Terms of Service and Payment

1Application

1.1These Standard Terms of Service and Payment (the “Terms”) apply to every quote, estimate, statement of work (“SOW”), order and invoice issued by Arta Cyber to a client (the “Client”), and to all services and deliverables we provide (the “Services”).

1.2Order of precedence. If documents conflict, the following prevails in this order: (a) a master services agreement signed by both parties; (b) a signed SOW or accepted quote, for its specific project only; (c) these Terms; (d) the invoice. Any terms in a Client purchase order, portal, or vendor form that add to or differ from these Terms have no effect unless an authorized officer of Arta Cyber agrees to them in writing.

1.3Business clients. The Services are offered to businesses and organizations, not to consumers. If the Client is an individual acting for personal, family or household purposes, any rights under the Consumer Protection Act, 2023 (Ontario) that cannot be waived continue to apply despite anything in these Terms.

2Quotes and estimates

2.1Validity. Unless the quote says otherwise, a quote or estimate is valid for seven (7) calendar days from its date. After that, it lapses automatically and pricing, scope and scheduling must be re-confirmed in writing.

2.2Acceptance. The Client accepts a quote, within its validity period, by any of: (a) signing it; (b) issuing a purchase order that references it; (c) confirming acceptance in writing, including by email or an electronic acceptance in our invoicing system; or (d) paying any requested deposit. Acceptance by electronic means is binding under the Electronic Commerce Act, 2000 (Ontario). On acceptance, the quote and these Terms form a binding agreement (the “Agreement”).

2.3Estimates are not fixed prices. Unless a quote is expressly stated to be a fixed price, time-and-materials figures are good-faith estimates based on the information the Client provided. We will tell the Client promptly if we expect to exceed an estimate by more than 10% and will not exceed it by more than that without the Client’s approval.

2.4Assumptions. Quotes rely on the assumptions and Client responsibilities they describe. If an assumption proves incorrect, we may adjust the fees and schedule by change order.

2.5Errors. We may correct obvious clerical or pricing errors in a quote or invoice.

3Scope and changes

3.1The Services are those described in the accepted quote or SOW. Anything else is out of scope.

3.2Change orders. Either party may request a change. Changes take effect only when documented in a written change order (email is sufficient) approved by both parties, stating any change to fees and schedule. Out-of-scope work requested by the Client is billed at our then-current hourly rates.

4Fees, expenses and taxes

4.1Currency. All amounts are in Canadian dollars (CAD) unless stated otherwise.

4.2Taxes. Fees exclude Harmonized Sales Tax (currently 13% in Ontario) and other applicable taxes, which are added to invoices and payable by the Client. Our GST/HST registration number is 788943249RT0001. If the Client is required by law to withhold any tax, it must gross up its payment so we receive the full amount invoiced, except where the law does not permit this.

4.3Expenses. Pre-approved reasonable out-of-pocket expenses (for example travel outside the National Capital Region, third-party licences, or hardware) are billed at cost plus 10% handling with receipts available on request.

4.4Deposits. For new clients or larger projects we may require a deposit or retainer before starting, as stated in the quote. Deposits are credited against the final invoice and, unless the quote says otherwise, are non-refundable once work has started, except to the extent work has not been performed.

4.5Rate changes. We may change our standard hourly rates on 30 days’ written notice; rates on an accepted fixed-price quote do not change during that project.

5Invoicing and payment

5.1Invoicing. Unless the quote says otherwise, we invoice monthly in arrears for time-and-materials work, and on the milestones stated in the quote for fixed-price work.

5.2Payment due. Each invoice is due and payable in full within thirty (30) days of the invoice date (“Net 30”), without set-off, counterclaim or deduction.

5.3Method. Payment is to be made by electronic funds transfer, Interac e-Transfer, or another method we accept, using the details on the invoice. The Client bears its own bank and transfer charges. Payment is made when cleared funds reach our account.

5.4Application of payments. Payments are applied first to collection costs, then to accrued interest, then to the oldest outstanding invoice.

