General Terms and Conditions for Direct Customers

These General Terms and Conditions govern the provision and use of the Service provided by Cyber Guru to the Customer.

1. INTRODUCTION AND ATTACHMENTS

The introduction and attachments to these General Terms and Conditions are an integral and essential part of them and are expressly acknowledged and accepted by both parties.

In particular, the following documents are attachments to these General Terms and Conditions:

The Privacy Policy, available at the following link.

The Data Processing Agreement, available at the following link.

The Commercial Offer

2. DEFINITIONS

The following terms have the following meanings in these General Terms and Conditions:

Access means the authorization granted by the Company Admin to the User to access the Platform and use the Products. The number of Accesses purchased by the Customer is specified in the Certificate, and until they are used up, Cyber Guru will authorize the Company Admin to grant Accesses to Users. Access is governed by the General Terms and Conditions.

Certificate means the certificate sent by Cyber Guru to the Customer containing, in addition to a summary of the Products and the number of Accesses purchased, the link to access the Platform and activate the Service after accepting the General Terms and Conditions.

Customer means the business entity (not a consumer) that has accepted the Offer, thereby entering into a contract with Cyber Guru, and is required to comply with these General Terms and Conditions for the activation and use of the Service.

Company Admin means, where provided by the Service, the person appointed by the Customer and authorized by them to access the Platform with administrative or supervisory functions, which may include managing, creating, or revoking User Accesses for that Customer.

General Terms and Conditions means these General Terms and Conditions (also referred to as the “Agreement”).

Cross-selling means the addition, during the relationship, of a Product (for example, adding the Phishing Product to the original Awareness Product).

Cyber Guru is an Italian company, certified ISO/IEC 27001, 27017, 27018, and ISO 9001, operating in the IT sector, providing the Service and being the exclusive owner of the Platform and Products.

Confidential Information means all non-public information or material designated as proprietary and/or confidential, or that should reasonably be understood as confidential (including, but not limited to, all information about fees and Product content).

Offer means the offer for the provision of the Service accepted by the Customer, including the description of the Service and related Products, economic terms, General Terms and Conditions, duration (including the Service activation date), and documents in compliance with data processing regulations.

Platform means the software as a Service (SaaS) platform through which the Service provided by Cyber Guru can be accessed.

Product(s) means the software solutions offered from time to time by Cyber Guru and available on the website.

Service means the service provided by Cyber Guru in Software as a Service (SaaS) mode, delivered through access to and use of the Platform, including the Products selected by the Customer and the number of Accesses purchased.

Up-selling means increasing the number of Accesses purchased by the Customer.

User means the person assigned Access by the Company Admin.

3. SUBJECT OF THE AGREEMENT

3.1 The relationship between Cyber Guru and the Customer concerns the provision of the Service by Cyber Guru, as specified in the Certificate and these General Terms and Conditions. It is understood that Cyber Guru’s obligation is a best-efforts obligation and not a results-based obligation.

4. ACCESS TO THE SERVICE (ACCEPTANCE OF GENERAL TERMS, COMPANY ADMIN, AND USERS)

4.1 To use the Service, the Customer will receive from Cyber Guru the Certificate, which confirms the Service has been enabled and contains the applicable General Terms and Conditions. Access to and use of the Service will only be allowed after the Customer explicitly accepts the General Terms and Conditions included in the Certificate. Without such acceptance, access to and use of the Service will remain unavailable.

4.2 After the Service is activated as per section 4.1, and depending on the type of Service activated, an account with administrative functions called “Company Admin” may be created, assigned to the Customer’s representative or another person designated and authorized by the Customer. The Company Admin, if applicable, may access the Platform with administrative privileges consistent with the activated Service and the operational configurations set by Cyber Guru. These privileges may include, as appropriate, the ability to create, manage, and revoke User access credentials, as well as view data and information related to Service usage or User performance, as necessary to ensure proper use or for monitoring purposes. For Services that allow it, the Company Admin may have read-only features, including through dedicated dashboards. It is understood that, by agreement between Cyber Guru and the Customer, an option may be activated that limits the Company Admin’s access to only aggregated or statistical data, by pseudonymizing personal data so that it cannot be directly linked to an individual, in compliance with current data protection laws.

4.3 To access the Services, the Company Admin (if any) and each User must use an identification code (username) and a personal access key (password) or other secure authentication methods, such as SSO (Single Sign-On) or two-factor authentication (2FA) systems, if available.

