General Terms and Conditions

1. Scope, Parties, and Definitions

• Western Tactics offers cybersecurity awareness training, phishing and social engineering simulations, LMS functionalities, and related Services. In simulations, Western Tactics may refer to or use characteristics of existing organizations, services, or brands for training and awareness purposes.
• These GTC apply to all agreements for the provision of these Services between Western Tactics and the Customer.
• Unless expressly agreed otherwise in writing, the Customer's general terms and conditions or purchasing conditions do not apply, even if Western Tactics has not expressly objected to the Customer's conditions.
• These GTC apply exclusively to business customers (B2B), ranging from small and medium-sized enterprises (SMEs) to (semi-)government institutions and public law funds, regardless of whether they are located in the Netherlands, elsewhere in the European Union, or beyond. These GTC do not apply to consumers.
• Offers, promises, and agreements made by employees or representatives of Western Tactics are only binding on Western Tactics if they have been confirmed in writing by the management.
• The definitions applicable to these GTC are included in the Appendix at the bottom of this document.

2. Formation and Scope of the Agreement

• Unless otherwise agreed in the Quotation, the Agreement is concluded upon signature (text form or digital is sufficient) of the Quotation by the Customer.
• During the term of the Agreement, Western Tactics shall provide the Customer with access to all functions of the booked Services in accordance with the specifications in the Quotation and the Service Level Agreement (SLA). The Quotation also specifies the agreed number of Users.
• Western Tactics makes the Platform available on servers for use via the access point of the (cloud) infrastructure of Western Tactics and its engaged third parties.
• Continuous Development of the Services: Western Tactics may maintain, update, modify, and further develop the Services and the Platform during the term, including by adding, modifying, or replacing functionalities. Such changes do not require prior notice to the Customer, unless the change leads to a material reduction in the agreed core functionality of the Services. Western Tactics will not materially reduce the nature and general level of the agreed Services during the Contract Term, unless this is necessary due to applicable laws or regulations, security risks, or circumstances beyond Western Tactics' reasonable control.

3. Obligations of the Customer

• The Customer must comply with the technical requirements for using the Services (in particular regarding systems, network, and infrastructure).
• In the event of a disruption in the use of the Services, the Customer shall notify Western Tactics without delay and shall assist, to the extent reasonably possible, in identifying the cause and remedying it.
• Immediately after the conclusion of the Agreement, the Customer shall provide Western Tactics with all documents and data necessary to set up access.
• The Customer shall appoint a designated contact person (Administrator) who is responsible for the access setup and use of the Services, and who is authorized to make decisions.
• The Customer instructs Western Tactics to carry out the agreed awareness training, phishing, and social engineering simulations and is responsible for the lawfulness of this instruction within its own organization, including the selection of Users and, where applicable, internal information, co-determination, and employment law obligations.

4. Customer Account and Usage Rights

4.1 Setup and Use of the Customer Account

• Creating a Customer account on the Platform is required to use the Services. This account may only be managed by the authorized Administrator.
• Only Users authorized by the Administrator may use the Services via a personal User account. Registration with private email addresses (such as Gmail or Hotmail) is not permitted unless approved in writing in advance. Accounts may not be shared (no simultaneous use).
• The Customer shall supervise its personnel and is fully responsible and liable for the acts and omissions of its Users.

4.2 Rights and Obligations (Acceptable Use)

Access details must be kept strictly confidential. The Customer shall inform Western Tactics immediately upon suspicion of unauthorized access.

The Customer guarantees that Customer content uploaded by them (such as company logos or specific documents) complies with laws and regulations and does not infringe on the rights of third parties. The Customer and Users are particularly prohibited from:

• Publishing malicious, racist, discriminatory, or illegal content.
• Performing actions that could block or overload the infrastructure (e.g., DDoS attacks).
• Using automated mechanisms (bots/scrapers).
• Uploading viruses or malicious code.

In case of violation of these rules (Prohibited Use), Western Tactics may limit or block accounts and irrevocably delete content without prior notice.

4.3 Licenses, Intellectual Property, and Feedback

• Western Tactics grants the Customer a non-exclusive, non-transferable, and non-sublicensable right to use the Platform and the Services exclusively for internal business purposes during the Contract Term. The Customer may not resell, rent out, sublicense, or use the Platform or the Services to develop a competing product or service.
• All intellectual property rights to the Platform, the software, training content, simulations, scenarios, methodologies, design, documentation, and other materials developed or made available by Western Tactics are vested exclusively in Western Tactics or its licensors. The Agreement does not entail the transfer of any intellectual property rights to the Customer.
• Western Tactics may freely use general feedback and suggestions for improvement provided by the Customer for the development and improvement of its Services, provided that no Confidential Information or personal data of the Customer is disclosed.

