CLIENT ENGAGEMENT CONTRACT
Master Services Agreement (Business Clients) and Consumer Services Agreement (Schedule 3)
ForgedCyberSentinel — Version 2.0 — Effective Date: 24 August 2026
This Client Engagement Contract (this "Agreement") is entered into by and between ForgedCyberSentinel and the client identified in the applicable Statement of Work, and sets out the terms and conditions on which ForgedCyberSentinel provides cybersecurity advisory and consulting services. This Agreement is structured so that engagements with business clients are governed by the Master Services Agreement terms set out below, while engagements with consumers are governed exclusively by Schedule 3.
(c) Mixed-purpose and unclear cases. Where a person enters into an engagement for purposes that are partly within and partly outside that person's trade, business, craft, or profession, and the business purpose is so limited as not to be predominant in the overall context of the engagement, that person shall be treated as a Consumer and the engagement shall be governed by Schedule 3. In any case of genuine doubt as to whether a client is a Business Client or a Consumer, ForgedCyberSentinel shall treat the client as a Consumer for the purpose of applying the more protective statutory regime, without prejudice to its right to establish the client's actual status.
This Agreement applies to every engagement between ForgedCyberSentinel and the Client, and its terms are incorporated by reference into each Statement of Work executed under it.
In this Agreement, the following capitalised terms have the meanings ascribed to them below. References to the singular include the plural and vice versa, and references to a statute include any subordinate legislation and any modification or re-enactment in force from time to time.
1.1 "Applicable Law" means all laws, regulations, statutory instruments, regulatory guidance, and binding decisions of competent courts or authorities applicable to either party or to the Services, including the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"), the Dutch Civil Code (Burgerlijk Wetboek, "BW"), Directive 2011/83/EU on consumer rights as implemented in Book 6, Title 5, Section 2B BW, Directive 93/13/EEC on unfair terms in consumer contracts as implemented in Articles 6:231 to 6:247 BW, and any sector-specific cybersecurity regulations relevant to the Client's industry.
1.1A "Business Client" means a Client acting wholly or mainly in the course of its trade, business, craft, or profession. Every reference in this Agreement to the "Client" is a reference to a Business Client.
1.1B "Consumer" means a natural person acting for purposes wholly or mainly outside that person's trade, business, craft, or profession, within the meaning of Article 6:230g(1)(a) of the Dutch Civil Code and Article 2(1) of Directive 2011/83/EU. Engagements with Consumers are governed exclusively by Schedule 3.
1.2 "Background IP" means all intellectual property, know-how, methodologies, tools, templates, frameworks, and materials developed by or for a party independently of this Agreement or any Statement of Work, including ForgedCyberSentinel's proprietary assessment frameworks, scoring models, report templates, and analytical techniques.
1.3 "Client Materials" means all information, data, documents, and materials provided by the Client to ForgedCyberSentinel in connection with a Statement of Work, including infrastructure diagrams, vulnerability reports, incident details, policies, and any other materials shared by the Client.
1.4 "Confidential Information" means all non-public information disclosed by either party to the other, whether orally, in writing, electronically, or by inspection, that is either marked as confidential or that a reasonable person would understand to be confidential given its nature and the circumstances of disclosure.
1.5 "Deliverables" means any written report, assessment, recommendation, advisory note, plan, training material, or other work product prepared by ForgedCyberSentinel for the Client under a Statement of Work, in each case excluding ForgedCyberSentinel's Background IP and any methodologies, tools, or templates used to produce such work product.
1.6 "Engagement" means each separate advisory, consulting, or incident-response engagement between ForgedCyberSentinel and the Client, governed by this Agreement and an applicable Statement of Work.
1.7 "Fees" means the consideration payable by the Client to ForgedCyberSentinel for the Services, as set out in the applicable Statement of Work.
1.8 "Services" means the cybersecurity advisory, consulting, incident-response, prevention, and related professional services provided by ForgedCyberSentinel to the Client as described in the applicable Statement of Work, being advisory and consultative in nature and expressly excluding any managed security services, ongoing system monitoring, system administration, or direct operational access to the Client's information systems.
1.9 "Statement of Work" or "SOW" means the written agreement, scope letter, or engagement letter executed by the parties that describes the specific Services, Deliverables, timeline, Fees, and other commercial terms for an Engagement, and which is governed by and subject to this Agreement. Each SOW forms an integral part of this Agreement.
This Agreement sets out the general terms on which ForgedCyberSentinel will provide Services to the Client from time to time. Each Engagement will be initiated by a separate SOW executed by authorised representatives of both parties. A SOW shall, at a minimum, identify the Services to be performed, the expected Deliverables, the timeline or milestones, the Fees and payment schedule, key personnel, any assumptions and dependencies, and any specific acceptance criteria applicable to the Deliverables.
