Terms and conditions

1. Definitions

• CoBoo: the sole proprietorship CoBoo, established in Hoogeveen, the Netherlands, registered with the Dutch Chamber of Commerce under number 99516551. Services delivered under the name Lumyo Awareness also fall under these terms.
• Client: the legal entity or business entering into an agreement with CoBoo.
• Assignment: the services agreed between the parties, including phishing simulations, security awareness training and the associated reporting and advice.
• Simulation: a controlled, simulated phishing or social engineering attack, carried out at the request of and with the permission of the client.
• Data subjects: the employees or other individuals of the client to whom a simulation or training relates.

2. Applicability

These terms apply to all quotations, order confirmations and agreements between CoBoo and the client, and to all work arising from them.

Deviations from these terms apply only where agreed in writing. Purchasing or other terms of the client are expressly rejected, unless CoBoo has accepted their applicability in writing.

CoBoo delivers exclusively to businesses and organisations, not to consumers.

3. Quotations and formation of the agreement

Quotations from CoBoo are without obligation and valid for thirty days, unless the quotation states a different period. All amounts are exclusive of VAT.

An agreement is formed when the client accepts the quotation in writing or by email, or when CoBoo begins performance at the client's request.

Obvious errors or clerical mistakes in a quotation are not binding on CoBoo.

4. Performance of the assignment

CoBoo performs the assignment to the best of its knowledge and ability, with the care that may be expected of a reasonably acting and reasonably competent service provider. CoBoo's obligation is an obligation of effort, not of result.

CoBoo determines how the assignment is carried out, within the scope and planning agreed with the client.

CoBoo is entitled to engage third parties in performing the assignment. These terms apply to those third parties as well.

Stated timeframes are indicative, unless expressly agreed as a strict deadline.

5. Phishing simulations: permission and scope

This article is essential. Without valid prior permission, CoBoo does not carry out a simulation.

A simulation is carried out only after the client has given prior written permission. That permission must be granted by the management or another person authorised to represent the client.

The order confirmation records at least:

• the target group and size of the simulation
• the period in which the simulation takes place
• the scenarios and domains to be used
• which systems and data fall within scope
• who within the organisation can be notified during performance

The client warrants that it is authorised to grant this permission and that in doing so it complies with all internally applicable obligations. Where relevant, these include obligations towards the works council or employee representation, and obligations arising from a collective labour agreement or company regulations.

The client informs its own IT department or IT supplier in good time, so that a simulation is not mistaken for a genuine attack. If this is not done, the consequences are for the client's account.

CoBoo never performs work outside the agreed scope. If the client wishes to extend it, this is recorded separately in writing.

6. Obligations of the client

The client ensures that CoBoo has timely access to all information required to perform the assignment, and warrants the accuracy and completeness of that information.

The client designates a contact person who is reachable during performance and authorised to make decisions on its behalf.

If delay or additional work arises because the client fails to meet these obligations, the resulting costs are for its account.

7. Prices and payment

CoBoo works on a fixed project price, unless agreed otherwise in writing. All amounts are exclusive of VAT and exclusive of third-party costs, unless expressly stated otherwise.

Invoices are payable within fourteen days of the invoice date, without set-off or suspension.

If the payment term is exceeded, the client is in default by operation of law. From that moment the statutory commercial interest is due, as well as extrajudicial collection costs in accordance with Dutch law.

CoBoo is entitled to suspend performance of the assignment for as long as the client has not paid a due invoice.

8. Cancellation and rescheduling

The client may cancel a scheduled assignment in writing. The following scale applies, calculated from the agreed start date:

Rescheduling an assignment to another date is possible once free of charge, provided this is requested in writing at least seven days before the start date and a new date within three months is agreed.

Costs already incurred and costs charged by third parties are always passed on in the event of cancellation.

9. Confidentiality

The parties keep confidential all confidential information they receive from each other in the context of the assignment, and use it solely for the purpose for which it was provided.

