General Terms and Conditions

As of: November 2026 · DEF.S3C e.U. · Graz, Austria. The version published at the time the contract is concluded applies. This English version is provided for convenience; the German version is legally binding.

1. Scope

These terms apply to all services of DEF.S3C e.U., Villefortgasse 11, 8010 Graz (hereinafter "Contractor") towards companies, public authorities, educational institutions and consumers (hereinafter "Client").

Deviating terms of the Client only become effective if they have been confirmed in writing. Individual agreements in the quote or in the Rules of Engagement take precedence over these terms.

2. Conclusion of contract

Quotes are subject to change and, unless stated otherwise, valid for 30 days. The contract is concluded by written commission from the Client and its confirmation by the Contractor. The free intro call does not constitute a contract.

3. Scope of services

The scope of services is defined exclusively by the written quote. Security assessments are sample-based examinations at a specific point in time. By their nature they cannot uncover all existing vulnerabilities.

A report without findings therefore does not mean that no vulnerabilities exist and does not constitute a guarantee of security. The Contractor owes a careful examination in accordance with the state of the art, not a specific result.

4. Commission and Rules of Engagement

Security assessments require a written commission and signed Rules of Engagement. These define objectives, systems, boundaries, time windows, contact persons and escalation paths.

No test begins without these documents. During physical assessments, the personnel deployed carry written authorisation; the Client names an escalation contact who can be reached throughout the entire time window.

5. Client's obligations to cooperate

• The Client warrants that it is authorised to dispose of all systems and premises to be tested.
• If systems are hosted by third parties (such as hosting or cloud providers), the Client obtains the necessary approvals in advance.
• The Client provides current backups and ensures that they can be restored.
• Named contact persons are reachable during the agreed time window.

Delays resulting from a lack of cooperation are not at the Contractor's expense.

6. Confidentiality

Both parties treat all information that becomes known in the course of the cooperation as confidential. This obligation continues beyond the end of the engagement.

The Contractor only names the Client as a reference with the Client's express written consent.

7. Fees and payment

Billing is based on the agreed scope. As a small business under § 6 (1) no. 27 UStG, no VAT is charged. Travel and accommodation costs outside the greater Graz area are charged at cost unless agreed otherwise.

Invoices are payable within 14 days without deduction. In the event of late payment, statutory default interest applies.

8. Appointments, rescheduling and cancellation

Agreed appointments are binding. Towards businesses: in the event of cancellation or rescheduling by the Client later than 14 days before the appointment, 50 per cent of the agreed fee may be charged, later than 5 working days before the appointment 100 per cent. Replacement dates are offered where possible. Towards consumers, § 1168 ABGB (Austrian Civil Code) applies: if the service is not performed for reasons on the Client's side, the agreed fee is due less whatever the Contractor saves as a result.

9. Liability

The Contractor is liable for intent and gross negligence. Liability for slight negligence is excluded to the extent permitted by law; this exclusion does not apply to personal injury.

Despite careful execution, security assessments can have an impact on running systems. The approach is therefore agreed in advance; tests with an increased risk of outage are explicitly approved.

Towards businesses, liability is also limited in amount to the value of the engagement; there is no liability for loss of profit, data loss and consequential damage. These limitations do not apply to intent, gross negligence and personal injury.

10. Warranty

The statutory warranty provisions apply, towards consumers in particular the ABGB and the Consumer Warranty Act (VGG); they are not restricted by these terms. Businesses notify defects in writing without delay after discovering them. The Contractor is given the opportunity to remedy them within a reasonable period.

11. Rights of use to the report

The Client receives a perpetual, non-exclusive right to use the report for its own purposes, including presentation to auditors, insurers and authorities.

Publication of the report or of extracts from it requires the Contractor's written consent. Methods, tools and templates used remain with the Contractor.

12. Data protection and data deletion

If personal data is processed in the course of the engagement, a data processing agreement pursuant to Art. 28 GDPR is concluded.

Project data and evidence are deleted no later than 14 days after the end of the mission unless expressly agreed otherwise. On request, an encrypted archive is handed over beforehand.

13. Use of third parties

The Contractor generally performs the services itself. Subcontractors are only used after prior notification and with the Client's consent.

14. Non-solicitation

Between businesses: both parties undertake not to deliberately poach employees of the other party during the cooperation and for twelve months thereafter.

15. Force majeure

Events outside a party's sphere of influence that make performance considerably more difficult release it from the obligation to perform for their duration. Both parties inform each other without delay.

16. Right of withdrawal for consumers

Consumers can withdraw from contracts concluded at a distance (e.g. by email, phone or via this website) or off our business premises within 14 days without giving reasons (§ 11 FAGG, Austrian Distance and Off-Premises Contracts Act). The period begins on the day the contract is concluded.

To exercise the right of withdrawal, a clear statement to DEF.S3C e.U., Villefortgasse 11, 8010 Graz, [email protected], +43 660 6136 415 is sufficient – for example by letter or email. You may use the model form below, but you don't have to. To meet the deadline it is sufficient to send the statement before the period expires.

Consequences of withdrawal: we refund all payments you have made without undue delay and no later than 14 days from receipt of your statement, using the same means of payment. If you expressly requested that we begin the service before the end of the withdrawal period, you pay an amount corresponding to the proportion of the service provided up to the withdrawal (§ 16 FAGG). If the service has been fully performed at your express request, the right of withdrawal expires (§ 18 (1) no. 1 FAGG); we point this out to you separately before we begin.

Model withdrawal form
To DEF.S3C e.U., Villefortgasse 11, 8010 Graz, [email protected]: I/We hereby withdraw from the contract concluded by me/us for the provision of the following service: … · Ordered on: … · Name: … · Address: … · Signature (only if notified on paper) · Date: …

17. Final provisions

Austrian law applies, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods. Place of jurisdiction is Graz to the extent permitted by law; for consumers the statutory jurisdictions apply.

Should any provision be invalid, the validity of the remaining provisions remains unaffected. Between businesses, amendments must be made in writing; towards consumers, oral commitments remain effective (§ 10 (3) KSchG, Austrian Consumer Protection Act).