Updated: 1st may 2026
Language and governing-law notice
This document is an auxiliary English translation of the Polish-language master document „Ogólne warunki świadczenia usług przez PATRONUSEC sp. z o.o.”. It is provided for the convenience of foreign-speaking Clients.
In the event of any discrepancy, ambiguity, or conflict of interpretation between the Polish and English versions, the Polish version shall prevail and constitute the legally binding text. References to provisions of Polish law are quoted using their original Polish abbreviations followed by an English-language explanation. The Agreement is governed exclusively by Polish law.
Preamble
These General Terms and Conditions of Service Provision (hereinafter: „GTC”) set forth the rules for the provision of services by PATRONUSEC sp. z o.o., with its registered seat in Poznań, ul. Św. Marcin 29/8, 61-806 Poznań, Poland, registered in the Register of Entrepreneurs of the National Court Register kept by the District Court Poznań – Nowe Miasto i Wilda in Poznań, 8th Commercial Division, under KRS number 0001039087, NIP (Tax ID) 7831881739, REGON 525386650 (hereinafter: „PATRONUSEC”), to its Clients.
The GTC constitute a standard contract template within the meaning of Article 384 § 1 and § 2 of the Polish Civil Code of 23 April 1964 (hereinafter: „PCC”). The GTC are made available to the Client in a manner enabling easy access to their content, in particular by publication on www.patronusec.com and by attaching them to, or incorporating them by reference into, every Offer addressed to the Client.
Cooperation between the Parties is established on the basis of a written offer of PATRONUSEC drawn up on PATRONUSEC’s template, addressed to a specific prospective Client (hereinafter: the „Offer”). The Offer constitutes an offer within the meaning of Article 66 § 1 PCC. Written acceptance of the Offer by the Client — by signing it without modification — constitutes the conclusion of a specific agreement (hereinafter: the „Specific Agreement”) on the terms set out in the Offer and in the GTC. Submission of the Offer together with the GTC and its signature by the Client constitutes acceptance of the GTC in the version applicable on the date the Offer is delivered to the Client.
The GTC do not apply to agreements concluded with consumers within the meaning of Article 22¹ PCC. PATRONUSEC does not provide Services to consumers.
§ 1. Subject matter and conclusion of the Specific Agreement
1. The subject matter of the GTC is to define the general principles of cooperation between PATRONUSEC and the Client (jointly: „the Parties”) within the scope of the services provided by PATRONUSEC, in particular: cybersecurity services, IT audit services, penetration testing, vulnerability assessments, vCISO services, regulatory compliance advisory services (including PCI DSS, ISO 27001, TISAX, DORA, NIS2, GDPR), training and related advisory services (hereinafter: „Services”).
2. The detailed scope of cooperation, including the specification of Services, schedule, fees, terms of payment and the Client’s cooperation obligations, shall be set forth in the Offer addressed by PATRONUSEC to the Client. Upon signature by the Client, the Offer together with the GTC constitutes the Specific Agreement within the meaning of the GTC. The term „Order” used in the further provisions of the GTC means the Specific Agreement concluded by signing the Offer in accordance with sec. 4 below and is used interchangeably with the term „Specific Agreement”.
3. By their nature, the Services constitute obligations of best efforts (zobowiązanie starannego działania) within the meaning of Article 750 PCC in conjunction with Article 734 et seq. PCC, and not obligations of result. PATRONUSEC undertakes to perform the Services with professional due diligence.
4. The Specific Agreement is concluded under the offer-and-acceptance procedure (Articles 66 et seq. PCC), subject to the following rules:
a) PATRONUSEC delivers to the Client an Offer drawn up on its own template, containing the essential terms of the agreement within the meaning of Article 66 § 1 PCC, in particular: detailed scope of the Services, fee and payment schedule, deadlines, Client’s responsible persons, list of resources to which PATRONUSEC will have access;
b) the Offer specifies the period during which PATRONUSEC remains bound by the Offer (the validity period of the Offer). Unless the Offer provides otherwise, this period is 30 days from the date the Offer is delivered to the Client. After expiry of this period the Offer ceases to bind PATRONUSEC and requires re-confirmation;
c) the Client accepts the Offer by signing it (in written, documentary or electronic form within the meaning of Article 78¹ PCC) without any modifications and delivering the signed Offer to PATRONUSEC within the validity period of the Offer. Upon delivery of the signed Offer to PATRONUSEC in a manner enabling acquaintance with its content, the Specific Agreement is concluded (Article 70 § 1 PCC);
d) signing the Offer with any modification, reservation, addition or reference to another standard contract template (including the Client’s template) — regardless of its nature or materiality — does not constitute acceptance of the Offer, but a new offer of the Client within the meaning of Article 68 PCC, which binds PATRONUSEC only after written acceptance by a person authorised to represent PATRONUSEC. This provision excludes the application of Article 68¹ § 1 PCC (modification by acceptance);
e) the Specific Agreement is concluded exclusively on the terms of the Offer and the GTC. In the event of any discrepancy between the Offer and the GTC, the Offer shall prevail.
5. PATRONUSEC is not bound by an Offer signed by the Client after expiry of the validity period of the Offer, regardless of the cause of the delay. Receipt by PATRONUSEC of a signed Offer after the deadline shall be treated as the Client’s offer requiring written acceptance by PATRONUSEC; the failure of PATRONUSEC to respond within 7 business days shall be deemed a rejection.
6. The provisions of the GTC form an integral part of the Specific Agreement. The Client confirms that, prior to signing the Offer, it has reviewed the GTC in the version in force on the date the Offer was delivered, and that it accepts their content in full. PATRONUSEC ensures that every Offer either references the GTC or includes the GTC as an annex.
