Clear agreements for careful collaboration.

These general terms and conditions apply to proposals, engagements and agreements under which Governancy provides services to a business client, provided they have been declared applicable and made available before or when the agreement is concluded.

• Governancy is the trade name of the contractor identified in the proposal or engagement confirmation.
• The legal name, address, Dutch Chamber of Commerce (KvK) and VAT details are stated in the proposal, agreement or invoice.
• Purchase conditions or other terms of the client apply only if Governancy expressly accepts them in writing.
• Deviations are valid only if agreed in writing.

Governancy focuses on business clients. If mandatory consumer law nevertheless applies, that law prevails over any conflicting provision.

A proposal is non-binding and valid for the period stated in it. If no period is stated, the proposal expires 30 days after its date.

An agreement is formed when:

• the client accepts the proposal or engagement confirmation in writing or by email;
• Governancy confirms the engagement in writing; or
• the parties, after explicit alignment, actually begin performance.

In the event of inconsistency, the following order applies: the signed agreement, the engagement confirmation or proposal, any appendices and then these general terms and conditions.

Governancy provides services including advice, gap analyses, implementation support, internal audits, training, awareness activities, AI-governance support and assistance with technical security assessments.

Unless a specific result is expressly guaranteed, the services constitute a best-efforts obligation. Governancy performs the engagement carefully and to the best of its professional judgement based on the information and circumstances known at that time.

• Within the agreed scope, Governancy determines the professional method and sequence of work.
• Reports and advice are snapshots and may become outdated due to changes in legislation, systems or the organisation.
• Deadlines are target dates unless expressly agreed in writing as strict deadlines.
• Governancy may suspend work where safe, lawful or careful performance is not possible.

The client provides in good time everything reasonably required for performance, including:

• accurate, complete and current information;
• access to relevant employees, systems, locations and documentation;
• timely decisions, approvals and availability of responsible persons;
• appropriate backups, continuity measures and internal communication;
• all required rights, permissions and authority for the engagement.

The client remains responsible for its own management decisions, risk choices, implementation, legal obligations and use of advice and reports. Delay or additional work caused by incomplete information or lack of cooperation may result in changes to planning and costs.

Planning and delivery dates are agreed in consultation. A delay entitles the client to termination or damages only if Governancy remains attributable in breach after a reasonable written remedy period.

The client reviews a draft or deliverable within the agreed period, or if none is specified, within ten working days. Comments should be consolidated and as specific as possible. Silence does not automatically constitute formal acceptance, but may affect the planning.

Hourly rates, fixed prices, advances, travel and accommodation costs and any third-party costs are stated in the proposal or engagement confirmation. Amounts exclude VAT unless expressly stated otherwise.

• Invoices must be paid within 14 days of the invoice date.
• Objections to an invoice must be substantiated within seven days of receipt.
• An objection does not suspend the payment obligation for the undisputed part.
• In case of late payment, the client owes statutory commercial interest and reasonable extrajudicial collection costs.
• Governancy may suspend work after reasonable notice where payment is overdue.

Requests outside the agreed scope are treated as additional work. Where possible, Governancy explains in advance the effect on price and planning. Urgent work needed to prevent damage or unsafe performance may, after consultation, be carried out immediately.

If the client cancels, work already performed, reserved capacity that can no longer reasonably be redeployed and non-cancellable third-party costs will be charged. Specific cancellation terms for training, audits, mystery visits or penetration tests may be included in the proposal.

Governancy may engage qualified specialists or service providers for parts of an engagement, for example for technical penetration testing, hosting or tooling. Governancy remains the central point of contact unless the parties agree otherwise.

If a third party contracts directly with the client, that party's own terms apply to that part. Costs and responsibilities are set out as clearly as possible in advance.

The parties treat non-public information received in connection with the engagement as confidential and use it only for performance of the engagement, unless disclosure is legally required.

• Access is limited to persons who need the information for the engagement.
• An existing non-disclosure agreement continues to apply alongside this provision.
• Personal data is processed in accordance with the GDPR, the privacy statement and any data-processing arrangements.
• After completion, data is retained, returned or deleted in accordance with the engagement, legal obligations and reasonable evidentiary interests.

Rights in existing methods, models, templates, training materials, software, working methods and general knowledge of Governancy remain with Governancy or the relevant rights holder.

After full payment, the client receives a non-exclusive, non-transferable right to use client-specific deliverables internally for the purpose of the engagement. Without prior written permission, materials may not be sold, publicly published, offered as the client's own product or distributed outside the client's own organisation.