In the event of any conflict between the documents forming an Engagement, the following order of precedence shall apply (highest to lowest): (a) a duly executed amendment to a SOW that expressly references the clause being amended; (b) the SOW; (c) any schedule to this Agreement (including the Mutual NDA overlay in Schedule 2 where applicable); and (d) this Agreement. No term or condition contained in any purchase order, acknowledgement, or other communication from the Client shall apply to an Engagement unless expressly accepted in writing by an authorised representative of ForgedCyberSentinel.
A SOW may incorporate by reference the ForgedCyberSentinel Terms and Conditions published at https://forgedcybersentinel.com. In the event of any conflict between this Agreement and the Terms and Conditions, this Agreement shall prevail. Where a SOW does not expressly incorporate the Terms and Conditions, this Agreement alone shall govern the Engagement.
ForgedCyberSentinel provides cybersecurity advisory and consulting services to commercial clients operating in the European Union, and, under the separate terms of Schedule 3, to individual consumers. The Services are designed to assist the Client in identifying, assessing, preventing, responding to, and recovering from cybersecurity risks and incidents. The precise scope of Services for each Engagement is set out in the applicable SOW. No service shall be deemed to be included in an Engagement unless expressly described in the SOW, and ForgedCyberSentinel shall have no obligation to provide any service not so described.
Without limiting the generality of the foregoing, the Services may include cybersecurity risk assessments, security posture reviews, advisory on preventive controls, incident-response planning and tabletop exercises, policy and procedure drafting support, advisory on regulatory compliance relating to cybersecurity, and general cybersecurity consulting. ForgedCyberSentinel may engage qualified subcontractors to perform specific portions of the Services, provided that ForgedCyberSentinel remains responsible to the Client for the performance of the subcontracted work as if it had been performed by ForgedCyberSentinel itself.
Any change to the scope of an Engagement after the SOW has been signed must be agreed in writing through a change order signed by authorised representatives of both parties. ForgedCyberSentinel is not obligated to perform any work outside the scope of the original SOW in advance of a signed change order, and any work performed at the Client's request outside the agreed scope shall be charged at ForgedCyberSentinel's then-current time-and-materials rates unless otherwise agreed in writing in the change order.
The Client expressly acknowledges and agrees that the Services are advisory and consultative in nature only. ForgedCyberSentinel does not provide managed security services, does not monitor the Client's information systems on an ongoing basis, does not operate, configure, or administer the Client's systems, networks, applications, or devices, and does not assume any operational responsibility for the security, availability, integrity, or confidentiality of the Client's information systems or data. ForgedCyberSentinel does not process personal data on behalf of the Client in the performance of the Services and is not acting as a data processor within the meaning of Article 28 of the GDPR.
Any recommendations, guidance, plans, or Deliverables provided by ForgedCyberSentinel are intended to inform the Client's own decision-making and to be implemented by the Client's own personnel or third-party providers engaged directly by the Client. The decision whether to implement, modify, or reject any recommendation rests solely with the Client, and the Client bears full responsibility for the implementation, operation, and maintenance of its information systems. ForgedCyberSentinel shall have no liability for any act or omission of the Client, its personnel, or any third-party provider in implementing or failing to implement any recommendation, except to the extent that any such act or omission directly results from a wilful misconduct or fraudulent misrepresentation by ForgedCyberSentinel.
Should the Client require services that fall outside the advisory scope described in this Section — including but not limited to ongoing system monitoring, incident-response operational intervention within the Client's environment, or processing of personal data on behalf of the Client — such services must be agreed in a separate written agreement that expressly addresses the additional risk allocation, insurance requirements, and any data-processing obligations required under the GDPR. No such expanded scope shall be implied from any communication, proposal, or conduct in the absence of an express written agreement. In particular, no expanded scope shall be inferred from ForgedCyberSentinel's review of Client Materials that incidentally reveal operational details of the Client's environment.
The Client shall provide ForgedCyberSentinel with such information, access, documentation, personnel, and cooperation as ForgedCyberSentinel reasonably requires to perform the Services, in a timely and accurate manner. The Client shall appoint a single point of contact with authority to make decisions on behalf of the Client in respect of the Engagement and shall ensure that this individual is reasonably available throughout the Engagement. Any delay or failure by the Client in providing such cooperation shall extend any timeline in the SOW by a corresponding period and shall not constitute a breach by ForgedCyberSentinel.
The Client represents that all Client Materials it provides to ForgedCyberSentinel are accurate, complete, and not misleading, and that the Client is entitled to disclose such materials to ForgedCyberSentinel for the purposes of the Engagement. The Client shall not knowingly provide ForgedCyberSentinel with personal data of the Client's customers, employees, or other data subjects unless expressly required for the performance of the Services and authorised under Applicable Law. Where the Client discloses personal data to ForgedCyberSentinel, the Client shall inform ForgedCyberSentinel in writing of the nature of the personal data prior to disclosure so that appropriate safeguards can be agreed.
