Snapshot 82904
Normalized text
Scripts and page chrome removed; this is what change detection compares.
CyberCX New Zealand – General Terms and Conditions
1. Performance of Services (ii) providing CyberCX with any requested information
relevant to the provision of the Services in a timely and
1.1 Formation of Agreements accurate manner;
(iii) ensuring the Client’s Systems are virus free and
(a) CyberCX will provide Services, Products or Third-Party backed-up prior to, and during, the performance of the
Products and Services as requested by the Client and agreed Services; and
by CyberCX in an Agreement. Products and/or Services will be (iv) complying with all reasonable requests or directions of
detailed in a Proposal or Statement of Work (as the case CyberCX.
requires) and Third Party Products and Services in a Sales (e) The Client acknowledges that, due to the nature of some
Quotation. In each case, once the relevant document has Services, CyberCX’s proper performance of those Services
been executed or issuance of Purchase Order by Client may have an impact on Client’s Systems, and that the Client
(whichever occurs first) a separate agreement will be should create and maintain a backup of its relevant Systems
formed between the parties incorporating these general terms prior to CyberCX commencing any work on those Systems.
and conditions (each, an Agreement).
1.4 Use of subcontractors
(b) In the event of any conflict between these general terms and
conditions and other provisions in the Agreement, it shall be (a) If an Agreement indicates that CyberCX will use any
interpreted in the following order of priority: (1) the terms subcontractors, CyberCX will be liable for:
contained in the SOW or Proposal or Sales Quotation; (2) the (i) the performance of obligations by its subcontractors;
Additional Terms Schedules (3) any document annexed to or and
incorporated by reference in the Agreement; and (5) (ii) provision of the Services by its subcontractors.
these general terms and conditions (not including the Additional 1.5 Provision of Products
Terms Schedules).
(a) At any time during the Term the Client may request to purchase
(c) Except as agreed in writing, no other terms or any Products (excluding Third Party Products and Services)
conditions contained in any other Client document will apply or offered for sale by CyberCX by submitting a purchase order to
be incorporated into an Agreement (including any purchase CyberCX.
order or other contractual documentation provided by the
(b) The purchase order must explicitly reference these general
Client) and such client provided terms will be null and void in
terms and conditions (and not seek to incorporate any other
respect of the Services or any engagement of CyberCX by the
terms) and set out the type and quantity of the Product/s to be
Client.
purchased and the desired date for delivery of the Products.
1.2 Additional Terms Schedules
(c) CyberCX will provide the Client with written notification of
To the extent the Services include: acceptance or rejection of the purchase order, the proposed
(a) Security Testing Services, the terms in Schedule 1 apply; delivery date along with any variable price changes (including
(b) Digital Forensic Services, the terms in Schedule 2 apply; exchange rate, delivery or third-party pricing changes) as
(c) Staff Augmentation Services, the terms in Schedule 3 apply, relevant for the purchase of the Products. Failure by CyberCX
to confirm receipt of the purchase order is not an acceptance of
and
that purchase order.
(d) Resale of Third-Party Products and Services, the terms in
Schedule 4 will apply. (d) All risk in any deliverable transfers to the Client upon delivery to
the Client and title passes on payment in full.
(together, the Additional Terms Schedules)
(e) As an alternative to the above, CyberCX may provide the Client
1.3 Provision of the Services with an offer to purchase Products via a third-party digital
(a) CyberCX will perform Services in accordance marketplace platform (including the AWS Marketplace or
with any specifications set out in an Agreement. Microsoft Azure Marketplace)(each a Marketplace) in certain
(b) When performing any Services, CyberCX will: circumstances (Platform Offer). The Client must have an
(i) comply with all reasonable directions of the Client and existing account with the relevant Marketplace in order to
all applicable Laws in performance of its obligations; accept a Platform Offer. When accepting a Platform Offer, it is a
condition that the Client accepts any third-party vendor terms
(ii) comply with all reasonable health and safety policies of (such as an end user license agreement) that apply to those
the Client whilst on the Client's site as provided to Products (which may be included with the Platform Offer, or
CyberCX prior to commencing Services; and made available by the third party vendor on their website.
(iii) use reasonable endeavours to have any specific Signature of a Quote, Proposal or SOW by a Client does not
Personnel identified in the Agreement available to constitute acceptance of a Platform Offer until the Client has
perform the Services and will provide the Client with accepted the offer via the Marketplace platform.
reasonable notice if it intends to replace or reassign
such Personnel. 1.6 Resale of Third-Party Products and Services.
(c) CyberCX may provide the Services (or any part of them) The resale of Third-Party Products and Services is governed by
through one or more of its Related Bodies Corporate. the terms set forth in Schedule 4.
CyberCX’s use of any of its Related Bodies Corporate to
perform the Services will not relieve CyberCX of its obligations
under this Agreement, and CyberCX will remain fully 1.7 Access and delays
responsible and accountable to the Client for the performance (a) The Client will be responsible for any delays caused or
of the Services provided by such Related Bodies Corporate. contributed to by the Client, including failure to provide any
(d) The Client agrees to reasonably facilitate CyberCX’s supply of information or access to any Client premises or Systems
any Services or Products, including: necessary for any of the Services at least 5 Business Days prior
(i) providing CyberCX with safe and timely access and to commencement of the applicable Services. Client
authorisation to access and use the Client’s Systems, acknowledges that where the Services are delayed as a result
Personnel, facilities, site and utilities as reasonably of any act or omission of the Client, its personnel or contractors,
required; CyberCX will be entitled to an extension of time equal to the
delay.
