provisions continue where legally possible. A delay in enforcing a right does not by itself waive it; this does not override legal time limits.

Changes, applicable law and courts

We may update website-use rules for future use and explain material changes on the site or through appropriate account communication. The terms saved with your order govern that purchase. Updated sales terms apply to future orders; we do not rewrite your accepted copy. Mandatory CA security requirements or applicable law may require changes during a plan. We will explain material effects where practicable and discuss available alternatives and refund rights if we cannot continue the purchased service. These terms and any dispute or claim arising from them are governed by the laws of England and Wales. Consumers also keep the mandatory protections of the law of their country of residence and may bring a claim in the courts of England and Wales or of that country. For business customers, the courts of England and Wales have exclusive jurisdiction. Contacting us first is not a condition of exercising legal rights.

Our role and the issuing CA

Solkrone Ltd trading as zuperssl resells certificates from Certificate Authorities (CAs) through upstream digital certificate suppliers. We remain your seller; we do not issue certificates ourselves. By purchasing through our website, you also agree to the applicable issuing CA’s Subscriber Agreement or Certificate Terms of Use linked before payment. The product and checkout identify the brand and issuing CA. The CA makes validation, issuance and revocation decisions; its agreement governs that separate certificate relationship.

What DV, OV and EV mean

DV checks domain control. OV also checks the organisation. EV adds the CA’s extended checks on the organisation and applicant authority. These levels describe validation, not stronger encryption or a guarantee that a website is safe. Browser address bars do not promise to display an organisation name.

Validation and the certificate plan

You must complete domain control validation and any organisation checks requested by the CA. Published issuance times are estimates after correct information is supplied, not deadlines or guarantees. The CA may ask for documents, decline an application or require fresh validation. Current CA/browser rules limit each issued certificate’s technical lifetime; a 1-year plan includes eligible free reissues within its service period. You must request each reissue, complete any required validation, and download and install the new certificate before the old one expires. Reissue is not automatic, does not extend the plan and does not guarantee uninterrupted coverage. No managed installation or ACME integration is included unless expressly listed.

Keys, CSR and certificate checks

You are responsible for protecting your private keys and any copies you download or receive. During setup, you can authorise us to generate a key and CSR for your order or provide a CSR generated on a system you control. If you provide your own CSR, submit the CSR, not the private key; we do not receive or store that matching private key through this option. The separate format converter may process a key you choose to submit for conversion; its data handling is described in the Privacy & Cookie Policy. Do not put private keys, card details or passwords in support messages. After issuance, check the domain names and organisation details before installing. Tell us and the CA promptly about incorrect information or a lost or compromised key; stop using the affected certificate and request revocation. Use a new key where compromise is suspected.

Keys generated for your account

We generate and store a private key only after you expressly authorise that option during setup. You must have the Certificate Subscriber’s authority to give this instruction and ensure it is permitted by the applicable CA terms and your security policy. We store generated private keys encrypted on our server and associate each key with its order and matching CSR. You can download the CSR from your account and download a stored private key after entering your current account password. Earlier generated keys remain distinguishable from the key for a later CSR or reissue. Keep a protected backup and install only the key that matches your certificate. Availability follows the account and order retention criteria in the Privacy & Cookie Policy; it is not a promise of permanent backup. Your responsibility for your account, devices and exported copies does not limit our responsibility for the security of our own processing and service.

Optional private-key email

Email delivery is optional and is not selected in advance. Only if you separately request it and acknowledge the risks will we send a copy of a generated private key to the email address you specify. Check that the address belongs to you or a recipient authorised by the Certificate Subscriber. The .key attachment is not password-protected or end-to-end encrypted; mail providers and anyone with access to that mailbox may be able to read and copy it. Encryption of our stored copy does not protect the emailed copy. You are responsible for the address you provide, mailbox access and the protection of received or forwarded copies. You can leave this option unselected and download the key from your account instead. Our own legal and security obligations remain unchanged.

Changes in control and permitted use

Notify us and the CA promptly if domain control, Subscriber authority or material certificate information changes. Do not continue using a certificate for a domain you are no longer authorised to represent. A public website TLS certificate is not a general licence for code signing, document signing or other uses outside its product scope. Review compatibility with your server and clients; certificate purchase does not establish that your website meets every security or regulatory requirement.

