These terms and conditions apply to all services of Counter Cybercrime, including the Cyber Health Check, consultancy and other assignments. Counter Cybercrime is a trade name of Automatiseringsbureau Q, registered with the Dutch Chamber of Commerce (KvK) under number 51169096, established in Vlaardingen, the Netherlands.
Version 1.0 — October 2026 · Download as PDF
1. Definitions
1.1 In these terms:
- Contractor means Counter Cybercrime, as described above.
- Client means the business or organisation that gives Contractor an assignment.
- Assignment means the agreement under which Contractor provides services, such as a Cyber Health Check, a vulnerability scan, a phishing test, advice or an annual subscription.
- Report means the written or digital presentation of findings and advice.
2. Applicability
2.1 These terms apply to all quotations, assignments and agreements of Contractor. Deviations only apply if agreed in writing.
2.2 Contractor works exclusively for businesses and organisations acting in the course of a profession or business. These terms are not intended for consumers.
2.3 General (purchasing) terms of Client do not apply unless Contractor has expressly accepted them in writing.
2.4 If any provision of these terms is void or annulled, the other provisions remain in force. The parties will then replace that provision with one that reflects its purpose and intent as closely as possible.
3. Quotations and formation of the agreement
3.1 Quotations and prices on the website are without obligation unless stated otherwise. All prices exclude VAT.
3.2 A request via the website is an enquiry. The Assignment is formed once Contractor confirms the request in writing (email included) or starts carrying it out.
3.3 Contractor may decline a request without giving reasons, for example to avoid a possible conflict of interest.
4. Performance and nature of the services
4.1 Contractor carries out the Assignment to the best of its knowledge and ability and in line with good professional practice. Contractor’s obligations are obligations of effort (inspanningsverplichting), not obligations of result.
4.2 A Cyber Health Check, scan or test is a snapshot and a sample. It is based on the information Client provides and on limited, non-intrusive checks within the agreed time. Contractor does not guarantee that all vulnerabilities or risks will be found, nor that Client will have no security incidents after implementing the advice.
4.3 A Cyber Health Check is not a certification, audit, auditor’s statement or legal advice, and gives no opinion on compliance with laws and regulations such as NIS2 or the GDPR, unless expressly agreed in writing.
4.4 Client decides whether to follow advice and remains responsible for the security, management and continuity of its own systems and data. Implementing measures, including by Client’s own IT supplier, is at Client’s expense and risk.
4.5 Stated deadlines, such as delivery of a Report, are target dates and not strict deadlines.
4.6 Contractor may have the Assignment carried out (in part) by carefully selected third parties.
5. Client’s obligations
5.1 Client provides all information, access and cooperation needed in good time, including the presence of an owner or manager and the person responsible for IT. Client guarantees that the information provided is correct and complete.
5.2 Client ensures a recent, working backup of its systems and data before any technical checks take place.
5.3 If performance is delayed or additional work is needed because Client does not meet these obligations, Contractor may charge the additional costs.
6. Permission for technical checks and phishing tests
6.1 Client authorises Contractor to carry out the agreed checks on the systems, networks, accounts and domains designated by Client, and declares that it is entitled to give that permission.
6.2 Where systems or services are managed or provided by third parties, such as a hosting provider, cloud provider or IT supplier, Client obtains the necessary permission from those third parties in advance.
6.3 For a phishing test or any other test involving employees, Client informs those involved where legally required and obtains any consent required from its works council or employee representatives.
6.4 Contractor only carries out checks within the agreed scope. More intrusive tests, such as a penetration test, only take place under a separate written assignment.
6.5 Even when carried out with care, technical checks may in exceptional cases delay or disrupt systems. Client accepts this risk. Contractor stops a check as soon as Client asks it to.
7. Prices and payment
7.1 A Cyber Health Check is charged at the fixed price stated for the package. Other work is invoiced on a time-and-materials basis or at a fixed quoted price. On-site work within the Randstad region is included; travel costs may be charged for locations outside it, as agreed in advance.
7.2 Contractor invoices after the Assignment has been carried out. An annual subscription is invoiced yearly in advance, or monthly if so agreed.
7.3 Invoices must be paid within 14 days of the invoice date. In case of late payment Client owes the Dutch statutory commercial interest without notice of default, and after a reminder also the extrajudicial collection costs under the statutory scale.
7.4 Contractor may adjust its rates annually on 1 January. For running annual subscriptions a new rate only applies from the next renewal.
