General terms and conditions

§ 1 Scope

These terms apply to all contracts between davque (hereinafter the “Contractor”) and the client for the provision of security testing services. The services are aimed exclusively at businesses within the meaning of Section 14 of the German Civil Code (BGB), legal entities under public law and special funds under public law. Deviating terms of the client apply only with explicit written consent.

§ 2 Subject matter

The subject matter is the performance of agreed security assessments on the systems named in the individual contract and the documentation of the results in a report. The service is a service, not a work; a specific outcome – in particular finding all existing vulnerabilities – is expressly not owed.

§ 3 Authorization and cooperation

Before any test execution begins, the client hands over a test authorization signed by an authorized signatory. It names the test target, the domains and address ranges included, the test window, permitted and excluded techniques and an emergency contact reachable during the test window.

The client warrants that it has the right of disposal over all systems included in the scope or has obtained the necessary consents of third parties – in particular hosting and service providers. Without complete authorization the Contractor does not begin execution.

The client provides the required access, test data and contact persons in good time. Delays resulting from omitted cooperation postpone agreed dates accordingly.

§ 4 Execution

The Contractor performs the services using recognized methods and the state of the art. If a significant impairment of production operations is imminent, the Contractor aborts the measure concerned and informs the emergency contact without delay. Availability tests are only performed after separate written agreement.

§ 5 Fees and payment

The fixed fee agreed in the individual contract for the scope defined there applies. Extending the scope requires a separate written agreement. Invoices are payable within 14 days without deduction. All prices are net plus statutory VAT.

§ 6 Confidentiality

Both parties treat all information obtained in the course of the cooperation as confidential. The Contractor does not use findings from the project for its own publications unless the client has agreed in writing. The obligation continues beyond the end of the contract.

§ 7 Handling of results

The report is intended exclusively for the client’s internal purposes. Passing it on to third parties – such as customers or auditors – is permitted insofar as it serves the purpose of evidence; publication requires the written consent of the Contractor.

§ 8 Retention and deletion

Project-related data is deleted after the period agreed in the individual contract, by default 30 days after handover of the report. The deletion is logged and confirmed on request. Statutory retention obligations remain unaffected.

§ 9 Liability

The Contractor is liable without limitation for intent and gross negligence and for injury to life, body or health. In the case of slightly negligent breach of essential contractual obligations, liability is limited to the typical, foreseeable damage. Otherwise liability is excluded. TODO: set the liability cap and the relationship to professional liability insurance with legal advice.

§ 10 Final provisions

German law applies, excluding the UN Convention on Contracts for the International Sale of Goods. Where permissible, the place of jurisdiction is Berlin. Amendments and additions require text form. Should a provision be invalid, the validity of the remaining provisions remains unaffected.