Diagnostic tools and private keys

Our free tools (SSL checker, Why No Padlock?, CSR decoder, CSR and CAA record generators, certificate chain resolver and format converter) assist with certificate tasks; they are not a security audit or a guarantee of CA acceptance. Only check systems you own or have permission to test. Checker results describe the response observed at the time and may change. The browser CSR generator creates the private key locally; save it securely before leaving the page. We cannot recover that key. You remain responsible for protecting it and checking the generated CSR and installation, without limiting our responsibility for our own service.

Certificate Transparency

Public TLS certificates are submitted to public Certificate Transparency logs. Domain names and certificate subject information, including organisation details where present, can become public and remain in those logs. Revocation does not remove historical log entries. Do not request public certificates for names you need to keep confidential.

Reissue, renewal and revocation

A reissue replaces a certificate within the existing plan and does not extend the plan. Coverage changes depend on the product and CA; a reissue can carry only the names your plan and any names bought for it allow, and further names are a separate purchase where the product offers them. A renewal buys a new plan. A CA may revoke a certificate to address compromise, misissuance, inaccurate information or mandatory security rules. Reissue or revocation can require action on your server. Applicable refund rights are considered separately.

Warranty and site seals

A quoted warranty amount is a limit under the CA’s own warranty or relying-party agreement. It is not insurance against all website losses, a promise to the purchaser of that amount, or a guarantee from zuperssl. Eligibility, covered events, exclusions and claim procedures are set by the CA. A site seal is an optional CA badge governed by its usage terms; it does not increase encryption strength or guarantee conversions.

Document order

This section forms part of the Terms of Service. The CA agreement governs your obligations to the CA and mandatory PKI rules. Neither set of terms removes mandatory consumer protections. See the CA Agreements & Policies for the agreement, CP/CPS, warranty and privacy documents linked to each brand.

Electronic delivery

Solkrone Ltd trading as zuperssl supplies SSL/TLS certificates electronically. There is no physical shipment or shipping fee. Setup is available in your account immediately after verified payment and order acceptance; opening it needs no separate request and no wait for the cancellation period to end. Provide a valid CSR, domains/SANs, Subscriber contacts and any required organisation and validation information. Submitting the application is the step at which we ask for your express request to begin processing now and your acknowledgement of how that affects cancellation rights; we record both before the application is sent to the CA and email you a copy. Submit it so that the application enters validation within the payment-based activation deadline described above. Follow validation progress in your account. Setup availability, application submission and certificate issuance do not by themselves waive statutory cancellation or refund rights.

Expected validation time

DV can often be issued within minutes after domain control is proven. OV commonly takes 1-3 working days and EV 1-5 working days after complete information is received. These are estimates. Domain access, inaccurate records, organisation checks, CA requests and non-working days can extend the time. Payment alone does not trigger issuance or guarantee a delivery time.

Delivery confirmation

When the CA issues the certificate, we retrieve and check it against the authorised domains. The certificate and available chain are then made available for download in your account, and a service email is sent to your delivery address. A sent email records dispatch, not proof that you opened it. The certificate must still be installed on your server. After issuance we may check which certificate your public server presents and remind you if the issued certificate is not installed there yet. Tell us if a download is unavailable or does not match your order.

Replacement certificates

Your account distinguishes service-plan end dates from individual certificate expiry dates. Shorter CA lifetimes require fresh certificates during a plan. Keep your contact address current, complete renewed validation and install each replacement. Reminders help but do not replace your responsibility to monitor expiry.

Delays, rejection and help

If validation stalls, check the instructions in your account and contact support@zuperssl.com with the order reference. We can explain missing steps and raise an issue with the supplier. Where delivery fails, the Refunds & Cancellation section and your statutory remedies apply. Do not send private keys or full card details.