(b) If the Client requests CyberCX to cancel, delay, reschedule or
suspend the Services with less than 3 Business Days’ notice,
General Terms and Conditions (v4.2 – 1 September 2026) Page 1 of 9
CONFIDENTIAL
the Client must pay CyberCX its reasonable costs associated 6.2 Intellectual Property in Deliverables and provision of
with such cancelation, delay, rescheduling or suspension. Services
(a) Subject to clauses 6.1 and 6.3, all intellectual property rights in
2. Authorisation the Deliverables, the Services and any other material created
by or for CyberCX in delivering the Services remain the
The Client authorises CyberCX and CyberCX’s Personnel to access property of CyberCX.
and use the Client’s Data, networks and Systems as reasonably (b) Subject to clause 6.3, CyberCX grants to the Client a non-
required to provide the Services. exclusive, non-transferable, non-sub licensable, royalty-free
(excluding any payments due under clause 5) licence for the
3. Governance Risk, Compliance and Privacy Advisory Term (except for documentary Deliverables for which the
licence will be perpetual) to use in New Zealand the intellectual
(a) The Client is responsible for ensuring that the selection and use property rights in the Deliverables, the Services and any other
of Products, Deliverables and Services satisfies all of the material created by CyberCX in delivering the Services for the
Client’s business requirements, legal, regulatory and sole and limited purpose of enjoying the benefit of the Services
compliance obligations. as set out in the Agreement.
(b) Unless set out in an Agreement, CyberCX is not responsible for 6.3 Third party intellectual property
any of the Client’s legal, regulatory or compliance obligations. (a) In conjunction with providing the Services, CyberCX may also
resell to the Client Third-Party Products and Services. The
4. Term Client agrees that:
(i) all Third-Party Products and Services are provided ‘as
Unless otherwise terminated in accordance with clause 13, this is’ by CyberCX as a reseller as facilitator, without
Agreement commences on the date it is last signed by the parties and warranty of any kind from CyberCX or its affiliates;
continue for the period as set out in the Agreement (Term). (ii) its use or acceptance of any Third-Party Products and
Services is conditional on the Client’s acceptance of the
5. Invoices & Payments Third-Party Supplier’s licence agreement or terms of
use (Third Party Licence), which shall be Client’s sole
(a) The Client agrees to pay CyberCX for the provision of the and exclusive remedy with respect to such Third-Party
Services and for the supply of any Products, as set out in the Products and Services;
Agreement. (iii) title in any Third-Party Products and Services remains
(b) The Client agrees to pay CyberCX for all travel and related at all times with the Third-Party Supplier unless
expenses reasonably incurred by CyberCX to meet the Client’s provided otherwise in a Third Party Licence; and
written direction or delivery requirements. (iv) it must comply with the terms on Schedule 4.
(c) CyberCX will issue invoices as set out in the applicable
Agreement or otherwise at the end of the month in which the 7. Confidentiality
Services are delivered, or in respect of Products (excluding
Third Party Products and Services, the terms of which are set (a) Each party agrees that where it, its Personnel, or its Related
forth on Schedule 4), upon acceptance of a purchase order for Bodies Corporate, are the recipient of Confidential Information
the Products. (Recipient) of the other party (Disclosing Party), the Recipient
(d) The Client must pay all invoices within 30 days of the invoice must:
date by electronic funds transfer to an account specified by (i) treat all Confidential Information as confidential and not
CyberCX. use it except as reasonably necessary for the purposes
(e) All CyberCX fees and charges are exclusive of all taxes, of this Agreement;
including sales, use, value added, withholding, consumption and (ii) hold the Confidential Information in strict confidence
other similar taxes or duties. All GST assessed on the provision and not disclose it to any third party (subject to any
of the Services or on CyberCX’s fees (including the legal requirement on the Recipient to disclose the
reimbursement of expenses) will be included as an additional Confidential Information), except to a member of that
charge in an invoice that satisfies the requirements of a “tax party’s Personnel, or a professional advisor of that
invoice” under the relevant GST legislation. Each party will be party, who needs such Confidential Information in order
responsible for its own income, employment, and property taxes. to perform his or her duties and provided that such
Client will reimburse CyberCX for any deficiency relating to taxes person has a legal or contractual obligation to maintain
that are Client’s responsibility under the Agreement. The parties the confidentiality of such Confidential Information and
agree to cooperate with each other to help each party minimise has agreed not to use the Confidential Information for
any potential liability to the extent legally permissible and will any other purpose;
provide to the other any tax exemptions or certifications (iii) to the extent permitted by law, promptly notify the
reasonably requested. The parties agree that reasonable Disclosing Party in writing if the Recipient suspects that
procedures are in place to prevent any form of facilitation of tax any Confidential Information may have been accessed
evasion from occurring in relation to the provision or receipt of by any unauthorised party;
the Services.
(iv) use, at a minimum, the same degree of care with
(f) The Client may not set-off, counterclaim or deduct any amount respect to its obligations under this Agreement as it
from an amount owing to CyberCX. Any disputed invoices must employs with respect to its own confidential or
be notified to CyberCX within 5 Business Days of receipt, and proprietary information, but in no event less than
the notice must detail the amount and the reason for the reasonable care; and
dispute. In such circumstances the Client must pay CyberCX
(v) upon request by the Disclosing Party or termination of
the portion of the invoiced amounts not in dispute on the due
this Agreement, promptly deliver to the Disclosing Party
date for payment.
any Confidential Information in its custody, control or
possession.
6. Intellectual Property (b) Nothing in this Agreement requires a party to return or destroy
6.1 Background IP any information contained in systems, archives or backups
which cannot be practicably deleted, which must be retained as
Each party retains all title and ownership in its own Background required by Law, any accounting standard or the rules of any
IP. stock exchange or for sound corporate governance purposes.
General Terms and Conditions (v4.2 – 1 September 2026) Page 2 of 9
CONFIDENTIAL
(c) Unless otherwise agreed in writing by the Disclosing Party, the within CyberCX’s cloud hosting within a specified geographical
obligations of confidentiality in clause 7(a)(i) do not apply to the location.
extent the Confidential Information:
(i) has been lawfully disclosed to the Recipient by a third 10. Warranties
party free from obligations of confidentiality;
(ii) is previously known to the Recipient without an (a) Each party warrants:
obligation of confidence; (i) it has the power, capacity and authority to enter into
(iii) is independently developed by Recipient or for it; or and observe its obligations under this Agreement; and
(iv) is in the public domain (other than through a breach of (ii) this Agreement has been duly executed by that party
this Agreement). and is a legal and binding agreement, enforceable
against it in accordance with the terms of this
(d) The provisions of this clause 7 shall continue in force
Agreement.
indefinitely following the termination of this Agreement.
