What is this document?

These are the general terms and conditions (in Dutch: “algemene voorwaarden”) of (). This version of the general terms and conditions is dated 15 July 2014.

In the spirit of 's philosophy, wants these general terms and conditions to be as understandable as possible. If you have any questions, feel free to ask for clarification.

What is ?

is a private limited liability company under Dutch law located in Amsterdam, The Netherlands. It is registered at the Dutch Chamber of Commerce under no. 60628081.

To what do these terms and conditions apply?

These general terms and conditions apply to all agreements between and the customer. rejects any terms and conditions used by the customer. The parties can only deviate from these general terms and conditions in writing. These general terms and conditions are also intended to benefit any person employed or engaged by during the performance of an assignment.

How does agree on an assignment?

wants both parties to have a clear picture of an assignment before it starts. This means there only is an agreement between and the customer after sends a written offer containing the key terms of the agreement and the customer subsequently accepts the offer. Communications other than the written offer do not form part of the agreement. can rescind an offer until it is accepted by the customer.

What can the customer expect from ?

It is important to understand the limits of 's services. does not (and cannot) give guarantees that something is secure. instead has an obligation to make reasonable efforts (in Dutch: “inspanningsverplichting”) to perform the agreed services.

will make reasonable efforts to perform the assignment in accordance with the plan set out in the offer (if any). If expects it will not fulfill the plan as documented, it will let the customer know without delay. is not automatically deemed to be in default if it doesn't meet the plan.

will make reasonable efforts to avoid disruption of the customer's operations and damage to its owned or operated systems, but it cannot guarantee that this will be avoided. The customer agrees to this. is not obliged to restore the systems or recover any data deleted or amended in the course of the assignment.

What can expect from the customer?

The customer will provide with all means necessary to allow to perform the agreed services. If needs explicit permission from the customer to perform its services (for example, when doing penetration tests) the customer gives this permission. The customer also warrants that it has the legal authority to give this permission.

How do the parties handle confidential information?

and the customer will not disclose to others confidential information and personal data they receive from each other or gain access to in the course of an assignment. has the right to disclose this information and data to persons engaged by , but only if these persons have a similar confidentiality obligation vis-á-vis . Any person will only use the information and data it receives or gains access to for the purposes following from the agreement. Both parties will take reasonable measures to maintain the confidentiality of the information and data they received or gained access to, and will ensure that persons engaged by them do the same.

What does do with vulnerabilities it finds in the course of an assignment?

If in the course of an assignment finds a vulnerability which might affect the customer, it will report this to the customer. If a vulnerability might affect third parties as well, retains the right to disclose this vulnerability also to others than the customer. It will only do so after having given the customer a reasonable period to take measures minimising the impact of the vulnerability, in line with responsible disclosure best practices.

What does do with indicators of compromise it finds?

If in the course of an assignment finds indicators of compromise, such as malware signatures and IP-addresses, it will report this to the customer. retains the right to also publish this information in a publicly accessible database. It will only do so after it has given the customer the opportunity to object to the publication of data which would negatively impact the customer.

Who owns the products developed in the course of the assignment?

retains any intellectual property rights in products developed for an assignment, such as software and reports., however, wants to teach as many customers as possible 'how to fish'.

For software it developed, this means that gives the customer a permanent, non-exclusive, transferable, sub-licensable, worldwide license to distribute and use the software in source and binary forms, with or without modification (very similar to the BSD-license). If 's software is based on other software which is provided under a license which restricts 's ability to license its own software (such as the GPLv3 license), the more restrictive license will apply.

For other products it developed, such as reports and analyses, gives the customer the same license, but this license is exclusive to the customer and does not contain the right to modification. The latter condition is intended to ensure that the customer will not change 's products, such as reports and analyses. retains the right to reuse these products, for example for training and marketing purposes. will remove any confidential information from these products before publication.

retains title to any property transferred to the customer until all outstanding payments by the customer have been done in full (in Dutch: “eigendomsvoorbehoud”). also only gives a license after all outstanding payments have been made in full.

Who will perform the assignment?

has the right to appoint the persons who will perform the assignment. It has the right to replace a person with someone with at least the same expertise, but only after having consulted with the customer. This means that section 7:404 Dutch Civil Code (in Dutch: “Burgerlijk Wetboek”) is excluded.