Applications that stall at the CA

If an application has been with the CA for 25 days without a certificate being issued, we withdraw it from the CA automatically, return the order to setup in your account and email you. This protects the cost position of the order with our supplier. It is not a cancellation: your service plan and your refund rights are unchanged, and you keep at least 30 days from the withdrawal to resubmit: if less of your activation deadline is left, we extend it to that day and show the new deadline in your account and in our email. Resubmit the application once the missing validation step is resolved. Reminders are sent while the application is pending. Contact support before that day if organisation checks legitimately need longer, so the next steps can be planned with you. Before the activation deadline you can also restart the setup of an application that has no certificate yet, for example to correct the CSR or the domain names: we withdraw the application from the CA and return the order to setup, without a refund and without changing your plan, your refund rights or the deadline. Your account allows this 3 times per order; contact support if you need more.

Evidence of the service

We retain order acceptance, validation events, issuance details, account access to the order, download responses and service-email dispatch records. These records help us resolve missing-delivery claims. They do not turn a failed validation or an unopened email into proof that a usable certificate was delivered.

Contact the legal seller

Solkrone Ltd is responsible for handling purchase refunds and cancellations for zuperssl. Email support@zuperssl.com, use the support area of your account, or write to Suite 11076, 5 Brayford Square, London, United Kingdom, E1 0SG. Within the commercial refund window described below, you can also send a refund request from your account. Include your order reference, affected product and what you would like us to do. No special wording or reason is required to exercise a statutory cancellation right.

Our commercial refund window

You can request cancellation and a refund within 14 days of purchase under our commercial refund policy. The clock starts on the purchase date, not issuance or installation. The window closes at the end of the 14th day after the day of purchase (23:59:59 UTC) and normally runs at least as long as a 14-day statutory cancellation period. Where a statutory period applies, it is calculated under its own rules and is neither shortened nor replaced by ours. A request received within that window is assessed using its receipt time even if processing finishes later. Within the window, we refund the full purchase price, except for additional names the certificate authority has already added, which follow their own rules below. A refund of an order already sent to the CA is conditional on ending that certificate relationship: we cancel a pending application or request revocation of any issued certificate when the refund is approved, and a refunded certificate must no longer be used. This also applies to a refund processed through our payment provider: once a full refund settles, the order is closed and we ask the CA to revoke any certificate issued for it. CA administration does not change your request date or postpone a statutory refund deadline. We may decline this additional commercial benefit where intentional fraud or material abuse connected with that order is established, with a written explanation and subject to your statutory rights. We may reduce a payment only to avoid refunding an amount already refunded or covered by a payment reversal. A normal reissue or replacement does not remove the commercial refund right. Outside this window, statutory and other contractual remedies remain available.

Before and during validation

An order not yet sent to the CA can be cancelled through a refund request in your account or through support. While validation is pending, we arrange cancellation with the CA. If a CA rejects or closes an application, the order shows as cancelled in your account; we review it, refund the payment where we cannot supply the purchased service and tell you by email. We explain the reason on request. We do not treat failed validation as proof of delivery. Additional names the certificate authority has already added follow their own rules below.

After issuance or reissue

Issued, installed and reissued certificates are still assessed within our commercial refund window. A refund requires revocation of the issued certificate; stop using a revoked certificate and remove it from your systems. Reissue does not restart the purchase refund clock. Additional names follow their own rules below. Outside the commercial window, contact us about the reason for the request so we can consider statutory rights and any applicable CA remedy. No blanket “no refunds” rule overrides those rights.

Statutory cancellation rights: consumers in the United Kingdom

The certificate plan is a service contract: we arrange validation and issuance through the CA and provide the service during the service period. Where UK statutory cancellation rules apply, the cancellation period for consumers buying at a distance normally ends at the end of the 14th day after the day the contract is concluded. Failure to provide the required cancellation information can extend that period. If you want the service to begin during that period, we ask for your express request before the application is sent to the CA, together with your acknowledgement that the right to cancel can end early once this service contract has been fully performed and the legal conditions are met. Issuance of the first certificate alone does not mean that all obligations under the purchased service plan have been fully performed. If you cancel after making that request but before full performance, you may owe a proportionate amount for what has been supplied, only where the legal conditions are met. The substantial part of what we supply is arranging and completing validation and issuance at the start of the plan rather than an equal amount of work on each day of the service period, and a proportionate amount is assessed on that basis rather than purely by elapsed days. We explain the calculation and you may dispute it. Within our commercial refund window we refund in full, apart from additional names the certificate authority has already added (see below), and make no other proportionate deduction. The proportionate assessment applies only where a statutory right of cancellation is exercised after that window has closed, or where the commercial benefit has been declined under its stated terms. Immediate setup availability, payment or opening the setup form does not by itself constitute that request; the request is recorded separately when you submit the application. Mandatory rights and remedies for a faulty, misdescribed or undelivered service remain available, and our separate commercial refund window also remains available.