5. DURATION, INTEGRATION, AND FUNCTIONALITY OF THE SERVICE

5.1 The Customer may use the Service for the initial period specified in the Certificate, based on the Offer signed with Cyber Guru. At the end of this initial period, the Service will automatically renew for additional 12 (twelve) months (each, a “Period”), and will continue to renew for subsequent Periods, unless the Customer cancels in writing with at least 3 (three) months’ notice before the end of the current Period.

5.2 During the provision of the Service, the Customer may request Up-selling and Cross-selling actions, with the understanding that the duration and expiration of the additional Accesses will match the initial duration and expiration of the Service, including any renewals as per section 5.1 above.

5.3 Upon expiration of the Service, the Company Admin and end Users will no longer be able to use the Service.

5.4 The Service features, including response times and issue resolution procedures, are as follows:

5.5 Any operational errors will be classified as follows:

5.6 The following are considered exceptional and extraordinary cases of operational errors, for which Cyber Guru will not be bound to comply with the standard times set out in section 5.4 above, but will only be required to inform the Customer as soon as possible of the estimated time to restore the Service:

natural disasters such as earthquakes, floods, hurricanes, or other natural events affecting the Service infrastructure;

external attacks such as DDoS (Distributed Denial of Service) attacks, hacking, or other forms of cyberattacks targeting the Platform;

service interruptions by third parties such as external service providers, data centers, or cloud service providers;

force majeure events, meaning any unforeseen and insurmountable event beyond Cyber Guru’s reasonable control, such as wars, riots, uprisings, civil unrest, acts of terrorism, fires, explosions.

5.7 In any case, for any technical support or assistance requests related to the provision of the Service, the Customer may contact the dedicated Cyber Guru support team by email.

6. CUSTOMER WITHDRAWAL

6.1 Without prejudice to any mandatory applicable law, either Party may terminate the Agreement with immediate effect, by written notice, if the other Party engages in conduct constituting a criminal offense under Legislative Decree 231/2001 or Legislative Decree 159/2011, provided such conduct has been definitively established by a final court judgment.

6.2 The Customer may withdraw from the Agreement, only by written and reasoned notice, solely in the following cases:

substantial changes to the contractual terms or deterioration of performance attributable to Cyber Guru that significantly and demonstrably affect critical or important outsourced functions, if such changes or deterioration have not been previously approved or accepted by the Customer;

determination, by written act issued by a competent authority, of serious and irremediable deficiencies in Cyber Guru’s ICT risk management, such as to materially and significantly compromise the availability, integrity, authenticity, or confidentiality of the data or services provided;

exceptional circumstances that concretely and demonstrably hinder the exercise of supervisory powers by the competent Authority solely due to the existing contractual relationship;

material changes to the subcontracting of critical services or unauthorized outsourcing of critical functions by Cyber Guru in violation of contractual obligations and despite the Customer’s written and reasoned objection, and only if such changes cause demonstrable serious harm to the Customer’s activities.

6.3 Except as provided in section 6.1, before exercising the right of withdrawal under this article, the Customer must notify Cyber Guru in writing, with detailed and reasoned communication, of the alleged violation, attaching appropriate supporting documentation, and granting Cyber Guru a period of no less than sixty (60) days to remedy the indicated violation. Withdrawal will only take effect if Cyber Guru fails to remedy the violation in a demonstrable manner within this period and if no reasonable alternative solution can be found between the Parties. If there is no documentation proving the conditions for withdrawal, the withdrawal will be considered ineffective.

6.4 In any case, any suspensions, interruptions, or temporary limitations of services necessary for the implementation of security measures, regulatory compliance, legal obligations, or ordinary or extraordinary maintenance interventions shall not constitute grounds for withdrawal under this article.

7. SPECIFIC CUSTOMER OBLIGATIONS

7.1 The Customer guarantees that the Platform will be used exclusively as set out in these General Terms and Conditions, otherwise they will be liable for damages. Therefore, the Customer undertakes, among other things, to:

provide all authorized persons (Company Admin and Users) who will use the Service through the Platform with the necessary operating instructions, informing them, among other things, of the provisions of sections 4.1, 4.2, 4.3, 5.1, 5.3, 7.2, 9.1, 9.5, 10.1, 11.1, 13.5, and 13.6 of the General Terms and Conditions;

ensure that the above authorized persons using the Service and accessing the Platform comply with the General Terms and Conditions;

assume responsibility for any violations committed by such authorized individuals, promptly informing Cyber Guru of any misuse of the Platform or breach of the agreed obligations.