(b) The Client warrants that, unless expressly stated otherwise in
an Agreement, it is not the trustee of any trust. Where an
8. Privacy Agreement indicates that the Client is the trustee of a trust, the
Client warrants that:
(a) Both parties agree to comply with the Privacy Laws in relation
to the provision and use of the Services. (i) it enters into the Agreement in its own right and as
trustee of each trust stated in that Agreement;
(b) Where the Client discloses Personal Information (Client
Personal Information) to CyberCX, or permits CyberCX to (ii) the relevant trust has been duly established and
collect, access, or handle Client Personal Information under this subsisting;
Agreement, the Client represents and warrants that it has (iii) the relevant trust is solvent and able to pay all of its
obtained (and will maintain) any authorisations or consents from debts when they fall due;
relevant individuals required under all applicable Privacy Laws. (iv) no administrators, receivers or trustees in bankruptcy
(c) CyberCX will only collect, access, otherwise use, disclose or have been appointed to the relevant trust or
handle Client Personal Information to the extent necessary for threatened to be appointed in the past 2 years;
performance of the Services in accordance with CyberCX’s (v) the Client is the duly appointed, current and only
Privacy Policy. trustee of the relevant trust;
(d) CyberCX may use certain Client Data when analysing cyber (vi) as trustee, the Client has the power to enter into and
security incidents or threats (including attack vectors, methods, perform its obligations under this Agreement;
defences, and other similar items) (Cyber Threats), and for the (vii) it has a sufficient right of indemnity out of the assets
purposes of quality assurance, and Service integrity and of the trust in respect of its obligations under this
enhancement. When analysing Cyber Threats, CyberCX will not Agreement;
collect Personal Information unless necessary and relevant to (viii) no breach of the trust deed exists or would arise as a
the Cyber Threat and understanding its nature or occurrence
result of entering into this Agreement;
(e.g. a person’s user account name to understand how an
attack occurred). (ix) on request, it will provide CyberCX with a copy of the
trust deed for each relevant trust (including any deeds
(e) CyberCX may share anonymised results of its Cyber Threats of variation, amendment or restatement).
research and analysis with other cyber security providers,
customers, government, regulatory bodies or authorities, or law (c) Disclaimer of warranty. Except as set out in an Agreement, to
enforcement that have an interest in cyber security threats and the extent permitted by law CyberCX makes no warranty or
prevention. representation, express or implied, in relation to the Services,
Products or any third-party hardware or software, including
Third Party Products and Services. In relation to third party
9. Data Security & Access Products and Services, Client agrees to comply with, the
relevant Third Party Supplier’s standard terms and conditions.
(a) CyberCX will take reasonable technical and administrative With respect to Third-Party Products and Services, to the extent
precautions within its own control to protect Client Data held in that an implied warranty cannot be excluded from this
CyberCX’s Systems. Agreement, or Client’s agreement, any warranty, condition or
(b) During the Term, CyberCX will maintain its ISO 27001 guarantee implied into this Agreement or Client’s agreement is
certification (or certification for such replacement or successor limited to, at CyberCX’s discretion:
standard) in respect of its Systems. On reasonable request of (i) in the case of Third-Party Products, any one or more of the
the Client, CyberCX will provide a copy of its ISO 27001 following:
certificate to the Client.
(a) the replacement of the Third-Party Products or the
(c) Each party shall promptly notify the other of any Security supply of equivalent Third-Party Products;
Breach where such breach involves Client Data and directly
(b) the repair of the Third-Party Products;
impacts the obligations of either party under this Agreement
.Where such Security Breach is caused by CyberCX, CyberCX (c) the payment of the cost of replacing the Third-Party
will provide reasonable assistance to the Client in managing Products or of acquiring equivalent Third-Party
such Security Breach and/or handling any requests in relation Products; or
to Personal Information. (d) the payment of the cost of having the Third-Party
(d) Client acknowledges that CyberCX is part of a global Products repaired; or
organisation and therefore its core IT systems are hosted (ii) in the case of Third-Party Services:
outside New Zealand on cloud-based systems. The Client (a) the supplying of the Third-Party Services again; or
agrees that to the extent Client Data is collected during the (b) the payment of the cost of having the Third-Party
provision of a Service (or the administering of an Agreement), Services supplied again
CyberCX will store it on Systems (including cloud-based
(d) CyberCX warrants that:
software such as Microsoft Teams and email services), that
comprise of secure servers or data centres outside New (i) it (and its Personnel) will provide the Services by
Zealand, and that Client Data may be accessed from outside exercising the same degree of skill, care and diligence
New Zealand. A Statement of Work may specify where specific that would be exercised by a professional services
items or categories of Client Data are to be held or accessed provider of similar size in the same industry in similar
circumstances; and
General Terms and Conditions (v4.2 – 1 September 2026) Page 3 of 9
CONFIDENTIAL
(ii) its Personnel are appropriately trained and experienced
to provide the Services. 12. New Zealand Consumer Law
(e) Nothing in this Agreement excludes, restricts or modifies any
condition, guarantee, warranty, right or remedy conferred on the (a) Nothing in the Agreement limits the application of the Fair
parties by Law that cannot be excluded, restricted or modified Trading Act 1986 (NZ) or the Consumer Guarantees Act 1993
by agreement. (NZ) or any equivalent legislation(“Relevant Legislation”). To
the extent legally able to do so, CyberCX limits its liability under
the Relevant Legislation to, at CyberCX’s option, replacing or
11. Liability repairing the relevant deliverable or re-performing the relevant
Services. To the extent permissible by law (including the
(a) CyberCX indemnifies the Client for any direct Loss suffered by
Relevant Legislation), all other warranties, terms, conditions
the Client arising from any third party claim that the Client’s use
and representations, express or implied, are excluded. Client
of the Deliverables or other materials provided to the Client by
agrees that the deliverables and/or Services to be performed or
CyberCX in the performance of its Services under an
provided under each Statement of Work are being acquired for
Agreement (other than Third Party Products and Services)
business purposes and the provisions of the Consumer
infringes the rights, including intellectual property rights, of a
Guarantees Act 1993 (NZ) do not apply to such supply.