Statutory right of withdrawal: consumers outside the United Kingdom

Consumers also keep mandatory protections applicable in their country of habitual residence. Because we do not accept consumer purchases from EU countries, this paragraph applies to consumers in EEA countries outside the EU and in the other countries we sell to. If a consumer contract with a person in an EU country nevertheless comes into existence despite those eligibility rules, that country’s mandatory consumer protections apply to it and nothing in these terms is intended to reduce them. Where a statutory right of withdrawal (cancellation) applies, a consumer may withdraw from this distance service contract without giving a reason within 14 days after the day the contract is concluded, subject to the rules on receipt of the required information and any statutory extension. Send us a clear withdrawal statement by email or post using the contact details above; you may use the model cancellation form below. Sending the statement before the statutory period ends is sufficient, even if we receive it later. This sending rule also applies to UK statutory cancellation. We reimburse payments due following withdrawal without undue delay and within 14 days after we are informed, using the same payment method unless you expressly agree otherwise, without a refund fee. A proportionate service charge is due only if you expressly requested early performance, received the required information and the other legal conditions are met. We do not treat the initial certificate as full performance of the continuing plan or seek a blanket waiver of rights for digital content. The separate commercial refund benefit remains available on its stated terms.

Other situations

Manual renewals have their own purchase date and refund window. Automatic renewal is not enabled. We sell electronic SSL products, not hardware tokens or shipped goods. Suspected fraud, fabricated validation or abuse may require a security review and revocation; we explain the refund decision subject to lawful disclosure restrictions. Card networks and card issuers report payments they consider unauthorised, sometimes weeks after purchase and before any chargeback is raised. Where we receive such a report for an order we refund it in full, cancel it and ask the CA to revoke any certificate issued for it, and we email you the reason and how to contest it. This can happen after our commercial refund window has closed, because that window limits when you may change your mind and not when a payment report may arrive. It is not a penalty and not a finding that you did anything wrong: no charge remains, your statutory rights are unaffected and you may order again.

Additional names bought with a certificate

Additional names bought with a certificate are priced per name and shown before you pay. Until an application that carries them is sent to the certificate authority, a refund within our commercial window includes their price. Sending that application at your express request has the certificate authority add the names, a step our supplier charges for and does not refund: from then on those names have been supplied, a refund under our commercial policy covers the rest of the price but not theirs, and their price is refunded only where the law requires it, for example if the certificate could not be issued for a reason that is not yours or the names do not work as described. A name counts as added once an application or reissue has carried it to the certificate authority, even if that application is later withdrawn. Their price is what you paid for them after any discount. Names you bought but no application has carried are refunded with the rest of the price. Statutory rights that the law does not allow us to limit remain unaffected.

Additional names bought later

Additional names bought later for an issued certificate are a separate purchase with its own date and price; this shop does not add name fees silently. Until a reissue that uses them is sent to the certificate authority, you can ask us to cancel them within 14 days of their purchase, and we refund what you paid for them. Sending that reissue at your express request has the certificate authority add the names, a step our supplier charges for and does not refund: from then on the names have been supplied, our commercial refund policy no longer covers them, and they are refunded only where the law requires it, for example if they could not be added or do not work as described. Where names a certificate already carries are refunded, they no longer belong to your plan: we may reissue the certificate without them or ask the certificate authority to revoke it, and you must stop using them. Statutory rights that the law does not allow us to limit remain unaffected.

Suspension, closure and disputed payments

An account restriction does not by itself mean that prepaid money is forfeited. If we end or cannot supply a paid service and you are not at fault, we refund the unprovided part, with any further remedy required by law. Where misuse is established, any amount retained or claimed must have a lawful basis and be proportionate; we do not impose an automatic penalty or blanket loss of refund rights. We explain the calculation where lawful. A good-faith complaint or payment dispute alone is not abuse. We may verify a reversed or disputed payment and coordinate any refund with the payment provider to avoid refunding the same amount twice.

