290 lines
15 KiB
XML
290 lines
15 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<annex>
|
|
<title>Annex 1 - General Terms and Conditions</title>
|
|
<p>
|
|
<b>What is this document?</b>
|
|
</p>
|
|
<p>These are the general terms and conditions (in Dutch: “<i>algemene
|
|
voorwaarden</i>”) of <company_long/> (<company_short/>). This version of
|
|
the general terms and conditions is dated 15 July 2014.
|
|
</p>
|
|
<p>In the spirit of <company_short/>'s philosophy, <company_short/>
|
|
wants these general terms and conditions to be as understandable as
|
|
possible. If you have any questions, feel free to ask for clarification.
|
|
</p>
|
|
<p>
|
|
<b>What is <company_long/>?</b>
|
|
</p>
|
|
<p>
|
|
<company_short/> is a private limited liability company under Dutch law
|
|
located in Amsterdam, The Netherlands. It is registered at the Dutch
|
|
Chamber of Commerce under no. 60628081.
|
|
</p>
|
|
<p>
|
|
<b>To what do these terms and conditions apply?</b>
|
|
</p>
|
|
<p>These general terms and conditions apply to all agreements between
|
|
<company_short/> and the customer. <company_short/>
|
|
rejects any terms and conditions used by the customer. The parties can only
|
|
deviate from these general terms and conditions in writing. These general
|
|
terms and conditions are also intended to benefit any person employed or
|
|
engaged by <company_short/> during the performance of an assignment.
|
|
</p>
|
|
<p>
|
|
<b>How does <company_short/> agree on an assignment?
|
|
</b>
|
|
</p>
|
|
<p>
|
|
<company_short/> wants both parties to have a clear picture of an assignment
|
|
before it starts. This means there only is an agreement between
|
|
<company_short/> and the customer after <company_short/>
|
|
sends a written offer containing the key terms of the agreement and the
|
|
customer subsequently accepts the offer. Communications other than the
|
|
written offer do not form part of the agreement. <company_short/>
|
|
can rescind an offer until it is accepted by the customer.
|
|
</p>
|
|
<p>
|
|
<b>What can the customer expect from <company_short/>?</b>
|
|
</p>
|
|
<p>It is important to understand the limits of <company_short/>'s services.
|
|
<company_short/> does not (and cannot) give guarantees that something is secure.
|
|
<company_short/> instead has an obligation to make reasonable efforts (in
|
|
Dutch: “<i>inspanningsverplichting</i>”) to perform the agreed services.
|
|
</p>
|
|
<p>
|
|
<company_short/> will make reasonable efforts to perform the assignment in
|
|
accordance with the plan set out in the offer (if any). If <company_short/>
|
|
expects it will not fulfill the plan as documented, it will let the customer
|
|
know without delay. <company_short/> is not automatically deemed to be in
|
|
default if it doesn't meet the plan.
|
|
</p>
|
|
<p>
|
|
<company_short/> will make reasonable efforts to avoid disruption of the
|
|
customer's operations and damage to its owned or operated systems, but it cannot
|
|
guarantee that this will be avoided. The customer agrees to this. <company_short/>
|
|
is not obliged to restore the systems or recover any data deleted or amended
|
|
in the course of the assignment.
|
|
</p>
|
|
<p>
|
|
<b>What can <company_short/> expect from the customer?</b>
|
|
</p>
|
|
<p>The customer will provide <company_short/> with all means necessary to allow
|
|
<company_short/> to perform the agreed services. If <company_short/>
|
|
needs explicit permission from the customer to perform its services (for
|
|
example, when doing penetration tests) the customer gives this permission.
|
|
The customer also warrants that it has the legal authority to give this
|
|
permission.
|
|
</p>
|
|
<p>
|
|
<b>How do the parties handle confidential information?</b>
|
|
</p>
|
|
<p>
|
|
<company_short/> and the customer will not disclose to others confidential
|
|
information and personal data they receive from each other or gain access
|
|
to in the course of an assignment. <company_short/>
|
|
has the right to disclose this information and data to persons engaged by
|
|
<company_short/>, but only if these persons have a similar confidentiality
|
|
obligation vis-á-vis <company_short/>. Any person will only use the
|
|
information and data it receives or gains access to for the purposes
|
|
following from the agreement. Both parties will take reasonable measures to
|
|
maintain the confidentiality of the information and data they received or
|
|
gained access to, and will ensure that persons engaged by them do the same.
|
|
</p>
|
|
<p>
|
|
<b>What does <company_short/> do with vulnerabilities it finds in the course
|
|
of an assignment?</b>
|
|
</p>
|
|
<p>If <company_short/> in the course of an assignment finds a vulnerability
|
|
which might affect the customer, it will report this to the customer. If a
|
|
vulnerability might affect third parties as well, <company_short/>
|
|
retains the right to disclose this vulnerability also to others than the
|
|
customer. It will only do so after having given the customer a reasonable
|
|
period to take measures minimising the impact of the vulnerability, in line
|
|
with responsible disclosure best practices.
