General Terms and Conditions

Section 1 Scope and Subject Matter of the Contract

(1) These General Terms and Conditions (GTC) apply to all contracts concluded between Threat-Informed Cybersecurity Solutions GmbH (hereinafter “Contractor”) and the customer (hereinafter “Client”) for audits, consulting services and other services in the areas of management systems, information security and cybersecurity.

(2) The subject matter of the contract includes in particular:

• Audits of management systems (e.g. quality management, information security, environmental management)
• Consulting and support for the introduction, optimization and certification of management systems
• Consulting and support in the area of information security and cybersecurity, including risk management, vulnerability analyses and security consulting.

Section 2 Conclusion of the Contract

(1) The Contractor’s offers are subject to change and non-binding unless expressly agreed otherwise. A period of validity or commitment stated in the respective offer takes precedence over this provision.

(2) The contract is concluded either by written confirmation of the order or by the Client’s express acceptance, e.g. by email or in another way.

(3) The contract takes effect upon confirmation by the Contractor or performance of the agreed service.

Section 3 Scope and Performance of Services

(1) The exact scope of the services to be provided by the Contractor is set out in the respective contract or offer.

(2) The Contractor undertakes to perform the agreed services to the best of its ability and in accordance with the generally recognized standards of information security and cybersecurity.

(3) The Client undertakes to provide in good time all information and documents required for the proper performance of the audit or consulting.

Section 4 Remuneration and Terms of Payment

(1) The remuneration for the services provided is set out in the offer or the contract.

(2) Unless otherwise agreed, payment of the remuneration is due within 14 days of invoicing without deduction.

(3) If the Client is in default of payment, the Contractor is entitled to demand default interest of 9 percentage points above the base interest rate pursuant to Section 288(2) of the German Civil Code (BGB).

(4) All prices stated are exclusive of statutory VAT.

Section 5 Client’s Obligations to Cooperate

(1) The Client undertakes to provide the Contractor with all documents and information relevant to the performance of the audit or consulting completely and in good time.

(2) The Client ensures that the Contractor obtains access to the relevant premises, systems and documentation required for the performance of the audits or consulting services.

(3) The Client is obliged to disclose all risks and vulnerabilities relevant to information security that are known to the Client.

Section 6 Data Protection and Information Security

(1) Data protection

(1.1) The Contractor undertakes to process all personal data processed in the course of performing the contractual services in accordance with the General Data Protection Regulation (GDPR) and other relevant data protection laws.

(1.2) If, in the course of the contractual services, the Contractor processes personal data on behalf of the Client, a data processing agreement (DPA) will be concluded. The provisions on processing on behalf of the Client are set out in a separate document.

(1.3) The Contractor undertakes to take all necessary technical and organizational measures to ensure the protection of personal data and to minimize possible risks.

(2) Information security and cybersecurity

(2.1) The Contractor undertakes to perform all services in the area of information security and cybersecurity in compliance with recognized standards.

(2.2) The Contractor takes technical and organizational measures to ensure the confidentiality, integrity and availability of information and IT systems processed or stored in the course of providing the services.

(2.3) The Contractor ensures that all employees who have access to security-relevant information or IT systems receive regular training on data protection and information security, and that the IT systems used are regularly checked for security vulnerabilities.

(2.4) The Client is obliged to inform the Contractor without delay of security vulnerabilities or data protection breaches identified during the performance of the services.

(2.5) The Client undertakes to inform the Contractor without delay of cyberattacks or security incidents that could possibly affect the Contractor’s IT systems or data. In such cases, the Contractor must be informed as quickly as possible of the potential effects in order to take the necessary countermeasures.

Section 7 Liability and Warranty

(1) The Contractor is liable in accordance with the statutory provisions for damage based on intentional or grossly negligent conduct.

(2) For slight negligence, the Contractor is only liable for the breach of an essential contractual obligation (cardinal obligation), the fulfillment of which makes the proper performance of the contract possible in the first place and the breach of which jeopardizes the purpose of the contract. Liability is limited to the typical, foreseeable damage.

(3) The Contractor assumes no liability for consequential damage, data loss, security vulnerabilities or damage caused by cyberattacks, unless the damage was caused by intentional or grossly negligent conduct on the part of the Contractor.

(4) The Contractor assumes no liability for the success of the consulting or audit with regard to the certification of management systems or the implementation of security measures.

(5) The Client is liable for the proper provision of all required documents and information and for the security of the underlying systems and data made accessible to the Contractor in the course of the services.

(6) The above limitations of liability do not apply to damage resulting from injury to life, body or health or to claims under the German Product Liability Act (ProdHaftG).

Section 8 Confidentiality

(1) Both parties undertake to keep confidential all confidential information received in the course of the cooperation (including data, reports, analyses) and to use it only for the purpose of performing the contract.

(2) This obligation of confidentiality continues to apply after the end of the contractual relationship.

Section 9 Rights to Work Results

(1) Unless otherwise agreed, all rights to the work results (e.g. reports, expert opinions, presentations) remain with the Contractor.

(2) The Client receives a simple, non-transferable right to use the work results for the contractually agreed purpose.

Section 10 Force Majeure

(1) The Contractor is not liable for delays or non-performance of the contractual services caused by events of force majeure (e.g. natural disasters, war, strikes, pandemics).

(2) In the event of force majeure, both parties are released from the performance of their obligations for the duration of the event.

Section 11 Term of Contract and Termination

(1) The contract takes effect in accordance with Section 2 (Conclusion of the Contract) and ends with the complete provision of the agreed services, unless otherwise agreed.

(2) The contract may be terminated by either party for good cause. Good cause exists in particular if a party materially breaches its contractual obligations or if continuing the cooperation is unreasonable for one of the parties.

Section 12 Final Provisions

(1) Amendments and additions must be made in writing. The written form is satisfied if the amendments or additions are recorded in a written document (including email) and signed or confirmed by both parties.

(2) Oral agreements or amendments are only effective if they are confirmed in writing by both parties.

(3) Should any provision of this contract be wholly or partially invalid or unenforceable, the validity of the remaining provisions remains unaffected.

(4) German law applies. The place of jurisdiction for all disputes arising from this contract is the Contractor’s registered office.