Refund method and timing

Approved refunds go to the original payment method, not compulsory store credit. We refund the amount due in the original purchase currency, including refundable tax we collected. Bank exchange differences or bank fees are outside our control. We process a statutory refund within the applicable legal deadline, normally within 14 days of being told of cancellation where that rule applies. Your bank’s posting time is additional. We confirm submission of the refund, not an unverified date it will reach your account.

Model cancellation form

Complete and return this form only if you wish to cancel the contract. To: Solkrone Ltd, Suite 11076, 5 Brayford Square, London, United Kingdom, E1 0SG, +44 7448 073064, support@zuperssl.com. I/We (*) hereby give notice that I/We (*) cancel my/our (*) contract for the supply of the following service (*): [product and order reference]. Ordered on (*)/received on (*): [date]. Name of consumer(s): [name]. Address of consumer(s): [address]. Signature of consumer(s) (only if this form is notified on paper): [signature]. Date: [date]. (*) Delete as appropriate. You may instead send any other clear statement of your decision to cancel.

Use certificates lawfully

Use certificates purchased from Solkrone Ltd trading as zuperssl only for domains and organisations you are authorised to represent and for the purpose permitted by the issuing CA. Do not submit false identities, forged documents, unauthorised domains or misleading information.

Prohibited activity

Do not use the service for phishing, malware distribution, payment fraud, impersonation, unlawful content or infringement of others’ rights. Examples include requesting a certificate for a fake bank login page, using stolen payment details, forging company documents or claiming a domain without the owner’s authority. Do not evade validation or bypass applicable sanctions, export controls or CA eligibility restrictions. We do not promise sales in every territory.

Platform, tools and automation

Do not attempt unauthorised access, credential stuffing, vulnerability exploitation, denial-of-service attacks or interception of other users’ data. Do not bypass authentication, rate limits, anti-bot checks or a restriction by rotating accounts or identities. Automated access must use an interface and limits we authorise; using public tools to scan unrelated systems without permission or flooding support and validation endpoints is prohibited. Report suspected vulnerabilities privately without accessing or retaining other users’ data.

Support conduct and investigations

Do not threaten or harass staff, knowingly submit fabricated abuse reports, or repeatedly send disruptive spam. Firm criticism, a genuine refund request or a good-faith complaint is not prohibited. Cooperate with relevant and proportionate security or validation enquiries within the deadline explained in the request; urgent CA requirements may allow very little time. We will not ask you to disclose a private key or full card security details.

Report abuse or compromise

Report suspected copyright infringement, phishing, malware, fraudulent applications, certificate misuse or a compromised private key involving our services to abuse@zuperssl.com. Anyone can report; an account or order reference is not required. Include the affected domain or URL, when you observed the issue with its time zone, a short description and available evidence. Add the certificate serial number and issuer if known. For copyright reports, identify the protected work, the specific allegedly infringing URL or material, and your relationship to the rights holder. Do not send private keys, passwords or full card details.

Email an Abuse Report

Urgent certificate incidents

For suspected key compromise or urgent revocation, also contact the issuing CA directly through its certificate problem-reporting channel; do not wait for our reply. The CA publishes reporting instructions in its CP/CPS or legal repository and controls certificate revocation. We prioritise reports based on severity and available evidence.

How we respond

We assess available evidence; a report alone is not proof of misuse. Responses may include seeking clarification, limiting affected requests or account access, and referring a certificate incident to the CA. Account suspension or termination follows the grounds, notice and review process in the Terms of Service. Only the CA controls certificate revocation under its rules. We do not host your website and cannot remove its content from the Internet.

Raise a complaint

Contact support@zuperssl.com, your account support area or Suite 11076, 5 Brayford Square, London, United Kingdom, E1 0SG. Include the order reference, a description of the issue and the outcome you seek. Tell us if the problem involves a certificate security incident, missing delivery, cancellation, withdrawal or payment. Do not send passwords, private keys or full card data.

Our response

We review complaints on working days in England and Wales. We will acknowledge the complaint, identify any information needed and give you a progress update if a supplier investigation is required. We do not promise a fixed resolution time before we know the issue. If you disagree with a response, ask for a further review and explain what remains unresolved.