In performing a simulation, CoBoo gains insight into vulnerabilities in the client's organisation. This information is not shared with third parties and is used solely for the report to the client.

This duty of confidentiality remains in force after the agreement ends.

CoBoo may use the client's name as a reference only with the client's express written permission.

10. Personal data

In performing a simulation or training, CoBoo processes personal data of data subjects, such as email addresses and data on behaviour during the simulation.

For that processing the client is the controller within the meaning of the General Data Protection Regulation. CoBoo acts as processor. To this end the parties conclude a separate data processing agreement, which forms part of the agreement.

CoBoo processes the data solely on the client's instructions and takes appropriate technical and organisational measures to protect it.

Reporting is aggregated as far as possible. Identifiable results are provided only to the contact person designated by the client.

The processing of personal data of visitors to our websites is described in our privacy policy.

11. Intellectual property

The report CoBoo delivers following an assignment is intended for the client. The client may use this report freely within its own organisation, and submit it to its accountant, auditor or insurer.

All other materials remain the property of CoBoo. These include the scenarios used, templates, training modules, e-learning material and the underlying methodology.

The client obtains a non-transferable right to use those materials internally within its own organisation, for the duration of the assignment. Reproduction, publication or making them available to third parties is not permitted without written consent.

12. Liability

CoBoo is liable only for direct damage resulting from an attributable failure in the performance of the assignment.

CoBoo's liability per assignment is limited to the amount charged to the client for that assignment, excluding VAT.

CoBoo is not liable for indirect damage. This includes in any event consequential loss, lost profit, lost turnover, lost savings, business interruption, loss of data and reputational damage.

Nor is CoBoo liable for damage resulting from:

• incorrect, incomplete or late information provided by the client
• the client failing to inform its own IT department or IT supplier, or doing so too late
• acts or omissions of data subjects in response to a simulation
• the client failing to meet its obligations under article 5
• decisions the client takes on the basis of the report

The client must report damage to CoBoo in writing within thirty days of discovery, and in any event within twelve months of completion of the assignment. If that period is exceeded, the right to compensation lapses.

The limitations in this article do not apply insofar as the damage results from intent or deliberate recklessness on the part of CoBoo.

13. Force majeure

CoBoo is not obliged to fulfil any obligation where it is prevented from doing so by a circumstance not attributable to it.

Force majeure includes in any event: disruption or failure of internet, telecommunications or hosting services, cyber attacks directed against CoBoo, power failure, government measures, and illness or unavailability of the person performing the assignment.

If the force majeure situation lasts longer than sixty days, either party is entitled to terminate the agreement in writing, without any obligation to pay compensation. Work performed up to that point is charged pro rata.

14. Term, notice and termination

An assignment for a one-off simulation or training ends upon delivery of the report.

For an ongoing programme, the agreed term applies. Notice is given in writing with one month's notice period, effective at the end of a contract period, unless agreed otherwise.

Either party may terminate the agreement with immediate effect if the other party is declared bankrupt, applies for suspension of payments, or ceases its business.

15. Complaints

Complaints about the performance of the assignment or about an invoice must be reported to CoBoo in writing within fourteen days of delivery or of the invoice date respectively, together with a description of the complaint.

A complaint does not suspend the payment obligation.

CoBoo responds substantively to a complaint within fourteen days, and makes every effort to reach a solution together with the client.

16. Governing law and disputes

All agreements between CoBoo and the client are governed by Dutch law.

Disputes are submitted exclusively to the competent court of the District Court of Northern Netherlands (rechtbank Noord-Nederland), unless mandatory law provides otherwise.

The parties turn to the court only after they have made an effort to resolve the dispute by mutual consultation.

17. Amendments

CoBoo is entitled to amend these terms. The amended terms apply to agreements formed after the date of amendment. For ongoing agreements, the terms that applied when they were entered into remain in force.

The current version is always available on this page.