1        Basis of Contract

1.1        Scope

These general terms and conditions (GTCs) apply to all legal transactions and services and/or goods delivered by ensec AG (ensec) both in Switzerland and abroad.

1.2        Precedence of Contractual Provisions

All contractual agreements are in the following order of precedence:

1. Individually concluded contracts;
2. Special provisions of contract;
3. These general terms and conditions;
4. Provisions of law.

The agreements mentioned first always have precedence over the ones mentioned last when contradictions arise. Loopholes will be closed in each case by the subordinate provisions. The GTCs of ensec apply in all cases exclusively. They also apply to all future business relationships, even if they are not expressly agreed to again. Counter-confirmations or the general terms and conditions of any contracting partners are herewith expressly rejected. This also applies if the offer is tendered or accepted by the contracting partner with reference to the prior precedence of its own general terms and conditions.

1.3        Type of Services and Products

ensec provides services and delivers products in the area of IT-Security. The type and scope the services provided and/or products delivered will be specified in the offer and the technical description of performances. Descriptions of performance in the sense of these GTCs, the special terms of contract or other contracts and declarations from ensec are only those documents, which are explicitly identified as descriptions of performance. The legal foundations for

• Hardware deliveries
• Software deliveries
• Services / consulting services
• Support and maintenance

are dealt with in the following. To the extent that a tender is not based on any particular terms of contract, these GTCs apply exclusively. To the extent not expressly agreed on, ensec does not in any case provide services on a work-for-hire basis in the sense of Art. 363 ff. OR. This also applies in the event that individual services provided were accepted by the customer through counter-signing records of performance, hourly reports other confirmations of performance, i.e. whose completion as such was confirmed.

2        Content of the Services

2.1        Hardware Deliveries

On conclusion of contract, the use and risk transfers to the customer. All transport and delivery costs are to borne by the customer, to the extent that this is not expressly agreed to elsewhere. ensec to not accept any acquisition risk with respect to sub-suppliers and for this reason excludes any and all liability in this respect. The transport risk list with the customer. The contractual purpose is governed exclusively by the description of performance in the tender. Agreements that differ from this must be confirmed in writing.

2.2        Software Deliveries

2.2.1         General

To the extent provided for in the tender ensec will supply the customer software. We explicitly note here that ensec neither programs the software that it supplies itself nor customizes it to the needs of customers, to the extent that this is not expressly a component of the tender. Without an expressed agreement there is no case an entitlement to release of the source code. Installation of the software is only owed if this is an expressed component of the tender. To the extent this is not agreed on between the parties, ensec will not provide any of its documentation for delivered software but will only relay the software manufacturer’s documentation to the customer.

2.2.2         Copyrights, Use Rights and Commercial Rights

The rights to use and commercial exploitation that originate with the copyrights as a rule are held as a rule by the manufacturer of the software, which, for its part, will contractually control the transfer of use rights and rights to commercial exploitation to third parties. To the extent that nothing different is expressly agreed upon between the parties, the type and scope of the transfer of use rights and rights to commercial exploitation of software are governed exclusively by the licensing provisions of the particular software manufacturer.  ensec cannot give any guarantee for the actual holding of the use rights and rights to commercial exploitation by the manufacturer. Claims with respect to such use rights and rights of commercial exploitation are to be directed exclusively to the particular manufacturer of the software.

2.3        Services / Consulting Services

2.3.1         General

ensec will perform operational services and consulting services in the field of IT-security and/or the installation and implementation of the delivered hardware and software. We expressly note here that these operational and consulting services are performed on order (on commission) in the sense of Art. 394 ff OR, to the extent that there is no contractual agreement that differs from this.

2.3.2         Billing

The billing of all operational and consulting services will be based on time spent. The smallest billing unit will be 0.25 of an hour. Should the time required actually fall under 0.25 hours, the time billed will be rounded up.  To this end, as a rule, a daily rate or a price per billing unit of 1 hour will be agreed on, at which the customer can order operational and consulting services at its own discretion and in the scope it needs. The agreed upon prices are binding for one year after the conclusion of the contract in the longest case. To the extent that fixed prices were agreed on for operational and consulting services, they apply under the expressed reservation that the IT-system environment assumed in the framework of ensec’s planning allows execution at this fixed price. The same applies for the required cooperation in services on the part of the customer (No.  2.5). If an operational and/or consulting service can no longer be provided at the fixed price due to changes in the IT-system environment at the customer’s premises or insufficient cooperation on the part of the customer, ensec will notify the customer immediately. In this case the parties will arrange for new compensation in mutual agreement.   To the extent that no agreement can be reached, ensec is entitled to cancel the existing contract immediately. Any services already performed will be billed by time and effort required through the date of cancellation at the rates in force at that time for performance of services. Agreed-upon dates for the performance of operational and maintenance services are binding. To the extent that arranged times are postponed by the customer with less than 3 (three) workdays’ notice, ensec is entitled to claim any costs that this postpone incurs against the customer.  This includes specifically costs for scheduled man-days, to the extent that postponement on such short notice makes it impossible to re-schedule.

