General Terms and Conditions

Article 1 – Definitions and applicability

1.1These general terms and conditions apply to all quotations, orders, services and agreements of CyberBusters B.V., located in Almere, registered with the Chamber of Commerce under number 89637631 (hereinafter: 'CyberBusters').

1.2The applicability of the client's (purchasing) terms and conditions is expressly excluded.

1.3Deviations from these terms and conditions are only valid if agreed upon in writing. Written communication includes email.

Article 2 – Nature of services

2.1CyberBusters provides its services in the field of IT security, OT security (Operational Technology), cybersecurity, assessments, (penetration) testing, OT/ICS testing, live demonstrations and consulting as expert contributions and best-efforts obligations. There is no guarantee or warranty obligation regarding specific results.

2.2Cybersecurity, IT security and OT security (including assessments, penetration tests, ICS/OT tests and demonstrations in production and OT environments) never provide absolute certainty. Risks cannot be completely eliminated. It is inherent to the nature of these services that security vulnerabilities, weaknesses or threats may continue to exist or may arise at a later time.

2.3Decisions and measures following advice, findings, test results or demonstrations remain at all times the client's own responsibility. CyberBusters is not liable for the choices made by the client based on the services provided.

Article 3 – Quotations and formation of agreement

3.1All quotations from CyberBusters are non-binding and valid for a period of 30 days, unless otherwise stated in writing.

3.2An agreement is concluded after written confirmation by CyberBusters, or at the moment when CyberBusters commences the actual execution of the services.

Article 4 – Execution of services

4.1CyberBusters executes the agreement to the best of its knowledge and ability, in accordance with the professional standards that may reasonably be expected from a specialist in the field of IT security, OT security and cybersecurity.

4.2CyberBusters is entitled to engage third parties in the execution of the services. The selection of these third parties is made with due care.

4.3The client is responsible for timely and accurate provision of all information, data and access that are reasonably necessary for proper execution of the services, including (if applicable) access to IT systems, networks, OT environments and industrial control systems (ICS).

4.4If the execution of the services is delayed due to circumstances beyond CyberBusters' control, including the untimely or incomplete provision of information or access by the client, reasonable new deadlines will be agreed upon. Additional costs resulting from such delays will be borne by the client.

Article 5 – Fees and payment

5.1All amounts are exclusive of value added tax (VAT) and other government levies, unless expressly stated otherwise.

5.2Payment must be made prior to the execution of the services, unless otherwise agreed in writing. CyberBusters is entitled to suspend execution until full payment has been received.

5.3In case of late payment, CyberBusters is entitled to charge the statutory commercial interest and to recover extrajudicial collection costs from the client.

5.4If the client uses multiple services or orders, CyberBusters is entitled to offset any payments first against the oldest outstanding claim.

Article 6 – Cancellation and modification

6.1Cancellation of an order by the client must be done in writing and only takes effect after written confirmation by CyberBusters.

6.2In case of cancellation within five working days before the scheduled execution, CyberBusters is entitled to charge the full agreed fee. In case of earlier cancellation, cancellation costs may be charged in the amount of costs already incurred and 50% of the remaining fee.

6.3Changes in planning, scope, conditions or specifications will be coordinated through mutual consultation. Such changes may lead to adjustments in the fee and the execution period.

Article 7 – Liability

7.1The total liability of CyberBusters due to attributable failure in the performance of the agreement is limited to compensation for direct damage up to a maximum of the amount charged for the relevant service, with a maximum of € 50,000 per event.

7.2CyberBusters is expressly not liable for indirect damage, consequential damage, loss of income, missed savings, reduced goodwill, damage due to business interruption, damage as a result of claims by third parties, data loss or damage to data, regardless of whether such damage was foreseeable.

7.3CyberBusters is not liable for damage arising from or related to decisions, measures or actions by the client following advice, findings, test results, reports or demonstrations. The responsibility for implementing recommendations and taking security measures rests entirely with the client.

7.4CyberBusters is not liable for damage that occurs during or as a result of performing penetration tests, OT/ICS tests, security assessments or demonstrations, unless there is intent or gross negligence on the part of CyberBusters. The client must take appropriate backups and security measures prior to such activities.

7.5Claims for compensation must be reported in writing within 12 months after the moment when the client became aware or could reasonably have become aware of the damage and CyberBusters as the liable party. If this period is exceeded, the right to compensation expires.

7.6CyberBusters strongly advises the client to take out adequate business liability insurance and cyber insurance.

Article 8 – Intellectual property

8.1All intellectual property rights relating to materials, presentations, reports, software, tools, scripts, applications, demonstrations, methodologies and working methods developed or made available by CyberBusters rest exclusively with CyberBusters or its licensors, unless expressly agreed otherwise in writing.