7.2 In particular, the Customer undertakes and guarantees that the Company Admin and each User:

access the Platform and Products exclusively in the manner prescribed by art. 4.3 and use them only for the purposes and in compliance with the General Terms and Conditions (by way of example and not limitation, they must not: modify, distort, block, abnormally overload, interrupt, slow down and/or hinder the normal functioning, in whole or in part, of the Platform or its components, nor limit its accessibility to other Users; transmit computer viruses or other software/malware or corrupted files and/or similar destructive devices or corrupted data; organize and/or participate in or be involved by any means in an attack against the Platform or the servers used by Cyber Guru; exchange spam messages for commercial or personal purposes, disrupting the flow of conversation with repeated posts of a similar nature; transmit or communicate material or content that may be considered offensive and damaging to the dignity and decorum of individuals, such as, for example, derogatory, explicit, illegal, threatening, or offensive language in any form; misuse the support service offered by Cyber Guru or misuse functions for requesting or sending false reports to Cyber Guru and its staff/collaborators; pretend to be an employee or representative of Cyber Guru, claiming to have authorization or privileges regarding the Platform or Cyber Guru) and applicable laws;

keep their credentials strictly confidential, without disclosing them to third parties, and take all necessary measures to prevent unauthorized access to their personal area, including choosing secure passwords and regularly updating them;

adopt appropriate security measures to protect User data, refraining from using User data for unauthorized or unlawful purposes (applies only to the Company Admin);

immediately notify Cyber Guru and the Customer of any unauthorized use of their credentials, any suspected security breach, or any attempt at unauthorized access to the Platform.

8. CHANGES, MONITORING, AND SERVICE UPDATES

8.1 Cyber Guru reserves the right to carry out security and maintenance activities on the Platform, including, but not limited to: updates, maintenance, troubleshooting, configuration to optimize the program, compatibility checks of system libraries, detailed log monitoring to detect any anomalies, and security checks. These activities are necessary to keep the Platform safe and functional and may result in the temporary suspension of the Service during the scheduled maintenance window as stated in art. 5.4. Furthermore, while Cyber Guru guarantees basic support for the entire duration of the Service, since this is a SaaS platform, in the event of changes or new feature releases, it cannot guarantee the maintenance of the previous version of the Platform.

9. INTELLECTUAL PROPERTY

9.1 The Customer acknowledges that everything included in the Service, including but not limited to the Platform and Products, is the exclusive intellectual property of Cyber Guru and that their use is permitted only within the limits set by the General Terms and Conditions. The Customer also acknowledges that Cyber Guru is the exclusive owner of all object code and source code of the Platform, as well as all elements, components, applications, versions, developments, updates, and software connected to or derived from the Platform that determine its originality, waiving any related dispute or right. Therefore, any form of plagiarism and/or counterfeiting of the Platform, unauthorized duplication—including both the unauthorized production of perfect copies of the program and the creation of programs derived from the development or modification of the original Platform—is prohibited. Likewise, the Customer is strictly prohibited from disassembling, reverse engineering, reproducing, plagiarizing, counterfeiting, altering, copying, exporting, accessing or attempting to access the Platform's source code, as well as creating, using, and/or distributing "auto," "trainer," "script," or "macro" computer programs or other "cheat" or "hack" programs or software applications for the Platform, and from performing total or partial decompilation (including both decompilation for interoperability and decompilation aimed at fixing software errors), which may only be carried out by Cyber Guru. As a result, except as expressly provided in the General Terms and Conditions, Cyber Guru does not grant any other rights or titles to the Platform and Products. The techniques, algorithms, and processes contained in the Platform, as well as in the related documentation, are confidential information owned by Cyber Guru and must remain strictly confidential and not be disclosed. All trademarks, registered or not, related to the Platform are protected by intellectual property rights.

9.2 The Customer authorizes Cyber Guru to use its logos and trademarks for the customization of the Platform used by the Customer.

9.3 The use of the Customer's logos and trademarks to promote the services and solutions provided by Cyber Guru is permitted only with the Customer's prior written authorization. This authorization extends to publication on Cyber Guru's official website, on social media platforms, during industry events, and also includes the right to reproduce and/or include the logo in communication and promotional materials.

9.4 The Customer guarantees full availability and the right to use such logos and/or trademarks and/or distinctive signs and undertakes to hold Cyber Guru harmless from any claims arising from third-party disputes regarding them.