5. Term and Termination

• The Agreement is entered into for the Contract Term agreed upon in the Quotation. The Customer owes the agreed fee for the full Contract Term. Early termination at the request of the Customer does not lead to a reduction or waiver of the fee owed for the remaining Contract Term. If the fee has been paid in advance, no refund will be made for the remaining Contract Term. If the fee is invoiced in installments, the un-invoiced installments for the remaining Contract Term remain due. The foregoing does not apply to the extent the Customer validly terminates the Agreement due to an attributable failure by Western Tactics or if mandatory applicable law provides otherwise. The Customer's statutory switching rights under Article 13 remain unaffected.
• Afterwards, the Agreement will be automatically renewed for periods of one (1) year each time, unless a Party terminates it no later than three (3) months before the end of the then-current Contract Term.
• The Customer may expand the subscription or the number of Users at any time. In the event of a limitation (downgrade) or reduction in the number of Users during the current Contract Term, no refund will ever take place.
• Either Party may terminate the Agreement in whole or in part in writing due to a material breach by the other Party, if this breach has not been remedied within a reasonable period after written notice of default. A notice of default or remedy period is not required if compliance is permanently impossible or if the terminating Party cannot reasonably and fairly be expected to continue the Agreement.
• If the Customer submits a valid and timely objection to a change of sub-processors (in accordance with the DPA), Western Tactics has the right to terminate the Agreement at the end of the then-current calendar month.

6. Compensation and Payment Terms

• The Customer shall pay the compensation agreed upon in the Quotation. All amounts are net and exclusive of VAT (Taxes). For Customers located in the European Union (outside the Netherlands), the VAT reverse charge mechanism (Reverse Charge) applies, provided the Customer provides a valid European VAT identification number.
• Unless otherwise agreed, the fee for the entire Contract Term is due in advance within fourteen (14) calendar days of the invoice date.
• Western Tactics is entitled to increase the applicable fee by a maximum of 5% in each Contract Year.
• Usage Limits & Multi-tenant Audits: The Services are subject to the usage limits (number of Users) stated in the Quotation. If the Customer uses multi-tenant sub-environments, usage is determined based on the sum of registered Users in all underlying tenants (organizations) of the Customer. Western Tactics is entitled to perform audits on the Platform to verify that the maximum number of Users is not exceeded. In the event of an exceedance, Western Tactics will invoice the extra Users in accordance with the then-current price list.

7. Warranty and Service Level

• Western Tactics warrants that the Services will substantially perform in accordance with the specifications during the term and will be provided with a degree of skill and care that may reasonably be expected. Availability is governed by the agreed SLA.
• The Customer must report defects promptly and in detail in writing. Western Tactics will remedy a Defect within a reasonable time.
• Western Tactics expressly disclaims all other warranties, express or implied, including warranties of fitness for a particular purpose. Western Tactics does not warrant that the operation of the Platform will be uninterrupted, error-free, or entirely free of security risks. The Services are aimed at increasing cyber awareness and digital resilience. Western Tactics does not guarantee that the use of the Services will completely prevent security incidents, human errors, phishing attacks, or other cyber attacks.
• Sole Remedy: The availability of the Platform and the applicable service levels are governed by the SLA. Failure to achieve an agreed availability level only entitles the Customer to the remedies expressly agreed upon in the SLA or Quotation.

8. Liability and Limitation of Liability

• The limitations of liability included in this Article do not apply to the extent that liability cannot be legally limited or excluded under mandatory applicable law, nor in the case of intent or willful recklessness by the management of Western Tactics.
• Subject to Article 8.1: (a) the total liability of Western Tactics per Contract Year is limited to the total amounts paid by the Customer under the Agreement in that respective Contract Year; (b) Western Tactics is never liable for any incidental, special, indirect, or consequential damages, loss of profit, loss of goodwill, missed income, or data loss (if the Customer has failed to make reasonable backups).
• To the extent permitted by law, Western Tactics is not liable for damages caused solely by third-party products, services, networks, or infrastructure over which Western Tactics reasonably has no control, including external telecommunication networks and integrations independently selected or managed by the Customer. This exclusion leaves the responsibility of Western Tactics for auxiliary persons and sub-processors engaged by it unaffected to the extent that Western Tactics is responsible for them under applicable law. To the extent Western Tactics is liable for such damages, the limitations of Article 8.2 and 8.6 continue to apply in full, to the extent permitted by law.
• Western Tactics is not liable for damages resulting from Force Majeure.
• Any right of the Customer to compensation shall expire if the relevant claim is not submitted in writing to Western Tactics within twelve (12) months after the Customer became aware of the damage and the liable party, to the extent permitted by law.
• The limitations and exclusions of liability included in this Article also apply to liability arising from the DPA and other data protection obligations that form part of the Agreement, to the extent limitation or exclusion thereof is permitted under applicable law.