7. Subject to § 6 sec. 3 (advance payment), PATRONUSEC shall commence performance of the Services no earlier than upon the conclusion of the Specific Agreement.
§ 2. Client’s representations and obligations
1. The Client undertakes to provide PATRONUSEC with full, accurate, true and timely cooperation, including: (i) granting access to documents, persons and infrastructure necessary for the performance of the Services, (ii) appointing a contact person authorised to provide information on behalf of the Client, (iii) responding to PATRONUSEC’s questions and requests within the agreed deadlines, (iv) refraining from any actions that may impede or prevent the performance of the Services.
2. The Parties jointly confirm that the Services of PATRONUSEC are provided:
a) on the basis of data, documents and information received from the Client or persons acting on the Client’s behalf, as well as on the basis of publicly available information;
b) on the assumption that all documents made available to PATRONUSEC, their copies and any information are accurate, complete, current, true and consistent with the actual and legal state of affairs.
Accordingly, PATRONUSEC shall not verify the reliability, completeness or truthfulness of the materials or information provided by the Client and shall not be liable for their content. The Client bears sole responsibility for the consequences of providing PATRONUSEC with information that is untrue, incomplete, misleading or outdated, including any conclusions drawn by PATRONUSEC on the basis of such information.
3. PATRONUSEC accepts documents provided by the Client in Polish and English. Documents drawn up in any other language shall not be analysed by PATRONUSEC unless PATRONUSEC confirms in writing (in documentary form) its readiness to analyse them in such language. In the absence of such confirmation, the Client shall provide a translation into Polish or English at its own expense.
4. The Client represents and warrants that all documents, materials, data and projects provided to PATRONUSEC in connection with the performance of the Agreement constitute its property or that the Client holds all consents, licences and authorisations required by law for their use by PATRONUSEC to the extent necessary for the performance of the Services, and that their transfer to and use by PATRONUSEC does not infringe any third-party rights, including copyrights, industrial property rights, trade secrets or personal data protection regulations.
5. Should any third party assert claims against PATRONUSEC in connection with the use of materials, data or information provided by the Client, the Client undertakes to:
a) promptly, upon the first written request of PATRONUSEC, cover all costs of PATRONUSEC’s defence, including legal counsel fees, court representation fees, court costs and expert witness fees;
b) release PATRONUSEC from the obligation to render performance to the third party pursuant to Article 392 PCC (assumption-of-debt protection) — the Client undertakes that the third party shall not demand performance from PATRONUSEC, and should such performance nevertheless be adjudicated against PATRONUSEC, the Client shall reimburse PATRONUSEC the full adjudicated amount, together with interest and all costs, within 14 days of receiving the request;
c) provide PATRONUSEC with all necessary support in the proceedings, including disclosure of necessary documents and information and, upon PATRONUSEC’s request, joining the proceedings as accessory intervener (Article 76 of the Polish Code of Civil Procedure of 17 November 1964, hereinafter: „PCCP”) on PATRONUSEC’s side.
PATRONUSEC shall promptly notify the Client of any such claim, no later than within 7 business days of becoming aware of it.
§ 3. Technical Services (penetration testing and similar)
1. Where the Services are technical in nature — in particular penetration testing, vulnerability scanning (external and internal), application testing, social engineering testing, TLPT testing and similar — the Client represents, warrants and undertakes that:
a) it is the lawful owner or holds legally effective authorisation to dispose of all IT systems, applications, IP addresses, domains and other resources specified in the Order (hereinafter: „Test Assets”);
b) it has obtained all consents and authorisations required by law or contract from third parties — in particular hosting providers, cloud service providers (including AWS, Microsoft Azure, Google Cloud Platform and similar), CDN providers, subcontractors, co-owners, and persons whose data or resources may be subject to testing — to the extent necessary for the lawful performance of the Services;
c) it grants PATRONUSEC and its subcontractors irrevocable consent to access the Test Assets, including to interfere with such systems and to circumvent their security measures within the meaning of Articles 267, 268, 268a, 269, 269a and 269b of the Polish Penal Code of 6 June 1997 (hereinafter: „PPC”), exclusively for the purpose of, and within the scope of, the Order. The consent shall remain effective during the performance of the Order and any subsequent verification period;
d) it acknowledges that, in the course of proper performance of the Services, temporary and unintended disruptions may occur, including service unavailability, generation of high network traffic, triggering of defensive mechanisms of the Client or its providers. The Client accepts this risk and undertakes not to assert claims against PATRONUSEC in this respect, save for damage caused by PATRONUSEC’s wilful misconduct or gross negligence;
e) it shall, upon PATRONUSEC’s request, deliver within 5 business days documents confirming the circumstances referred to in items (a) and (b), in particular extracts from agreements or statements from third parties;
f) it shall ensure that the test window is communicated to the Client’s internal teams (including SOC, NOC, IT) in a manner consistent with the test design (excluding „black-box” or „red team” engagements, where limited communication is part of the methodology).
2. The Client bears sole responsibility for the consequences of unauthorised granting of the consent referred to in sec. 1(c). The provisions of § 2 sec. 4–5 apply mutatis mutandis.
§ 4. Rescheduling and reservation fee
1. PATRONUSEC reserves delivery capacity of its team for the agreed performance dates. In the event of rescheduling or relocation of a previously agreed meeting or service for reasons attributable to the Client, the Client shall:
a) fully reimburse documented costs already incurred by PATRONUSEC, including hotel reservations, tickets, licensing fees of testing tools and subcontractor costs — to the extent that they cannot be cancelled at no charge (based on copies of invoices or receipts); and
b) pay a reservation fee (compensation for capacity reservation) in the amount of:
(i) 25% of the net value of the Order — for rescheduling more than 30 days before the agreed performance date,
(ii) 50% of the net value of the Order — for rescheduling between 30 and 14 days before the agreed performance date,
(iii) 75% of the net value of the Order — for rescheduling less than 14 days before the agreed performance date.