The Client is solely responsible for the implementation of any recommendations, the operation of its information systems, the maintenance of its own security controls, and compliance with all Applicable Laws applicable to its business. ForgedCyberSentinel shall have no obligation to verify the accuracy of any information provided by the Client or to investigate matters beyond the agreed scope of the Engagement. The Client shall promptly notify ForgedCyberSentinel of any matter of which it becomes aware that may materially affect the performance, scope, or safety of the Services.
The Client shall pay the Fees for the Services as set out in the applicable SOW. Unless otherwise stated in the SOW, Fees are quoted in euros (EUR), exclusive of value-added tax (VAT) and any other applicable taxes, duties, or levies, which shall be added to the invoice and payable by the Client at the prevailing rate. Where a SOW provides for time-and-materials billing, ForgedCyberSentinel shall record time in increments of fifteen (15) minutes and shall maintain accurate records of time spent on the Engagement.
Invoices shall be issued in accordance with the payment schedule set out in the SOW. Where no schedule is specified, invoices shall be issued monthly in arrears for work performed in the preceding month and shall be payable within fourteen (14) calendar days of the invoice date. Payment shall be made by bank transfer to the account designated by ForgedCyberSentinel on the invoice, in cleared funds, without set-off, deduction, or withholding other than as required by Applicable Law.
Without prejudice to any other right or remedy, if the Client fails to make any payment by the due date, ForgedCyberSentinel may: (a) charge interest on the overdue amount at the statutory commercial rate applicable in the Netherlands under Article 6:119a of the Dutch Civil Code, accruing daily from the due date until payment in full; (b) recover from the Client all reasonable costs of recovery, including the statutory commercial debt-collection costs under Article 6:96 of the Dutch Civil Code; and (c) suspend performance of any further Services, including the delivery of any Deliverables, until all overdue amounts (including interest and recovery costs) have been paid in full. Suspension under this Section shall not constitute a breach by ForgedCyberSentinel.
Unless a SOW expressly provides for a written acceptance procedure, Deliverables shall be deemed accepted by the Client upon delivery. Where a written acceptance procedure is specified in the SOW, the Client shall have seven (7) calendar days from delivery to notify ForgedCyberSentinel in writing of any material non-conformity of the Deliverables with the specifications in the SOW, specifying in reasonable detail the nature of the alleged non-conformity. If no such written notice is received within that period, the Deliverables shall be deemed accepted.
ForgedCyberSentinel shall, at its option, remedy any material non-conformity notified within the acceptance period or refund the proportion of the Fees attributable to the non-conforming portion of the Deliverables, and the remedy set out in this Section shall be the Client's sole and exclusive remedy in respect of any non-conformity of the Deliverables. For the avoidance of doubt, the Client's right to reject Deliverables under this Section shall not apply to: (a) issues that exist only because the Client failed to provide accurate, complete, or timely information or cooperation; (b) deviations that are insubstantial or that do not materially affect the fitness of the Deliverables for the purposes described in the SOW; or (c) any matter that the Client has actually or constructively relied upon or implemented before notifying ForgedCyberSentinel.
The Client acknowledges and agrees that, once the Services have been performed, they cannot be returned, unperformed, or resold. Accordingly, all Fees paid or payable for Services that have been performed are non-refundable in whole or in part. This Section reflects the intrinsic nature of professional advisory services and is a material basis of the bargain between the parties.
Consumers. This Section, and the deemed-acceptance mechanism earlier in it, apply only to Business Clients. A Consumer has a statutory right of withdrawal of fourteen (14) days and full statutory conformity remedies, which are set out in Part C of Schedule 3 and are not affected by this Section.
The Client expressly acknowledges and agrees that cybersecurity is a dynamic and adversarial field in which no provider, however skilled or diligent, can guarantee the prevention, detection, or successful resolution of any security incident. New vulnerabilities, attack techniques, and threat actors emerge continuously, and even the most rigorous controls and recommendations may be circumvented by determined adversaries, by novel attack vectors, or by failings in the Client's own implementation. Accordingly, ForgedCyberSentinel does not warrant or guarantee that the Services will result in the prevention of any cyber incident, the elimination of any vulnerability, the achievement of any specific security outcome, or the absence of any breach, loss, or damage.
Except as expressly set out in this Agreement or in a SOW, all warranties, conditions, representations, and other terms that would otherwise be implied into this Agreement by statute, common law, or otherwise are excluded to the maximum extent permitted by Applicable Law. ForgedCyberSentinel warrants only that the Services shall be performed with the reasonable skill and care of a qualified cybersecurity advisor. This warranty is given in lieu of, and ForgedCyberSentinel hereby disclaims, all other warranties, whether express or implied, including any warranties of merchantability, fitness for a particular purpose, non-infringement, or that the Services will meet the Client's requirements or achieve any particular result.
The Client's sole and exclusive remedy for any breach of the warranty in this Section shall be, at ForgedCyberSentinel's option, the re-performance of the affected Services or the refund of the proportion of the Fees attributable to the affected Services. The Client must notify ForgedCyberSentinel of any alleged breach of warranty within thirty (30) calendar days of the date on which the Services were performed or the breach ought reasonably to have been discovered, failing which the warranty shall be deemed waived.