2.4        Support and Maintenance

2.4.1         General

ensec owns support and maintenance services only if this is expressly agreed upon between the parties.  Support and maintenance services will be provided as an order in the sense of Art. 394 ff. OR. Type and scope of the maintenance services owed proceed from the tender and the description of performance that comes with it. ensec is also entitled at its discretion to have support and maintenance services performed by third parties. If in this case a support and maintenance contract is concluded between the customer and the third party, then all the customer’s legal claims with respect to support and maintenance services proceeding solely from this contractual relationship must be asserted directly against the third party.

2.4.2         Billing

Support- and Maintenance fees are to be understood as fixed prices, i.e. they will not be billed by actual time worked. Support and maintenance fees are to be paid annually in advance to the extent not expressly otherwise agreed in the particular case. A reimbursement of already paid support and maintenance fees is excluded.

2.5        Obligations to Cooperate

In order to assure the proper fulfilment of the contract by ensec, the customer is obligated without any additional compensation to establish all technical preconditions needed to facilitate the proper performance of services by ensec. It must especially make sure that ensec is provided with all the requested information about the IT-infrastructure in a timely fashion, i.e. with adequate advanced notice. This includes specifically providing the information relating to IT-technical matters and project organization that is required in order to complete the service (e.g. hardware and operating systems, standard software used, organizational schedules) as well as in needed providing the hardware and/or software (including documentation) for which the contracted service is to be provided. It is possible that the customer will need to grant access to its servers and system environment for certain work and services during the course of the contact. To the extent that access to external providers is required for this, the customer will make sure that they grant ensec this access in writing. The customer expressly indemnifies ensec against all claims to compensation for damages and other claims that arise in the framework of providing services through access to third parties, especially external providers. The customer will make sure that while ensec is performing services, competent employees who are familiar with the IT-plant and IT-infrastructure of the customer are available as contact persons during regular business hours. To the extent that the customer is presented with drafts, test versions of programs or similar documents while contracted services are being performed, it must review them carefully with respect to compatibility with its own IT-systems and notify ensec of any existing problems or IT-incompatibilities. In the case of certain services and at customer request, attacks on the system environment will be simulated (e.g. hacker attacks). In these cases, ensec will be expressly authorized by the customer to attack the customer’s IT-infrastructure to the extent that this is required in order to perform the specific service in question.  This access will as a rule be granted via an IP-address approved by the customer. In this case ensec expressly draws attention to the risk that data within the IT-infrastructure could be damaged or deleted. The customer will make sure for these reasons that data is regularly backed up and will back up all system-relevant data before ensec performs this service.

3        Rules for Hardware Deliveries, Software Deliveries, Operational and Consulting Services and Support and Maintenance

3.1        Delivery Deadlines and Delivery Periods 

Delivery deadlines and delivery periods are non-binding, to the extent that no express written arrangements stating otherwise are made.  The delivery deadline is deemed met if the goods are brought to dispatch or picked up on the deadline. The delivery will proceed in accord with the Incoterms (newest version) agreed on and within the timeframe specified in the tender. ensec can extend the delivery period to a reasonable extent to the extent that relevant conditions change in such a way for ensec and/or its suppliers that the manufacture, transport, export or import of the products is impeded. The customer cannot assert any claim to compensation for direct or indirect damages resulting from such a delay. I such as case the customer is only entitled to declare the contract invalid, after it has granted ensec in writing a reasonable grace period for subsequent fulfilment and ensec has not delivered within this period for reason of negligence.

3.2        Guarantee

3.2.1         Hardware / Software

ensec only guarantees that the hardware and/or software delivered is free of defects on date of delivery, which would vitiate or more than insignificantly reduce the value or utility of the items for the purposes specified in the contract.  Any further guarantee on the part of ensec is – to the extent legally permitted –is excluded. In particular, ensec provides no guarantee for wear and tear or for defects that arise from improper use as well as failure to heed the manufacturer’s instructions, or those for assembly, installation or operation. The guarantee right is void also if the customer repairs the device or otherwise manipulates it or has such done by third parties. ensec notes that it is not possible according to the state of the art to create software that is completely free of errors.  To the extent nothing to the contrary is agreed on, ensec grants no guarantee that the software will meet the special requirements of the customer or will work with the customer’s programs or the hardware used at the customer’s premises. The warranty rights expire one year after delivery in the sense of No.  2.1 Sentence 1. The customer must report defects in writing and in as much detail as possible. ensec may, at its own discretion, fulfil the guarantee through repair or replacement. The costs accruing for completing the repair (especially transport, road, labor and materials costs) will be assumed by ensec. If repair or replacement fails, the customer is entitled to demand a reduction in compensation or to withdraw from the contract.

