General Terms and Conditions
These are the general Terms and Conditions of Defora Networks GmbH. This version of the general Terms andConditions is dated January 21st, 2020.
Defora Networks GmbH is a private limited liability company under German law, located in Berlin, Germany. It
is registered at the German Chamber of Commerce under Number HRB 205522 B.
These general Terms and Conditions apply to all agreements between Defora Networks GmbH and thecustomer. Defora Networks GmbH rejects any Terms and Conditions used by the customer. The parties canonly deviate from these general Terms and Conditions in writing. These general Terms and Conditions are also
intended to benefit any person employed or engaged by Defora Networks GmbH during the performance ofan assignment.
Defora Networks GmbH wants both parties to have a clear picture of an assignment before it starts. Thismeans there only is an agreement between Defora Networks GmbH and the customer if Defora Networks
GmbH sends a written offer containing the key terms of the agreement and the customer subsequently
accepts the offer. Communications other than the written offer do not form part of the agreement. This also
holds true for tasks that come up during testing but were not part of the original agreement; additional workneeds to be negotiated and added as a separate project. Defora Networks GmbH can rescind an offer until itis accepted by the customer.
It is important to understand the limits of Defora Networks GmbH's services. Defora Networks GmbH does not(and can not) give guarantees that something is fully secure. Defora Networks GmbH instead has an obligation
to make reasonable efforts to perform the agreed services.
Defora Networks GmbH will make reasonable efforts to perform the assignment in accordance with theplanning set out in the offer (if any). If Defora Networks GmbH expects it will not meet the planning, it will let
the customer know without delay. Defora Networks GmbH is not automatically deemed to be in default if it
does not meet the planning.
Defora Networks GmbH will make reasonable efforts to avoid disruption of the operations of the customer anddamage to systems owned or operated by the customer, but it cannot guarantee that this will be avoided. The
customer agrees to this. Defora Networks GmbH is not obliged to restore the systems or recover any data it
deleted or amended in the course of the assignment.
The customer will provide Defora Networks GmbH with all means necessary to allow Defora Networks GmbHto perform the agreed services.
If Defora Networks GmbH needs explicit permission from the customer to perform its services, for example
when doing penetration tests, the customer gives this permission. The customer also warrants that it has thelegal authority to give this permission.
Defora Networks GmbH and the customer will not disclose confidential information and personal data theyreceive from each other or gain access to in the course of an assignment to others. Defora Networks GmbHhas the right to disclose this information and data to persons engaged by Defora Networks GmbH, but only ifthese persons have a similar confidentiality obligation vis-á-vis Defora Networks GmbH. Any person will only
use the information and data they receive or gain access to for the purposes following from the agreement.
Both parties will take reasonable measures to maintain the confidentiality of the information and data they

Public — Page 1 of 5

received or gained access to, and will ensure that persons engaged by them do the same. In any case, thecustomer will be asked regarding and informed on who handles their data before it gets handled by said
person.
If Defora Networks GmbH in the course of an assignment finds a vulnerability which might affect the customer,
it will report this to the customer. If a vulnerability might affect third parties as well, Defora Networks GmbHretains the right to disclose this vulnerability also to others than the customer. It will only do so after having
given the customer a reasonable amount of time to take measures minimising the impact of the vulnerability, inline with responsible disclosure best practices.
If Defora Networks GmbH in the course of an assignment finds indicators of compromise, such as malware
signatures and IP addresses, it will report this to the customer. Defora Networks GmbH retains the right to also
publish this information in a publicly accessible database. It will do so only after it has given the customer theopportunity to object to the publication of data in case it would negatively impact the customer.
Defora Networks GmbH retains any intellectual property rights in products developed for an assignment, suchas software and reports.
For software it developed, this means that Defora Networks GmbH gives the customer a permanent, nonexclusive, transferable, sub-licensable, worldwide license to distribute and use the software in source andbinary forms, with or without modification (very similar to the BSD-license). If Defora Networks GmbH's
software is based on other software which is provided under a license which restricts Defora Networks
GmbH's ability to license its own software (such as the GPLv3 license), the more restrictive license will apply.
For other products it developed, such as reports and analyses, Defora Networks GmbH gives the customerthe same license, but this license is exclusive to the customer and does not contain the right to modification.
The latter condition is intended to ensure that the customer will not change Defora Networks GmbH'sproducts, such as reports and analyses. Defora Networks GmbH retains the right to reuse these products, forexample for training and marketing purposes. Defora Networks GmbH will remove any confidential informationfrom these products before publication.
Defora Networks GmbH retains title to any property transferred to the customer until all outstanding payments
by the customer have been done in full. Additionally, Defora Networks GmbH gives a license only after all
outstanding payments have been done in full.
Defora Networks GmbH has the right to appoint the persons who will perform the assignment. It has the rightto replace a person with someone with at least the same expertise, but only after having consulted with thecustomer.
Due to the nature of Defora Networks GmbH's business, Defora Networks GmbH regularly works withfreelancers for the performance of its assignments. Defora Networks GmbH has the right to engage thirdparties, including freelancers, in the course of the performance of an assignment - always after consulting withthe client.
Defora Networks GmbH wants to be able to use the expertise of its entire team to help with an assignment.
This means that in the course of an assignment, it is possible that the persons performing the assignment willconsult with and be advised by others in Defora Networks GmbH's team. These others will of course bebound by the same confidentiality obligations as the persons performing the assignment.