The Client expressly acknowledges that ForgedCyberSentinel's expertise is based on practical, operational, and field-tested experience in cybersecurity incident response, prevention, and consulting, and not on the basis of formal third-party certifications or accreditations. As of the Effective Date, ForgedCyberSentinel does not hold ISO/IEC 27001 certification, SOC 2 attestation, NIST framework alignment certification, or any other formal third-party certification or accreditation. The Client further acknowledges that ForgedCyberSentinel does not currently maintain professional indemnity insurance or any other liability insurance, and the Client has had the opportunity to consider this fact in deciding whether to engage ForgedCyberSentinel and in determining the scope and Fee structure of the Engagement.
Nothing in any proposal, SOW, Deliverable, or communication from ForgedCyberSentinel shall be construed as a representation that ForgedCyberSentinel holds any certification, accreditation, or insurance that it does not in fact hold. ForgedCyberSentinel does not represent, warrant, or imply that it carries professional indemnity insurance, public liability insurance, or any other form of insurance, and the Client shall not rely on any such representation in entering into this Agreement or any SOW. The Client acknowledges that the absence of insurance has been disclosed prior to engagement and that the Fees reflect the cost structure of an uncertified, uninsured advisory practice.
This disclosure is made to Consumers as well, in accordance with Articles 6:193a to 6:193j BW on unfair commercial practices, but it does not limit ForgedCyberSentinel's liability to a Consumer in any way, and the absence of insurance is not a defence to any claim by a Consumer.
Where the Services refer to or are informed by recognised frameworks (such as the NIST Cybersecurity Framework, ISO/IEC 27001, CIS Controls, MITRE ATT&CK, or similar), such references indicate that ForgedCyberSentinel's advice draws upon the conceptual content of those frameworks and not that ForgedCyberSentinel has been certified against them or that the Client's environment will achieve certification or compliance with them as a result of the Services. If, at any time during an Engagement, the Client requires the involvement of a certified or insured provider — for example because a regulator, contract counterparty, or insurer requires it — the Client shall promptly notify ForgedCyberSentinel, and the parties shall discuss in good faith whether the Engagement can continue, be modified, or be transitioned to a third-party provider.
This Section 10 applies only to Business Clients. It has no application to a Consumer, and ForgedCyberSentinel will not rely on it against a Consumer. Liability towards Consumers is dealt with in Part D of Schedule 3.
This Section 10 sets out the entire liability of ForgedCyberSentinel to the Business Client in respect of any Engagement and shall apply to the maximum extent permitted by Applicable Law. The Client's attention is specifically drawn to the fact that the Fees for the Services have been calculated on the basis of the limitations and exclusions of liability set out in this Section, and that the Client has had the opportunity to engage ForgedCyberSentinel on alternative terms (including without limitation of liability) at a higher Fee, and has elected not to do so.
10.1 Aggregate Cap. Subject to Section 10.3, ForgedCyberSentinel's total aggregate liability arising out of or in connection with any Engagement, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, shall in no circumstances exceed an amount equal to the total Fees actually paid by the Client to ForgedCyberSentinel in respect of the Engagement giving rise to the claim, or, where the claim arises from services performed over a period, the total Fees paid in the twelve (12) months immediately preceding the event giving rise to the claim. Where a SOW specifies a higher cap, that higher cap shall apply to the Engagement under that SOW. The parties agree that the cap set out in this Section is reasonable given the Fee structure, the scope of the Services, and the fact that ForgedCyberSentinel does not maintain professional liability insurance.
10.2 Excluded Losses. Subject to Section 10.3, in no event shall ForgedCyberSentinel be liable to the Client for: (a) any indirect, incidental, special, or consequential loss or damage; (b) any loss of profits, loss of revenue, loss of business, loss of goodwill, or loss of opportunity; (c) any loss or corruption of data; (d) any loss arising from any actual or alleged cyber incident, breach, or compromise affecting the Client or any third party; (e) any loss arising from the Client's failure to implement, or its manner of implementing, any recommendation; or (f) any loss arising from any act or omission of any third party, including any third-party provider engaged by the Client. The exclusion in sub-paragraph (d) above applies regardless of whether the cyber incident relates to a vulnerability, threat, or risk that was the subject of the Services.
10.3 Carve-Outs. Nothing in this Agreement shall exclude or limit the liability of either party for: (i) death or personal injury caused by its negligence; (ii) fraud or fraudulent misrepresentation; (iii) wilful misconduct; (iv) any other liability that cannot be excluded or limited under Applicable Law, including liability under Section 6:76 of the Dutch Civil Code for intent or deliberate recklessness (opzet of bewuste roekeloosheid); or (v) the Client's payment obligations under Section 6.
