Terms and Conditions

1. Definitions

1.1 Provider (Tester): the sole proprietor operating under the Bastinet brand, whose statutory details are set out in the Legal notice.

1.2 Client: the business or organisation contracting with the Provider. A consumer (Hungarian Civil Code, Section 8:1(1)3) cannot be a Client.

1.3 Contract: the individual engagement agreement between the parties, its annexes (proposal, Authorisation, data processing agreement) and these Terms together.

1.4 Authorisation: the Client's signed written statement defining the systems that may be tested (Scope), exclusions, the time window, permitted methods and emergency contacts.

1.5 Assessment: security testing carried out under the Authorisation, including penetration testing, red teaming, OT assessment, social engineering or configuration review.

1.6 Deliverables: reports, remediation plans, attestation letters and other documents provided by the Provider.

1.7 Confidential information: any non-public information obtained in connection with the Contract, in particular system architecture, credentials, vulnerabilities and the content of Deliverables; it qualifies as a trade secret under Hungarian Act LIV of 2018.

2. Scope and acceptance of these Terms

2.1 These Terms become part of the Contract if the Provider made them available before conclusion of the Contract and the Client accepted them (Civil Code, Section 6:78(1)). The Terms are permanently available on the Provider's website and are attached to each proposal.

2.2 Clauses that materially deviate from statutory rules or common contractual practice – points 5.6 (acceptance period), 7.3 (suspension), 7.4 (cancellation fee), 13.3 (deemed acceptance), 13.4 (warranty period and exclusions), 14.2–14.5 and 14.7 (limitation of liability and indemnity), 17.2 (jurisdiction) and 17.3 (shortened limitation period) – are specifically brought to the Client's attention and become part of the Contract only upon the Client's express, separate acceptance (Civil Code, Section 6:78(2)), given by signature when placing the order.

2.3 The Client's own general terms apply only if expressly accepted by the Provider in writing. Conflicting general terms are governed by Section 6:81 of the Civil Code.

2.4 Order of precedence: (1) the Authorisation, (2) the individual contract, (3) the accepted proposal, (4) the data processing agreement as regards personal data, (5) these Terms.

3. Conclusion of the Contract

3.1 The Provider issues a written proposal based on the information supplied by the Client. The proposal is binding for the period stated in it, or 30 days if none is stated. Information published on the website is not an offer.

3.2 The Contract is concluded by a contract signed by both parties, or by the Client's written acceptance of the proposal (including by e-mail) and the Provider's confirmation. The language of the Contract is Hungarian, or English on request; in case of discrepancy the Hungarian version prevails.

3.3 The parties treat e-mail as written communication. The Client delivers the Authorisation signed by an authorised representative, by electronic signature or as a signed scanned copy.

4. Lawfulness of testing and the Authorisation

4.1 Unauthorised testing of an information system may constitute a criminal offence under Sections 423–424 of the Hungarian Criminal Code. The Provider therefore tests only with a signed Authorisation and within its Scope, time window and permitted methods. Without an Authorisation testing will not start; any resulting delay is at the Client's risk.

4.2 By signing the Authorisation the Client warrants that (a) it has the right to dispose of the in-scope systems and data, or has obtained the written consent of the entitled party (owner, operator, cloud provider, IT partner, landlord); (b) the in-scope IP addresses, domains and accounts belong to it; (c) the information provided is accurate and complete.

4.3 In environments operated by third parties (cloud, hosting, managed IT), the Client is responsible for ensuring that testing complies with that provider's testing policy and, where necessary, for notifying it in advance.

4.4 Social engineering and physical testing require a separate, detailed scenario and a signed letter of authority from the Client. The Client ensures that testing involving its staff complies with its employment and data protection obligations; results are reported only in aggregate, without naming individuals.

4.5 Denial-of-service, destructive or production-endangering tests are performed only with separate express written permission. In industrial (OT) environments, active testing takes place only in a test environment, on redundant equipment or in a maintenance window, with operations staff present.

5. Performance of services

5.1 Security testing, advisory and training are provided as an engagement for services (Civil Code, Section 6:272); Development is governed by point 13. The Provider acts with due professional care, taking into account international methodologies (in particular OWASP, PTES, NIST SP 800-115, MITRE ATT&CK, IEC 62443). The Provider does not guarantee any result, in particular that all vulnerabilities will be found or that the system is secure.

5.2 Deliverables reflect the state of affairs at the time of the Assessment and do not cover out-of-scope elements or subsequent changes.

5.3 The Provider reports critical findings, and any circumstance indicating a past or ongoing intrusion, to the Client's designated contact without delay. In such a case the Provider may suspend testing pending consultation; incident investigation and response are subject to a separate engagement.

5.4 Either party may stop testing immediately (emergency stop) if unexpected operational disruption occurs, using the channel set out in the Authorisation; the parties decide jointly on resumption.