9. Confidentiality

• The Parties shall treat all Confidential Information strictly secret and use it exclusively for the purposes of the Agreement.
• This obligation does not apply to information that (a) was already public, (b) was developed independently without using the Confidential Information, or (c) was provided by a legitimate third party.
• The confidentiality obligation remains in force for five (5) years after termination of the Agreement. For trade secrets, source code, security information, and information that by its nature is permanently confidential, this obligation remains in effect as long as the relevant information retains its confidential character.

10. Indemnity and Penalty Clause

• Western Tactics defends the Customer against third-party claims alleging that the Platform infringes their intellectual property rights (a "Customer IP Claim") and indemnifies the Customer against awarded damages, provided the Customer immediately notifies Western Tactics and leaves full control of the defense to Western Tactics.
• The Customer defends and indemnifies Western Tactics against third-party claims arising from (i) unlawful use of the Platform by the Customer, (ii) Customer content uploaded by the Customer, or (iii) infringement of rights by combinations with non-Western Tactics applications (a "Western Tactics IP Claim").
• Penalty Clause after termination: Upon termination of the Agreement, the Customer immediately loses the right to use Western Tactics' content, software, or (exported) training materials. If the Customer continues to make unauthorized use of Western Tactics' intellectual property after termination, the Customer shall owe an immediately payable penalty of € 5,000 per violation, increased by € 500 for each day the violation continues, without prejudice to Western Tactics' right to claim full damages.

11. Data Protection and Anonymization

• The Parties shall process personal data exclusively in accordance with applicable privacy legislation (GDPR). The specific Data Processing Agreement (DPA) applies to the processing of personal data on behalf of the Customer.
• The Customer explicitly authorizes Western Tactics to anonymize and aggregate personal data and usage data. Western Tactics may use this anonymized data for statistical purposes, benchmarking, product development, and improvement, whereby personal or company-specific information will never be traceable by third parties.

12. General Provisions

• Independence: The Parties act as independent contractors. There is no joint venture or agency relationship.
• Order of Precedence of Documents: In the event of contradictions, the following order of precedence applies: (i) Quotation, (ii) SLA, (iii) DPA, and (iv) these GTC. In deviation from this, the DPA prevails to the extent a contradiction relates to the processing and protection of personal data.
• Export Control and Sanctions: The Customer shall not use the Services in violation of export control or sanctions legislation applicable to Western Tactics.
• Reference Customer: Western Tactics may only use the Customer's name, trade name, and logo as a customer reference with the Customer's prior written consent.
• Amendments: Western Tactics may amend these GTC from time to time. Non-material changes may be implemented during the Contract Term after prior notice to the Customer. Changes that materially adversely affect the Customer's rights or obligations will generally apply at the next renewal of the Agreement, unless the change is necessary due to applicable laws, regulations, or security requirements.
• Applicable Law and Language: The legal relationship is exclusively governed by Dutch law (Vienna Sales Convention excluded). The exclusive competent court for disputes is the District Court of Overijssel, location Enschede. If these GTC are provided in a language other than Dutch (e.g., for international Customers), the Dutch text is decisive for legal interpretation at all times.