Data protection complaints

Complaints about personal data follow the separate procedure in our Privacy & Cookie Policy. You can use the public contact form without an account. We acknowledge them within 30 days and provide the outcome without undue delay.

Send a data protection complaint

Review of an account restriction

If your account is restricted, email support@zuperssl.com from your registered address or explain how we can verify your authority. Include any decision reference, what you believe is incorrect and supporting information. We will review the available evidence and explain the outcome where lawful, including what is needed to restore access where restoration is appropriate. Security-sensitive details or information about others may be withheld, but you may still pursue external legal or regulatory remedies. A review request does not postpone an urgent CA revocation.

Security incidents

Report certificate misuse or a compromised key to abuse@zuperssl.com. For urgent certificate incidents, also notify the issuing CA directly through its certificate problem-reporting channel and request revocation where appropriate; do not wait for our response. A commercial dispute must not delay action needed to contain a security incident.

Payment, legal rights and alternative dispute resolution

We can provide your order record, accepted terms and payment/refund references to help resolve a payment question. You remain free to contact your bank, an adviser, a regulator or a court. We do not require you to waive a chargeback or statutory remedy. If a complaint cannot be resolved through our internal process, we will tell you so on a durable medium and give you the name, postal address and website of an accredited alternative dispute resolution (ADR) body that could deal with it. We have not committed to voluntary ADR. Unless applicable law requires participation, we decide whether to participate in the particular case and state that decision in the notice. Any applicable duty to identify or participate in a dispute-resolution body remains in place. UK consumers may also use the Citizens Advice consumer service; EU consumers keep any dispute options available under their own law.

Scope and roles

This section forms our Data Processing Agreement only for personal data we process on your behalf as a processor under applicable UK GDPR or EU GDPR. Roles follow the actual activity, not a label or the purchase alone. We remain an independent controller for our own account administration, billing, security and legal records as explained in the Privacy & Cookie Policy. The DPA does not govern a CA’s or another provider’s independent-controller activities, or give us access to visitors’ data on your website. Our website usage statistics and optional advertising measurement are our own controller activities. They are not processing instructed by you under this DPA. We do not send personal data entrusted to us under this DPA to Google Ads for those purposes.

Processing details and your responsibilities

Before processor activities start, we must record the parties, your authority as controller, subject matter, purpose, operations, duration, data types and people concerned in an agreed written processing schedule. Where relevant to an agreed certificate task, this may cover receiving, storing and forwarding business contact and certificate application information about Subscribers and authorised contacts. The schedule must identify the actual scope, locations, retention and security measures; a purchase is not an instruction to process unrelated or sensitive datasets. You provide lawful instructions, necessary notices and a lawful basis, and may correct or withdraw instructions subject to law.

Limits on independent reuse

Personal data that we process solely on your behalf under this DPA remains subject to your documented instructions and the agreed purposes. The service-improvement or AI wording in our Privacy & Cookie Policy is not permission to reuse that data independently or train models on it. Preparing, masking or anonymising such data does not itself authorise a new processing purpose. Any external AI processing must be within the agreed scope and comply with the instructions, sub-processor and transfer conditions in this DPA; otherwise it is excluded.

Instructions and confidentiality

We process covered data only on your documented instructions, including instructions about transfers. If law requires other processing, we notify you beforehand unless prohibited. We tell you immediately if we consider an instruction unlawful and pause that instruction while it is resolved. Authorised personnel must be bound by confidentiality duties and have access only as needed for their work.

Security

We must maintain technical and organisational measures appropriate to the risk and Article 32, including appropriate access controls, protection of stored and transmitted data, recovery arrangements and regular assessment of their effectiveness. The agreed processing schedule describes the applicable measures and locations.

Sub-processors

For processing covered by this DPA, you give us general written authorisation to engage sub-processors subject to the safeguards in this section. Before covered processing starts, we provide you with the relevant sub-processor list, including identities, contact details, roles, processing locations and applicable safeguards, and keep that information up to date. We share these details directly with the relevant customer for compliance purposes; a public supplier list is not required by this agreement. We bind sub-processors to equivalent data protection obligations and remain responsible to you for their performance as required by Article 28.

