These General Terms and Conditions of Sale (the “Terms”) govern all services and products supplied by Penthertz to its professional clients. They are concluded exclusively between professionals (business to business). Placing an order implies the client’s full and unreserved acceptance of these Terms, which prevail over any of the client’s own purchasing terms unless Penthertz has expressly agreed otherwise in writing. The French version of these Terms prevails.
1. Definitions
“Penthertz” means the company identified in the Legal notice. “Client” means the professional entity ordering the services or products. “Services” means the security testing, audit, vulnerability research, R&D, tooling and training services. “Products” means the hardware kits and benches. “Quote” means the written proposal (devis) issued by Penthertz. “Deliverables” means the reports, tools and materials provided under an engagement.
2. Scope and order of precedence
Each engagement is governed, in descending order of precedence, by: (i) the signed Quote or statement of work and any specific conditions; (ii) these Terms; (iii) any other document referenced therein. A purchase order or framework agreement issued by the Client applies only to the extent expressly accepted in writing by Penthertz.
3. Quotes and orders
Quotes are valid for thirty (30) days from their date unless stated otherwise. An order is formed when the Client returns the Quote signed, or confirms it in writing, or sends a matching purchase order accepted by Penthertz. Any change to scope, targets, dates or headcount after acceptance is subject to a written amendment and may affect the price and schedule.
4. Nature of the services: obligation of means
Penthertz performs the Services with professional diligence and the current state of the art. The Services are an obligation of means (obligation de moyens) and not an obligation of result. In particular, security testing, auditing and research by their nature cannot detect every vulnerability or guarantee the security, compliance, availability or integrity of any system. The absence of findings does not warrant that a system is free of vulnerabilities. Any recommendation is advisory; the Client remains solely responsible for its own decisions, systems and compliance.
5. Client obligations and authorisation to test
The Client shall provide, in good time, the scope, authorisations, access, information, environments and points of contact needed to perform the Services. The Client warrants that it owns, or is duly and lawfully authorised by the owner and any third party concerned to have tested, all systems, networks, devices, frequencies and data within the agreed scope, and that performing the Services will not breach any law, regulation, licence or third-party right. The Client shall obtain any regulatory authorisation required for radio transmission or similar activities where testing is performed on its premises. The Client shall indemnify and hold Penthertz harmless against any claim, loss or penalty arising from inaccurate scope, insufficient authorisation, or the Client’s breach of this clause.
6. Risks inherent to testing
The Client acknowledges that offensive security testing, and in particular hardware attacks, fault injection, fuzzing and radio testing, may cause interruption, degradation, alteration or, exceptionally, irreversible damage to the systems or devices tested. Before testing, the parties agree in writing which systems, devices and time windows may be affected, and which must remain intact. The Client is responsible for backing up its data and for its business continuity, and shall provide a suitable test environment where appropriate. Penthertz shall not be liable for consequences inherent to the testing agreed in writing and carried out with due professional care.
7. Prices
Prices are stated in euros, exclusive of tax (hors taxes). Value added tax and any other applicable taxes are added at the rate in force on the invoice date. Unless the Quote states otherwise, prices exclude travel, accommodation and subsistence (billed at cost or as a flat fee) and any third-party hardware, licences or cloud resources. Public training is priced per attendee; private and tailored engagements are quoted per group or per project.
8. Invoicing and payment
Unless the Quote states otherwise, invoices are payable within thirty (30) days of the invoice date. Penthertz may require a deposit or milestone payments. In accordance with Articles L.441-10 and D.441-5 of the French Commercial Code, any sum unpaid at its due date automatically bears late-payment interest at three (3) times the legal interest rate, together with a fixed recovery indemnity of forty euros (€40) per invoice, without prejudice to any additional recovery costs on justification and without the need for a reminder. Penthertz may suspend performance and withhold Deliverables until outstanding sums are paid in full. No discount is granted for early payment.
9. Deliverables and acceptance
Deliverables are provided electronically. The Client shall notify any reasoned reservation within ten (10) business days of delivery; failing which the Deliverables are deemed accepted. Acceptance does not reduce Penthertz’s confidentiality obligations.
10. Intellectual property
Penthertz retains ownership of all intellectual property, methods, methodologies, software, frameworks and tools (including RF Swift) and general know-how existing before or developed independently of the engagement, together with the generic techniques, methods and tools of general application that it develops or improves during the engagement, provided they contain none of the Client’s confidential information (the “Penthertz Background”). The intellectual-property rights in the Deliverables remain with Penthertz unless assigned as set out below. Subject to full payment, Penthertz grants the Client a non-exclusive, non-transferable right, at no additional fee, to use the Deliverables for its own internal needs, including to run, modify and maintain any tools provided with their source code, worldwide and for the legal duration of the rights. An assignment of the rights in developments created specifically for the Client may be agreed in a separate written agreement that sets out the rights assigned, their scope and the price; the Penthertz Background is never assigned and, where it forms part of a Deliverable, is licensed on the terms above. Open-source components remain subject to their own licences. Information about vulnerabilities in the Client’s systems is the Client’s confidential information: the Client decides whether, how and when it is disclosed, and Penthertz may ask to be credited for the technical work. Penthertz remains free to reuse its generic know-how, experience and anonymised or aggregated learnings, and to conduct and publish independent research on its own targets or with the Client’s prior written consent.
