1 Parties

The client is the party that has requested the assessor to perform a security assessment. The ‘Assessor’ is the party that will perform the
security assessment as requested by the client.

2 Contractual arrangements

The relevant parties declare that the following contracts are in place: Client and assessor have a legally binding contract for the assessment Client
and service provider have a legally binding contract for the hosting, management, maintenance and / or execution of services included in the scope
of the assessment.

3 Legal liability

Breaking into a computer system is not allowed by law. The assessment may include activities such as breaking security measures, producing false
signals and/or keys or assuming a false identity. However, within the scope of the assessment, the assessor is performing activities on request of
the client, therefore neither the client or the service provider or anybody on their behalf will hold the assessor liable or press legal and/or criminal charges.
Client and service provider will not hold the assessor liable for any damage to systems or service in scope as a result of the assessment and any
third-party claims of such nature. The assessor understands that it may still be held liable for any of these activities outside the scope of the assessment
or in case of gross neglect or abuse.

4 Governing Law

This agreement is governed by, and will be construed in accordance with British Law. The parties submit to the non-exclusive jurisdiction of the courts
of The Netherlands in relation to any legal actions or proceedings arising out of or in connection with this agreement. Damages would not be an adequate
remedy for any breach of this Agreement and the parties shall be entitled to the remedies of injunction, specific performance and other equitable relief
for any threatened or actual breach of this Agreement and no proof of special damages shall be necessary for the enforcement of this Agreement.