|
|
</p>
|
|
<p>
|
|
<b>What does <company_short/> do with indicators of compromise it finds?</b>
|
|
</p>
|
|
<p>If <company_short/> in the course of an assignment finds indicators of
|
|
compromise, such as malware signatures and IP-addresses, it will report this
|
|
to the customer. <company_short/> retains the right to also publish this
|
|
information in a publicly accessible database. It will only do so after it
|
|
has given the customer the opportunity to object to the publication of data
|
|
which would negatively impact the customer.
|
|
</p>
|
|
<p>
|
|
<b>Who owns the products developed in the course of the assignment?</b>
|
|
</p>
|
|
<p>
|
|
<company_short/> retains any intellectual property rights in products
|
|
developed for an assignment, such as software and reports.<company_short/>,
|
|
however, wants to teach as many customers as possible 'how to fish'.
|
|
</p>
|
|
<p>For software it developed, this means that <company_short/>
|
|
gives the customer a permanent, non-exclusive, transferable, sub-licensable,
|
|
worldwide license to distribute and use the software in source and binary
|
|
forms, with or without modification (very similar to the BSD-license). If
|
|
<company_short/>'s software is based on other software which is provided
|
|
under a license which restricts <company_short/>'s ability to license its
|
|
own software (such as the GPLv3 license), the more restrictive license will
|
|
apply.
|
|
</p>
|
|
<p>For other products it developed, such as reports and analyses,
|
|
<company_short/> gives the customer the same license, but this license is
|
|
exclusive to the customer and does not contain the right to modification.
|
|
The latter condition is intended to ensure that the customer will not change
|
|
<company_short/>'s products, such as reports and analyses.
|
|
<company_short/> retains the right to reuse these products, for example for
|
|
training and marketing purposes. <company_short/> will remove any confidential
|
|
information from these products before publication.
|
|
</p>
|
|
<p>
|
|
<company_short/> retains title to any property transferred to the customer
|
|
until all outstanding payments by the customer have been done in full (in Dutch:
|
|
“<i>eigendomsvoorbehoud</i>”). <company_short/> also only gives a license after
|
|
all outstanding payments have been made in full.
|
|
</p>
|
|
<p>
|
|
<b>Who will perform the assignment?</b>
|
|
</p>
|
|
<p>
|
|
<company_short/> has the right to appoint the persons who will perform the
|
|
assignment. It has the right to replace a person with someone with at least
|
|
the same expertise, but only after having consulted with the customer.
|
|
This means that section 7:404 Dutch Civil Code (in Dutch: “<i>Burgerlijk
|
|
Wetboek</i>”) is excluded.
|
|
</p>
|
|
<p>Due to the nature of <company_short/>'s business, <company_short/>
|
|
regularly works with freelancers for the performance of its assignments.
|
|
<company_short/> has the right to engage third parties, including freelancers,
|
|
in the course of the performance of an assignment.
|
|
</p>
|
|
<p>
|
|
<company_short/>
|
|
wants to be able to use the expertise of its entire team to help with an
|
|
assignment. This means that in the course of an assignment, it is possible
|
|
that the persons performing the assignment will consult with and be advised
|
|
by others in <company_short/>'s team. These others will of course be bound by
|
|
the same confidentiality obligations as the persons performing the
|
|
assignment.
|
|
</p>
|
|
<p>
|
|
<b>What happens when the scope of the assignment is bigger than agreed?</b>
|
|
</p>
|
|
<p>
|
|
<company_short/> and the customer will attempt to precisely define the scope
|
|
of the assignment before <company_short/> starts. If during the course of the
|
|
assignment, the scope turns out to be bigger than expected, <company_short/>
|
|
will report this to the customer and make a written offer for the additional
|
|
work.
|
|
</p>
|
|
<p>
|
|
<b>How is payment arranged?</b>
|
|
</p>
|
|
<p>All amounts in <company_short/>'s offers are in Euros, excluding VAT and
|
|
other applicable taxes, unless agreed otherwise.
|
|
</p>
|
|
<p>For assignments where the parties agreed to an hourly fee, <company_short/>
|
|
will send an invoice after each month. For other assignments, <company_short/>
|
|
will send an invoice after completion of the assignment, and at moments set
|
|
out in the offer (if any). The customer must pay an invoice within 14 days
|
|
of the invoice date.
|
|
</p>
|
|
<p>
|
|
<company_short/> may, prior to an assignment, agree on the payment of a
|
|
deposit by the customer. <company_short/> will settle deposits with interim
|
|
payments or the final invoice for the assignment.
|
|
</p>
|
|
<p>If the payment is not received before the agreed term, the client will be
|
|
deemed to be in default without prior notice. <company_short/>
|
|
will then have the right to charge the statutory interest (in Dutch:
|
|
“<i>wettelijke rente</i>”) and any judicial and extrajudicial (collection)
|
|
costs (in Dutch: “<i>gerechtelijke- en buitengerechtelijke
|
|
(incasso)kosten</i>”).