8. Cancelling and rescheduling
8.1 Client may reschedule or cancel an on-site appointment free of charge up to two working days in advance.
8.2 If Client cancels within two working days of the appointment, 50% of the price is due. If Client cancels on the day itself, or if the work cannot be carried out on arrival for reasons attributable to Client, 100% is due.
8.3 If Contractor cannot keep an appointment due to illness or force majeure, a new date is scheduled in consultation. Client is not entitled to compensation in that case.
9. Annual subscription
9.1 An annual subscription runs for twelve months and is then tacitly renewed for further periods of twelve months.
9.2 Client may terminate the subscription in writing (email included) as of the end of the current period, with one month’s notice.
9.3 Priority on incidents means Contractor makes every reasonable effort to respond as quickly as possible. It is not a guaranteed response or recovery time and not 24/7 availability, unless agreed in writing.
10. Confidentiality and personal data
10.1 Both parties keep confidential any confidential information received from each other. This applies in any case to findings, vulnerabilities and the contents of Reports. This obligation does not apply where disclosure is required by law.
10.2 Contractor uses Client’s information only to carry out the Assignment. Working notes and Reports are stored securely and deleted no later than two years after completion of the Assignment, unless a longer retention period is needed for an annual subscription or required by law.
10.3 To the extent Contractor processes personal data on Client’s behalf, the parties will on request enter into a data processing agreement. Contractor processes no more personal data than necessary.
10.4 Contractor may mention Client as a reference only with Client’s prior consent.
11. Reports and intellectual property
11.1 The Report is intended solely for Client’s internal use. Client may share it with its own advisers, IT supplier, insurer or customers, provided it points out the snapshot nature described in article 4.
11.2 Third parties cannot derive any rights from a Report. Contractor is not liable to third parties for the use of a Report.
11.3 All intellectual property rights in Contractor’s methods, checklists, templates and software remain with Contractor. Client receives a non-exclusive right to use the Report within its own organisation.
12. Liability
12.1 Contractor’s total liability for breach of contract, tort or on any other ground is limited to compensation of direct damage, up to the amount Client paid for the Assignment concerned, excluding VAT. For an annual subscription this is at most the amount Client paid in the twelve months before the event causing the damage.
12.2 In all cases liability is further limited to the amount paid out by Contractor’s professional liability insurance in the case concerned, plus the deductible.
12.3 Contractor is never liable for indirect damage, including:
- consequential damage, lost profits, missed savings and damage due to business interruption;
- loss, corruption or unavailability of data, and the cost of restoring it;
- damage caused by a cyberattack, intrusion, ransomware, fraud or other acts of third parties, even if a vulnerability involved was not mentioned in a Report;
- damage caused by Client not following advice, or following it incompletely or incorrectly, or by acts of its IT supplier or other third parties;
- fines, third-party claims and reputational damage.
12.4 Direct damage means only: reasonable costs of establishing the cause and extent of the damage, reasonable costs of making Contractor’s defective performance conform to the Assignment, and reasonable costs of preventing or limiting damage.
12.5 The limitations in this article do not apply if the damage results from intent or deliberate recklessness on the part of Contractor itself.
12.6 A right to compensation only arises if Client reports the failure in writing, in as much detail as possible, within 30 days of discovering it. Any claim for compensation lapses twelve months after it arises.
13. Indemnity
13.1 Client indemnifies Contractor against all claims by third parties, including hosting providers, suppliers and Client’s employees, relating to the performance of the Assignment. This applies in particular to claims arising from a lack of the permission described in article 6, unless the claim results from intent or deliberate recklessness on the part of Contractor.
14. Force majeure
14.1 Contractor is not obliged to perform if prevented by force majeure. Force majeure includes illness, failures of internet or telecom services, cyberattacks on Contractor, government measures and failures of suppliers.
14.2 If force majeure lasts longer than 60 days, either party may terminate the Assignment in writing without any obligation to pay compensation. Work already performed is paid proportionally.
15. Complaints
15.1 Client reports complaints about the work or an invoice to Contractor in writing within 14 days of receiving the Report or invoice. A complaint does not suspend the payment obligation.
15.2 If a complaint is justified, Contractor will redo the work concerned properly. If that is no longer meaningful, it refunds a proportional part of the amount paid, within the limits of article 12.
16. Governing law and disputes
16.1 All Assignments and these terms are governed by Dutch law.
16.2 Disputes are submitted to the competent court of the District Court of Rotterdam (Rechtbank Rotterdam), unless the law mandatorily designates another court. The parties first try to resolve a dispute through mutual consultation.
16.3 These terms are also available in Dutch. In case of any difference between the versions, the Dutch text prevails.