third party except CyberCX will not be liable for any such Loss
caused or contributed to by
(i) any modification of the Deliverables or materials 13. Termination
provided by CyberCX;
(ii) use of the Deliverables or materials provided by (a) Either party may terminate the Agreement with immediate effect
CyberCX not in accordance with any directions given by if the other party:
CyberCX; (i) is in material breach of the Agreement and such breach
(iii) the Client’s breach or failure to comply with, any Third is incapable of remedy, or such breach is remediable
Party Licence; or but that defaulting party fails to remedy the breach
(iv) the Client’s (and its Personnel’s) failure to take all within 14 days of receiving notice of the breach;
reasonable steps to mitigate any Loss on becoming (ii) becomes insolvent (other than for the purpose of a
aware of any such third-party intellectual property genuine internal reorganisation); or
claims, (iii) is subject to an Event of Force Majeure that continues
and is subject to: for a period of at least 90 days.
(v) for Third Party Products and Services, any restrictions (b) Upon termination of this Agreement for any reason:
or limitations imposed by the Third Party Licence in (i) CyberCX will cease providing the Services and
respect of this indemnity; and Products;
(vi) the Client (and its Personnel, where relevant) permitting (ii) the Client must pay to CyberCX all outstanding
CyberCX to manage any relevant claim or action in the amounts for Services actually performed and expenses
name of the Client (or any relevant Personnel). incurred prior to date of termination including a pro-
(b) Subject to clause 11(d) and to the extent permitted by law, rated portion for Deliverables in progress and expenses
CyberCX’s total aggregate liability to the Client in respect of any incurred prior to date of termination or Products (for its
and all Losses incurred by the Client (whether for breach of full committed term) ordered by the Client or amounts
contract, in tort (including negligence) or otherwise) arising out that CyberCX has paid or owes to third parties that it
of or in connection with the carrying out of the Services or cannot reasonably get out of paying in connection with
supply of the Products under this Agreement is limited to the an Agreement; and
amount paid by the Client to CyberCX under the applicable (iii) the Client must pay for any termination fees specified in
Agreement in the 12 months preceding the event giving rise to the Agreement.
the Loss. (c) Termination of this Agreement does not affect a liability or any
(c) CyberCX’s limit on liability in clause 11(b) does not apply to the obligation of a party arising prior to termination nor affect any
following Losses: damages or other remedies which a party may be entitled under
(i) personal injury or death of a party or person to the this Agreement.
extent caused by CyberCX; (d) On expiry or termination of this Agreement:
(ii) damage to tangible property caused by CyberCX’s (i) Clauses 7(Confidentiality), 8(Privacy), 9(Data Security
negligent act or omission; or and Access), 10(Warranties), 11(Liability),
(iii) breach of clause 7(Confidentiality) by CyberCX; 13(b)(Termination) and 14(Non-solicitation) continue in
(iv) under the indemnity in clause 11(a). full force and effect; and
(d) CyberCX’s maximum liability for its breach of clause 8 (ii) all rights, obligations and liabilities a party has accrued
(Privacy), will be limited to $2,000,000. before expiry or termination continue.
(e) Notwithstanding anything in this Agreement, CyberCX will not
be liable under this Agreement for any incidental, indirect, 14. Non-solicitation
special or punitive loss, or consequential Loss that does not
arise naturally (that is, according to the usual course of things) During the Term and for a period of 12 months after completion of the
from the event giving rise to the Loss or any loss of profits, loss Term, the Client must not offer work to, solicit or induce for
of production, loss of revenue, loss of business, loss of savings, employment, employ, or contract with, CyberCX’s Personnel who are
loss of goodwill, damage to reputation, loss of opportunity, loss involved with the provision of the Services, without first obtaining the
or corruption of data or wasted overheads. written consent of CyberCX (which may be withheld by CyberCX at its
absolute discretion). This clause does not apply to a bona fide publicly
(f) Each party will use commercially reasonable efforts to mitigate listed job advertisement by the Client.
any Loss. CyberCX’s liability will be reduced to the extent Client
has caused or contributed to the event giving rise to the claim.
15. Modern Slavery
(g) This section shall not be construed to limit any of Client’s rights
or remedies it may have against the applicable Third Party (a) CyberCX complies with all applicable laws relating to modern
Supplier (as that term is defined in Schedule 4) for its use of slavery, human trafficking, forced labour and worker
Third Party Products and Services in an agreement between exploitation.
Client and such Third Party Supplier or under law.
(b) As at the date of entering into this Agreement, CyberCX:
General Terms and Conditions (v4.2 – 1 September 2026) Page 4 of 9
CONFIDENTIAL
(i) has no knowledge of any modern slavery offence shall be required by the terms of this Agreement to be directly or
currently occurring within its organisation or supply indirectly involved in the provision of goods, software,
chains; and deliverables, work, services and/or technical data that may be
(ii) take reasonable commercial steps to identify the risk of prohibited by applicable export control or economic sanctions
and prevent modern slavery offences. programs. Applicable export control or economic sanctions
programs may include those of the UN, EU, and U.S. With
(c) If CyberCX becomes aware of any modern slavery offence (or
respect to the export or re-export of U.S. origin goods, software,
of any charges laid or orders made in relation to a modern
services and/or technical data, or the direct product thereof
slavery offence) within its organisation or supply chain that
CyberCX and Client will comply with U.S. export control and U.S.
directly or adversely impacts the obligations in this Agreement,
economic sanctions laws. The Parties understand and agree that
CyberCX will notify the Client in writing.
this Agreement shall not require CyberCX to provide or support
services involving Cuba, Iran, Sudan, Syria, North Korea,
16. Miscellaneous Specially Designated Nationals, and/or Blocked Persons (as
determined by the US Treasury Office of Foreign Assets Control),
(a) If any provision of this Agreement is deemed to be either directly or indirectly, including through the use of
unenforceable, invalid or illegal, the interpretation is to be subcontractors.
applied to reflect the intention of the parties as far as possible
(k) No party is authorised to bind another party and nothing in this
whilst not affecting the validity of the remainder of the
Agreement is construed as creating a relationship of principal
Agreement.
and agent, partners, trustee and beneficiary, or employer and
(b) Neither party may assign or novate its rights under this employee.
