BOIT Cyber Security s.r.o., Company ID: 17614261, VAT ID: CZ17614261, with its registered office at Korunní 2569/108, Praha 10, 101 00, entered in the Commercial Register maintained by the Municipal Court in Prague on 6 October 2022, Section C, File 373905, website: https://boit.cz.
1. Introduction
1.1 These General Terms and Conditions govern the relationship between BOIT Cyber Security s.r.o. (the “Provider”) and customers (the “Customer”) in the provision of cybersecurity services.
1.2 Individual contractual agreements take precedence over these General Terms and Conditions.
2. Scope of services
2.1 Services provided include penetration testing, vulnerability testing, phishing simulations, training, consulting, etc. Testing follows OWASP, NIST and MITRE ATT&CK methodologies, or an individual agreement.
2.2 The exact scope and schedule will be specified in the contract or order.
3. Conclusion of the contract
3.1 A contract may be concluded by a signed contract, a confirmed order, email or another verifiable means.
3.2 The Provider may reject an order without stating a reason.
4. Obligations of the parties
4.1 The Provider shall:
- perform the services professionally, on time and with due care;
- protect confidential information and personal data;
- comply with applicable legislation (including the GDPR and Czech Act No. 110/2019 Coll., on Personal Data Processing);
- in the event of a security breach or GDPR violation, inform the supervisory authority and the Customer without undue delay, within 72 hours at the latest;
- appoint a Data Protection Officer (DPO) where necessary.
4.2 The Customer shall:
- provide cooperation and truthful information;
- pay the agreed price;
- refrain from unauthorised interference with the services during testing.
5. Pricing and payment terms
5.1 The price is agreed individually or determined by the price list.
5.2 Invoices are payable within 14 days of issue, unless otherwise agreed.
5.3 In the event of late payment, the Provider is entitled to statutory interest on arrears.
6. Personal data protection (GDPR)
6.1 The Provider acts as the controller of personal data processing.
6.2 Purposes of processing: performance of the contract, compliance with legal obligations, protection of rights and ensuring legality.
6.3 Legal bases: performance of the contract, consent (e.g. marketing), legitimate interest and compliance with the law.
6.4 The Customer has the rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent.
6.5 Data is not disclosed to third parties, except for processors (external suppliers), state authorities and security institutions as required by law.
6.6 Data is retained for the duration of the contract, the time limits for complaints procedures and applicable archiving periods.
6.7 Place of processing: the EU; processing may involve providers outside the Czech Republic/EU, subject to the conclusion of standard contractual clauses.
6.8 For more information, the Customer should refer to the Privacy Policy, which forms an integral part of the website and the contract.
7. Liability
7.1 The Provider is liable for damage caused intentionally or through gross negligence, up to the amount of the agreed price.
7.2 The Provider is not liable for consequential damage, loss of profit or unrealised savings.
7.3 The confidentiality obligation applies throughout the provision of services and for 3 years after the cooperation ends.
8. Termination of the contract
8.1 The contract may be terminated by mutual agreement, notice or withdrawal due to a material breach.
8.2 In the event of withdrawal, the Customer must pay for services performed up to termination.
9. Testing conditions
9.1 Tests are performed in the approved manner, including the schedule, scope and emergency contacts. Testing is conducted in accordance with ethical principles and recorded in an activity log.
9.2 The Customer must not inspect or alter the environment being tested while testing is in progress.
10. Final provisions
10.1 The contract is governed by Czech law.
10.2 Jurisdiction lies with the court in the Czech Republic having territorial and subject-matter jurisdiction.
10.3 Consumer rights remain unrestricted where legislation provides a higher level of protection.
10.4 The Customer shall confirm acceptance of these General Terms and Conditions before concluding the contract (electronically or by signature).
10.5 These General Terms and Conditions are published at www.boit.cz and are accessible before an order is placed. The Provider reserves the right to amend them; any amendment will be announced by email or published on the website at least 15 days before taking effect.
12. Marketing communications
12.1 The Provider may send the Customer commercial communications about its own services (e.g. newsletters, training invitations and cybersecurity news) if:
- the Customer has given consent, or
- there is a legitimate interest arising from an existing business relationship (under Section 7(3) of Czech Act No. 480/2004 Coll.).
12.2 Each communication includes a simple unsubscribe option via a link in the message.
12.3 Personal data is not shared with third parties for marketing purposes without explicit consent.
13. Withdrawal of consent and exercising rights
13.1 Where personal data processing is based on consent (e.g. cookies or marketing), the Customer has the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.
13.2 Consent can be withdrawn:
- by clicking the unsubscribe link in an email;
- by changing the cookie settings on the website;
- or by using the details on the page Contact.
13.3 The User/Customer also has the right to access personal data, to rectification, erasure and restriction of processing, to object to processing and to lodge a complaint with the Czech Office for Personal Data Protection (ÚOOÚ).