The Client acknowledges that the limitations and exclusions of liability in this Section reflect a reasonable allocation of risk between the parties and form an essential basis of the bargain. The Client further acknowledges that, in the absence of insurance maintained by ForgedCyberSentinel, the limitations and exclusions in this Section are the principal mechanism by which ForgedCyberSentinel manages its exposure to liability, and that the Fees have been set accordingly. The Client is strongly encouraged to maintain its own adequate cyber-liability and professional-indemnity insurance to cover losses that may fall outside the scope of ForgedCyberSentinel's liability under this Agreement.
This Section 11 applies only to Business Clients. No Consumer is required to indemnify ForgedCyberSentinel under any circumstances.
The Client shall indemnify, defend, and hold harmless ForgedCyberSentinel and its proprietor, personnel, agents, and permitted subcontractors (each an "Indemnified Person") from and against any and all claims, actions, proceedings, demands, losses, damages, fines, penalties, costs, and expenses (including reasonable legal fees) of whatsoever nature arising out of or in connection with: (a) the Client's breach of this Agreement or any SOW; (b) the Client's use, implementation, or non-implementation of any recommendation, Deliverable, or other output of the Services; (c) any actual or alleged cyber incident, breach, or compromise affecting the Client's information systems or data; (d) any claim by a third party that the Client's provision of Client Materials to ForgedCyberSentinel infringes the rights of any third party or breaches any Applicable Law; (e) any claim by a regulator, customer, or other third party arising from the Client's cybersecurity posture, practices, or incidents; and (f) any claim by the Client's personnel, customers, or other data subjects relating to personal data that the Client has disclosed to ForgedCyberSentinel in breach of this Agreement.
ForgedCyberSentinel shall indemnify, defend, and hold harmless the Client from and against any and all third-party claims that the Deliverables, when used by the Client in accordance with the licence granted under Section 12, infringe the intellectual property rights of any third party, provided that ForgedCyberSentinel's total liability under this indemnity shall be subject to the cap in Section 10.1. ForgedCyberSentinel's obligations under this indemnity are conditional upon the Client: (i) promptly notifying ForgedCyberSentinel in writing of the claim; (ii) giving ForgedCyberSentinel sole control of the defence and settlement of the claim; and (iii) providing ForgedCyberSentinel with reasonable cooperation in the defence and settlement of the claim.
Where the Deliverables are subject to an infringement claim or ForgedCyberSentinel reasonably believes they may become subject to such a claim, ForgedCyberSentinel may, at its option and expense: (a) procure for the Client the right to continue using the Deliverables; (b) modify the Deliverables so that they become non-infringing without materially adversely affecting their functionality; or (c) replace the Deliverables with non-infringing equivalents. If none of these options is reasonably available, ForgedCyberSentinel may terminate the licence in respect of the affected Deliverables and refund the proportion of the Fees attributable to them. This Section 11.2 sets out the Client's sole and exclusive remedy in respect of any intellectual property infringement claim.
Each party retains all right, title, and interest in and to its Background IP. ForgedCyberSentinel's Background IP includes, without limitation, any proprietary assessment frameworks, scoring models, report templates, analytical techniques, and other methodologies used by ForgedCyberSentinel in delivering the Services, even where such Background IP is embodied in or used to produce a Deliverable. Nothing in this Agreement transfers any ownership of Background IP from one party to the other.
Subject to the Client's payment in full of all Fees due in respect of an Engagement, ForgedCyberSentinel grants the Client a non-exclusive, non-transferable, non-sublicensable, perpetual, royalty-free, worldwide licence to use, copy, modify, and internally distribute the Deliverables produced for the Client under that Engagement, solely for the Client's internal business purposes. The Client shall not: (a) resell, sublicense, publish, or otherwise distribute the Deliverables to any third party without ForgedCyberSentinel's prior written consent; (b) remove or alter any proprietary notices included in the Deliverables; or (c) use the Deliverables to develop a competing service offering. The licence granted under this Section is expressly conditional upon payment in full and shall automatically terminate upon any material breach by the Client of its payment obligations that remains uncured for thirty (30) calendar days.
All intellectual property rights in the Client Materials remain the property of the Client or its licensors. ForgedCyberSentinel is granted a limited licence to use the Client Materials solely for the purpose of performing the Services and fulfilling its obligations under this Agreement. Following completion or termination of an Engagement, ForgedCyberSentinel shall, at the Client's written request, return or securely destroy any Confidential Information of the Client in its possession, except to the extent retention is required by Applicable Law or ForgedCyberSentinel's professional record-keeping obligations.
Each party (as "Receiving Party") shall hold the Confidential Information of the other party (as "Disclosing Party") in strict confidence and shall not disclose, copy, or use such Confidential Information for any purpose other than the performance of its obligations or the exercise of its rights under this Agreement. The Receiving Party shall protect Confidential Information using at least the same degree of care it uses to protect its own confidential information of similar importance, and in no event less than a reasonable degree of care. The Receiving Party shall restrict access to Confidential Information to its personnel and permitted subcontractors who have a need to know for the purposes of the Engagement and who are bound by written confidentiality obligations no less protective than those in this Section.