Changes to sub-processors

We give the affected customer written notice of intended additions or replacements sufficiently in advance to allow a reasonable opportunity to object on data-protection grounds before the change takes effect. The applicable processing schedule sets the notice and objection arrangements appropriate to the service. Separate written approval of each change is not required under this general authorisation. We assess objections in good faith and seek a lawful resolution, such as an alternative sub-processor, an alternative configuration or additional safeguards. If we cannot agree a resolution within 30 days of your objection, you may end the affected processing service by written notice without penalty, in accordance with the contract and applicable law and including any refund due. Where a change is necessary to keep the service secure, lawful or operable and delay would put your data at risk, we may make it before that period ends and will tell you why; your termination and refund rights above still apply. This procedure applies only to sub-processors handling your data under this DPA; it does not create a general approval or notification requirement for unrelated suppliers or our independent-controller activities.

International transfers

A restricted transfer requires your documented instructions and a valid transfer mechanism under the applicable law, together with any necessary assessment and supplementary protection. Depending on the transfer, this may involve adequacy, the UK IDTA or Addendum, or EU Standard Contractual Clauses. The DPA alone is not an international transfer mechanism. We document the applicable arrangement before transfer and make relevant safeguards available to you.

Rights requests and incidents

We promptly pass covered data-rights requests to you and assist with responses using appropriate measures. We notify you without undue delay after becoming aware of a personal data breach, share available details and provide updates to support containment and your notification duties. Taking account of the processing and information available, we also assist with security duties, impact assessments and required regulator consultation.

Return or deletion

When covered processing ends, we return or securely delete the data at your choice and delete copies unless applicable law requires retention. We explain any required retention and continue protecting that data. Backup copies awaiting secure deletion must be put beyond ordinary use and removed under the agreed retention schedule. Independent-controller records and public Certificate Transparency logs remain subject to their own lawful retention rules.

Compliance and contract priority

We provide information needed to evidence compliance and allow and contribute to audits and inspections by you or your appointed auditor. We will first offer existing documentation, such as current certifications, audit summaries or a completed security questionnaire, because that answers most requests without an on-site visit. Where it does not answer yours, you may audit once in any 12 months, and additionally after a personal data breach affecting your data or where a supervisory authority requires it, on at least 30 days’ written notice, during business hours and with reasonable steps to limit disruption. Your appointed auditor must be bound by confidentiality and must not be a competitor of ours. You bear your own and your auditor’s costs. These arrangements order and pace an audit; they are not grounds to refuse one, and they do not limit a supervisory authority’s own powers. Practical arrangements must protect others’ information without preventing required oversight. These DPA obligations continue while we hold covered data and prevail over conflicting general terms for that processing. Neither party’s obligations or individuals’ rights under data protection law are excluded.

Request a copy or discuss your requirements

Email privacy@zuperssl.com with the subject “Privacy / DPA” to request an email copy of these terms and discuss an applicable processing schedule. Identify your organisation and relevant service or order; do not send private keys or unnecessary personal data. Any required DPA and schedule must be binding before the relevant processing starts, whether or not you request a copy.

Request a DPA Copy

Legal seller

zuperssl is a trading name of Solkrone Ltd, a company registered at Companies House in England and Wales. Company Number: 17368118. Registered office: Suite 11076, 5 Brayford Square, London, United Kingdom, E1 0SG. The registered office is a correspondence address; no walk-in service is offered.

Contact

Email: support@zuperssl.com. Phone: +44 7448 073064. You can also use the Contact page or send an order-specific ticket from your account. The legal seller, merchant of record and contracting entity for all purchases is Solkrone Ltd.

Payments

Stripe processes card payments for Solkrone Ltd under the zuperssl trading name. The brand may appear on Checkout and payment communications. Where Stripe issues an invoice or receipt for your payment, it identifies the registered company and you can open it from the billing page of your account; the order record in your account is the copy of your purchase and accepted terms. Prices are in USD and there is no automatic renewal. Available payment methods are shown on Stripe Checkout.

Certificate supply

We resell third-party SSL/TLS products and do not issue certificates ourselves. The product page and CA Agreements & Policies identify the issuer. Company, product and policy information should be read together when deciding whether the service meets your requirements.