GENERAL TERMS AND CONDITIONS — VERSION OCTOBER 2025

These General Terms and Conditions govern all services provided by WYKYK B.V. to business Clients. They apply to all Agreements, offers and quotations unless explicitly agreed otherwise in writing.

CHAPTER 1 — GENERAL PROVISIONS The provisions in this chapter apply to all Agreements, offers and quotations between WYKYK and the Client.

1. Definitions: License means a limited right of use granted by WYKYK to the Client in respect of intellectual property rights in certain software products or services, including but not limited to the CMS module, as well as other systems, applications or functionalities developed or offered by WYKYK. WYKYK means WYKYK B.V., a private limited liability company under Dutch law, trading as WYKYK, registered with the Dutch Trade Register under number 97530859, and/or one or more of its subsidiaries. Client means any natural person acting in the course of a profession or business, or any legal entity, that has entered into, or intends to enter into, an Agreement with WYKYK. Agreement means the written agreement between the Client and WYKYK setting out the specific terms and conditions, including the type of services, under which WYKYK shall provide services to the Client.

2. General:

2.1 These terms apply to all Agreements, offers and quotations under which WYKYK supplies services for a monetary price.

2.2 Once agreed, they also apply to subsequent Agreements with WYKYK.

2.3 These terms are stipulated for the benefit of WYKYK’s directors, employees and auxiliaries.

2.4 Where WYKYK supplies or grants access to third-party products or services, the third party’s terms apply if WYKYK notified the Client in advance and the Client had a reasonable opportunity to review them; if those terms do not apply, these terms replace them.

2.5 The Client’s general terms are expressly rejected.

2.6 WYKYK may amend these terms; amendments are deemed accepted unless the Client objects in writing within seven (7) days after WYKYK’s written notice.

2.7 In case of conflict, the Agreement prevails over these terms.

2.8 If an offer or quotation conflicts with the Agreement, the Agreement prevails.

2.9 Deviations or additions are valid only if agreed in writing by the parties.

3. Formation and Content of the Agreement:

3.1 All offers and quotations by WYKYK are without obligation and may be revoked at any time unless stated otherwise in writing. The Client warrants the accuracy, completeness and reliability of information it provides and on which WYKYK’s offer is based.

3.2 The Agreement is concluded once the Client accepts WYKYK’s offer or order confirmation by signature, digital confirmation, or other unambiguous electronic acceptance, including e-mail.

3.3 If changes or additions are necessary after conclusion, parties shall amend the Agreement by mutual consultation.

4. Performance of the Agreement:

4.1 WYKYK shall use best efforts and professional skill to perform with due care per written arrangements and procedures; obligations are best-efforts, not result, and no specific outcome is guaranteed.

4.2 WYKYK may have work performed by third parties.

4.3 The Client shall provide all cooperation and guarantees the accuracy, completeness and reliability of all information, data and documentation provided; WYKYK shall inform the Client of information it deems necessary.

4.4 If performance is delayed due to the Client’s act or omission, resulting delays, additional costs and extra hours are borne by the Client.

4.5 All (delivery) periods stated by WYKYK are target periods and never strict deadlines unless expressly agreed otherwise.

5. Additional Work:

5.1 If adjustments or extensions are necessary, parties shall consult timely and implement changes only after prior Client approval.

5.2 Additional work is at WYKYK’s then-applicable rates unless agreed otherwise. If a fixed price was agreed, WYKYK will inform the Client in advance of financial consequences.

5.3 WYKYK is not obliged to accept requests for additional work.

5.4 Instructions deviating from the original scope are deemed additional work and invoiced separately if implemented.

5.5 The Client acknowledges additional work may impact planning, delivery deadlines and obligations.

6. Complaints:

6.1 The Client shall promptly inspect work and deliverables and notify WYKYK in writing, as detailed as possible, of complaints as soon as possible but no later than one (1) week after completion or delivery; after this period rights lapse unless the defect could not reasonably have been discovered earlier.

6.2 Retaining or paying invoices without protest constitutes acceptance of the work and amount, extinguishing related rights.

6.3 Timely complaints lead to consultation as soon as reasonably possible; complaints do not suspend payment obligations.

6.4 Complaints about ongoing work do not oblige WYKYK to perform work other than originally agreed.

7. Price and Payment:

7.1 Prices are exclusive of VAT, government levies and expenses (e.g., travel, registration) and are in euros unless stated otherwise.