11. Confidentiality
Each party undertakes to keep confidential the other party’s non-public information disclosed in connection with an engagement, to use it only for the purpose of the engagement, and to protect it with the same care as its own confidential information and at least reasonable care. This obligation is mutual and does not apply to information that is public, already known, independently developed, or lawfully received from a third party, or whose disclosure is required by law or a competent authority. A mutual non-disclosure agreement may supplement these Terms; Penthertz is free to propose its own and to review and align any agreement submitted by the Client before signature. This obligation survives three (3) years after the end of the engagement. Penthertz does not name or identify its clients in public material without their prior consent.
Data, captures, extracts, firmware, credentials and other artefacts obtained while performing the Services are used only for the engagement and handled with care. Save for the report and the records Penthertz is required to keep, such artefacts are returned or securely destroyed within thirty (30) days of delivery, or sooner on the Client’s written request, except where retention is required by law.
12. Personal data
Each party complies with applicable data-protection law, including the GDPR. Where Penthertz processes personal data on behalf of the Client, the parties enter into a data-processing agreement. Penthertz’s processing of its own contacts and prospects is described in its Privacy Policy.
13. Limitation of liability
Penthertz is bound by an obligation of means. To the fullest extent permitted by law, Penthertz’s total, cumulative liability arising out of or in connection with an engagement, whatever the cause and legal basis, is limited to the amounts actually paid by the Client for that engagement during the twelve (12) months preceding the event giving rise to liability. Penthertz shall not be liable for any indirect or consequential loss, nor for any loss of data, profit, revenue, business, opportunity, savings or reputation. Nothing in these Terms excludes or limits liability that cannot lawfully be excluded, including liability for death or personal injury caused by negligence, for gross negligence (faute lourde) or for wilful misconduct (dol). Any claim must be brought within twelve (12) months of the event giving rise to it.
14. Insurance
Penthertz holds professional liability insurance covering its activity. A certificate is available on request.
15. Term, suspension and termination
Each engagement runs for the duration set out in the Quote. Either party may terminate for a material breach not remedied within thirty (30) days of written notice. Penthertz may suspend or terminate for non-payment or where continuing would be unlawful or unsafe. On termination, the Client pays for all Services performed and expenses committed up to the effective date.
16. Cancellation and postponement
Any cancellation or postponement by the Client must be notified in writing. Unless the Quote states otherwise: a cancellation more than fifteen (15) business days before the start incurs no fee; between fifteen (15) and five (5) business days, fifty percent (50%) of the price is due; less than five (5) business days, or no-show, the full price is due. Travel and accommodation already committed are billed in addition. Additional terms specific to training are set out in clause 18.
17. Products and hardware kits
Products are sold to professionals. Delivery times are indicative. Risk passes to the Client on delivery. Penthertz retains title to the Products until full payment of the price. The Client is responsible for complying with all applicable laws on the holding, use and export of radio and security equipment; some Products are subject to export control or restricted sale and may require prior checks. Products are intended for lawful, authorised testing only; the Client is solely responsible for their use. The Client shall examine the Products on delivery and notify any apparent defect or non-conformity in writing within eight (8) business days; Penthertz then, at its option, repairs or replaces the Product or issues a credit note. The legal warranty against hidden defects (garantie légale des vices cachés) applies. Products that are dead on arrival or defective are returned under a return authorisation issued by Penthertz; returns sent without authorisation may be refused. The Products are sold to professionals acting for the purposes of their business; as a business-to-business sale there is no consumer right of withdrawal, and orders placed by consumers are not accepted.
18. Training
Penthertz is a registered training organisation (organisme de formation), registration number given in the Legal notice; this registration does not constitute State approval of the content. Training is governed by a training agreement (convention or contrat de formation professionnelle) and by Penthertz’s internal rules (règlement intérieur), provided on request. A certificate of attendance is issued to each participant. Unless agreed otherwise, training is not eligible for CPF funding. The cancellation and postponement schedule in clause 16 applies to training; in addition, the Client may replace a registered participant with another person at no charge at any time before the session starts, by informing Penthertz in advance. Access to on-demand or self-paced training is granted to a single named participant and is personal and non-transferable; sharing credentials, or using an account from several places at once, is a breach of these Terms, and Penthertz may suspend such an account immediately, with no refund due for a suspension resulting from the Client’s breach. Where a participant has a disability or specific need, Penthertz adapts the arrangements as far as reasonably possible when informed in advance.
19. Subcontracting and independence
Penthertz may entrust all or part of an engagement to qualified subcontractors while remaining responsible towards the Client. The parties are independent contractors; nothing creates an employment, agency, partnership or joint-venture relationship.
20. Force majeure
Neither party is liable for a failure caused by an event of force majeure within the meaning of Article 1218 of the French Civil Code. The affected party informs the other without delay; obligations are suspended for the duration of the event.
21. References
Penthertz may mention the Client’s name and logo as a commercial reference only with the Client’s prior written consent.
22. Anti-corruption and sanctions
Each party complies with applicable anti-corruption, anti-bribery, export-control and international-sanctions laws, and warrants that it is not, and is not controlled by, a person subject to such sanctions. Neither party offers, promises or accepts any undue advantage in connection with an engagement. Penthertz may suspend or terminate, without liability, any engagement that would place it in breach of these laws.
23. Miscellaneous
If any provision is held invalid, the remainder continues in force. A failure to enforce a provision is not a waiver. These Terms, together with the Quote and its annexes, constitute the entire agreement between the parties for the engagement and supersede any prior understanding on the same subject.
24. Governing law and jurisdiction
These Terms are governed by French law. Any dispute that cannot be resolved amicably falls within the exclusive jurisdiction of the Tribunal de commerce de Nanterre, notwithstanding plurality of defendants or third-party proceedings.