The obligations in this Section shall not apply to information that: (a) is or becomes publicly available without breach of this Agreement; (b) was lawfully in the Receiving Party's possession free of any obligation of confidence prior to disclosure by the Disclosing Party; (c) is independently developed by the Receiving Party without reference to or use of the Disclosing Party's Confidential Information; or (d) is required to be disclosed by law, regulation, or order of a court or competent authority, provided that the Receiving Party gives the Disclosing Party prompt written notice of such requirement (to the extent legally permitted) and reasonable cooperation to enable the Disclosing Party to seek a protective order or other appropriate remedy.
The confidentiality obligations in this Section shall survive the termination or expiry of any Engagement for a period of five (5) years, except that Confidential Information that constitutes a trade secret under Applicable Law shall remain subject to confidentiality obligations for so long as it retains its trade-secret status. Where the parties have executed the Mutual NDA overlay set out in Schedule 2, the terms of that Schedule shall apply in addition to, and not in substitution for, the confidentiality obligations in this Section, and in the event of any conflict the more protective provision shall apply. The Receiving Party acknowledges that monetary damages alone may not be an adequate remedy for a breach of confidentiality and that the Disclosing Party shall be entitled to seek injunctive relief without prejudice to any other rights or remedies.
ForgedCyberSentinel processes limited personal data in connection with the operation of its website and its pre-contractual and contractual communications with the Client, as further described in its Privacy Policy available at https://forgedcybersentinel.com. For the avoidance of doubt, the performance of the Services does not involve ForgedCyberSentinel processing personal data on behalf of the Client, and ForgedCyberSentinel is not acting as a processor within the meaning of Article 28 of the GDPR. Each party shall comply with its respective obligations under the GDPR and any other Applicable Law relating to the processing of personal data.
The Client shall not provide ForgedCyberSentinel with personal data of the Client's customers, employees, or other data subjects except to the extent strictly necessary for the performance of the Services, and in such case the Client shall ensure that it has an appropriate lawful basis for disclosing such personal data to ForgedCyberSentinel and shall inform ForgedCyberSentinel in writing of the categories of personal data to be disclosed prior to any disclosure. The Client indemnifies and holds ForgedCyberSentinel harmless from any claim, fine, or loss arising from the Client's unauthorised disclosure of personal data to ForgedCyberSentinel.
In the event that the scope of an Engagement is expanded in the future to include services that would render ForgedCyberSentinel a processor of personal data on behalf of the Client — for example, managed security services involving access to the Client's systems or data — the parties shall enter into a separate data processing agreement in the form required by Article 28(3) of the GDPR before any such processing commences. No such processor relationship shall be implied in the absence of such written agreement.
Neither party shall be liable for any failure or delay in performing its obligations under this Agreement to the extent that such failure or delay is caused by an event of force majeure, being an event beyond the reasonable control of the affected party, including without limitation acts of God, natural disasters, fire, flood, earthquake, epidemic or pandemic, war, armed conflict, civil unrest, terrorism, sabotage, governmental action, labour disputes, strikes (other than at the affected party's own facilities), failure of utilities or telecommunications networks, internet or infrastructure failures, and large-scale cyber incidents affecting third-party infrastructure on which the affected party reasonably relies.
The affected party shall: (a) notify the other party in writing within five (5) business days of becoming aware of the force majeure event, providing reasonable details of its nature, expected duration, and impact; (b) use reasonable endeavours to mitigate the impact and to resume performance as soon as reasonably practicable; and (c) keep the other party reasonably informed of developments. The affected party shall not be entitled to rely on force majeure for any obligation to pay amounts due under this Agreement. If a force majeure event continues for more than thirty (30) consecutive calendar days, either party may terminate the affected Engagement by written notice with immediate effect, in which case Section 17.4 shall apply.
This Agreement takes effect on the Effective Date and shall remain in force until terminated in accordance with this Section. This Agreement applies to each Engagement from the commencement of that Engagement until its completion or earlier termination, and the expiry or termination of any one Engagement shall not affect the continuing application of this Agreement to any other Engagement or to any provision that by its nature is intended to survive.
Either party may terminate an Engagement or this Agreement for convenience by giving not less than thirty (30) calendar days' written notice to the other party. Upon termination for convenience, the Client shall pay for all Services performed and reasonable, documented, irrevocable expenses incurred by ForgedCyberSentinel up to the effective date of termination, including any non-cancellable commitments entered into by ForgedCyberSentinel in reliance on the Engagement.
ForgedCyberSentinel may terminate an Engagement or this Agreement with immediate effect by written notice to the Client if: (a) the Client commits a material breach of this Agreement or any SOW that is incapable of remedy or, if capable of remedy, is not remedied within fifteen (15) calendar days of written notice; (b) the Client fails to pay any undisputed invoice within fifteen (15) calendar days of the due date; (c) the Client becomes insolvent, enters into any arrangement with its creditors, has a receiver, administrator, or liquidator appointed over any of its assets, or ceases or threatens to cease to carry on business; or (d) the Client engages in any conduct that, in ForgedCyberSentinel's reasonable opinion, exposes ForgedCyberSentinel, its personnel, or any third party to unacceptable legal, reputational, or security risk.