The client remains the owner of its own documents, data, trademarks and other materials made available for the engagement.

Technical and physical security assessments are carried out only within a scope approved in writing in advance and with demonstrable authorisation from an authorised client.

• The client warrants that it is authorised to grant permission for all systems, accounts, locations and organisations involved.
• Where appropriate, the parties document rules of engagement: targets, time windows, permitted techniques, exclusions, contacts and emergency-stop procedure.
• The client provides appropriate backups, monitoring and internal escalation.
• Governancy may stop a test in the event of unexpected risk, instability, possible damage or doubt about authorisation.
• Findings are treated confidentially and shared only with designated contacts.

A penetration test, scan, mystery visit or retest is a snapshot and cannot guarantee that all vulnerabilities, attack paths or human risks are discovered. A retest evaluates only the agreed findings and changes.

Governancy supports organisations with matters including ISO 27001, NIS2, the Dutch Cybersecurity Act, AI governance, the EU AI Act and ISO/IEC 42001. Advice and preparatory work do not guarantee that an organisation is fully compliant, prevents an incident or obtains certification.

• A certification decision is made solely by the independent certification body.
• An internal audit or gap analysis is not a legal opinion and not a decision by a statutory supervisory authority.
• Legal interpretations are general governance information and do not replace advice from a lawyer or other qualified legal specialist.
• The client remains responsible for management decisions, risk treatment and formal statements.

Governancy is liable only for direct loss that is the immediate result of an attributable failure in performance of the engagement. The client first gives Governancy a reasonable opportunity to remedy a failure or limit the loss.

To the extent permitted by law, total liability is limited to the amount paid for the relevant part of the engagement, subject to a maximum of €5,000 per event. Related events are treated as one event.

Governancy is not liable for indirect loss, including:

• consequential loss, loss of profit, lost savings and reputational damage;
• business interruption, loss of data or damage to data;
• loss resulting from decisions by the client or third parties based on incomplete or outdated information;
• loss caused by the client's failure to meet its obligations or maintain backups or security measures.

The limitations do not apply in cases of intent or deliberate recklessness by Governancy, or to the extent that limitation is prohibited by mandatory law.

Neither party is liable for delay or non-performance caused by circumstances reasonably beyond its control, such as prolonged failure of essential infrastructure, government measures, serious cyber incidents, illness, power or internet outages, war, natural disasters or failures of critical suppliers.

The affected party informs the other party as soon as possible. Obligations are suspended for the duration of the force majeure. If performance becomes permanently impossible or the situation lasts longer than 60 days, either party may terminate the unperformed part in writing without compensation.

A party may terminate the agreement in whole or in part where the other party materially fails to perform and does not remedy that failure within a reasonable written remedy period.

Governancy may suspend or terminate immediately where:

• payment remains outstanding despite a reminder;
• the engagement proves unlawful, unauthorised or irresponsible;
• the client becomes bankrupt, applies for suspension of payments or ceases business;
• continuation creates a serious safety, integrity or reputational risk.

On termination, work already performed, costs incurred, payment obligations, confidentiality, intellectual-property provisions and liability provisions remain in force.

A complaint should be reported in writing and with sufficient detail as soon as possible after discovery, preferably within 14 days, via legal@governancy.com. The parties first discuss what remediation or clarification is reasonable.

Submitting a complaint does not automatically suspend payment obligations. A client may lose the right to rely on a defect if it reports it unreasonably late and Governancy is thereby prejudiced in its investigation or remediation.

Proposals, agreements and these terms are governed by Dutch law. The parties first try to resolve a dispute through good-faith consultation and may jointly use mediation or expert consultation.

If no solution is reached, the dispute will be submitted to the competent court in the district where Governancy is established, unless mandatory law designates another court.

Information on this website is general and intended as an initial orientation. It does not constitute personal advice, a legal opinion, a certification statement or a guarantee. A separate assessment is required for a specific situation.

Governancy aims to provide current and accurate information, but cannot guarantee that all information is complete, error-free or up to date at all times. External links are provided for convenience; Governancy is not responsible for the content or availability of third-party websites.

Governancy may amend these terms when services, legislation or business operations change. A new version applies to future engagements from the moment it is declared applicable. For an ongoing engagement, a change applies only if the parties agree it or if the change is reasonable and necessary and the client has been informed in good time.

Questions about these terms or a specific engagement can be sent to legal@governancy.com.

The full legal and registration details of the contracting entity are stated in the proposal, engagement confirmation and invoice.