5.5 The Provider may engage subcontractors only with the Client's prior written approval. Subcontractors are bound by confidentiality obligations at least equivalent to these Terms, and the Provider is liable for them as for its own conduct (Civil Code, Section 6:148).

5.6 Within 60 days of delivery, the Provider retests remediated findings once free of charge, unless agreed otherwise. The Client may raise comments on Deliverables within 8 business days of delivery; otherwise they are deemed accepted.

6. Client obligations

6.1 Before testing the Client (a) provides the necessary access, test accounts and documentation; (b) makes a recent, restorable backup of the affected systems and data; (c) designates an emergency contact available throughout testing; (d) where necessary informs its operations team so that testing is not treated as a real attack, or, where that is the purpose of the exercise (red team), designates the people who are aware.

6.2 The Client shares credentials only through the agreed encrypted channel and revokes or changes them after the engagement.

6.3 The Client is responsible for delays and extra costs resulting from lack of cooperation, incomplete or incorrect information, or later changes to the Scope. Deadlines are extended accordingly and additional work is charged separately.

7. Fees, payment, cancellation

7.1 Fees and the payment schedule are set out in the proposal. Unless stated otherwise, fees are net; any value added tax is payable under the applicable law.

7.2 Invoices are payable within the period stated in the proposal, or 15 days of receipt if none is stated. In case of late payment the Provider may claim default interest under Section 6:155 of the Civil Code and a fixed recovery cost of EUR 40 under Hungarian Act IX of 2016.

7.3 In case of late payment the Provider may, after prior written notice, suspend further performance, including the delivery of Deliverables, until the debt is settled, and is not liable for resulting delay.

7.4 If the Client cancels or postpones the agreed testing within 5 business days before the start, or testing cannot start for reasons attributable to the Client, the Provider is entitled to 50% of the fee for the reserved days. If the Client terminates after testing has started, the fee for work performed and costs incurred are payable.

8. Confidentiality

8.1 The parties treat Confidential information as trade secrets, use it solely to perform the Contract, and disclose it to third parties only with the other party's prior written consent. This obligation survives for 5 years after termination, and for trade secrets until they cease to be secret.

8.2 Disclosure required by law or by a court or authority is not a breach; the disclosing party notifies the other party without delay where legally permitted. Disclosure to a party's legal or financial advisers or accountants who are bound by confidentiality is also permitted.

8.3 Deliverables are provided encrypted, with the password sent through a separate channel, and marked under the FIRST Traffic Light Protocol (TLP) 2.0.

9. Handling of assessment data

9.1 The Provider records only the evidence needed to substantiate a finding; passwords, tokens and personal data are redacted in Deliverables.

9.2 Assessment data (logs, evidence, working copies) is kept on encrypted storage and securely deleted within 90 days of delivery of the final Deliverable unless agreed otherwise. The Provider may retain one encrypted copy of the Deliverable for the establishment and defence of legal claims within the limitation period.

9.3 Where testing involves personal data, the Provider acts as the Client's processor (GDPR Article 28); details are set out in a data processing agreement. See the Privacy notice.

10. Use of artificial intelligence tools

10.1 The Provider may use AI-based tools for certain steps of testing and documentation (for example automating discovery, analysing logs and tool output, drafting report text). This does not affect the Provider's professional responsibility: every finding, severity rating and recommendation is reviewed and approved by a professional, and no AI tool acts on the Client's systems on its own outside the Authorisation.

10.2 Tools running on the Provider's own infrastructure or not transferring data may be used without the Client's separate consent. The Client's Confidential information or personal data is sent to a third-party (cloud) AI service only with the Client's prior written consent, minimised and where possible pseudonymised, and only via providers that contractually commit not to use the data to train their models and provide appropriate security and transfer safeguards.

10.3 The Client may prohibit or restrict the use of cloud AI services in writing; the Provider then performs the Assessment without them.

10.4 The Provider uses AI tools in line with its obligations under Regulation (EU) 2024/1689 (AI Act), in particular ensuring AI literacy.

11. Intellectual property and licence

11.1 Deliverables are works protected by copyright (Hungarian Act LXXVI of 1999). The results of Development are governed by point 13.5; otherwise, upon full payment the Client acquires a non-exclusive, perpetual, worldwide licence to use the Deliverables for its internal purposes and to share them in confidence with auditors, authorities, insurers or business partners. Attestation letters may be shared freely.

11.2 The Provider's methodology, tools, scripts, templates and general know-how remain the Provider's intellectual property and may be used in other engagements without the Client's Confidential information.

11.3 The Provider uses the Client's name, logo or the fact of the engagement as a reference only with the Client's prior written consent.

12. Responsible disclosure

12.1 The Provider does not publish or share with third parties any vulnerability discovered during an Assessment.

12.2 Where a vulnerability affects a third-party product, the Provider notifies the vendor only with the Client's prior written consent, without data identifying the Client or its systems, following established coordinated disclosure practice.