3.2.2         Operational Services /Consulting Services, Support and Maintenance

ensec warrants that it will perform the contractually owed services through appropriately trained specialists exercising the due care common to their trade. If any defect is discovered, the customer must report it immediately and has a right to repair free of charge. This right expires one years after the initial services are performed. All other warranty or guarantee rights as well as all claims to compensation for damages are excluded to the extent permitted under law. ensec notes that significant parts of the system environment (software, hardware, networks) may not be available while support and maintenance services are being performed.

3.3        Liability

ensec’s liability is excluded to the extent permitted under law and regardless of the legal grounds. This also applies to the liability of employees, representatives and temporary employees. The liability exclusion does not apply

• To the extent that the cause of damages is attributable to malicious intent and/or gross negligence
• To damages that result for injury to life, limb or health that result from a negligent breach of obligations by ensec or an intentional or negligent breach of obligation by a representative or temporary employee of ensec.
• To claims arising from the Product Liability Act.

ensec expressly excludes any liability for indirect and subsequent damages (e.g. lost profits, third party claims).

3.4        Reservation of Title

All delivered hard and/or software remains the property of ensec until all of the specific payment claims against the customer are fulfilled. Should the customer fall into default of payment and/or stop making payments, ensec is entitled, after giving appropriate notice, to have the reservation of title entered in the reservation of title register at cost to the customer and/or demand return of the hardware and/or software and assert all rights it has flowing from the non-fulfilment of the contract.

3.5        Recruiting Prohibited

The customer pledges not to recruit the employees assigned work to it, i.e. not to recruit them for fixed or freelance employment directly with the customer and/or event attempt to recruit them.  Any breach of this provision brings with it a contractual penalty whose amount will be determined at the discretion of the ruling court.

3.6        Data Protection

ensec is obligated to observe all relevant provisions of law relating to data protection. To the extent that the customer relays personal data in the framework of contractual collaboration the customer gives assurance that it will collect and store the personal data relayed in conformity with the applicable provisions of law governing data protection as well as that is allowed to share the data with ensec in the framework of their contractual collaboration and especially that it has obtained the necessary declarations of consent to this end.  The customer indemnifies ensec in this respect against all losses, damages and costs including costs of legal defense which would arise from a breach of provisions of law governing data protection by the customer and this even to the extent that measures must be taken in order to defend against interventions by third parties including the responsible regulatory authorities.

ensec may have personal data processed by authorised third parties in Switzerland and abroad and/or transfer it to them. Insofar as appropriate data protection is guaranteed. Such data processing and transfers serve the purpose of communication, marketing, sales, information security or the execution of the contract/legal transaction. Foreign third-party processors may be located anywhere in the world.

3.7        Confidentiality

Both parties mutually pledge to maintain strict secrecy regarding know-how and trade secrets which the learn about each other in the execution of their contracted collaboration and to keep all know-how that is not generally known secret from third parties and subject their employees to this same obligation. This applies specifically – but not exclusively – to all information about business partners, customers, internal company matters, technologies and procedures used.

3.8        Payments

To the extent that nothing else is agreed to, all payments are due and payable 30 days after receipt of invoice without and discounts.  ensec reserves the right at its own discretion to provide services only on condition of payment in advance. A right of retention on the part of the customer exists only limited to the same contractual relationship and in the case of defects only in the amount of triple the expenditures required to remedy the defect.  Offsetting against counter-claims is only permitted to the extent that they are undisputed or legally established. In the event of default on payment by the customer ensec’s claims are governed by the legal provisions for default.  ensec is however free to assert higher default damages against the customer if these are proven.

4        General Provisions

All of ensec’s business relationships are exclusively subject to Swiss law. The UN-CISG is expressly excluded. The place of fulfilment for all obligations of the parties is Zurich, Switzerland. The sole court of jurisdiction is, to the extent legally permissible, Zurich, Switzerland. ensec is entitled at its own discretion to bring its own claims at the court of jurisdiction responsible for the customer.

5        Mediation Clause

The parties will attempt to solve all problems which arise in the course of executing this contract through amicable negotiations. If the parties are unable to resolve their differences of opinion within 60 days after the request to assume negotiations, they will begin a mediation process according to the mediation rules of the Swiss Chamber for Business Mediation. The like applies if the negotiations are not initiated within 30 days of receipt of the request. This agreement does not prevent any party from bringing a legal action in court.