<?xml version="1.0" encoding="UTF-8"?>
<annex>
  <title>Annex 1 - General Terms and Conditions</title>
  <p>
    <b>What is this document?</b>
  </p>
  <p>These are the general terms and conditions (in Dutch: “<i>algemene
    voorwaarden</i>”) of <company_long/> (<company_short/>). This version of
    the general terms and conditions is dated 15 July 2014.
  </p>
  <p>In the spirit of <company_short/>'s philosophy, <company_short/>
    wants these general terms and conditions to be as understandable as
    possible. If you have any questions, feel free to ask for clarification.
  </p>
  <p>
    <b>What is <company_long/>?</b>
  </p>
  <p>
    <company_short/> is a private limited liability company under Dutch law
    located in Amsterdam, The Netherlands. It is registered at the Dutch
    Chamber of Commerce under no. 60628081.
  </p>
  <p>
    <b>To what do these terms and conditions apply?</b>
  </p>
  <p>These general terms and conditions apply to all agreements between
    <company_short/> and the customer. <company_short/>
    rejects any terms and conditions used by the customer. The parties can only
    deviate from these general terms and conditions in writing. These general
    terms and conditions are also intended to benefit any person employed or
    engaged by <company_short/> during the performance of an assignment.
  </p>
  <p>
    <b>How does <company_short/> agree on an assignment?
    </b>
  </p>
  <p>
    <company_short/> wants both parties to have a clear picture of an assignment
    before it starts. This means there only is an agreement between
    <company_short/> and the customer after <company_short/>
    sends a written offer containing the key terms of the agreement and the
    customer subsequently accepts the offer. Communications other than the
    written offer do not form part of the agreement. <company_short/>
    can rescind an offer until it is accepted by the customer.
  </p>
  <p>
    <b>What can the customer expect from <company_short/>?</b>
  </p>
  <p>It is important to understand the limits of <company_short/>'s services.
    <company_short/> does not (and cannot) give guarantees that something is secure.
    <company_short/> instead has an obligation to make reasonable efforts (in
    Dutch: “<i>inspanningsverplichting</i>”) to perform the agreed services.
  </p>
  <p>
    <company_short/> will make reasonable efforts to perform the assignment in
    accordance with the plan set out in the offer (if any). If <company_short/>
    expects it will not fulfill the plan as documented, it will let the customer
    know without delay. <company_short/> is not automatically deemed to be in
    default if it doesn't meet the plan.
  </p>
  <p>
    <company_short/> will make reasonable efforts to avoid disruption of the
    customer's operations and damage to its owned or operated systems, but it cannot
    guarantee that this will be avoided. The customer agrees to this. <company_short/>
    is not obliged to restore the systems or recover any data deleted or amended
    in the course of the assignment.
  </p>
  <p>
    <b>What can <company_short/> expect from the customer?</b>
  </p>
  <p>The customer will provide <company_short/> with all means necessary to allow
    <company_short/> to perform the agreed services. If <company_short/>
    needs explicit permission from the customer to perform its services (for
    example, when doing penetration tests) the customer gives this permission.
    The customer also warrants that it has the legal authority to give this
    permission.
  </p>
  <p>
    <b>How do the parties handle confidential information?</b>
  </p>
  <p>
    <company_short/> and the customer will not disclose to others confidential
    information and personal data they receive from each other or gain access
    to in the course of an assignment. <company_short/>
    has the right to disclose this information and data to persons engaged by
    <company_short/>, but only if these persons have a similar confidentiality
    obligation vis-á-vis <company_short/>. Any person will only use the
    information and data it receives or gains access to for the purposes
    following from the agreement. Both parties will take reasonable measures to
    maintain the confidentiality of the information and data they received or
    gained access to, and will ensure that persons engaged by them do the same.
  </p>
  <p>
    <b>What does <company_short/> do with vulnerabilities it finds in the course
      of an assignment?</b>
  </p>
  <p>If <company_short/> in the course of an assignment finds a vulnerability
    which might affect the customer, it will report this to the customer. If a
    vulnerability might affect third parties as well, <company_short/>
    retains the right to disclose this vulnerability also to others than the
    customer. It will only do so after having given the customer a reasonable
    period to take measures minimising the impact of the vulnerability, in line
    with responsible disclosure best practices.