The amounts indicated in item (b) constitute a contractual penalty (kara umowna) reserved for the case of improper performance of a non-monetary obligation (the duty to cooperate) within the meaning of Article 483 § 1 PCC, and do not exclude PATRONUSEC’s right to seek supplementary damages on general principles, where the actual damage exceeds the amount of the contractual penalty (Article 484 § 1 PCC second sentence in fine, in conjunction with Article 353¹ PCC).
2. The first rescheduling for reasons attributable to the Client made earlier than 60 days before the agreed performance date shall not trigger the obligation to pay the reservation fee, provided that the Parties agree on a new performance date within 14 days of the original date.
§ 5. Communication and form of acts
1. The Parties shall conduct ongoing communication electronically (e-mail) at the addresses specified in the Order or agreed during performance.
2. PATRONUSEC undertakes to follow the Client’s organisational and procedural directions concerning the performance of the Services, in particular regarding meeting schedules, reporting format and communication channels. The foregoing does not modify PATRONUSEC’s autonomy in respect of the substantive content of the Services or the choice of methodology, techniques and testing tools.
3. All arrangements made during performance of the Agreement that concern its execution require at least documentary form. The Parties allow oral or telephone arrangements, however, their effectiveness is conditional upon documentary confirmation (e-mail) by either Party within 3 business days. The other Party’s failure to object within 2 business days of receipt of such confirmation shall be deemed acceptance.
4. The Client acknowledges and accepts the risks associated with electronic communication, including risks of interception, modification or loss of messages. PATRONUSEC shall not be liable for damage arising from risks associated with communication over the Internet, save for damage caused by PATRONUSEC’s wilful misconduct. The Parties undertake to apply reasonable communication security measures (encrypted e-mail for sensitive information, secure channels for technical data exchange).
5. Any modification of the Order requires the mutual consent of both Parties expressed at least in documentary form.
§ 6. Fees and payment terms
1. For the Services rendered, PATRONUSEC shall be entitled to the fee specified in the Order. The fee is stated as a net amount and shall be increased by VAT at the rates applicable on the invoice date.
2. The fee specified in the Order covers all costs and expenses of PATRONUSEC related to the performance of the Services, except for the additional costs referred to in sec. 8.
3. PATRONUSEC may request an advance payment of up to 50% of the net Order fee, payable before commencement of the Services. The amount and payment date of the advance shall be specified in the Order. Failure to pay the advance on time entitles PATRONUSEC to suspend commencement without consequence.
4. Invoices are issued in structured form and delivered:
a) for Clients holding the status of an active VAT taxpayer in Poland — exclusively via the National e-Invoicing System (KSeF — Krajowy System e-Faktur), in accordance with Articles 106nd et seq. of the Polish Act on Goods and Services Tax of 11 March 2004 (hereinafter: „Polish VAT Act”). The date of delivery of the invoice is the date on which the invoice is assigned an identification number in KSeF;
b) for Clients not subject to the obligation of receiving invoices via KSeF (in particular, foreign Clients without a registered seat or fixed establishment in Poland) — in electronic form (PDF), to the Client’s e-mail address indicated in the Offer. The Client hereby consents to receiving invoices in electronic form pursuant to Article 106n sec. 1 of the Polish VAT Act.
5. The payment term is 15 days from the date of invoice issuance, unless the Order provides otherwise. The payment date is the date on which the bank account of PATRONUSEC is credited with the full amount stated on the invoice.
6. Payment shall be made by bank transfer to PATRONUSEC’s account disclosed in the official register of taxpayers referred to in Article 96b sec. 1 of the Polish VAT Act (so-called „white list”), as indicated on the invoice.
7. If there is doubt regarding payment status (timeliness, completeness), the Client shall promptly present a confirmation of transfer at PATRONUSEC’s request.
8. Unless the Offer provides otherwise, the fee specified in the Offer does not include travel expenses, in particular transport, accommodation and per diem allowances (hereinafter: „Travel Expenses”). Travel Expenses shall be added to the fee on the basis of documented expenditures, at acquisition cost, with no administrative margin. PATRONUSEC undertakes to exercise due diligence in optimising travel costs. Other additional costs (in particular licensing fees of specialist testing tools acquired specifically for the Client, subcontractor fees, translation costs) shall be added to the fee on the basis of documented expenditures, with an administrative margin of up to 10%, unless the Offer provides otherwise.
9. In the event of late payment, PATRONUSEC shall be entitled to charge statutory interest for late payment in commercial transactions in accordance with the Polish Act of 8 March 2013 on the Counteracting of Excessive Delays in Commercial Transactions, as well as to claim the recovery cost compensation referred to in Article 10 of that Act.
10. Where late payment of the fee or advance exceeds 14 days, PATRONUSEC may suspend performance of the Services until full payment of the overdue amount with interest. During the suspension period, the deadlines specified in the Order do not run, and PATRONUSEC shall not be liable for the consequences of delays resulting from the suspension.