Agreement without the other party’s prior written consent,
(l) This Agreement may only be amended or replaced with the
provided however CyberCX can assign or novate its rights
written agreement of all parties.
under this Agreement to a Related Body Corporate without prior
written consent(or, in the case of novation, with consent to be (m) This Agreement constitutes the entire agreement between the
reasonably provided). parties and supersedes any prior conduct, arrangement,
representation, agreement or understanding in relation to its
(c) The Client acknowledges and agrees that, depending on the
subject matter.
Services to be provided, some or all of the Services may be
provided by CyberCX Personnel located outside of New (n) This Agreement can be signed in counterparts. If an electronic
Zealand . Client Data may be stored or accessed from locations signature is used, it shall have the same effect as a handwritten
outside of New Zealand for the purpose of these CyberCX signature.
Personnel providing the Services. 17. Definitions and interpretation
(d) Client agrees that if it procures any Third Party Products and
17.1 Definitions
Services through CyberCX, CyberCX may be required to
provide the relevant third party certain Client Data to facilitate All capitalised terms have either the meanings given to that term in the
the supply of such Third Party Products and Services. Agreement, the definitions in this clause 17or where otherwise set out in
these general terms and conditions:
(e) CyberCX and its Personnel may use artificial intelligence tools,
services and models (AI Tools) for their internal operations and Agreement means an Agreement made pursuant to clause
performance of specific services. Any use of an AI Tool by 1.1(a) incorporating the agreed Proposal, Sales Quotation or Statement
CyberCX will be in compliance with all applicable laws. of Work and these general terms and conditions; .
(f) All notices and consents must be sent by email to, in the case
of the Client, the email address for the Client or its Background IP means a party’s intellectual property rights in any
representative set out in the Agreement, and in the case of materials developed independently of, or prior to, the provision of the
CyberCX, the CyberCX representative set out in the Services and the Deliverables, together with any enhancements,
Agreement, with any legal notices or notice of dispute, copied to modifications and derivatives made to such intellectual property;
legal@cybercx.com.au (Legal Address). A notice will be of no Business Day means a day that is not a Saturday, Sunday, public
effect unless it has been sent to CyberCX’s Legal Address. holiday or bank holiday in the location where the Services are being
(g) This Agreement is governed by the laws of , New Zealand. provided (unless expressed otherwise in the Agreement);
Each party irrevocably submits to the non-exclusive jurisdiction Client means the customer who has requested the Services to be
of the courts of New Zealand performed by CyberCX and as identified in the Agreement;
(h) CyberCX will not be liable for any delay or failure to supply the Client Data means the data owned or supplied by the Client which is
Services or Products if such a delay or failure was due to an accessed by CyberCX (including its Related Bodies Corporate) or its
Event of Force Majeure. subcontractors in the course of performing the Services;
(i) The parties agree that in the event of a dispute or alleged Confidential Information means any and all information (in any form
breach, the parties will work together in good faith first to or media) of a confidential nature that is made available directly or
resolve the matter internally by escalating it to higher levels of indirectly, and before, on or after the date of this Agreement including
management. In the event the parties fail to resolve the matter financial, client, employee and supplier information, product
within 30 days after the dispute has been escalated to higher specifications, policies and procedures, processes, statements,
levels of management, the dispute shall be submitted to formulae, trade secrets, Client Data, drawings and data which is not in
mediation prior to any other dispute resolution process being the public domain (except by virtue of a breach of the confidentiality
invoked. The dispute must be referred to mediation to the obligations arising under this Agreement), and includes the existence
chairperson for the time being of Resolutions Institute (“RI”) and details of this Agreement (and any Agreement made under it) and
New Zealand Inc (or his or her nominee). The dispute referred the business relationship between the parties (but does not include
to RI for mediation must be heard by RI as soon as possible. Personal Information);
The parties agree to adhere to the procedures set out in this Cyberattack means any breach of (or attempted or threatened breach
section before enforcing any other rights permitted by law in the of) or unauthorised access to the Client’s Systems, including identity or
resolution of any disputes under the Agreement. Nothing in this intellectual property theft, exploitation of ICT systems, phishing,
clause prohibits a party from seeking urgent interlocutory or spamming, denial-of-service (including distributed), stolen hardware, or
injunctive relief. website defacement;
(j) Notwithstanding any other provision of this Agreement to the CyberCX means CyberCX New Zealand Limited;
contrary: (a) each Party shall retain responsibility for its Deliverables means the materials, reports and other deliverables to be
compliance with all applicable export control laws and economic provided by CyberCX as set out in the relevant Agreement.
sanctions programs relating to its respective business, facilities,
Digital Forensic Services includes:
and the provision of services to third parties; and neither Party
General Terms and Conditions (v4.2 – 1 September 2026) Page 5 of 9
CONFIDENTIAL
(a) digital forensic investigation; risks assessment and any other security testing or assessment
(b) digital forensic analysis; activities carried out for a Client under an Agreement
(c) forensic reporting and opinions; Services means the services to be provided to the Client by CyberCX,
as set out in a relevant Agreement;
(d) threat hunting;
Staff Augmentation means the use of CyberCX Personnel to fill, or
(e) cyber threat intelligence and risks assessment (including augment the capacity and capability within the Client’s business;
compromise assessments);
Statement of Work or SOW means a statement of work setting out the
(f) crisis communications; and Services and/or Products to be provided to the Client and which has
(g) any other activities related to those in (a)–(e) above (or been signed by both CyberCX and the Client;
otherwise referred to as a ‘digital forensic service’) carried out Systems includes networks, software, applications, computers,
for, or on behalf of, the Client under an Agreement; servers, mobile devices, cloud services (including storage, software,
Event of Force Majeure means any event or circumstance, or a platforms and infrastructure as a service), industrial control systems,
combination of events or circumstances, which is beyond the and any other IT systems or equipment;
reasonable control of an affected party (but does not excuse any Term has the meaning given to that term in clause 4;
obligation to make payment); Third Party Licence has the meaning given to that term in clause
Laws means all laws including rules of common law, statutes, Error! Reference source not found.; and
regulations, subordinate legislation, proclamations, ordinances, by Third-Party Products and Services means the products and services
laws, rules, regulatory principles and requirements, mandatory codes of CyberCX purchases from a Third Party Supplier for resale to the Client
conduct, writs, orders, injunctions, judgments and any awards, which in New Zealand under an Agreement.