13. Development services

13.1 For the development of websites, web applications, custom software and integrations (Development), the parties enter into a contract for work (Civil Code, Section 6:238). The scope is defined by the proposal or specification approved by the parties; additional requests (change requests) are performed on the basis of a separate proposal and fee and may affect deadlines.

13.2 The Client provides the necessary content, data, access and decisions on time and warrants that content it supplies (text, images, data, trademarks) is lawful and does not infringe third-party rights; otherwise it indemnifies the Provider against resulting claims.

13.3 After delivery the Client performs acceptance testing within 10 business days and reports any material deviation from the specification in writing. If no material defect is reported within this period, or the Client starts using the Development in production, the Development is deemed accepted. Minor defects do not prevent acceptance and are fixed during the warranty period.

13.4 The Provider fixes free of charge any deviations from the specification reported in writing within 90 days of acceptance; the Client's statutory warranty rights otherwise apply under the Civil Code. The Provider is not liable for defects resulting from modification by the Client or third parties, improper use, changes to third-party services (hosting, APIs, external libraries), or browser and operating system updates after delivery.

13.5 Upon full payment the Client acquires a perpetual, worldwide, exclusive licence, including the right to modify and transfer, to the custom-developed code and documentation, and the Provider hands over the source code. The Provider's pre-existing or generally used components, libraries and solutions remain the Provider's property; the Client receives a non-exclusive licence to use them as part of the Development. Open-source components are governed by their own licences.

13.6 The Provider develops using security-conscious methods and, if agreed, security-tests the Development before delivery, but does not warrant that it is free of vulnerabilities. Post-delivery hosting, backups, security updates and further development are subject to a separate contract.

14. Liability

14.1 The Provider is liable for damage caused by breach of contract under the Civil Code, subject to the following limitations.

14.2 The Client acknowledges that even carefully performed testing may cause temporary slowdown, service interruption, log entries or alerts. The Provider is not liable for such effects arising from conduct in line with the Authorisation, nor for data loss due to the Client's failure to make backups.

14.3 The Provider is not liable for damage resulting from incomplete or incorrect information provided by the Client, incorrectly defined Scope, contact with third-party systems not authorised by the Client, or failure to remediate findings or incorrect remediation.

14.4 Except in the cases set out in Section 6:152 of the Civil Code, the Provider's liability per event and in aggregate under the Contract is limited to the net fee actually paid by the Client under that Contract.

14.5 The Provider is not liable for loss of profit, business opportunity or reputation, data recovery costs or other indirect or consequential damage.

14.6 These limitations do not apply to intentional damage or to breaches harming life, physical integrity or health (Civil Code, Section 6:152).

14.7 The Client indemnifies the Provider against all third-party claims, regulatory proceedings and costs arising from a breach of the Client's warranties in points 4.2–4.4, in particular where the Client had no right to dispose of an in-scope system.

15. NIS2 and supply chain

15.1 The Provider is not registered with the Supervisory Authority for Regulated Activities (SZTFH) as a vulnerability assessor and therefore does not perform the mandatory vulnerability assessment under Hungarian Act LXIX of 2024. Its assessments are voluntary, do not replace the mandatory assessment and do not certify compliance.

15.2 If the Client is subject to Act LXIX of 2024, the Provider reasonably cooperates with the Client's supply chain security requirements (for example completing questionnaires, describing security measures, providing information in case of an incident). Requirements beyond this are subject to separate agreement.

15.3 The Provider informs the Client without undue delay of any security incident affecting its own systems that endangers the Client's data.

16. Force majeure, termination

16.1 Neither party is liable for breach caused by circumstances beyond its control that were unforeseeable at contract conclusion and could not be averted (Civil Code, Section 6:142). Deadlines are extended for the duration of such circumstances.

16.2 Either party may terminate the Contract under Section 6:278 of the Civil Code. If the Client terminates, the Provider is entitled to the fee for work performed and costs incurred.

16.3 Termination does not affect the provisions on confidentiality, data handling, liability, intellectual property and disputes.

17. Final provisions

17.1 The Contract is governed by Hungarian law, in particular the Civil Code; conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods do not apply.

17.2 The parties first seek to resolve disputes by negotiation. Failing that, under Section 25 of Hungarian Act CXXX of 2016 on Civil Procedure, the parties stipulate the exclusive jurisdiction of the district court or regional court (as applicable) competent for the Provider's registered seat.

17.3 Claims arising from the Contract – except for intentional damage and cases specified by law – become time-barred one year after delivery of the Deliverable (Civil Code, Section 6:22(4)).

17.4 If any provision is invalid or unenforceable, the remaining provisions remain unaffected; the parties replace the invalid provision with a valid one closest to its purpose.

17.5 The Provider may amend these Terms. Amendments apply to Contracts concluded after publication; to ongoing Contracts only with the Client's written acceptance. Previous versions are available on request.

17.6 Contact regarding the Contract: info@bastinet.hu.