11. Where, during the performance of the Services, the originally agreed fee proves materially inadequate to PATRONUSEC’s engagement due to circumstances for which PATRONUSEC is not responsible (in particular extension of the scope of Services, disclosure of material new facts, delays attributable to the Client), the Parties shall negotiate fee modifications in good faith. If the Parties fail to reach agreement within 14 days of the request being raised by either Party, PATRONUSEC may:
a) terminate the relevant Order with a 14-day notice period, retaining the right to fees for all Services performed up to the termination date; or
b) continue performance of the Order on the original terms, retaining the right to subsequently pursue claims under Article 357¹ PCC (rebus sic stantibus clause).
§ 7. Subcontractors
1. PATRONUSEC may entrust performance of all or part of the Services to third parties (subcontractors). PATRONUSEC is liable for acts and omissions of subcontractors as for its own (Article 474 PCC).
2. Engagement of a subcontractor does not require the Client’s prior consent, unless the Order provides otherwise. PATRONUSEC shall ensure that subcontractors undertake confidentiality obligations no less stringent than those set out in § 9 GTC.
3. Upon the Client’s written request, PATRONUSEC shall disclose a list of principal subcontractors engaged in the performance of a specific Order.
§ 8. Personal data protection
1. The Parties undertake to process personal data acquired in connection with performance of the Agreement in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter: „GDPR”), the Polish Personal Data Protection Act of 10 May 2018, and other applicable laws.
2. The Parties adopt the following allocation of roles:
a) with respect to contact data of employees and associates of the other Party, each Party remains an independent controller of its data;
b) to the extent that, in performing the Services, PATRONUSEC processes personal data for which the Client is the controller (e.g., system log data, test data, administrator data), PATRONUSEC acts as a processor within the meaning of Article 28 GDPR. In such cases, the Parties shall conclude a separate Data Processing Agreement (DPA) no later than on the date of conclusion of the first Order encompassing such processing. A DPA template constitutes Annex 1 to the GTC.
3. PATRONUSEC applies technical and organisational measures ensuring security of personal-data processing appropriate to the risk, including (i) encryption of data at rest and in transit, (ii) access control on a least-privilege basis, (iii) operation logging, (iv) regular security tests and reviews, (v) personnel training, (vi) business-continuity plan.
4. PATRONUSEC shall promptly, no later than within 24 hours of detection, notify the Client of any personal-data breach concerning the performance of the Services for the Client.
5. The provisions of this paragraph do not modify in any way the limitations of liability set out in § 11 GTC.
§ 9. Confidentiality and trade secrets
1. The Parties undertake to keep confidential all information obtained in connection with performance of the Agreement, marked by the disclosing Party as confidential or which by its nature should be treated as confidential (hereinafter: „Confidential Information”). In particular, Confidential Information includes information constituting a trade secret within the meaning of Article 11 sec. 2 of the Polish Act of 16 April 1993 on Combating Unfair Competition.
2. Among Confidential Information, the Parties distinguish „Sensitive Confidential Information”, which includes: authentication data (logins, passwords, API keys), cryptographic keys, full penetration-test reports containing technical evidence (proof-of-concept), information about active vulnerabilities prior to remediation, payment-card data within the scope covered by the PCI DSS standard, and personal data of special categories within the meaning of Article 9 GDPR. Sensitive Confidential Information is subject to enhanced protection: encryption at rest and in transit (algorithms not weaker than AES-128), least-privilege access control, access logging, and a prohibition on transmission via unencrypted channels.
3. The Parties undertake to: (i) use Confidential Information solely for the purpose of performing the Agreement, (ii) not disclose Confidential Information to third parties without the disclosing Party’s prior written consent, (iii) protect Confidential Information with due diligence, no less than that applied to protect their own confidential information.
4. The confidentiality obligation applies for the entire term of the Agreement and for 5 years after its termination for any reason. With respect to Sensitive Confidential Information, the confidentiality obligation is indefinite.
5. The confidentiality obligation does not cover information which:
a) at the time of receipt was generally known or has become generally known without breach of the confidentiality obligation by the receiving Party;
b) was known to the receiving Party prior to receipt from the disclosing Party, which the receiving Party can prove;
c) has been independently developed by the receiving Party without using the disclosing Party’s Confidential Information;
d) has been disclosed pursuant to a mandatory obligation under applicable law, a final court judgment or a decision of a public authority, provided that the receiving Party, where permissible, promptly notifies the disclosing Party of such obligation.
6. Upon termination of the Agreement, each Party shall, upon the other Party’s request, return or permanently delete the other Party’s Confidential Information, except for (i) one archival copy retained for evidentiary purposes for the limitation period of claims, (ii) Confidential Information contained in system archives where selective deletion is technically infeasible — provided that the confidentiality obligation continues until natural expiry in the archival cycle.
7. PATRONUSEC shall be entitled to publicise the fact of cooperation with the Client and to feature the Client in its portfolio, in particular by:
a) displaying the Client’s name and logo on PATRONUSEC’s website, in marketing materials, sales presentations and offers;
b) providing a general description of the cooperation (e.g., „PCI DSS audit”, „penetration testing”) without disclosing technical details or Sensitive Confidential Information;
c) publishing references approved by the Client.
The Client may at any time withdraw consent to publication of its logo and name in writing, with a 30-day removal period; however, mere disclosure of the cooperation in the course of a sales process (in response to a specific inquiry from a prospective client) remains permissible, subject to maintenance of the confidentiality of Confidential Information.
8. The provisions of this paragraph do not exclude PATRONUSEC’s reporting obligations to industry-standard organisations (e.g., the PCI Security Standards Council) or its obligation to provide documentation in the event of an audit by such organisations.
§ 10. Intellectual property
1. Definitions:
a) „Background IP” means all intellectual property rights of PATRONUSEC existing prior to conclusion of the Agreement or arising independently of its performance, in particular testing methodologies, tools (including software), report templates, checklists, audit frameworks, know-how and training materials;
b) „Foreground IP” means all intellectual property rights arising in the course of performance of the Agreement, including reports, documentation, recommendations and analyses.