  </p>
  <p>
    <b>What does <company_short/> do with indicators of compromise it finds?</b>
  </p>
  <p>If <company_short/> in the course of an assignment finds indicators of
    compromise, such as malware signatures and IP-addresses, it will report this
    to the customer. <company_short/> retains the right to also publish this
    information in a publicly accessible database. It will only do so after it
    has given the customer the opportunity to object to the publication of data
    which would negatively impact the customer.
  </p>
  <p>
    <b>Who owns the products developed in the course of the assignment?</b>
  </p>
  <p>
    <company_short/> retains any intellectual property rights in products
    developed for an assignment, such as software and reports.<company_short/>,
    however, wants to teach as many customers as possible 'how to fish'.
  </p>
  <p>For software it developed, this means that <company_short/>
    gives the customer a permanent, non-exclusive, transferable, sub-licensable,
    worldwide license to distribute and use the software in source and binary
    forms, with or without modification (very similar to the BSD-license). If
    <company_short/>'s software is based on other software which is provided
    under a license which restricts <company_short/>'s ability to license its
    own software (such as the GPLv3 license), the more restrictive license will
    apply.
  </p>
  <p>For other products it developed, such as reports and analyses,
    <company_short/> gives the customer the same license, but this license is
    exclusive to the customer and does not contain the right to modification.
    The latter condition is intended to ensure that the customer will not change
    <company_short/>'s products, such as reports and analyses.
    <company_short/> retains the right to reuse these products, for example for
    training and marketing purposes. <company_short/> will remove any confidential
    information from these products before publication.
  </p>
  <p>
    <company_short/> retains title to any property transferred to the customer
    until all outstanding payments by the customer have been done in full (in Dutch:
    “<i>eigendomsvoorbehoud</i>”). <company_short/> also only gives a license after
    all outstanding payments have been made in full.
  </p>
  <p>
    <b>Who will perform the assignment?</b>
  </p>
  <p>
    <company_short/> has the right to appoint the persons who will perform the
    assignment. It has the right to replace a person with someone with at least
    the same expertise, but only after having consulted with the customer.
    This means that section 7:404 Dutch Civil Code (in Dutch: “<i>Burgerlijk
    Wetboek</i>”) is excluded.
  </p>
  <p>Due to the nature of <company_short/>'s business, <company_short/>
    regularly works with freelancers for the performance of its assignments.
    <company_short/> has the right to engage third parties, including freelancers,
    in the course of the performance of an assignment.
  </p>
  <p>
    <company_short/>
    wants to be able to use the expertise of its entire team to help with an
    assignment. This means that in the course of an assignment, it is possible
    that the persons performing the assignment will consult with and be advised
    by others in <company_short/>'s team. These others will of course be bound by
    the same confidentiality obligations as the persons performing the
    assignment.
  </p>
  <p>
    <b>What happens when the scope of the assignment is bigger than agreed?</b>
  </p>
  <p>
    <company_short/> and the customer will attempt to precisely define the scope
    of the assignment before <company_short/> starts. If during the course of the
    assignment, the scope turns out to be bigger than expected, <company_short/>
    will report this to the customer and make a written offer for the additional
    work.
  </p>
  <p>
    <b>How is payment arranged?</b>
  </p>
  <p>All amounts in <company_short/>'s offers are in Euros, excluding VAT and
    other applicable taxes, unless agreed otherwise.
  </p>
  <p>For assignments where the parties agreed to an hourly fee, <company_short/>
    will send an invoice after each month. For other assignments, <company_short/>
    will send an invoice after completion of the assignment, and at moments set
    out in the offer (if any). The customer must pay an invoice within 14 days
    of the invoice date.
  </p>
  <p>
    <company_short/> may, prior to an assignment, agree on the payment of a
    deposit by the customer. <company_short/> will settle deposits with interim
    payments or the final invoice for the assignment.
  </p>
  <p>If the payment is not received before the agreed term, the client will be
    deemed to be in default without prior notice. <company_short/>
    will then have the right to charge the statutory interest (in Dutch:
    “<i>wettelijke rente</i>”) and any judicial and extrajudicial (collection)
    costs (in Dutch: “<i>gerechtelijke- en buitengerechtelijke
      (incasso)kosten</i>”).