7.2 Unless otherwise agreed or fixed in writing, fees are actual time spent times the applicable rate; WYKYK’s time records are conclusive, and preliminary estimates or budgets are non-binding.

7.3 WYKYK may reasonably increase prices if, after conclusion but before full performance, cost-determining factors increase by at least 5% (e.g., insurance, taxes, levies, exchange rates).

7.4 If direct debit is agreed, the Client authorizes automatic collection for the term and may not revoke during the term; failed collections may incur administrative costs and subsequent attempts.

7.5 Invoices are payable within fourteen (14) days from invoice date without deduction, set-off or suspension; this is a strict deadline.

7.6 After expiry, the Client owes: (i) 1.5% interest per month on the principal including VAT (partial month counts as full); (ii) extrajudicial collection costs of at least 15% of the principal including VAT with a minimum of EUR 500.00; and (iii) actual judicial costs including advisers, lawyers and external experts, without prejudice to other rights.

7.7 The invoiced price becomes immediately due if the Client faces bankruptcy, suspension of payments, debt restructuring, attachment, death, dissolution, guardianship/administration, or WYKYK has reasonable grounds to fear non-performance.

7.8 WYKYK may require adequate security for payment at any time and may suspend obligations until security is provided or payment is made.

8. Term and Termination:

8.1 Fixed-term Agreements are deemed for an initial period of one (1) year unless agreed otherwise; they auto-renew for successive equal periods unless terminated in writing with at least one (1) month’s notice before the end of the current term.

8.2 Interim termination by the Client is not permitted unless expressly agreed; in absence of a specific term, the initial period is one (1) year.

8.3 Agreements without a fixed end date may be terminated in writing with a reasonable notice period; if none agreed, one (1) month applies.

9. Dissolution of the Agreement:

9.1 Each party may dissolve in whole or in part if the other imputably fails to perform a material obligation, after written notice of default specifying the breach and granting a reasonable cure period, unless otherwise provided.

9.2 WYKYK may terminate with immediate effect without notice of default by written notice if the Client breaches the Agreement or these terms, faces bankruptcy, suspension of payments, asset seizure, dissolution, guardianship/administration, or if post-conclusion circumstances give well-founded concern the Client will not fulfil obligations; all without prejudice to WYKYK’s right to claim damages.

9.3 Upon dissolution, services already performed and corresponding payment obligations become immediately due unless the breach is insufficiently serious to justify termination; no refund or reversal applies in that case.

10. Information Security and Use of the WYKYK Portal:

10.1 Where access to WYKYK’s online vulnerability management or reporting environment (“WYKYK Portal”) is provided, WYKYK implements appropriate technical and organizational measures to protect confidentiality, integrity and availability.

10.2 WYKYK does not warrant security will be effective under all circumstances; no system is entirely free of vulnerabilities.

10.3 Identification means, certificates or login credentials are personal and confidential; the Client is responsible for careful management and timely revocation.

10.4 WYKYK may temporarily suspend the Portal for maintenance, updates or security and will use reasonable efforts to notify in advance where possible.

10.5 WYKYK may modify functionality, content or technical operation provided this does not materially limit the agreed level of service.

10.6 The Client remains responsible for internal security measures including back-ups, network protection and account management.

10.7 WYKYK is not liable for damage from unauthorized access, data loss or temporary unavailability of the Portal except in cases of willful misconduct or gross negligence.

11. Intellectual Property Rights:

11.1 All IP rights in everything provided to or developed for the Client — including software, source code, applications, websites, designs, models, algorithms, documentation and other materials — remain with WYKYK or its licensors; use is limited to agreed purposes and scope, and upon termination materials shall be returned or destroyed at WYKYK’s request.

11.2 IP arising during performance belongs exclusively to WYKYK unless agreed otherwise; to the extent rights vest in the Client by law, they are irrevocably assigned in advance to WYKYK, and the Client waives moral rights to the extent permitted and undertakes not to assert them in trade.

11.3 Transfer of specific IP to the Client does not affect WYKYK’s rights in underlying concepts, methods, algorithms and technical elements; no exclusive rights are granted therein and WYKYK may freely reuse them.

11.4 Any license is non-exclusive, non-transferable and non-sublicensable, limited to agreed purposes and subject to the Agreement and these terms.

11.5 Unless otherwise agreed, a license is limited to the term of the Agreement or as long as WYKYK products are purchased; WYKYK may terminate a license with immediate effect without liability.

11.6 Licensed software may be used only via WYKYK-provided credentials and on designated systems; no copying, disclosure, modification, reverse-engineering or circumvention of security is permitted; upon termination the Client shall remove references to WYKYK and indemnify WYKYK against third-party claims arising from Client-supplied materials.