2. Background IP remains the exclusive property of PATRONUSEC. The Client acquires no rights thereto other than the limited right of use arising from Foreground IP.
3. Upon payment of the full fee for a given Order, PATRONUSEC grants the Client a non-exclusive, non-transferable (except as set out in sec. 4) licence — unlimited as to territory — to use the Foreground IP for internal purposes, in particular to:
a) implement the recommendations contained in the report;
b) present the report to regulators, auditors (external and internal), statutory auditors, legal and tax advisors, and certifying organisations (including the PCI SSC and ISO accreditation bodies);
c) make working and archival copies to the necessary extent.
The licence is granted in respect of the fields of exploitation specified in Article 50 of the Polish Act of 4 February 1994 on Copyright and Related Rights (hereinafter: „PCRA”): fixation, digital reproduction, entry into computer memory, making available to the indicated entities — solely for the purpose specified above.
4. The licence may be transferred to the acquirer of the Client’s enterprise or its organised part, in the course of corporate transactions (mergers, divisions, share sales). In the event of M&A with an independent acquirer, the Client shall notify PATRONUSEC of the transfer within 14 days of its completion.
5. The Client is not entitled to:
a) make Foreground IP available to third parties for commercial purposes (sale, sublicensing, use in services rendered to third parties);
b) use Foreground IP to create its own tools or services competing with PATRONUSEC’s business;
c) remove PATRONUSEC’s authorship markings from documents.
6. The Client retains exclusive rights to its data, documents and materials provided to PATRONUSEC. Upon completion of an Order, PATRONUSEC shall return or delete them in accordance with § 9 sec. 6.
7. PATRONUSEC retains the right to use experience, know-how, techniques and general principles learned in the course of performance of the Agreement in its future business — provided it does not disclose the Client’s Confidential Information.
8. Consideration for the licence referred to in sec. 3 is included in the fee specified in the Order and is not payable separately.
§ 11. Limitation of liability
1. Subject to sec. 5 below, the total liability of PATRONUSEC for damage caused to the Client in connection with the performance of the Agreement or an Order (irrespective of legal basis — contractual or tortious) shall be limited to:
a) actual damage (damnum emergens), to the exclusion of lost profits (lucrum cessans), indirect, consequential or reputational damage, damage relating to data loss, loss of goodwill, or inability to perform contracts with third parties; and
b) a maximum amount equal to 100% of the net fees actually paid to PATRONUSEC in respect of the specific Order in connection with whose performance the damage arose, in the 12 months preceding the damaging event.
The monetary cap applies in aggregate to all claims arising from the relevant Order, regardless of their number or legal basis.
2. PATRONUSEC shall not be liable for:
a) the content, correctness, completeness or truthfulness of information, materials and documents provided by the Client;
b) delays and improper performance of the Services caused by the Client’s act or omission or that of persons acting on its behalf, in particular failure to provide access to information, documentation, persons or infrastructure, or provision of untrue, incomplete or misleading information;
c) the consequences of decisions taken by the Client based on PATRONUSEC’s recommendations — liability for business decisions rests solely with the Client;
d) damage arising from acts of third parties who used information or reports made available by the Client to third parties in breach of § 9;
e) damage resulting from the Client’s failure to follow the recommendations contained in PATRONUSEC’s report.
3. PATRONUSEC gives no warranty as to the Client’s achievement of any particular regulatory outcome (including obtaining, maintaining or renewing PCI DSS, ISO 27001, TISAX or SOC certification, or compliance with DORA, NIS2, GDPR or other regulations), beyond its undertaking to exercise professional due diligence. The Services constitute an obligation of best efforts and not an obligation of result.
4. PATRONUSEC undertakes to maintain professional liability insurance for a sum insured of not less than PLN 1,000,000 per occurrence throughout the term of the Agreement. Upon the Client’s request, PATRONUSEC shall provide a copy of the policy or insurance certificate.
5. The limitations of liability set out in sec. 1 do not apply to damage caused by PATRONUSEC’s wilful misconduct (Article 473 § 2 PCC — invalidity of any waiver of liability for intentional damage) or to damage to a person.
§ 12. Force majeure
1. The Parties are exempted from liability where they fail, in whole or in part, to perform their obligations as a result of force majeure, defined as a sudden event of an external character, unforeseeable at the time of conclusion of the Agreement, which cannot be averted and the consequences of which cannot be prevented.
2. Force majeure includes in particular: (i) natural disasters, (ii) war, armed action, acts of terrorism, (iii) pandemics and epidemics and related acts of public authorities, (iv) industry-wide strikes, (v) acts of public authorities, including embargoes and sanctions making performance impossible, (vi) prolonged failure of third-party telecommunications infrastructure of global or regional scope (e.g., outages of major cloud providers or major Internet exchange points), (vii) cyberattack on PATRONUSEC’s infrastructure rendering performance of the Services impossible despite the exercise of due diligence.
3. A Party invoking force majeure shall promptly notify the other Party of its occurrence, expected duration and impact on performance of the Agreement. The Parties shall in good faith take steps to minimise the consequences of force majeure.
4. If a state of force majeure persists uninterrupted for more than 60 days, either Party may terminate the Agreement or a specific Order with immediate effect. PATRONUSEC retains the right to fees for Services performed up to the termination date.