are applicable from time to time in the jurisdiction in which CyberCX or
its Personnel perform their obligations under this Agreement;
Loss means any loss, cost, liability or damage, including reasonable 17.2 Interpretation
legal costs on a solicitor/client basis; In this Agreement, unless the context requires otherwise:
Personal Information has the meaning given to that term in the (a) clause and subclause headings are for reference purposes
Privacy Act; only;
Personnel means, in relation to a party, its employees, secondees, (b) the singular includes the plural and vice versa;
officers, agents, advisers and contractors (and in the case of CyberCX, (c) words denoting any gender include all genders;
also includes the Personnel of its Related Bodies Corporate);
(d) a reference to a person includes any other entity recognised by
Privacy Act means the Privacy Act 2020 (NZ); law and vice versa;
Privacy Laws means the Privacy Act and all other applicable privacy (e) where a word or phrase is defined, its other grammatical forms
and data protection Laws as may be in force from time to time which have a corresponding meaning;
regulate the collection, use, disclosure, storage of and granting of
access rights to Personal Information; (f) any reference to a party to this Agreement includes its
successors and permitted assigns;
Privacy Policy means the privacy statement (and associated
documents) of CyberCX’s group of companies as amended from time (g) any reference to any agreement or document includes that
to time, located at: www.cybercx.com/privacy; agreement or document as amended at any time;
Product means any products or goods supplied pursuant to the (h) the use of the word includes or including is not to be taken as
Agreement; limiting the meaning of the words preceding it;
Proposal means a proposal prepared by CyberCX for Services (i) the expression at any time includes reference to past, present
and/or Products to be provided to the Client that references or and future time and performing any action from time to time;
incorporates these general terms and conditions; (j) no provision of this Agreement will be construed adversely to a
Quote means a quote prepared by CyberCX for Services and/or party because that party was responsible for the preparation of
Products to be provided to the Client that references or incorporates this agreement or that provision;
these general terms and conditions; (k) a reference to any legislation includes all delegated legislation
Related Body Corporate is as defined in the Corporations Act made under it and amendments, consolidations, replacements
2001 (Cth) and equivalent to a ‘related company’ as set out in the or re-enactments of any of them; and
Companies Act 1993 (NZ); (l) an agreement, representation or warranty by two or more
Security Breach means any unauthorised access to, or alteration of persons binds them jointly and severally and is for the benefit of
data that a party is responsible for or in control of; them jointly and severally.
Security Testing Services means penetration testing red teaming,
purple teaming, intrusion techniques, code reviews, security threats and
General Terms and Conditions (v4.2 – 1 September 2026) Page 6 of 9
CONFIDENTIAL
(iii) provides no warranty or guarantee as to the outcome
Schedule 1: SECURITY TESTING TERMS of the Security Testing Services, all testing has
limitations, and that such testing cannot guarantee
1. Application of these Terms discovery of all weaknesses, noncompliance issues,
(a) The terms in this Schedule apply if Security Testing Services or vulnerabilities; and
are provided by CyberCX. (iv) may use various proprietary methods and software
(b) The Client agrees and acknowledges that it is aware of the tools to probe network resources, and to detect
nature and risks associated with Security Testing Services, actual or potential security flaws and vulnerability,
and such Services may include: which will not be revealed
(i) simulating or performing controlled Cyberattacks on (d) No other terms or any other agreement will limit the Client’s
the Client’s Systems; authorisation or liability in clause 2(c) of this Schedule.
(ii) deliberate attempts to penetrate the security of the
Client which may be provided by a third party;
Schedule 2: DIGITAL FORENSIC TERMS
(iii) red teaming (including, but not limited to, deliberately
masquerading as a hostile attacker with the intention 1. Application of these Terms
of detecting vulnerabilities) activities in relation to the (a) The terms in this Schedule apply if Digital Forensic Services
Client and its premises and Systems; or are provided by CyberCX.
(iv) deliberately allowing unauthorised access to the (b) The Client acknowledges that it is aware of the nature of the
Client’s network or Systems for the purpose of Digital Forensic Services and that should CyberCX form a
analysing threat vectors and origination. reasonable belief or identify evidence of serious criminal
conduct during an engagement, CyberCX may be required
to notify law enforcement.
2. Acknowledgment and liability
2. Acknowledgment and liability
(a) The Client acknowledges and agrees that:
(i) Security Testing Services will be performed by (a) The Client acknowledges and agrees that:
CyberCX Personnel located in New Zealand, and (i) Digital Forensic Services will be performed by
may be performed by CyberCX Personnel located CyberCX Personnel located in New Zealand, and
outside of New Zealand (Overseas Personnel); may be performed by CyberCX Personnel located
(ii) in order to provide the Client with the access to outside of New Zealand (Overseas Personnel);
expertise in a particular scenario and in a timely (ii) in order to provide the Client with the access to
manner, CyberCX may be required to use its expertise in a particular scenario and in a timely
Overseas Personnel; manner, CyberCX may be required to use its
(iii) all Overseas Personnel are employed directly by Overseas Personnel;
CyberCX or its Related Bodies Corporate and are (iii) all Overseas Personnel are employed directly by
bound by CyberCX’s internal security and CyberCX or its Related Bodies Corporate and are
confidentiality requirements; and bound by CyberCX’s corporate group security and
(iv) to the extent necessary for the scope of works, any confidentiality requirements; and
Client Data that is retrieved and needs to be stored (iv) to the extent necessary for the performance of the
as a result of Security Testing Services will be held Digital Forensic Services, any Client Data that is
within, CyberCX’s Systems, and only accessed by retrieved and needs to be stored as a result of the
CyberCX Personnel on a need to know basis. Digital Forensic Services will be held within
(b) The Client accepts that the Security Testing Services: CyberCX’s Systems, and only accessed by
CyberCX Personnel on a need to know basis.