Due to the nature of 's business, regularly works with freelancers for the performance of its assignments. has the right to engage third parties, including freelancers, in the course of the performance of an assignment.

wants to be able to use the expertise of its entire team to help with an assignment. This means that in the course of an assignment, it is possible that the persons performing the assignment will consult with and be advised by others in 's team. These others will of course be bound by the same confidentiality obligations as the persons performing the assignment.

What happens when the scope of the assignment is bigger than agreed?

and the customer will attempt to precisely define the scope of the assignment before starts. If during the course of the assignment, the scope turns out to be bigger than expected, will report this to the customer and make a written offer for the additional work.

How is payment arranged?

All amounts in 's offers are in Euros, excluding VAT and other applicable taxes, unless agreed otherwise.

For assignments where the parties agreed to an hourly fee, will send an invoice after each month. For other assignments, will send an invoice after completion of the assignment, and at moments set out in the offer (if any). The customer must pay an invoice within 14 days of the invoice date.

may, prior to an assignment, agree on the payment of a deposit by the customer. will settle deposits with interim payments or the final invoice for the assignment.

If the payment is not received before the agreed term, the client will be deemed to be in default without prior notice. will then have the right to charge the statutory interest (in Dutch: “wettelijke rente”) and any judicial and extrajudicial (collection) costs (in Dutch: “gerechtelijke- en buitengerechtelijke (incasso)kosten”).

If the customer cancels or delays the assignment two weeks before it starts, is entitled to charge the customer 50% of the agreed price. If the customer cancels or delays the assignment after it already started, is entitled to charge the customer 100% of the agreed price. is entitled to charge a pro rata percentage in the case of cancellation or delay shorter than two weeks before the start of the assignment (i.e. a cancellation one week before the assignment would entitle to charge 75% of the agreed price).

For what can be held liable?

Any liability of resulting from or related to the performance of an assignment, shall be limited to the amount that is paid out in that specific case under an applicable indemnity insurance of , if any, increased by the amount of the applicable deductible (in Dutch: “eigen risico”) which under that insurance shall be borne by . If no amount is paid out under an insurance, these damages are limited to the amount already paid for the assignment, with a maximum of EUR 10.000. Each claim for damages shall expire after a period of one month from the day following the day on which the customer became aware or could reasonably be aware of the existence of the damages.

To make things clear, is not liable if a person associated with acts contrary to any confidentiality or non-compete obligation vis-á-vis the customer or a third party, this person might have agreed to in another engagement.

What happens when third parties lodge a claim or initiate criminal proceedings against ?

The customer shall indemnify and any person employed or engaged by for any claims of third parties which are in any way related to the activities of and any person employed or engaged by for the customer.

Should a third party lodge a claim against or any of the consultants it engaged or employed as a result of the performance of the assignment for the customer, then the customer will co-operate fully with in defending against this claim, including by providing to any evidence it has which relates to this claim. Should the public prosecutor initiate an investigation or criminal proceedings against or any of the consultants it engaged or employed as a result of the performance of the assignment for the customer, then the customer will also co-operate fully with in defending against this investigation or proceedings, including by providing any evidence it has which relates to this investigation or these proceedings.

The customer shall reimburse and any person employed or engaged by all costs of legal defence and all damages in relation to these claims, investigations or proceedings. This provision does not apply to the extent a claim, investigation, or proceeding is the result of the intent or recklessness (in Dutch: “opzet of bewuste roekeloosheid”) of or a person employed or engaged by .

When is this agreement terminated and what happens then?

Each of the parties may terminate the agreement wholly or partly without prior notice if the other party is declared bankrupt or is being wound up or if the other party's affairs are being administered by the court (in Dutch: “surséance van betaling”).

When can not be expected to perform the assignment?

In the case of force majeure (in Dutch: “overmacht”) as a result of which cannot reasonably be expected to perform the assignment, the performance will be suspended. Situations of force majeure include cases where means, such as soft- and hardware, which are prescribed by the customer do not function well. The agreement may be terminated by either party if a situation of force majeure has continued longer than 90 days. The customer will then have to pay the amount for the work already performed pro rata.

Which law applies and which court is competent?

Dutch law applies to the legal relationship between and its customers. Any dispute between and a customer will be resolved in the first instance exclusively by the District Court (in Dutch: “rechtbank”) of Amsterdam, the Netherlands.