§ 13. Non-solicitation of personnel
1. Given the critical nature of human resources to PATRONUSEC’s business, during the term of the Agreement and for 12 months after its termination for any reason, the Client undertakes not to take any action seeking to induce termination of any legal relationship with PATRONUSEC and to establish an employment or cooperation relationship with the Client (or with any entity affiliated with the Client by capital or personal links) of any member of PATRONUSEC’s team engaged in the performance of the Services for the Client during the 12 months preceding the planned engagement.
2. The undertaking in sec. 1 does not cover:
a) situations where a member of PATRONUSEC’s team independently responds to a job advertisement published by the Client in a generally accessible manner (e.g., job portals, LinkedIn, careers page), provided that the advertisement was not directed personally to that individual;
b) engagement of a person who has not been a member of PATRONUSEC’s team for at least 6 months;
c) situations where PATRONUSEC has granted prior written consent to the engagement.
3. The Client also undertakes not to share with third parties information enabling or facilitating the recruitment of PATRONUSEC’s team members, including contact data obtained in the course of performance of the Agreement.
4. In the event of breach of the undertaking in sec. 1, the Client shall pay PATRONUSEC a contractual penalty equal to 12 months’ gross remuneration of the recruited person (based on the remuneration offered or actually paid by the Client), but not less than PLN 100,000 per person. The contractual penalty is payable within 14 days of receipt of a demand. PATRONUSEC retains the right to seek supplementary damages on general principles where the actual damage exceeds the amount of the contractual penalty.
5. Without PATRONUSEC’s prior written consent, the Client undertakes not to use the deliverables of the Services (reports, documentation, recommendations) for the purpose of providing analogous services to third parties — subject to the licence granted under § 10.
§ 14. Term, termination and rescission
1. Each Order (Specific Agreement) is concluded for a fixed term and remains in force for a period of 12 months from the date of its conclusion, unless the Offer expressly provides otherwise (hereinafter: the „Order Validity Period”). During this period the Client is entitled and obliged to use the Services covered by the Order.
2. The Client is obliged to cooperate in the performance of the Services and, in particular, to confirm its readiness for the commencement of a specific Service. Confirmation of readiness includes: (i) granting access to infrastructure, documents, persons and other resources specified in the Offer, (ii) indicating the time window for performance and the contact persons, (iii) fulfilling all other cooperation obligations necessary for commencement of the Services. Failure to confirm readiness constitutes default of the creditor (mora creditoris) within the meaning of Article 486 § 2 PCC.
3. Failure to use the Services within the Order Validity Period for reasons attributable to the Client — including failure to confirm readiness as referred to in sec. 2, failure to grant access to resources, delays, or changes in the Client’s priorities — does not release the Client from the obligation to pay the full fee for the Order. Upon expiry of the Order Validity Period, PATRONUSEC shall be deemed to have offered and remained ready to perform the Services, and the Client shall be deemed to have failed to use the Services for reasons attributable to it. PATRONUSEC is then released from the obligation to perform the Services, retaining the right to the full fee under the Order.
4. PATRONUSEC may, in its sole discretion and without obligation, give written consent to extend the Order Validity Period by an additional period agreed by the Parties. Consent of PATRONUSEC is not granted automatically and may be conditional upon additional commercial terms, including fee escalation. The Client’s request for extension shall be made in documentary form no later than 30 days before expiry of the Order Validity Period.
5. The Parties jointly confirm that the mechanism set out in sec. 1–3 reflects the actual economic burden borne by PATRONUSEC, comprising: (i) the need to reserve the team’s delivery capacity for the Client and the resulting inability to reallocate resources to other projects, (ii) fixed costs of maintaining dedicated personnel, infrastructure and licensing resources, (iii) the reputational risk associated with the incomplete execution of planned projects. The fee for the Order covers not only the time actually devoted to the Client but also the readiness of PATRONUSEC to perform the Services during the Order Validity Period.
6. The provisions of sec. 1–3 concerning the consequences of the expiry of the Order Validity Period do not apply to situations in which the failure to perform the Services results solely from reasons attributable to PATRONUSEC. In such cases, PATRONUSEC shall refund the fee received in the part corresponding to the Services not performed, unless the Parties agree on a different settlement method.
7. The end of the Order Validity Period does not affect the provisions on confidentiality (§ 9), intellectual property (§ 10), non-solicitation (§ 13), or the contractual penalty provisions — which remain in force, for the periods specified therein, regardless of the end of the Order.
8. The Client is not entitled to unilaterally terminate or rescind an Order, except in cases of:
a) material delay by PATRONUSEC, not attributable to the Client, of more than 60 days against the agreed deadline, provided the Client has previously called upon PATRONUSEC to perform within an additional period of not less than 14 days;
b) gross breach by PATRONUSEC of the Agreement or Order which has not been cured within 14 days of written notice;
c) force majeure persisting uninterrupted for more than 60 days and rendering performance of the Order in its original form impossible.
For the avoidance of doubt, the Client’s right to rescission does not extend to situations in which, in the course of performance of the Services (in particular an audit), unfavourable findings, risks, non-compliances or conclusions are identified. An anticipated unfavourable outcome of the Services does not constitute grounds for rescission.
9. In the event of termination, rescission, withdrawal, repudiation, cancellation or any other unilateral end of an Order by the Client — regardless of the terminology used and the legal basis invoked, save for the cases set out in sec. 8 — the Client shall:
a) pay the full fee equal to 100% of the net value of the Order, regardless of the stage of progress of the Services as at the date of cancellation;
b) reimburse all documented additional costs incurred by PATRONUSEC up to the date of cancellation (in particular travel costs, licensing fees and subcontractor fees).