(i) are sample testing activities only and cannot account
for all possible ways a third party could breach the (b) The Client acknowledges and agrees that the Digital
Client’s security measures or Systems; Forensic Services:
(ii) do not implement any security measures and will not (i) subject to clause 2(b)(ii), are intended for the Client
prevent security or data breaches, or Cyberattacks; only and outputs may not be provided to any third
party without CyberCX’s prior written consent;
(iii) could result in interruptions or degradations to the (ii) CyberCX may, on written request, permit the Client
Client’s Systems and accepts those risks and to share a report deliverable with a third party. The
consequences; and Client agrees that any report deliverable approved
(iv) although carried out by professionals using tools for sharing can only be shared on a need to know
from trusted resources, carry an element of risk that basis, and on the condition that the recipient has
can never be fully eliminated, and the Client accepts agreed to keep it strictly confidential and not to
that there is no guarantee that every vulnerability in further disseminate;
its Systems will be identified during the Security (iii) are not intended to provide any specific results, other
Testing Services; and than to identify factual findings, analysis of evidence,
(v) have the potential to activate the Client’s existing and responses to specific questions related to the
security or incident response services or programs, provision of our expert opinion; and
and in such an event, the Client remains responsible (iv) are not delivered against any standards or guidelines
for managing these at its sole cost. unless otherwise agreed in writing.
(c) In carrying out the Security Testing Services, the Client (c) In carrying out Digital Forensic Services, the Client agrees
acknowledges and agrees that CyberCX: that CyberCX:
(i) as agent of the Client, is considered to be party to a (i) is expressly authorised by the Client to perform such
communication in the case of intercepting any Services (and all such tasks and tests reasonably
private communication on the Client’s Systems; contemplated by or reasonably necessary to perform
(ii) is expressly authorised by the Client to perform the Services) and the Client does so in compliance
such Services (and all tests reasonably necessary to with all relevant Laws (including the Privacy Act);
(ii) once engaged, is authorised to accrue reasonable
perform the Services) on the relevant network
costs to provide the Services and the Client accepts
resources and IP addresses. The Client represents
and will meet all costs until conclusion of the
that, if it does not own such network resources, it
engagement or the Client instructs in writing that the
has requisite consent and authority to engage
Services be suspended or terminated;
CyberCX to provide the Security Testing Services;
General Terms and Conditions (v4.2 – 1 September 2026) Page 7 of 9
CONFIDENTIAL
(iii) is acting on behalf of the Client, so in the case of (ix)
CyberCX warrants that its Personnel have the
intercepting any private communication on the knowledge, skill and experience to perform the
Client’s Systems, CyberCX as agent of the Client is agreed role or tasks; and
considered to be party to such private (x) the only Deliverable is the provision of CyberCX
communication; Personnel to perform the agreed tasks or role.
(iv) provides no warranty or guarantee as to the outcome (b) All outputs, including any intellectual property rights in those
of the Digital Forensic Services, or any resulting outputs, from Staff Augmentation Services will be owned by
legal or other proceedings; the Client upon full payment of the relevant invoice(s).
(v) will rely on the information provided by the Client as (c) During the term of the Staff Augmentation Services, the
true and correct, and that unless otherwise agreed, Client must not induce or solicit into, or otherwise make an
will not undertake any review, validation or audit to
offer to, any CyberCX Personnel for an offer of employment
ascertain the completeness or accuracy of
with the Client.
information provided; and
(vi) leverages cyber threat intelligence gained through (d) The CyberCX Personnel are not required to undertake any
previous engagements for other clients. Through the activities for the Client that are outside the scope of works in
course of our work, CyberCX may collect cyber an Agreement, or any activity that would be unlawful or place
threat intelligence, including from the Client the individual in an unsafe situation.
Systems, focused on attacker tools and methods.
Any external use of such cyber threat intelligence will (e) Client represents and warrants that:
not include information which may identify the Client (i) CyberCX Personnel will not be given any financial
organisation, networks, Systems, sensitive delegation or authority to bind the Client, except
information, staff, customers, related parties, or where expressly stated otherwise in a Statement of
include any Client confidential information. Work;
(d) No other terms or any other agreement will limit the Client’s
authorisation or liability in clause 2(c) of this Schedule. (ii) it will not ask nor place the CyberCX Personnel in a
position where it would be in breach of, or a conflict
with, the CyberCX Personnel’s obligations or duties
to CyberCX as its employer;
Schedule 3: STAFF AUGMENTATION TERMS
3. Virtual Chief Information Security Officer Engagements
1. Application of these terms (a) This clause 3 applies where the Client has requested
(a) The terms of this Schedule apply if Staff Augmentation CyberCX provides one or more of its Personnel in a Chief
Services are provided by CyberCX under an Agreement. Information Security Officer or a similar senior role (vCISO).
(b) The Client acknowledges and agrees that Staff (b) The Client must not:
Augmentation Services are provided on the basis that
CyberCX Personnel will be working under the direction and (1) require or request the CyberCX Personnel, acting
control of the Client, and the Client remains responsible for in a vCISO role, participate in any board meetings
all project and/or work outcomes. or decision making of the Client, and that
(c) CyberCX remains responsible for its employment obligations otherwise, they will not be asked to perform or
pursuant to the CyberCX Personnel, in particular in regards fulfill the roles or duties of an officer of the Client
to remuneration, PAYE obligations and superannuation. as contemplated by the Companies Act 1993
(d) When the Client makes a request for any CyberCX (NZ)(Officer);
Personnel to provide Staff Augmentation Services it shall
provide CyberCX with: (2) hold the CyberCX Personnel out as being an
(i) the date on which the Client requires the Personnel Officer of the Client to any other person, and must
to commence work and the duration, or likely not appoint them as an Officer in any corporate
duration of the services; documentation or registers.