|
|
</p>
|
|
<p>If the customer cancels or delays the assignment two weeks before it
|
|
starts, <company_short/> is entitled to charge the customer 50% of the agreed
|
|
price. If the customer cancels or delays the assignment after it already started,
|
|
<company_short/> is entitled to charge the customer 100% of the agreed price.
|
|
<company_short/> is entitled to charge a pro rata percentage in the case of
|
|
cancellation or delay shorter than two weeks before the start of the assignment
|
|
(i.e. a cancellation one week before the assignment would entitle
|
|
<company_short/> to charge 75% of the agreed price).
|
|
</p>
|
|
<p>
|
|
<b>For what can <company_short/> be held liable?</b>
|
|
</p>
|
|
<p>Any liability of <company_short/> resulting from or related to the performance
|
|
of an assignment, shall be limited to the amount that is paid out in that
|
|
specific case under an applicable indemnity insurance of <company_short/>,
|
|
if any, increased by the amount of the applicable deductible (in Dutch:
|
|
“<i>eigen risico</i>”) which under that insurance shall be borne by
|
|
<company_short/>. If no amount is paid out under an insurance, these damages
|
|
are limited to the amount already paid for the assignment, with a maximum of
|
|
EUR 10.000. Each claim for damages shall expire after a period of one month
|
|
from the day following the day on which the customer became aware or could
|
|
reasonably be aware of the existence of the damages.
|
|
</p>
|
|
<p>To make things clear, <company_short/> is not liable if a person associated with
|
|
<company_short/> acts contrary to any confidentiality or non-compete obligation
|
|
vis-á-vis the customer or a third party, this person might have agreed to in another
|
|
engagement.
|
|
</p>
|
|
<p><b>What happens when third parties lodge a claim or initiate criminal
|
|
proceedings against <company_short/>?</b>
|
|
</p>
|
|
<p>The customer shall indemnify <company_short/> and any person employed or engaged by
|
|
<company_short/> for any claims of third parties which are in any way related to the
|
|
activities of <company_short/> and any person employed or engaged by
|
|
<company_short/> for the customer.
|
|
</p>
|
|
<p>Should a third party lodge a claim against <company_short/>
|
|
or any of the consultants it engaged or employed as a result of the
|
|
performance of the assignment for the customer, then the customer will
|
|
co-operate fully with <company_short/> in defending against this claim,
|
|
including by providing to <company_short/> any evidence it has which
|
|
relates to this claim. Should the public prosecutor initiate an investigation
|
|
or criminal proceedings against <company_short/>
|
|
or any of the consultants it engaged or employed as a result of the
|
|
performance of the assignment for the customer, then the customer will also
|
|
co-operate fully with <company_short/>
|
|
in defending against this investigation or proceedings, including by
|
|
providing any evidence it has which relates to this investigation or these
|
|
proceedings.
|
|
</p>
|
|
<p>The customer shall reimburse <company_short/> and any person employed or engaged by
|
|
<company_short/> all costs of legal defence and all damages in relation to these claims,
|
|
investigations or proceedings. This provision does not apply to the extent a
|
|
claim, investigation, or proceeding is the result of the intent or
|
|
recklessness (in Dutch: “<i>opzet of bewuste roekeloosheid</i>”) of
|
|
<company_short/> or a person employed or engaged by <company_short/>.
|
|
</p>
|
|
<p>
|
|
<b>When is this agreement terminated and what happens then?</b>
|
|
</p>
|
|
<p>Each of the parties may terminate the agreement wholly or partly without
|
|
prior notice if the other party is declared bankrupt or is being wound up or
|
|
if the other party's affairs are being administered by the court (in Dutch:
|
|
“surséance van betaling”).
|
|
</p>
|
|
<p>
|
|
<b>When can <company_short/> not be expected to perform the assignment?</b>
|
|
</p>
|
|
<p>In the case of force majeure (in Dutch: “<i>overmacht</i>”) as a result of
|
|
which <company_short/> cannot reasonably be expected to perform the assignment,
|
|
the performance will be suspended. Situations of force majeure include cases
|
|
where means, such as soft- and hardware, which are prescribed by the customer
|
|
do not function well. The agreement may be terminated by either party if a
|
|
situation of force majeure has continued longer than 90 days. The customer
|
|
will then have to pay the amount for the work already performed pro rata.
|
|
</p>
|
|
<p>
|
|
<b>Which law applies and which court is competent?</b>
|
|
</p>
|
|
<p>Dutch law applies to the legal relationship between <company_short/>
|
|
and its customers. Any dispute between <company_short/>
|
|
and a customer will be resolved in the first instance exclusively by the
|
|
District Court (in Dutch: “<i>rechtbank</i>”) of Amsterdam, the Netherlands.
|
|
</p>
|
|
</annex>
|