Upon termination of an Engagement for any reason: (a) the Client shall immediately pay all Fees and other amounts due to ForgedCyberSentinel up to the effective date of termination, together with any costs recoverable under Section 6; (b) ForgedCyberSentinel shall, at the Client's written request and at the Client's cost, deliver to the Client any work in progress in its then-current state; (c) each party shall return or, at the other party's option, securely destroy the Confidential Information of the other party in its possession, except to the extent retention is required by Applicable Law; and (d) the provisions of this Agreement that by their nature are intended to survive termination — including without limitation Sections 8 (No Warranty of Outcome), 9 (Practical Experience Disclaimer and Insurance Non-Representation), 10 (Limitation of Liability), 11 (Indemnification), 12 (Intellectual Property), 13 (Confidentiality), 14 (Data Protection), 18 (Governing Law and Jurisdiction), and 19 (Dispute Resolution) — shall continue in full force and effect.
Any notice or other communication given under or in connection with this Agreement shall be in writing and shall be delivered to the relevant party at the address or email address set out in the SOW or, failing that, as published from time to time on ForgedCyberSentinel's website at https://forgedcybersentinel.com. Notices to ForgedCyberSentinel may be sent by email to the contact address published on the website, with a copy by registered post to the postal address published on the website.
Notices shall be deemed received: (a) if delivered by hand, on the date of delivery; (b) if sent by registered post within the Netherlands, on the second business day after posting; (c) if sent by registered post from outside the Netherlands, on the fifth business day after posting; and (d) if sent by email, at the time of transmission, provided that no delivery-failure notification has been received and a copy has also been sent by an alternative method. Notices of legal proceedings must be served by registered post or hand delivery in accordance with the rules of civil procedure of the Netherlands.
This Agreement and any Engagement, and any dispute or claim arising out of or in connection with them or their subject matter or formation (including non-contractual disputes or claims), shall be governed by and construed in accordance with the laws of the Netherlands, excluding the conflict-of-laws rules of the Netherlands and excluding the United Nations Convention on Contracts for the International Sale of Goods (CISG), the application of which is hereby expressly excluded.
Consumers. The choice of law and jurisdiction provisions in this Section apply only to Business Clients. For Consumers, the choice of Dutch law is subject to Article 6(2) of Regulation (EC) No 593/2008 (Rome I), and jurisdiction is governed by Articles 17 to 19 of Regulation (EU) No 1215/2012 and Article 108(2) of the Dutch Code of Civil Procedure, as set out in Part F of Schedule 3.
Subject to Section 19 (Dispute Resolution), the parties irrevocably submit to the exclusive jurisdiction of the competent courts of the Netherlands, sitting in the district of the registered place of business of ForgedCyberSentinel, in respect of any dispute or claim arising out of or in connection with this Agreement or any Engagement. The parties waive any objection to the venue of such courts on the grounds of forum non conveniens or otherwise.
International enforcement fallback. Notwithstanding the foregoing, ForgedCyberSentinel may bring proceedings to recover sums due under this Agreement in any court of competent jurisdiction, and the parties agree that the exclusive jurisdiction clause in Section 18.2 shall not preclude ForgedCyberSentinel from seeking interim or injunctive relief in any court of competent jurisdiction where necessary to protect its rights or Confidential Information. The parties further agree that any judgment of a court of competent jurisdiction may be enforced in any jurisdiction in accordance with the applicable rules of recognition and enforcement, including where applicable under Council Regulation (EU) No. 1215/2012 (Brussels I recast) for judgments given in one EU Member State and sought to be enforced in another, the Hague Convention on the Recognition and Enforcement of Foreign Judgments in Civil and Commercial Matters (2019), and any bilateral or multilateral treaty on the recognition and enforcement of judgments in force between the Netherlands and the country of enforcement. The Client waives any defence based on the foreign nature of the judgment to the extent permitted by Applicable Law.
The parties shall attempt in good faith to resolve any dispute arising out of or in connection with this Agreement or any Engagement promptly through negotiation between senior representatives of each party who have authority to settle the dispute. Either party may initiate the negotiation process by giving written notice to the other party identifying the dispute and proposing a resolution. If the dispute is not resolved within fifteen (15) business days of such notice (or such longer period as the parties may agree in writing), either party may escalate the dispute to mediation under the rules of the Netherlands Mediation Institute (NMI) or such other mediation rules as the parties may agree in writing.
If the dispute is not resolved through negotiation or mediation within sixty (60) calendar days of the initial notice (or such longer period as the parties may agree in writing), either party may commence proceedings before the competent courts of the Netherlands in accordance with Section 18. Nothing in this Section shall prevent either party from applying to a court of competent jurisdiction for urgent interim or injunctive relief at any time. The parties expressly agree that the dispute resolution procedures in this Section are conditions precedent to the commencement of court proceedings, except in respect of applications for urgent interim or injunctive relief.