10. The amounts referred to in sec. 9(a) constitute a contractual penalty (kara umowna) reserved for the case of improper performance of a non-monetary obligation (the duty to cooperate) within the meaning of Article 483 § 1 PCC. The Parties jointly confirm that the amount of the contractual penalty reflects PATRONUSEC’s actual damage, comprising: costs of reservation of delivery capacity, inability to reallocate the team to other projects, the auditor’s reputational risk arising from non-completion of a planned project (in particular for certification audits, the discontinuation of which may be reportable to industry-standard organisations) and lost profits. PATRONUSEC retains the right to seek supplementary damages on general principles where actual damage exceeds the amount of the contractual penalty (Article 484 § 1 PCC second sentence in fine).
11. PATRONUSEC may terminate an Order with immediate effect in case of:
a) delay in payment of the fee or advance exceeding 30 days;
b) discovery that the Client’s representations under § 2 sec. 4 or § 3 sec. 1 are inconsistent with the actual state of affairs;
c) commencement of bankruptcy or restructuring proceedings against the Client, subject to the limitations arising from the provisions of the Polish Restructuring Law of 15 May 2015 and the Polish Bankruptcy Law of 28 February 2003.
§ 15. Regulatory compliance (sanctions, anti-bribery)
1. Each Party represents and warrants that, on the date of conclusion of the Agreement and on the date of each Order:
a) it is not subject to any international sanctions, in particular sanctions of the European Union, the United States (OFAC), the United Kingdom (HM Treasury) or the United Nations;
b) none of its ultimate beneficial owners within the meaning of the Polish Act of 1 March 2018 on Counteracting Money Laundering and Terrorist Financing appears on sanctions lists;
c) it is not under the control of an entity subject to sanctions within the meaning of Article 1 sec. 6 of Council Regulation (EU) No 833/2014.
2. The Parties undertake to comply with anti-corruption laws, in particular Articles 296a and 296b PPC and, where applicable, the US Foreign Corrupt Practices Act (FCPA) and the UK Bribery Act 2010. Neither Party nor persons acting on its behalf has given, promised or shall accept any pecuniary or personal benefit in connection with the conclusion or performance of the Agreement which could be characterised as a bribe, corruption or conflict of interest.
3. Breach of sec. 1 or 2 constitutes a gross breach of the Agreement entitling the other Party to terminate it with immediate effect.
§ 16. Final provisions
1. Assignment of rights and obligations under the Agreement or an Order requires the prior written consent of the other Party, except for assignment to an entity affiliated by capital (subsidiary, parent or sister) and assignment in the course of corporate transactions performed in accordance with law (mergers, divisions, sale of an enterprise or its organised part). PATRONUSEC may at any time assign monetary receivables under the Agreement to a financial institution for factoring or financing purposes, without the Client’s consent.
2. PATRONUSEC reserves the right to amend the GTC for important reasons, including in particular: changes in legislation, changes in market practice, business strategy adjustments, alignment with case law or positions of public authorities. Amendments to the GTC do not affect the terms of Orders concluded prior to the date the amendments take effect. Such Orders are governed by the GTC in the version in force on the date of the Order’s conclusion.
3. Should any provision of the GTC prove invalid or unenforceable, the remaining provisions shall remain in force. In place of the invalid provision, the Parties shall substitute a provision most closely reflecting the original economic and legal intent (severability clause).
4. In matters not regulated by the Agreement, an Order or the GTC, exclusively the laws of Poland apply, in particular the Polish Civil Code of 23 April 1964, the Polish Act of 4 February 1994 on Copyright and Related Rights, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation — GDPR), the Polish Personal Data Protection Act of 10 May 2018, the Polish Act on Goods and Services Tax of 11 March 2004, the Polish Act of 8 March 2013 on the Counteracting of Excessive Delays in Commercial Transactions, the Polish Act of 16 April 1993 on Combating Unfair Competition, and the Polish Code of Civil Procedure of 17 November 1964.
5. Any disputes arising out of or in connection with the Agreement, the GTC or the Orders shall first be resolved amicably through direct negotiations between authorised representatives of each Party. If no agreement is reached within 30 days of written notification of the dispute, either Party may refer the matter to mediation conducted by the Court of Arbitration at the Polish Chamber of Commerce in Warsaw in accordance with its rules.
6. If the dispute is not resolved under sec. 5 within 60 days of its notification, the Parties submit the dispute to the exclusive jurisdiction of the common court having subject-matter competence for the seat of PATRONUSEC. This provision constitutes a choice-of-court agreement within the meaning of Article 46 § 1 PCCP.
7. Notwithstanding sec. 5 and 6, either Party may apply to the court for interim relief without exhausting the amicable procedure.
8. The GTC are drawn up in the Polish language. The English version of the GTC constitutes an auxiliary translation; in the event of any discrepancy, ambiguity or conflict of interpretation, the Polish version shall prevail and constitute the binding text.
9. The Annexes to the GTC form an integral part thereof:
1) Data Processing Agreement (DPA) template.
ANNEX 1 TO THE GTC – DATA PROCESSING AGREEMENT (DPA) — TEMPLATE
This template forms an integral part of the GTC. Upon conclusion of an Order involving the processing of personal data for which the Client is the controller, the provisions of the DPA bind the Parties in full, unless the Parties enter into a separate data processing agreement.
§ 1. Definitions and general provisions
1. Terms used in this DPA shall have the meanings ascribed to them in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: „GDPR”), unless otherwise provided herein.
2. The Client acts as the controller of personal data, and PATRONUSEC acts as the processor within the meaning of Article 28 GDPR. The Parties enter into the DPA for the purpose of fulfilling the obligation set out in Article 28(3) GDPR.