9.5 Regarding the customization and configuration of content (including, but not limited to, simulated phishing campaigns or training materials) of the Products carried out directly by the Customer, the Customer agrees and acknowledges that:

they are solely responsible for the use of third-party logos, trademarks, and/or any other distinctive signs;

they must not include third-party intellectual property without their prior written consent;

they will not register or use, through the Platform, domain names or other distinctive signs that are identical to, incorporate, or are easily confused with third-party trademarks without their prior written consent;

in the event of complaints from third parties claiming that the Customer's activities have infringed their intellectual property rights, Cyber Guru will provide such third parties with the Customer's contact details to resolve the issue;

they will promptly respond to any complaint or report from third parties and simultaneously notify Cyber Guru in writing.

The Customer will indemnify and hold Cyber Guru harmless from any adverse effects (including damages) that Cyber Guru may suffer as a result of legal claims, damages, or demands arising from the customization and configuration of Product content carried out by the Customer.

10. SERVICE SUSPENSION

10.1 If the Customer fails to comply with even a single provision of the General Terms and Conditions (including, but not limited to, those set out in arts. 4, 7, 9 and/or 11), Cyber Guru reserves the right to immediately and temporarily suspend access to the Platform, after written notice. That said, except as provided in this article, Cyber Guru may grant the Customer a reasonable period of time, not less than 15 days, to remedy the breach. If the Customer does not remedy the breach within the specified period, Cyber Guru may proceed with the permanent termination of access to the Platform. Furthermore, Cyber Guru may suspend the provision of the Service at the request of the party to whom the Customer is required, under the Offer, to pay the Service fee, if notified of the Customer's failure to pay. In such cases, the suspension may last until all outstanding amounts are paid in full.

10.2 In the event of contract termination, the Customer must immediately cease using the Platform and, if the Platform has been installed on-premise on the Customer's infrastructure, proceed with its complete uninstallation, returning or destroying all copies in their possession.

11. CONFIDENTIALITY

11.1 Confidential Information. The Parties acknowledge that, in connection with this Agreement and/or the Service/Products/Training Modules, one Party may transmit Confidential Information to the other. For the purposes of this Agreement, the "Receiving Party" is defined as the Party receiving the Confidential Information, while the "Disclosing Party" is defined as the Party providing the Confidential Information.

11.2 Obligations. The Receiving Party agrees (i) to protect the Confidential Information from unauthorized disclosure and use, (ii) to use the Confidential Information only for the performance of this Agreement and the exercise of any rights granted under this Agreement, (iii) not to disclose any Confidential Information to persons who are not subject to confidentiality obligations at least as restrictive as those required by this Article 11, and (iv) not to remove or destroy any proprietary or confidential legend or marking placed on or contained in the Confidential Information. The Receiving Party must not copy, decode, disassemble, create derivative works from, or decompile prototypes, software, or other tangible objects that incorporate the Confidential Information and/or are provided to it under this Agreement. Confidential Information must not be reproduced in any form, except as required to fulfill the purposes and intent of this Agreement.

11.3 Exclusions. The above confidentiality provisions do not apply where the Receiving Party can demonstrate that the information or material: (i) was previously known to the Receiving Party at the time of disclosure, free from any obligation to keep it confidential; (ii) was, or subsequently became, public knowledge; (iii) was lawfully obtained from third parties who were not themselves subject to confidentiality agreements with the Disclosing Party. Each Party may also make disclosures only to the extent expressly required by law or resulting from a court order. In such cases, the Receiving Party agrees to promptly notify (for information purposes only) the Disclosing Party.

12. DATA PROCESSING

12.1 With reference to the provisions of Regulation (EU) 2016/679 (hereinafter "GDPR"), the Parties mutually acknowledge that the personal data collected by each in the execution of this Agreement (including personal data relating to the legal representative, contacts, and reference persons) will be processed in compliance with applicable law. In this regard, if the contractual relationship is entered into between Cyber Guru and the Customer, the Customer declares that they have read the privacy notice prepared by Cyber Guru in accordance with GDPR, art. 13 ("Privacy Notice").

The execution of this Agreement involves the processing of personal data relating to employees, collaborators, or other individuals identified by the Customer. To this end, the Parties acknowledge and declare that: The Customer acts as Data Controller, pursuant to art. 4, no. 7 of Regulation (EU) 2016/679 ("GDPR");

Cyber Guru acts solely as Data Processor, pursuant to art. 28 of the GDPR, following the documented instructions of the Controller and in accordance with the Data Processing Agreement, attached to this Agreement or signed separately;

For certain products, Cyber Guru may use external providers formally designated as Sub-Processors pursuant to art. 28, para. 4, of the GDPR.

