Terms and conditions

Version 1.0 · November 2026

1. Definitions

• Nuvtek: the business offering SurfaceGuard, registered with the Dutch Chamber of Commerce under number [KvK number], located at [address].
• Client: the organisation that engages Nuvtek.
• Service: mapping and assessing the client's external digital attack surface, once (assessment) or periodically (monitoring).
• Scope: the domains, IP addresses and other assets Nuvtek may examine according to the authorisation form.

2. Applicability

These terms apply to every quote, engagement and agreement between Nuvtek and the client. Deviations only apply if agreed in writing. The client's own terms do not apply.

3. Authorisation and scope

1. Nuvtek only starts work after the client has fully completed and signed the authorisation form.
2. The client declares that it owns the assets in scope, or has written permission from the owner. This also applies to assets hosted by third parties, such as cloud or hosting providers.
3. Nuvtek only examines assets within scope. If Nuvtek finds assets during discovery that may belong to the client but fall outside scope, it reports them without examining them further.
4. The client indemnifies Nuvtek against third-party claims arising from incorrect or incomplete information about scope or permission.

4. Performance

1. Nuvtek performs the service to the best of its knowledge and ability. This is an obligation of effort, not of result.
2. The service consists of examining publicly visible information and services. Nuvtek does not carry out exploitation, brute-force attacks, social engineering or destructive testing unless agreed otherwise in writing.
3. An assessment reflects the attack surface at the time of examination. Nuvtek does not guarantee that all vulnerabilities will be found.
4. Where necessary, the client informs its own IT suppliers and hosting parties in advance, for example to prevent unwarranted blocking.

5. Prices and payment

1. All prices are in euros and exclude VAT.
2. A one-off assessment is invoiced after delivery of the report. Monitoring is invoiced monthly in advance, unless agreed otherwise.
3. Invoices must be paid within [14] days of the invoice date.

6. Term and termination

1. An assessment ends after delivery and review of the report.
2. A monitoring agreement runs for one year and is then tacitly renewed for one year at a time, unless either party terminates in writing at least [one month] before the end of the term.

7. Confidentiality

Nuvtek treats all results, reports and client information as confidential. Nuvtek only shares them with the contacts the client designates, unless a legal obligation requires otherwise.

8. Data and retention

Nuvtek keeps scan results and reports for as long as needed for the engagement and at most [12 months] afterwards, unless the client requests earlier deletion. Personal data is covered by the privacy statement. If Nuvtek processes personal data on the client's behalf, the parties will enter into a data processing agreement.

9. Liability

1. Nuvtek's liability is limited to the amount the client paid for the engagement concerned, and for monitoring to the fees for the last three months.
2. Nuvtek is not liable for indirect damage, such as consequential loss, lost profits or business interruption.
3. Nuvtek is not liable for damage resulting from a security incident at the client, including where it relates to a vulnerability not included in the report.
4. These limitations do not apply in the event of intent or deliberate recklessness on Nuvtek's part.

10. Governing law

These terms and all agreements are governed by Dutch law. Disputes are submitted to the competent court in the district where Nuvtek is located.

Contact

Questions about these terms? Email klantenservice@nuvtek.nl.