General terms of sale and service

1. Purpose and scope

These terms govern every offer, order and service of Secureflow SRL (hereinafter “Secureflow”) for a client acting in the course of its professional activity. They are not addressed to consumers.

They form an integral part of every offer and are deemed accepted upon signature of the quotation, upon written order, or upon the start of performance accepted by the client.

They prevail over the client’s general purchasing conditions, unless Secureflow agrees otherwise in writing. Specific conditions set out in the offer prevail over these terms in the event of a discrepancy.

2. Offers and formation of the contract

Our offers are valid for thirty calendar days unless stated otherwise, and are based on the information provided by the client. Inaccurate or incomplete information may justify revising the offer.

The contract is formed upon receipt of the client’s written agreement. Any request outside the scope described in the offer is subject to a costed amendment before performance.

3. Nature of the services

Secureflow performs its engagements with the skill and care expected of a professional in the field. Unless expressly agreed in writing for a defined result, our obligations are best-efforts obligations.

No audit, risk analysis or technical measure can guarantee the complete absence of incidents, residual vulnerabilities or downtime. Our recommendations reduce a risk; they do not remove it.

4. Client obligations

Proper performance requires the client’s active cooperation. The client undertakes to:

• appoint a single contact person with the necessary decision-making authority;
• provide the required information, drawings, inventories and access in good time, and warrant their accuracy;
• hold the necessary rights and authorisations over the systems concerned, including where they belong to a third party or are operated by a supplier;
• perform and verify its backups before any intervention on a production system;
• report anything liable to affect the safety of people or the continuity of production.

5. Authorisation to intervene and to test

No test, active analysis or intervention on a system is undertaken without the client’s prior written authorisation, specifying the scope, the equipment concerned, the intervention windows and the emergency contacts.

This authorisation is an essential condition: accessing an information system without authorisation is a criminal offence in Belgium. The client warrants that it has the power to grant it for the entire declared scope, and indemnifies Secureflow against any claim by a third party owning or operating a system wrongly included in that scope.

6. Lead times

Announced lead times are indicative unless expressly stated as firm in the offer. They run from receipt of the client’s agreement, of any down payment and of the items required for performance.

Interventions on production installations are scheduled within the agreed shutdown windows. A postponement attributable to the client, in particular the unavailability of access or of a contact person, may result in the reserved time being invoiced.

7. Prices

Prices are in euros, excluding value added tax and excluding travel, accommodation, licence and hardware costs, which are re-invoiced at cost unless a lump sum is agreed.

Time-and-materials services are invoiced according to time spent at the daily rate stated in the offer, every started half-day being due. Work outside business hours, at weekends or on public holidays is subject to the surcharge stated in the offer.

For contracts longer than twelve months, rates may be adjusted once a year subject to three months’ written notice.

8. Invoicing and payment

A down payment of 30 % of the total amount is due on order, according to the threshold stated in the offer. The balance is invoiced on delivery or, for longer engagements, according to the agreed milestones.

Our invoices are payable within thirty calendar days of their date, by transfer to the account indicated. Any dispute must reach us in writing within fifteen calendar days of receipt of the invoice; after that period the invoice is deemed accepted.

Failing payment on the due date and without prior notice, the balance automatically bears interest at the rate provided by the Belgian Act of 2 August 2002 on combating late payment in commercial transactions, together with fixed compensation of 40 euros for recovery costs, without prejudice to the right to claim the reasonable recovery costs actually incurred.

Where payment is more than fifteen days late, Secureflow may suspend performance after informing the client in writing, without such suspension giving rise to compensation or extending its own deadlines beyond the time lost.

9. Deliverables and acceptance

Deliverables are deemed accepted in the absence of written and reasoned reservations within ten business days of handover, or as soon as the client puts them into operation if that occurs earlier.

Well-founded reservations are corrected within a reasonable time, without the client being entitled to withhold payment for the undisputed parts of the engagement.

10. Intellectual property

Secureflow retains ownership of its methods, templates, tools, libraries and software components that pre-exist the engagement or are developed independently of it. The client receives a non-exclusive, non-transferable licence, unlimited in time, for its internal needs.

Deliverables produced specifically for the client (reports, documentation, configurations, custom developments) are assigned to it exclusively after full payment of the price. No assignment takes place before that payment.

The client may neither publish an audit report nor disclose it to a competitor of Secureflow without prior written consent. Disclosure to the client’s insurers, auditors, supervisory authorities and advisers remains free.

11. Confidentiality

Each party keeps confidential the information received from the other and uses it only to perform the contract, for its entire duration and for five years after it ends.

This undertaking does not cover public information, information already known without an obligation of confidence, or information whose disclosure is required by law or by a competent authority. Security findings concerning the client’s installations are handled with particular care and do not leave our protected systems.

12. Personal data protection

Where the engagement involves access to personal data for which the client is the controller, Secureflow acts as a processor within the meaning of Article 28 of Regulation (EU) 2016/679; a data processing agreement is signed beforehand.

Secureflow also processes, as a controller, the contact data required for the business relationship, under the conditions described in its privacy policy.

13. Liability

Secureflow is liable for direct damage caused by proven fault in performing the engagement. Its total liability is limited, per engagement, to the amount excluding tax actually invoiced for it and, for recurring contracts, to the amounts invoiced during the twelve months preceding the triggering event.

Indirect damage is excluded, in particular loss of business, loss of production, loss of data or of customers, damage to reputation and third-party claims.

These limitations apply neither to fraud, nor to gross negligence, nor to damage resulting from harm to life or physical integrity, nor to any liability which the law prohibits limiting.

Secureflow holds professional indemnity insurance; the certificate is provided on request.

14. Personnel and subcontracting

The client shall refrain from hiring or directly engaging, for itself or for an affiliated company, any person who took part in the engagement, during the engagement and for twelve months after it ends, unless Secureflow agrees in writing.

Secureflow may use subcontractors; it remains responsible for their work and imposes the same confidentiality obligations on them.

15. Force majeure

Neither party is liable for a failure resulting from an event beyond its reasonable control, in particular a natural disaster, a widespread network or power outage, a major cyberattack affecting its own systems, a decision of an authority or a pandemic.

The affected party informs the other without delay. If the impediment lasts more than sixty days, either party may terminate the contract in writing, services already performed remaining due.

16. Suspension and termination

In the event of a serious breach, the aggrieved party may terminate the contract in writing after a formal notice has remained without effect for fifteen calendar days. Services performed and costs incurred remain due.

Recurring contracts may be terminated by either party subject to three months’ written notice. Cancelling a scheduled engagement less than ten business days before it starts allows 50 % of the reserved days to be invoiced.

17. Commercial references

Secureflow publishes neither the name, nor the logo, nor any report extract concerning a client without its prior written consent, including in anonymised form where the client would remain identifiable by cross-referencing.

18. Miscellaneous

The possible nullity of one clause does not affect the others: it is replaced by a valid provision of equivalent economic effect. Not invoking a clause does not amount to waiving it.

The contract, its annexes and these terms express the entire agreement of the parties and supersede any prior exchange. Any amendment requires a written document.

19. Governing law and jurisdiction

These terms are governed by Belgian law, excluding the Vienna Convention on Contracts for the International Sale of Goods.

The parties first seek an amicable solution. Failing that, any dispute falls within the exclusive jurisdiction of the courts of the district of the registered office of Secureflow SRL (Tribunal de l'entreprise compétent pour le siège social).