8.2Even if the services have been fully executed and completed, all intellectual property rights to software, tooling and other materials remain fully vested with CyberBusters. The client only receives a non-exclusive, non-transferable and non-sublicensable right of use for internal business purposes, insofar as strictly necessary for the intended purpose of the service.

8.3The client is not permitted to reproduce, reverse-engineer, decompile, publish, commercially exploit or make available to third parties any materials, software, tools or results of the services without prior express written permission from CyberBusters. Violation of this provision entitles CyberBusters to an immediately payable penalty of € 25,000 per violation, without prejudice to the right to full compensation for damages.

8.4If third-party software, tools or materials are used in the execution of the services, the license terms of these third parties apply. CyberBusters provides no warranties regarding third-party software or tools.

Article 9 – Ownership of hardware and software

9.1All hardware, equipment, software, licenses and other tangible or intangible items delivered or made available by CyberBusters remain the property of CyberBusters, unless expressly agreed otherwise in writing and full payment has been made.

9.2The client is obliged to handle delivered hardware and software with care and to use them exclusively for the agreed purpose. The client is not permitted to rent, sell, pledge or otherwise encumber these items without prior written permission from CyberBusters.

9.3CyberBusters has the right at all times to claim and reclaim hardware, software or other items that are its property, if the client fails to fulfill its obligations under the agreement, including payment, or if the client is declared bankrupt or applies for suspension of payments.

9.4Upon termination of the agreement, regardless of the reason, the client is obliged to immediately return all hardware, software and materials belonging to CyberBusters in good condition. Costs for return are borne by the client, unless otherwise agreed.

Article 10 – Confidentiality

10.1Parties are obliged to maintain confidentiality of all confidential information they obtain from each other or from other sources in the context of the agreement. Information is considered confidential if this has been communicated by the other party or if this follows from the nature of the information.

10.2This confidentiality obligation remains in force even after termination of the agreement, insofar as the nature of the information requires this or as long as parties have not been released from this obligation in writing.

10.3CyberBusters may use the client's name and a general description of the services provided for reference purposes, unless the client objects to this in writing.

Article 11 – Privacy and data protection

11.1The client remains at all times the data controller within the meaning of the General Data Protection Regulation (GDPR) for personal data processed in the context of the agreement, unless expressly agreed otherwise in writing.

11.2Insofar as CyberBusters processes personal data on behalf of the client, CyberBusters acts as a processor. In that case, parties will enter into a separate data processing agreement in accordance with the GDPR.

11.3CyberBusters processes personal data only insofar as necessary for the execution of the agreement and in accordance with applicable laws and regulations on data protection. CyberBusters takes appropriate technical and organizational measures to protect personal data.

Article 12 – Force majeure

12.1CyberBusters is not obliged to fulfill any obligation towards the client if it is prevented from doing so as a result of a circumstance that cannot be attributed to it (force majeure).

12.2Force majeure also includes: disruptions or failures of internet, telecommunications infrastructure or electricity supply, DDoS attacks or other cyber incidents, failure of (cloud) systems or software, government measures, pandemics, natural disasters, war or terrorism, strikes, illness of key personnel and defects at suppliers or other third parties on which CyberBusters depends.

12.3If a force majeure situation continues for longer than 90 days, each of the parties has the right to terminate the agreement in whole or in part, without obligation to pay compensation.

Article 13 – Duration and termination

13.1The agreement is entered into for the duration necessary for the execution of the agreed services, unless parties have expressly agreed on a different duration.

13.2Both parties are entitled to terminate the agreement with immediate effect in case of bankruptcy, (application for) suspension of payments or in case of liquidation of the other party.

13.3After termination of the agreement, the provisions regarding liability, intellectual property, ownership of hardware and software, confidentiality and dispute resolution remain in force.

Article 14 – Applicable law and dispute resolution

14.1All agreements and legal acts to which these general terms and conditions apply are exclusively governed by Dutch law.

14.2All disputes arising from or related to the agreement will be exclusively submitted to the competent court in the district where CyberBusters is located, unless the law mandates otherwise.

14.3Notwithstanding the foregoing, parties are obliged to first attempt to resolve a dispute through mutual consultation before appealing to the court.

Article 15 – Final provisions

15.1If one or more provisions of these general terms and conditions prove to be void or are annulled, the remaining provisions remain fully in force. Parties will consult to agree on new provisions to replace the void or annulled provisions, whereby the purpose and intent of the original provision are taken into account as much as possible.

15.2CyberBusters is entitled to unilaterally amend or supplement these general terms and conditions. Changes take effect 30 days after notification, unless the client objects in writing within this period. In case of objection, the old terms and conditions remain in force for ongoing agreements.

15.3These general terms and conditions take effect on January 1, 2025 and replace all previous versions of the general terms and conditions of CyberBusters B.V.