(ii) the position which the Client is seeking to fill, (c) Where the Client has engaged CyberCX to provide a vCISO
including the type of work the Personnel in that role, it agrees and acknowledges that CyberCX will not be
position is required to do, the location at which and prevented from obtaining subsequent work with the Client by
the hours during which, the Personnel would be virtue of the CyberCX Personnel acting in the vCISO role.
required to work; Each party agrees that it will maintain appropriate
(iii) a description of the work environment (if on a information barriers to identify and resolve any perceived or
Client’s premises), and a statement detailing any actual conflicts of interest to ensure CyberCX is not
known health and safety risks , the steps the Client prohibited from any proposed future work with the Client.
has taken to prevent or control such risks, and any
reasonable precautions the CyberCX Personnel (d) In the event a CyberCX Personnel performing a vCISO role
must take prior to commencing work; is deemed to be an officer of the Client, the Client
indemnifies and holds harmless CyberCX and that CyberCX
(iv) the experience, training, qualifications and any
Personnel from any loss or damage, actions or claims that
authorisation which the Client considers are
may arise asserting that the CyberCX Personnel has
necessary, or which are required by Law, or by any
breached a duty or obligation they may have under the
professional body, for the Personnel to possess in
Companies Act 1993 (NZ) as an Officer of the Client.
order to work in the position; and
(v) any expenses payable by or to the Personnel.
2. Acknowledgement and Liability
(a) The Client acknowledges and agrees that:
(vi) CyberCX Personnel may be engaged either at the
Client premises or remotely;
(vii) the Client is responsible for all work output,
decisions, directions or omissions of the CyberCX
Personnel providing Staff Augmentation Services;
(viii) the Client is responsible for all project outcomes
from the Staff Augmentation Services;
General Terms and Conditions (v4.2 – 1 September 2026) Page 8 of 9
CONFIDENTIAL
4. Taxes.
Schedule 4: RESALE OF THIRD PARTY
(a) Applicable taxes will be billed as a separate item on invoices
PRODUCTS AND SERVICES and any taxes paid on behalf of Client by CyberCX will be
identified on the applicable invoice. In addition to the
1. Application of these terms purchase price, the Client shall pay or reimburse CyberCX
(a) The terms of this Schedule apply to, and are the enforceable for all sales, use, property and all other similar taxes,
terms and conditions for, the resale of Third Party Products including tax costs incurred by CyberCX arising from
and Services between CyberCX and Client and will govern transactions to purchase the Third Party Products and
the Client’s purchase of Third Party Products and Services Services, local fees or charges imposed by any federal, state
from CyberCX in New Zealand. or local government for Products and/or Services provided
under this Agreement, even if imposed by law upon
(b) For the avoidance of doubt, all Third Party Products and
CyberCX or CyberCX’s employees, excluding taxes based
Services are provided directly by a third party supplier (“Third
upon the income or property of CyberCX and taxes based
Party Supplier”).
upon the payroll of CyberCX’s employees (collectively
2. Sales Quotations “Taxes”). Client will reimburse CyberCX for any deficiencies,
(a) Third Party Products and Services purchased by Client interest or penalties relating to taxes that are Client’s
hereunder will be listed on the a sales quotation issued by responsibility under this Agreement.
CyberCX to Client, which incorporates these terms and (b) If Client is required to withhold or deduct any Taxes from any
conditions by reference, and together are the “Sales payment, Client shall be required to “gross up” the amount of
Quotation”. CyberCX will order the Third Party Products and such payment and shall pay the total amount reflected on
Services specified on the Sales Quotation that has been the invoice. The Client agrees to pay such Taxes unless the
accepted by both Client and CyberCX. Client accepts the Client has provided CyberCX with a direct pay permit or valid
Sales Quotation by signing the Sales Quotation or by issuing exemption certificate for the applicable jurisdiction.
a purchase order for the Third Party Products and Services (c) The Parties will cooperate in good faith to minimize Taxes to
listed in the Sales Quotation. CyberCX confirms its the extent legally permissible including, if available,
acceptance of the Sales Quotation to the extent that acceptance of electronic delivery of software products with
CyberCX orders Third Party Products and Services pursuant no media backup. Both Parties agree that in connection with
to the Sales Quotation. the activities under this Agreement shall (i) not engage in tax
(b) Any term, condition or proposal submitted by Client in a evasion or the facilitation of tax evasion and (ii) have
purchase order or otherwise (whether orally or in writing) that sufficient controls and policies in place to prevent tax
is inconsistent with or in addition to the Sales Quotation or evasion or the facilitation of tax evasion.
the terms and conditions of this Agreement will be of no 5. Delivery and Risk of Loss.
force or effect, unless otherwise agreed in writing.
(a) Shipment and delivery of Third Party Products and Services,
including risk of loss, will be in accordance with the
3. Prices and Payment. applicable terms and conditions of the Third Party Supplier.
(a) CyberCX will invoice Client in the primary local currency of All orders are subject to the availability of underlying Third
CyberCX (unless stated otherwise in the Sales Quotation). Party Products and Services. For hardware, title will each
Client agrees to pay as invoiced the total purchase price for pass to Client from CyberCX immediately after being
the Third Party Products and Services agreed in the Sales transferred to CyberCX from the Third Party Supplier.
Quotation, plus Taxes (as defined in Section 4) and 6. Order Changes, Cancellations and Returns.
applicable delivery and insurance charges. (a) Subject to (b), any Third Party Products and Services is
(b) Payment in full is due within 30 days of an invoice date. supplied on a non-cancellable, non-refundable basis.
Interest on any payment past due will accrue at the lower of (b) Any order changes, cancellations or returns of Third Party
the rate of 1.5% per month or the maximum rate allowed by Products and Services will be governed by the applicable
law. Client will be responsible for CyberCX's costs of Third Party Supplier policies. Client will be responsible for
collection for any payment default, including, but not limited any fees, penalties or other amounts a Third Party Supplier
to, court costs, filing fees and reasonable attorneys' fees. charges CyberCX as a result of any order change,
cancellation or return by Client.
General Terms and Conditions (v4.2 – 1 September 2026) Page 9 of 9
CONFIDENTIAL