13. Right to Switch

• To the extent Regulation (EU) 2023/2854 (Data Act) applies to the Services, the Customer has the right to switch to another provider of data processing services, transfer the exportable data and digital assets to its own ICT infrastructure, or have the exportable data and digital assets deleted, in accordance with applicable legal requirements.
• The Customer may request Western Tactics to (i) switch to another provider, whereby the Customer provides the necessary details of that provider for the switch, (ii) switch to their own ICT infrastructure, or (iii) have the exportable data and digital assets deleted after termination of the Services.
• A notice period of a maximum of two (2) months applies to initiate the switching process. Following this, a maximum transition period of thirty (30) calendar days generally applies.
• During the transition period, the Agreement remains applicable. Western Tactics will provide reasonable cooperation to the Customer and third parties authorized by the Customer, support the exit strategy relevant to the Services, exercise reasonable care for the continuity of the Services, inform the Customer of known risks to that continuity, and maintain appropriate security measures during the switching process.
• If completing the switching process within thirty (30) calendar days is technically unfeasible, Western Tactics shall inform the Customer thereof within fourteen (14) Working Days of receiving the switching request. Western Tactics will justify the technical unfeasibility and state an alternative transition period, which shall not exceed seven (7) months. The continuity of the Services will be guaranteed during this alternative transition period in accordance with applicable legal requirements.
• The Customer has the right to extend the transition period once by a period suitable for its purposes, in accordance with the Data Act.
• The data and digital assets that can be transferred during the switching process include, where present and exportable, at least: (a) account and user data provided by or on behalf of the Customer; (b) training, progress, and results data; (c) Customer content provided by the Customer; (d) configuration data and settings available to the Customer; (e) reports available to the Customer; and (f) other data and metadata directly or indirectly generated by the use of the Services and qualifying as exportable data under the Data Act.
• Data and digital assets that relate exclusively to Western Tactics' internal operations and whose disclosure would pose a risk to trade secrets, intellectual property rights, or the security of the Platform are excluded from transfer, to the extent permitted under the Data Act. This may include internal system logic, source code, internal security configurations, detection rules, internal operational metadata, and other non-customer-specific technical data. Such an exclusion may not hinder or delay the statutory switching process.
• After the termination of the applicable transition period, Western Tactics shall make the exportable data and digital assets available for retrieval by the Customer for at least thirty (30) calendar days. After this retrieval period expires, or at a later time agreed between the Parties, the eligible exportable data and digital assets will be deleted, provided no statutory retention obligation requires further storage and the switching process has been successfully completed.
• The Agreement is deemed terminated for the relevant Services, and Western Tactics will inform the Customer thereof (i) upon successful completion of the switching process, or (ii) if the Customer exclusively requests deletion, after the applicable notice period and in accordance with applicable deletion obligations.
• Western Tactics will provide the Customer with information on the available procedures, methods, and formats for transferring exportable data, as well as on known technical limitations. To the extent required by law, Western Tactics maintains an up-to-date online overview for this purpose.
• Up to and including January 11, 2027, Western Tactics may only charge the reduced switching costs permitted under the Data Act. These costs shall not exceed the costs incurred by Western Tactics directly related to the respective switching process. As of January 12, 2027, Western Tactics will not charge any switching costs for the actions it is required to perform under the Data Act as part of a switching process. Switching costs are separate from the regular fees owed under the Agreement for the agreed Contract Term. Initiating or executing a switching process does not automatically entitle the Customer to a refund, reduction, or waiver of these fees. If the Customer switches during an ongoing fixed Contract Term and the Services are consequently terminated before the end of that Contract Term, the Customer remains liable for the agreed fee for the remaining Contract Term, to the extent permitted by applicable law. Any prepaid fees for that remaining period will not be refunded. If the fee is paid in installments, the remaining installments remain due. The aforementioned fees are not compensation for the technical execution of the switching process, but arise from the agreed fixed Contract Term. Any separate early termination fees will only be applied to the extent they have been contractually agreed in advance and are legally permitted.

Appendix: Definitions

• Administrator: The Customer's employee authorized to configure and manage the Platform.
• Awareness Building Services: the Services as defined in these General Terms and Conditions.
• Contract Term: The initial or extended term of the Agreement as defined in Art 5.1.
• Contract Year: A consecutive period of 12 months, starting on the effective date of the Agreement.
• Customer: the business organization that enters into the Agreement with Western Tactics.
• Customer Content: Content, such as logos and PDFs, uploaded by the Customer to the Platform.
• Force Majeure: Any circumstance beyond the reasonable control and sphere of influence of Western Tactics that temporarily or permanently prevents the performance of the Agreement and which Western Tactics could not prevent or remedy, despite taking reasonably appropriate measures. This may include: large-scale power or internet outages, disruptions of essential public infrastructure, natural disasters, fire, war, terrorism, government measures, general labor disputes, and large-scale cyber attacks or DDoS attacks that could not reasonably be prevented or remedied in time despite appropriate technical and organizational security measures. An event does not qualify as Force Majeure to the extent it is primarily the result of a shortcoming attributable to Western Tactics.
• Platform: the cybersecurity awareness platform Orbit offered by Western Tactics.
• Services: the cybersecurity awareness services provided by Western Tactics via Orbit, including, where agreed, awareness training, simulations, reporting, and related functionalities.
• Sub-processor: an external party that processes personal data on behalf of Western Tactics that Western Tactics processes on behalf of a Customer.
• User: a user authorized by the Customer.