  </p>
  <p>If the customer cancels or delays the assignment two weeks before it
    starts, <company_short/> is entitled to charge the customer 50% of the agreed
    price. If the customer cancels or delays the assignment after it already started,
    <company_short/> is entitled to charge the customer 100% of the agreed price.
    <company_short/> is entitled to charge a pro rata percentage in the case of
    cancellation or delay shorter than two weeks before the start of the assignment
    (i.e. a cancellation one week before the assignment would entitle
    <company_short/> to charge 75% of the agreed price).
  </p>
  <p>
    <b>For what can <company_short/> be held liable?</b>
  </p>
  <p>Any liability of <company_short/> resulting from or related to the performance
    of an assignment, shall be limited to the amount that is paid out in that
    specific case under an applicable indemnity insurance of <company_short/>,
    if any, increased by the amount of the applicable deductible (in Dutch:
    “<i>eigen risico</i>”) which under that insurance shall be borne by
    <company_short/>. If no amount is paid out under an insurance, these damages
    are limited to the amount already paid for the assignment, with a maximum of
    EUR 10.000. Each claim for damages shall expire after a period of one month
    from the day following the day on which the customer became aware or could
    reasonably be aware of the existence of the damages.
  </p>
  <p>To make things clear, <company_short/> is not liable if a person associated with
    <company_short/> acts contrary to any confidentiality or non-compete obligation
    vis-á-vis the customer or a third party, this person might have agreed to in another
    engagement.
  </p>
  <p><b>What happens when third parties lodge a claim or initiate criminal
    proceedings against <company_short/>?</b>
  </p>
  <p>The customer shall indemnify <company_short/> and any person employed or engaged by
    <company_short/> for any claims of third parties which are in any way related to the
    activities of <company_short/> and any person employed or engaged by
    <company_short/> for the customer.
  </p>
  <p>Should a third party lodge a claim against <company_short/>
    or any of the consultants it engaged or employed as a result of the
    performance of the assignment for the customer, then the customer will
    co-operate fully with <company_short/> in defending against this claim,
    including by providing to <company_short/> any evidence it has which
    relates to this claim. Should the public prosecutor initiate an investigation
    or criminal proceedings against <company_short/>
    or any of the consultants it engaged or employed as a result of the
    performance of the assignment for the customer, then the customer will also
    co-operate fully with <company_short/>
    in defending against this investigation or proceedings, including by
    providing any evidence it has which relates to this investigation or these
    proceedings.
  </p>
  <p>The customer shall reimburse <company_short/> and any person employed or engaged by
    <company_short/> all costs of legal defence and all damages in relation to these claims,
    investigations or proceedings. This provision does not apply to the extent a
    claim, investigation, or proceeding is the result of the intent or
    recklessness (in Dutch: “<i>opzet of bewuste roekeloosheid</i>”) of
    <company_short/> or a person employed or engaged by <company_short/>.
  </p>
  <p>
    <b>When is this agreement terminated and what happens then?</b>
  </p>
  <p>Each of the parties may terminate the agreement wholly or partly without
    prior notice if the other party is declared bankrupt or is being wound up or
    if the other party's affairs are being administered by the court (in Dutch:
    “surséance van betaling”).
  </p>
  <p>
    <b>When can <company_short/> not be expected to perform the assignment?</b>
  </p>
  <p>In the case of force majeure (in Dutch: “<i>overmacht</i>”) as a result of
    which <company_short/> cannot reasonably be expected to perform the assignment,
    the performance will be suspended. Situations of force majeure include cases
    where means, such as soft- and hardware, which are prescribed by the customer
    do not function well. The agreement may be terminated by either party if a
    situation of force majeure has continued longer than 90 days. The customer
    will then have to pay the amount for the work already performed pro rata.
  </p>
  <p>
    <b>Which law applies and which court is competent?</b>
  </p>
  <p>Dutch law applies to the legal relationship between <company_short/>
    and its customers. Any dispute between <company_short/>
    and a customer will be resolved in the first instance exclusively by the
    District Court (in Dutch: “<i>rechtbank</i>”) of Amsterdam, the Netherlands.
  </p>
</annex>
