Skip to content
Drillroom
Sign in
Buy for £499 a year

Terms

Last updated 26 October 2026.

Who these terms are between

These terms are between ItsMonkie Limited ("we"), which runs Drillroom, and the organisation that buys a Drillroom licence ("you"). They are for business customers buying for an organisation, not for individuals buying for themselves.

ItsMonkie Limited is a company registered in England and Wales, company number 17091942. Its registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

The licence

A licence costs £499 a year and gives your organisation full use of Drillroom for that year. It renews once a year unless you cancel it on your Account page, which turns renewal off. We email you 21 days before each renewal with the amount and the date. If you cancel, you keep full access until the end of the year you have paid for. If a renewal payment fails, the licence ends on its renewal date, and if the payment goes through later, the licence renews from that day.

Paying

You pay through our payment provider when you buy and at each renewal. ItsMonkie Limited is not registered for VAT, so no VAT is charged.

Refunds

You can have a full refund on request within 30 days of buying, whether or not you have run an exercise. Email support@getdrillroom.com. If you close your account and your last payment, including a renewal, was in the last 30 days, it is refunded in full when the account is deleted.

Fair use

The licence is for one operator exercising one organisation. Usage that is unreasonable relative to that purpose, or automated access, may be suspended. We will contact you before suspending anything.

What Drillroom does and does not do

Drillroom helps you run incident response exercises and keep a dated record of them. Drafted findings and suggested wording are drafts for you to check, and you decide what goes into your evidence pack. Drillroom does not certify compliance, does not decide whether your evidence meets an auditor's requirements, and does not confirm that any control is adequate or effective. Whether an auditor, insurer or customer accepts your evidence is their judgement.

Your responsibilities

Keep your sign-in details to yourself and tell us at support@getdrillroom.com if you think someone else has them. Use Drillroom lawfully. When you add people, make sure your organisation is entitled to give us their names, roles and email addresses for its exercises. Our privacy page tells them what we hold and how to ask for it to be removed.

Your content and data

What you put into Drillroom stays yours. You let us use it only to provide Drillroom to you. Our privacy page says what we hold, the kinds of provider we use and how long we keep it. For the people you add and what you record about them, your organisation decides what goes in, and we handle it on your behalf, only to provide Drillroom. For questions about data, email contact@getdrillroom.com.

Data processing schedule

For the people your organisation adds and what it records about them, we handle personal data on your behalf as your processor, and this schedule is the contract data protection law requires for that.

  • What and why: names, roles and email addresses of the people you add, and what is recorded about them in your exercises (attendance, logged entries, actions and findings), handled only to provide Drillroom to you: storing it, showing it to your operator, building your evidence packs, emailing reminders to people named on actions, and, when you ask for drafted findings or suggested wording, sending the parts our privacy page names to our AI provider.
  • How long: while your account exists, then until it is deleted as the sections below on not renewing and closing your account say.
  • Your instructions: we act only on your instructions, which are these terms and how you use Drillroom, unless the law requires otherwise, in which case we tell you first unless the law forbids it. If we think an instruction would break data protection law, we tell you straight away.
  • Security: we protect it with appropriate technical and organisational measures, including encryption in transit and at rest.
  • Sub-processors: you allow us to use providers of the kinds listed on our privacy page, on terms that protect the data as this schedule does, and their names are available on request. We change that list on our privacy page at least 30 days before a change takes effect, and you can object by closing your account.
  • Helping you: we help you answer requests from the people the data is about, and with security, breach notification, impact assessments and consulting the Information Commissioner's Office, as far as our part of the processing allows. Records of exercises already run are sealed as evidence and cannot be edited, so a person's name in them stays until your account is deleted.
  • Breaches: we tell you without undue delay after becoming aware of a personal data breach affecting this data.
  • At the end: the data is deleted with your account, as the sections below say, and our providers delete their copies within the periods our privacy page gives. We keep only a scrambled form of any address that asked us to stop reminders, as our own record, so the request still holds. Export anything you want to keep before then.
  • Showing we comply: we give you the information you need to show these obligations are met, and allow for and contribute to audits, including inspections, by you or an auditor you appoint. An audit is once a year unless a breach or a regulator requires another, on 30 days' notice, by written questions first, and may rely on our providers' own certifications. Anything beyond that is at your cost.
  • Transfers: where a sub-processor holds data outside the UK, the transfer relies on the safeguards our privacy page names.

If you do not renew

Your evidence packs stay downloadable for twelve months after your last paid year ends, and your profile and participant list are kept for those twelve months too. We email you a month and a week before the end of them. Then we delete the account and everything in it, and our backups of it within a further 15 weeks.

Closing your account

You can close your account from your Account page. You then have seven days to change your mind. After that we delete everything in your account within 30 days of your request, and our backups of it within a further 15 weeks. Export anything you want to keep before you close.

Ending the agreement

You can stop using Drillroom at any time by cancelling the licence or closing your account. We can suspend or end your licence if you seriously break these terms, and we will contact you first, as the fair use clause says.

Keeping Drillroom running

We work to keep Drillroom available and your data safe, but we cannot promise it will always be available or free of faults. We may change or improve how Drillroom works, as long as the licence still does what this page and the pricing page say. If we change these terms, the date at the top of this page changes.

Liability

Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else the law does not allow us to limit. Otherwise, we are not liable for indirect or consequential loss, or for loss of profit, revenue or business. Our total liability to you in any year of the licence is limited to what you paid us for that year. We are not responsible for decisions you make using Drillroom, or for how an auditor, insurer or customer treats your evidence.

General

These terms are the whole agreement between us about Drillroom. If a court finds part of them unenforceable, the rest still applies. If we do not enforce a term straight away, we can still enforce it later. Neither of us is responsible for delays caused by events outside our reasonable control. You may not transfer the licence to another organisation without our agreement. Nobody else has rights under these terms. We contact you by email at the address on your account, and you contact us at support@getdrillroom.com.

Law

These terms are governed by the law of England and Wales, and the courts of England and Wales deal with any dispute about them.