For Engagements with international clients (i.e., clients not established in the Netherlands), the parties may, by mutual written agreement recorded in the SOW or a separate dispute-resolution agreement, refer any dispute to arbitration under the rules of the Netherlands Arbitration Institute (NAI) seated in Amsterdam, with the language of the arbitration being English and the number of arbitrators being one. Where arbitration is so agreed, the arbitration clause shall be in substitution for the jurisdiction clause in Section 18.2, and the award shall be final and binding on the parties and enforceable in accordance with the New York Convention on the Recognition and Enforcement of Foreign Arbitral Awards (1958).
20.1 Entire Agreement. This Agreement, together with any SOW and any documents expressly referred to in it, constitutes the entire agreement between the parties in relation to its subject matter and supersedes all prior or contemporaneous agreements, representations, understandings, and negotiations, whether written or oral. Each party acknowledges that it has not relied on any statement, representation, assurance, or warranty other than those expressly set out in this Agreement or the applicable SOW. Nothing in this Agreement shall limit or exclude any liability for fraud or fraudulent misrepresentation.
20.2 Independent Contractors. This Agreement shall not constitute, and shall not be construed as creating, a partnership, joint venture, agency, employment, or fiduciary relationship between the parties. ForgedCyberSentinel is an independent contractor, and neither party has authority to bind the other or to incur any obligations on behalf of the other except as expressly permitted in writing. Recommendations and Deliverables provided by ForgedCyberSentinel do not constitute legal advice, audit opinions, or regulatory compliance certifications.
20.3 Assignment. The Client shall not assign, transfer, sub-contract, or otherwise deal with any of its rights or obligations under this Agreement or any Engagement without the prior written consent of ForgedCyberSentinel, such consent not to be unreasonably withheld or delayed. ForgedCyberSentinel may assign, transfer, or novate its rights and obligations under this Agreement to any successor entity in connection with any reorganisation, conversion to a Dutch B.V., or sale of all or substantially all of its business, on written notice to the Client. The Client's consent to such assignment or novation is hereby given in advance.
20.4 Third-Party Rights. A person who is not a party to this Agreement shall have no right to enforce any of its provisions, except that the proprietor of ForgedCyberSentinel and any successor entity shall be entitled to enforce this Agreement as if a party to it.
20.5 Severability. If any provision of this Agreement is held by a court or other competent authority to be invalid, illegal, or unenforceable in whole or in part, that provision shall, to the extent of its invalidity, illegality, or unenforceability, be deemed modified to the minimum extent necessary to make it valid, legal, and enforceable, or, if such modification is not possible, shall be deemed deleted. The validity, legality, and enforceability of the remaining provisions shall not be affected.
20.6 Waiver. No failure or delay by either party to exercise any right or remedy provided under this Agreement or by Applicable Law shall constitute a waiver of that or any other right or remedy, nor shall it preclude or restrict the further exercise of that or any other right or remedy. A waiver is only effective if given in writing and signed by an authorised representative of the waiving party, and it applies only to the specific circumstances for which it is given.
20.7 Variation. No variation of this Agreement shall be effective unless made in writing and signed by an authorised representative of each party (in the case of variations to this Agreement) or incorporated into a signed SOW or change order (in the case of variations to a specific Engagement).
20.8 Counterparts. This Agreement and any SOW may be executed in any number of counterparts, each of which when executed shall constitute an original, but all the counterparts shall together constitute the same agreement. Electronic signatures and signatures transmitted by email (including in PDF format) shall be deemed to constitute original signatures for all purposes of this Agreement.
20.9 Survival. Any provision of this Agreement that expressly or by implication is intended to come into or continue in force on or after termination of an Engagement shall remain in full force and effect notwithstanding such termination.
20.10 Cumulative Remedies. The rights and remedies provided under this Agreement are in addition to, and not in exclusion of, any rights or remedies provided by Applicable Law. No single or partial exercise of any right or remedy shall preclude or restrict the further exercise of that or any other right or remedy.
This Agreement may be executed by the parties in counterparts, each of which when executed and delivered shall constitute an original, but all of which together shall constitute one and the same instrument. The parties may execute this Agreement by handwritten signature, electronic signature, or scanned PDF signature, each of which shall be deemed an original for all purposes. By signing a Statement of Work that incorporates this Agreement by reference, the Client shall be deemed to have accepted and agreed to be bound by this Agreement.
SCHEDULE 1 — STATEMENT OF WORK (SOW) TEMPLATE (BUSINESS CLIENTS)
This Statement of Work template is to be completed and executed for each Engagement with a Business Client. It must not be used for a Consumer; the Consumer Service Order Form in Part G of Schedule 3 is used instead. Capitalised terms used in this SOW have the meanings given to them in the Client Engagement Contract (Master Services Agreement) to which this SOW is attached. This SOW forms an integral part of, and is governed by, that Agreement.