13. WARRANTY AND DISCLAIMER OF LIABILITY

13.1 Cyber Guru undertakes to provide the Service to the Customer in accordance with art. 5.4 and only provides the warranties set forth in the General Terms and Conditions (expressly excluding warranties of merchantability and fitness for a particular purpose), except as required by mandatory law.

13.2 Cyber Guru shall not be liable for any damages (including, but not limited to, direct or indirect damages, loss of data, profits and/or business) caused to the Customer and/or the User and/or third parties arising from:

inability/discontinuity in accessing or using the Platform due to incompatibility with the hardware, connection, and software used by the Customer or end User, or due to failure to verify in advance the correct simultaneous functioning of different programs;

malfunctions, delays, and/or interruptions in the provision of the Service resulting from the use of telephone lines, electrical lines, and global and national networks, such as, for example: breakdowns, overloads, interruptions, as well as force majeure, unforeseen events, unpredictable events, and events caused by natural occurrences or third parties, such as: weather events, explosions, and generally unforeseeable hardware failures;

inability to access or malfunction of the Platform due to causes attributable to the Customer or User, such as incorrect use of the Platform or entering the wrong key and access code, or malfunction of the devices used by the Customer or User (PC, modem, and other equipment), or network malfunctions/issues, and finally, for any other issue not attributable to Cyber Guru's actions;

use of the Service for purposes other than those set out in the General Terms and Conditions;

any violation of art. 7 by the Customer, Company Admin, and/or User;

ordinary and/or extraordinary maintenance activities pursuant to art. 8.

13.3 In any case, Cyber Guru's liability to the Customer will be limited to the amount actually paid by the Customer for the provision of the Service.

13.4 Conversely, the Customer will indemnify and hold Cyber Guru harmless from any adverse effects (including damages) that Cyber Guru may suffer as a result of any third-party claims based on any breach by the Customer of one or more obligations assumed under the General Terms and Conditions.

13.5 The Customer acknowledges and agrees that if they purchase or use Cyber Guru Products that incorporate generative artificial intelligence technologies (including, but not limited to, “Cyber Advisor” and “Chatbot”), the results generated by these tools are probabilistic in nature, may contain errors, be incomplete, inaccurate, or misleading, and in no case constitute professional advice or binding guidance.

The Customer is solely and exclusively responsible for verifying, before use or sharing, the accuracy, adequacy, reliability, and suitability for use of the results generated by these tools, including through human review, and holds Cyber Guru harmless from any liability in this regard.

Cyber Guru shall in no event be held liable, under any circumstances, for decisions, actions, or omissions taken by the Customer or third parties based on content generated by artificial intelligence tools, nor for any damages, losses, costs, or expenses, whether direct or indirect, including but not limited to loss of data, lost profits, or business interruptions that may result.

13.6 The Customer acknowledges and agrees that if they purchase or use Cyber Guru Products designed to assist the User in recognizing potential risks or abnormal behaviors through warnings, alerts, or operational suggestions (including, but not limited to, tools such as “Smart Banner,” “Cyber Advisor,” or similar features), the information provided by these tools is purely informational and supportive in nature.

The assessments generated by these Products are based on automated and/or algorithmic analyses and do not constitute a certain or definitive verification of the reliability, origin, or security of the analyzed content or communications.

It remains the sole responsibility of the User and the Customer to independently verify the legitimacy and accuracy of the reported information or emails, as well as to take all precautionary and control measures required by their own internal security procedures, ensuring the full implementation of control and verification mechanisms conducted by human personnel.

Cyber Guru shall in no event be held liable for damages, losses, or consequences resulting from incorrect, incomplete, or missing qualification of content or communications by these Products, nor for exclusive or improper reliance on the information they provide.

14. APPLICABLE LAW AND JURISDICTION

14.1 These General Terms and Conditions are governed by Italian substantive law, excluding any reference to foreign laws (including those based on international law or treaties). For any dispute relating, among other things, to their interpretation, execution, validity, and/or termination, the Court of Rome shall have exclusive jurisdiction.

15. MISCELLANEOUS

15.1 Any addition or modification to the General Terms and Conditions (including related attachments) must be specifically approved in writing by both parties.

15.2 No term or clause of the General Terms and Conditions shall be deemed waived, and no breach shall be considered permitted, unless such waiver or consent is expressly made in writing.

Notice on Automatic Translations

These General Terms and Conditions are drafted in both Italian and English. Both versions are considered official and have equal legal value. Any versions in languages other than Italian and English, made available through automatic translation tools (including those integrated into digital platforms), are not considered official versions and have no legal value. Such translations are provided for informational purposes only.