5.5Disputed invoices. The Client must notify us in writing of any good-faith dispute about an invoice, with reasonable detail, within ten (10) days of the invoice date. If no notice is given, the invoice is deemed accepted. The Client must pay the undisputed portion by the due date. The parties will work in good faith to resolve the dispute within 30 days; once resolved, any amount found owing is due within 10 days, with interest under Section 6 from the original due date.

6Late payment

6.1Interest. Any amount not paid when due bears interest from the due date until paid in full, both before and after judgment, at one percent (1%) per month, calculated and compounded monthly, which is equal to an effective annual rate of twelve point six eight percent (12.68%) per year. (This annual-rate statement is included so that the rate complies with section 4 of the Interest Act (Canada); it is well below the criminal interest rate under the Criminal Code.)

6.2Collection costs. The Client will reimburse us for all reasonable costs of collecting overdue amounts, including legal fees on a substantial-indemnity basis, collection agency fees, and court costs.

6.3Suspension. If any amount is more than 15 days overdue, we may, after giving ten (10) days’ written notice, suspend all or part of the Services, including withholding deliverables and access credentials we manage, until all overdue amounts and interest are paid. Suspension does not relieve the Client of its obligation to pay. Schedules are extended by the length of any suspension, and we may charge reasonable remobilization costs. We will act reasonably so that suspension does not leave Client systems in an insecure state, and we will give the Client what it needs to maintain its own systems’ security during a suspension.

6.4Termination for non-payment. If any amount remains unpaid more than 60 days after its due date, we may terminate the Agreement on written notice, and all unpaid fees for work performed become immediately due.

7Client responsibilities

7.1The Client will: (a) provide timely access to the people, information, systems, premises and approvals reasonably needed; (b) make decisions promptly; (c) ensure the information it gives us is accurate and complete; (d) maintain its own backups of data and systems before any work begins; and (e) appoint a contact person with authority to approve changes.

7.2Delays or additional costs caused by the Client’s failure to meet these responsibilities may be billed as a change.

8Intellectual property

8.1Pre-existing materials. Each party keeps ownership of everything it owned before the Agreement or develops independently. Our methods, tools, scripts, templates, know-how, and general knowledge (“Arta Cyber Materials”) remain ours.

8.2Deliverables. Ownership of deliverables created specifically for the Client (for example reports, designs, configurations) passes to the Client only on payment in full of the related invoices. Until then, we grant the Client a limited, revocable licence to use them for its internal purposes.

8.3Licence to Arta Cyber Materials. To the extent Arta Cyber Materials are embedded in deliverables, we grant the Client, on payment in full, a non-exclusive, perpetual, non-transferable licence to use them as part of the deliverables for its internal business purposes.

8.4Third-party software, licences, and hardware remain subject to their own terms.

9Confidentiality and privacy

9.1Each party will keep the other’s confidential information confidential, use it only for the Agreement, and protect it with at least reasonable care. This does not apply to information that is public through no fault of the recipient, already known to it, independently developed, or lawfully received from a third party. Disclosure required by law is permitted with prompt notice where lawful.

9.2Security findings, vulnerability details, credentials and system information are the Client’s confidential information. We will store them securely and return or destroy them at the end of the engagement on request, except copies we must keep for legal, insurance or professional records, which remain confidential.

9.3Where we handle personal information on the Client’s behalf, we will do so only on the Client’s instructions and in line with applicable privacy law, including the Personal Information Protection and Electronic Documents Act (Canada), and will notify the Client without undue delay of any breach of security safeguards affecting it.

9.4These obligations survive for 3 years after the Agreement ends, and indefinitely for credentials, security findings and trade secrets.

10Warranties

10.1We will perform the Services in a professional and workmanlike manner, consistent with generally accepted industry practice. If the Client notifies us in writing within 30 days of delivery that the Services did not meet this standard, we will re-perform the deficient Services at no extra charge or, if we cannot, refund the fees paid for them. This is the Client’s sole remedy for breach of warranty.

10.2No guarantee of security. Cybersecurity work reduces risk but cannot eliminate it. We do not guarantee that systems will be free of vulnerabilities, error, intrusion or loss, or that an assessment will identify every weakness. Assessments reflect the systems as they were at the time of testing.