12. Confidentiality and Personal Data:

12.1 Both parties shall maintain confidentiality of all confidential information received in connection with the Agreement.

12.2 Confidential information may be used solely for performance and not disclosed to third parties without prior written consent, except where required by law or court order (with prior notice where lawfully permitted).

12.3 Materials provided by WYKYK may contain trade secrets or confidential information; the Client shall protect such information.

12.4 If WYKYK processes personal data on behalf of the Client, it shall do so in accordance with applicable data-protection laws; the Client is responsible for lawful instructions.

12.5 The Client shall indemnify WYKYK against third-party claims arising from unlawful processing resulting from the Client’s acts or instructions.

12.6 If a competent authority requests disclosure of the Client’s data, WYKYK shall comply; related costs may be charged to the Client.

13. Penalty: In the event of any breach by the Client of Articles 11 or 12, the Client owes a penalty of EUR 10,000.00 per violation without prior notice of default, without prejudice to WYKYK’s right to claim full damages, interest and costs in addition. Any penalty does not offset such damages; Article 6:92(2) Dutch Civil Code is expressly deviated from.

14. Force Majeure:

14.1 WYKYK is in force majeure (Art. 6:75 DCC) if prevented from performing due to circumstances beyond reasonable control, including: (i) supplier delays/non-delivery; (ii) defects in third-party goods, equipment, software or materials; (iii) government measures; (iv) electricity and/or internet outages; (v) emergencies such as (civil) war, riots, uprisings, natural disasters; (vi) occupation of workplaces or strikes; (vii) general transport disruptions; (viii) outbreaks of disease or pandemics; (ix) unavailability of personnel; (x) failures in telecom infrastructure; (xi) hacking, computer viruses, ransomware or DDOS attacks.

14.2 WYKYK is not obliged to perform during force majeure; delivery terms extend by its duration.

14.3 If force majeure lasts or is expected to last longer than three (3) months, either party may terminate the unperformed part without liability.

15. Liability and Indemnification:

15.1 Except in cases of willful misconduct or gross negligence, WYKYK is not liable for direct or indirect damages, including consequential loss, business interruption, loss of profit, missed savings, loss of goodwill or damage from business stagnation.

15.2 If the exclusion does not hold, total liability is limited to the invoice amount (excl. VAT) relating to the specific performance from which liability arises or is directly connected; for continuing performance exceeding one (1) year, liability is limited to the total fees (excl. VAT) payable in one (1) year. In all cases, liability per event (or series of related events) shall not exceed EUR 100,000 unless insurance pays more, in which case that higher amount applies plus any deductible.

15.4 The limitations and exclusions apply concurrently and cumulatively with other limitations in these terms unless expressly agreed otherwise.

16. Employee Non-Solicitation:

16.1 The Client is prohibited, during the term and for one (1) year after termination, from employing or engaging WYKYK employees without prior written consent; WYKYK may attach conditions.

16.2 Breach results in a penalty of EUR 50,000.00 without prior notice, without prejudice to full damages; Article 6:92(2) DCC is expressly deviated from.

17. Assignment of Rights and Severability:

17.1 The Client may not assign or transfer any claims against WYKYK; claims are explicitly non-transferable with property-law effect per Article 3:83(2) DCC.

17.2 Obligations under the Agreement and/or these terms may not be assigned or transferred without WYKYK’s prior written consent.

17.3 If any provision is null or voidable, the remainder remains in force; WYKYK will replace it with a valid provision that most closely reflects the original intent.

18. Expiry of Rights, Governing Law and Jurisdiction:

18.1 Unless otherwise stipulated, Client claims expire one (1) year after the cause of action arose unless brought before the competent court within that period.

18.2 All legal relationships are governed exclusively by the laws of the Netherlands.

18.3 Disputes shall be submitted exclusively to the Gelderland District Court, location Zutphen, the Netherlands.

CHAPTER 2 — USE OF WYKYK TOOLS AND REPORTS: This chapter applies where WYKYK provides access to online security tools, vulnerability portals or digital reporting environments, forming an integral part of services. Unless explicitly agreed otherwise in writing, access is provided on an “as-is” basis for the duration of the Agreement and solely for the Client’s internal business purposes.

19. Scope of Use:

19.1 WYKYK may provide access to proprietary online tools, portals or reporting environments (“WYKYK Tools”), including dashboards, vulnerability overviews, risk reports or related documentation.