Public — Page 2 of 5

Defora Networks GmbH and the customer will attempt to precisely define the scope of the assignment before
Defora Networks GmbH starts. If during the course of the assignment, the scope turns out to be bigger thanexpected, Defora Networks GmbH will report this to the customer and make a written offer for the additionalwork.
All amounts in Defora Networks GmbH's offers are in Euro and excluding VAT and other applicable taxes
according to German law, unless agreed otherwise.
For assignments where the parties agreed to an hourly fee, Defora Networks GmbH will send an invoice after
each month. For other assignments, Defora Networks GmbH will send an invoice after completion of theassignment, and at moments set out in the offer (if any). The customer must pay an invoice within 30 days
from the invoice date.
Defora Networks GmbH may, prior to an assignment, agree on the payment of a deposit by the customer.
Defora Networks GmbH will settle deposits with interim payments or the final invoice for the assignment.
If the payment is not received before the agreed term, the client will be deemed to be in default without priornotice. Defora Networks GmbH will then have the right to charge the statutory interest and any judicial andextrajudicial (collection) costs.
If the customer cancels or delays the assignment two weeks before the start, Defora Networks GmbH isentitled to charge the customer 50% of the agreed price. If the customer cancels or delays the assignment
when it already started, Defora Networks GmbH is entitled to charge the customer 100% of the agreed price.
Defora Networks GmbH is entitled to charge a pro rata percentage in the case of cancellation or delay shorter
than two weeks before the start of the assignment (i.e. a cancellation one week before the assignment wouldentitle Defora Networks GmbH to charge 75% of the agreed price).
Any liability of Defora Networks GmbH resulting from or related to the performance of an assignment, shall belimited to the amount that is paid out in that specific case under an applicable indemnity insurance of Defora
Networks GmbH, if any, increased by the amount of the applicable deductible which under that insurance shallbe borne by Defora Networks GmbH. If no amount is paid out under an insurance, these damages are limited
to the amount already paid for the assignment, with a maximum of € 10.000,-.
Each claim for damages shall expire after a period of one month from the day following the day on which thecustomer became aware or could reasonably be aware of the existence of the damages.
To make things clear, Defora Networks GmbH is not liable if a person associated with Defora Networks GmbH
acts contrary to any confidentiality or non-compete obligation vis-à-vis the customer or a third party, thisperson might have agreed to in another engagement.
The customer shall indemnify Defora Networks GmbH and any person employed or engaged by Defora
Networks GmbH for any claims of third parties which are in any way related to the activities of Defora
Networks GmbH and any person employed or engaged by Defora Networks GmbH for the customer.
Should a third party lodge a claim against Defora Networks GmbH or any of the consultants it engaged oremployed as a result of the performance of the assignment for the customer, then the customer will cooperate fully with Defora Networks GmbH in defending against this claim, including by providing to Defora
Networks GmbH any evidence it has which relates to this claim.

Public — Page 3 of 5

Should the public prosecutor initiate an investigation or criminal proceedings against Defora Networks GmbHor any of the consultants it engaged or employed as a result of the performance of the assignment for thecustomer, then the customer will also co-operate fully with Defora Networks GmbH in defending against thisinvestigation or proceedings, including by providing any evidence it has which relates to this investigation orthese proceedings.
The customer shall reimburse to Defora Networks GmbH and any person employed or engaged by Defora
Networks GmbH all costs of legal defence and all damages in relation to these claims, investigations orproceedings. This provision does not apply to the extent a claim, investigation or proceeding is the result of theintent or recklessness of Defora Networks GmbH or a person employed or engaged by Defora NetworksGmbH.
In the case of force majeure as a result of which Defora Networks GmbH cannot reasonably be expected toperform the assignment, the performance will be suspended. Situations of force majeure include cases wheremeans, such as soft- and hardware, which are prescribed by the customer, do not function well. Theagreement may be terminated by either party if a situation of force majeure has continued longer than 90 days.
The customer will then have to pay the amount for the work already performed pro rata.
German law applies to the legal relationship between Defora Networks GmbH and its customers. Any dispute
between Defora Networks GmbH and a customer will be resolved in the first instance exclusively by theDistrict Court of Berlin, Germany.

Public — Page 4 of 5

Attribution
This document makes use of content under the Creative Commons Attribution 4.0 International License(https://creativecommons.org/licenses/by/4.0/)• ODT template for Offerte (https://github.com/radicallyopensecurity/templates/blob/master/Offertes/OFFdate.version-name-request.odt) by Michiel Leenaars and Bob Goudriaan.

Public — Page 5 of 5