10.3Except as stated in this Section 10, and to the extent permitted by law, all other warranties and conditions, express or implied, including those of merchantability, quality and fitness for a particular purpose (including under the Sale of Goods Act (Ontario)), are excluded.

11Limitation of liability

11.1To the maximum extent permitted by law, neither party is liable for any indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, data or business opportunity, however caused, even if advised of the possibility.

11.2To the maximum extent permitted by law, Arta Cyber’s total liability arising out of or relating to an Agreement, whether in contract, tort (including negligence) or otherwise, is limited to the fees paid by the Client under that Agreement in the 12 months before the event giving rise to the claim.

11.3Sections 11.1 and 11.2 do not limit (a) the Client’s obligation to pay fees, interest and collection costs; (b) liability for fraud, wilful misconduct, or gross negligence; or (c) liability that cannot lawfully be limited.

12Security testing authorization

12.1We will not perform any penetration testing, vulnerability scanning, social-engineering, or other active testing until the Client has signed a written authorization (rules of engagement) defining the scope, systems, IP ranges, dates and contacts.

12.2The Client represents that it owns, or has all necessary authorization from the owners (including cloud, hosting and other third-party providers) to permit, the testing of every system in scope, and will indemnify Arta Cyber against claims by third parties arising from a breach of this representation.

12.3Testing can cause service disruption or data loss despite reasonable care. The Client accepts this risk for authorized in-scope testing and must keep current backups.

13Non-solicitation

13.1During the Agreement and for 12 months after, the Client will not solicit for employment or engagement any Arta Cyber employee or contractor who worked on its project, without our written consent. General advertising not targeted at our personnel is not a breach. If breached, the Client will pay a placement fee of 20% of the person’s first-year compensation, as a genuine pre-estimate of our loss.

14Term and termination

14.1Either party may terminate an Agreement on 30 days’ written notice, or immediately on written notice if the other party materially breaches it and fails to cure within 15 days of notice, or becomes insolvent.

14.2On termination, the Client must pay for all Services performed and expenses incurred up to the termination date, plus any non-cancellable commitments we made for the Client.

14.3Sections 4 to 6, 8, 9, 10.2, 10.3, 11, 12.2, 13, 15 and any accrued payment obligations survive termination.

15General

15.1Governing law. These Terms and each Agreement are governed by the laws of the Province of Ontario and the federal laws of Canada applicable there. The parties submit to the exclusive jurisdiction of the courts of Ontario sitting in Ottawa, except that we may bring a claim for unpaid amounts in any court with jurisdiction. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

15.2Disputes. Before starting court proceedings (other than to collect undisputed amounts or seek urgent relief), the parties will try in good faith to resolve the dispute through senior representatives for 30 days.

15.3Independent contractor. We are an independent contractor. Nothing creates a partnership, joint venture, agency or employment relationship.

15.4Subcontractors. We may use qualified subcontractors bound by confidentiality obligations at least as protective as these Terms, and we remain responsible for their work.

15.5Force majeure. Neither party is liable for delay or failure (other than payment obligations) caused by events beyond its reasonable control.

15.6Notices. Notices must be in writing and delivered by email or courier to the addresses on the latest quote or invoice, or another address a party designates. Email notices to Arta Cyber go to info@artacyber.com.

15.7Assignment. The Client may not assign an Agreement without our written consent. We may assign it to an affiliate or a successor to our business.

15.8Entire agreement; amendment; waiver. The Agreement is the entire agreement for its subject matter. It may be amended only in writing signed or accepted by both parties. A failure to enforce a right is not a waiver.

15.9Severability. If any provision is unenforceable, it will be enforced to the maximum extent permitted and the rest of the Terms remain in effect.

15.10Updates. We may update these Terms for future quotes and Agreements; the version referenced in, or in effect on the date of, a quote applies to that quote.

15.11Language. The parties have requested that these Terms be drawn up in English. Les parties ont exigé que les présentes soient rédigées en anglais.