3. The DPA applies exclusively to the processing of personal data which PATRONUSEC carries out in the course of providing the Services under an Order, and for which the Client remains the controller. The DPA does not apply to data for which PATRONUSEC remains an independent controller (e.g., contact data of the Client’s employees).
§ 2. Subject matter, nature and purpose of processing
1. The Client entrusts PATRONUSEC with the processing of personal data within the scope and for the purpose specified in the Order, in particular:
a) nature of processing: cybersecurity services, IT audits, penetration testing, vulnerability assessment, compliance advisory — in accordance with the scope of the relevant Offer;
b) purpose of processing: provision of the Services to the Client in accordance with the Order;
c) type of personal data: depending on the nature of the Services — identification data (name, surname, login), contact data (e-mail, phone), employment data (position, department), system log data, technical data (IP addresses, device identifiers), and in special cases data of special categories (Article 9 GDPR) — only if this results from the scope of the Services;
d) categories of data subjects: the Client’s employees and associates, users of the Client’s systems, the Client’s customers, the Client’s contractors — within the scope arising from the Services;
e) duration of processing: the term of the Order and the period necessary to deliver the results of the Services, but no longer than 6 months from completion, unless the Parties agree on a different period.
§ 3. Obligations of the processor
1. PATRONUSEC undertakes to process personal data only on documented instructions of the Client — the Order itself constituting documented instructions within the meaning of Article 28(3)(a) GDPR. Any further instructions shall be issued by the Client in documentary form (e-mail).
2. PATRONUSEC ensures that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3. PATRONUSEC takes all measures required pursuant to Article 32 GDPR, in particular:
a) pseudonymisation and encryption of personal data (algorithms not weaker than AES-128 for data at rest and TLS 1.2+ for data in transit);
b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
c) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of processing;
e) least-privilege access control, multi-factor authentication for access to systems processing personal data;
f) logging of personal-data processing operations in accordance with PATRONUSEC’s security policy.
4. Taking into account the nature of processing, PATRONUSEC assists the Client by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Client’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III of the GDPR (Articles 15–22 GDPR).
5. PATRONUSEC assists the Client in ensuring compliance with the obligations pursuant to Articles 32–36 GDPR, in particular as regards security of processing, notification of personal-data breaches to the supervisory authority and to the data subject, and conducting data protection impact assessments (DPIA) and prior consultations with the supervisory authority.
6. After the end of the provision of the Services, PATRONUSEC shall, at the Client’s choice, delete or return to the Client all personal data and delete all existing copies, unless Union or Member State law requires storage of the personal data. One archival copy may be retained for the limitation period of claims arising from the Order, on the confidentiality terms set out in § 9 of the GTC.
7. PATRONUSEC makes available to the Client all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Client or another auditor mandated by the Client. An audit may be conducted no more than once per year, at the Client’s expense, upon 30 days’ prior notice to PATRONUSEC, during PATRONUSEC’s business hours and without disrupting its current operations. PATRONUSEC may refuse access to information constituting trade secrets of other PATRONUSEC clients.
§ 4. Sub-processing
1. The Client grants PATRONUSEC general authorisation to engage other processors (sub-processors), provided that PATRONUSEC concludes with them agreements ensuring at least the same level of protection of personal data as set out in this DPA.
2. PATRONUSEC informs the Client of any intended changes concerning the addition or replacement of sub-processors with reasonable advance notice. The Client has the right to object to such changes within 14 days of receipt of the notice. In case of objection, the Parties shall in good faith engage in discussions to find a solution; failure to reach agreement entitles either Party to terminate the Order on agreed notice.
3. An up-to-date list of sub-processors shall be made available to the Client upon request.
§ 5. Transfers to third countries
1. PATRONUSEC shall not transfer personal data to third countries (outside the European Economic Area) without a legal basis compliant with Chapter V of the GDPR.
2. Where transfer to a third country is necessary, PATRONUSEC shall enter into Standard Contractual Clauses (SCCs) issued by the European Commission pursuant to Article 46(2)(c) GDPR or apply another mechanism compliant with Chapter V GDPR. The Client hereby authorises PATRONUSEC to enter into SCCs on its behalf with sub-processors located outside the EEA.
§ 6. Notification of personal-data breaches
1. PATRONUSEC shall, without undue delay and no later than within 24 hours of becoming aware of a personal-data breach, notify the Client of the breach and provide all information necessary to enable the Client to make a notification to the supervisory authority pursuant to Article 33 GDPR, in particular:
a) the nature of the breach, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal-data records concerned;
b) the name and contact details of the data protection officer or other point of contact;
c) the likely consequences of the personal-data breach;
d) the measures taken or proposed by PATRONUSEC to address the personal-data breach, including, where appropriate, measures to mitigate its possible adverse effects.
2. PATRONUSEC shall cooperate with the Client in handling the breach and any subsequent notification to the data subjects (Article 34 GDPR).
§ 7. Liability and final provisions
1. Each Party shall be liable for breach of this DPA on the terms set out in the GDPR and Polish law. The provisions of § 11 of the GTC (limitation of liability) shall apply to contractual claims between the Parties; they do not affect direct liability towards data subjects or administrative liability towards supervisory authorities.
2. The DPA binds the Parties for the entire term of the Order and for the period necessary to fulfil the obligations set out in § 3 sec. 6.
3. In matters not regulated by the DPA, the provisions of the GTC and applicable laws shall apply, in particular the GDPR and the Polish Personal Data Protection Act of 10 May 2018.
4. In the event of any conflict between the provisions of the DPA and other provisions of the GTC or the Order in the area of personal data protection, the provisions of the DPA shall prevail.