19.2 Access is exclusively for internal business use and only for the term of the Agreement; no disclosure, sublicensing, resale or third-party access without prior written consent.

19.3 WYKYK Tools and content remain the exclusive IP of WYKYK or licensors; no rights are transferred or implied beyond those explicitly granted.

19.4 WYKYK may modify, improve, suspend or discontinue Tools at its discretion, provided changes do not materially affect access to agreed deliverables or reports.

20. Use of Reports and Deliverables:

20.1 WYKYK may provide security reports, test results, recommendations and related documents (“Reports”) as part of its services; Reports are confidential and for internal use only.

20.2 No public disclosure, distribution or third-party validation use without WYKYK’s prior written consent.

20.3 Reports reflect the system status at the time of testing and are based on information and access provided by the Client; not all vulnerabilities can be guaranteed detected.

20.4 WYKYK is not liable for decisions or actions taken based on a Report; the Client is responsible for interpretation and implementation of recommendations.

21. Availability and Maintenance:

21.1 WYKYK Tools are provided “as-is” and “as-available”; no warranty of uninterrupted, continuous or error-free operation.

21.2 Maintenance, updates or upgrades may occur at any time and may affect availability; WYKYK uses reasonable efforts to perform outside regular hours or with prior notice where feasible.

21.3 WYKYK is not liable for delay, data loss or unavailability due to maintenance, internet disruption or technical malfunctions outside reasonable control.

22. Data and Security:

22.1 The Client acknowledges that information in WYKYK Tools may be sensitive; the Client ensures only authorized persons have access.

22.2 WYKYK implements reasonable security measures against unauthorized access, alteration or loss; the Client remains responsible for its own network security, access control and back-ups.

22.3 WYKYK may retain or delete data after termination at its discretion unless required otherwise by law or contract.

22.4 WYKYK is not liable for loss or disclosure of data resulting from actions of the Client, its users or third parties with obtained credentials, except in cases of willful misconduct or gross negligence by WYKYK.

CHAPTER 3 — SECURITY CONSULTANCY AND ADVISORY SERVICES: This chapter applies where WYKYK provides professional advisory or consultancy services to the Client.

23. Advisory and Consultancy Services:

23.1 WYKYK performs advisory and consultancy services independently using professional judgment; obligations are best-efforts and no specific result is guaranteed.

23.2 Service quality depends partly on timely, accurate and complete information from the Client; the Client ensures access to relevant data, systems and contacts.

23.3 The Client is solely responsible for decisions based on WYKYK’s advice; use is at the Client’s risk and expense, and the Client bears the burden of proof for any alleged deficiency.

23.4 Advice, reports and deliverables are for internal use only; disclosure to third parties requires WYKYK’s prior written consent; reports are non-binding unless expressly agreed otherwise.

23.5 WYKYK informs the Client of progress as agreed; the Client informs WYKYK in due time of relevant circumstances and ensures internal coordination.

CHAPTER 4 — ON-SITE SECURITY SERVICES: This chapter applies where WYKYK performs security or consultancy activities on-site at the Client’s premises or within its technical environment. These provisions safeguard embedded or hybrid assignments where WYKYK personnel operate from or within the Client’s organization while remaining under WYKYK’s management and responsibility.

24. Scope and Supervision:

24.1 WYKYK may perform testing, consultancy or monitoring on-site or via remote access; such work remains under WYKYK’s professional direction and responsibility. The Client shall not issue binding instructions regarding methodology, except for health, safety or facility-related reasons.

24.2 The Client provides a safe and secure working environment and complies with applicable occupational-health, safety and data-protection laws, ensuring required access, facilities and connectivity.

24.3 WYKYK may replace assigned personnel for operational or security reasons with comparably qualified replacements.

25. Liability and Responsibilities:

25.1 While on-site, WYKYK personnel comply with Client internal security and confidentiality policies communicated in writing and reasonably applicable.

25.2 The Client remains responsible for integrity and availability of its systems, data and networks; WYKYK takes reasonable care to avoid disruption but cannot guarantee no operational impact.

25.3 WYKYK is not liable for indirect or consequential loss (including data loss, production or continuity) from on-site activities except in cases of willful misconduct or gross negligence.

25.4 If WYKYK personnel suffer injury or damage on-site due to unsafe conditions attributable to the Client, the Client shall indemnify WYKYK.

25.5 Unless otherwise agreed in writing, on-site engagements may be terminated by either party with one (1) calendar-month written notice.