Invoice and Payment Terms

1.1These terms apply to all invoices issued by Ciberseg to entrepreneurs, legal entities and public-law bodies (the “Customer”). They do not apply to consumers.

1.2Ciberseg’s customer is exclusively the reseller or managed service provider. There is no contractual and no billing relationship between Ciberseg and the Customer’s end customers.

1.3Conflicting or deviating purchasing or payment terms of the Customer do not become part of the contract, even if Ciberseg renders services without reservation while aware of them.

2.1In the event of conflict the following order of precedence applies: (a) the signed framework agreement; (b) the order form; (c) the service level agreement (SLA); (d) the data processing agreement (always prevailing for data protection matters); (e) these terms.

2.2These terms supplement and do not replace the documents listed above.

3.1Recurring managed services, in particular the 24/7 Managed SOC service, are invoiced monthly in advance.

3.2Time-and-materials work, incident-response effort exceeding the agreed retainer volume and project services are invoiced monthly in arrears.

3.3Volume-based charges (e.g. per endpoint, per user, per data source or per GB of logs) are calculated on the count recorded on the last calendar day of the preceding month. Increases are charged pro rata from the activation date; reductions take effect at the end of the current billing month unless the order form provides otherwise.

3.4Onboarding, set-up and migration fees fall due upon provisioning or acceptance, unless agreed otherwise.

4.1Invoices are delivered electronically as PDF to the billing e-mail address nominated by the Customer, who consents to electronic invoicing.

4.2The Customer shall notify changes to its billing address, e-mail, tax identification number and any required purchase-order references without undue delay in writing. The absence of a purchase-order reference not communicated in time does not affect the due date.

5.1All prices are net amounts in Euro (EUR), exclusive of applicable taxes, duties and charges.

5.2The agreed prices are wholesale prices intended exclusively for resale by the Customer in its own name and for its own account.

5.3Where invoicing is exceptionally made in Cape Verdean Escudo (CVE), the Banco de Cabo Verde reference rate as at the invoice date applies.

6.1Services supplied by Ciberseg to a taxable customer established outside Cape Verde constitute an export of services, exempt from IVA in Cape Verde under the IVA Code (Law 21/VI/2003). The invoice carries the applicable exemption mention.

6.2Where the customer is established in Germany, VAT is due from the customer in its own country under the reverse-charge mechanism, pursuant to § 13b of the Umsatzsteuergesetz (UStG). The Customer shall provide a valid VAT identification number and is responsible for correct taxation in its country of establishment.

7.1Ciberseg’s fees are not subject to withholding tax in Cape Verde. There is no double-taxation treaty between Cape Verde and Germany.

7.2If the law of any jurisdiction requires the Customer to withhold tax on payments due to Ciberseg, the amounts shall be grossed up so that Ciberseg receives the net amount it would have received absent such withholding, save to the extent the withholding is recoverable by the Customer. The Customer shall promptly provide official tax certificates.

8.1Invoices are payable in full, without deduction, within 14 calendar days of the invoice date.

8.2Payment shall be made exclusively by bank transfer to the account stated on the invoice, quoting the invoice number. Unconditional credit to Ciberseg’s account is decisive.

8.3Bank, transfer and correspondent-bank charges are borne by the Customer. Deductions on this account are treated as partial payment.

9.1Ciberseg’s bank details appear on each invoice. Ciberseg communicates changes to those details exclusively in writing, via the designated contact person.

9.2Before executing any payment, the Customer must verify any purported change of bank details by telephone, using the number recorded in the framework agreement. Payments to an unverified account do not discharge the payment obligation.

10.1Upon expiry of the payment period the Customer is in default without further reminder.

10.2During default, interest is payable at the legal rate applicable under article 559 of the Cape Verde Civil Code, or at the rate agreed in writing in the framework agreement. Ciberseg may additionally claim reasonable collection costs actually incurred and evidenced.

10.3If more than one invoice is overdue, Ciberseg may require advance payment or reasonable security for future services.

11.1If the Customer is in default with a not insignificant, undisputed amount for more than 30 days, Ciberseg may suspend the services in whole or in part following written notice of 10 days.

11.2Suspension does not extend to measures required to handle a security incident ongoing at the time of suspension and to hand over operational responsibility in an orderly manner.

11.3Suspension does not affect payment obligations for the suspension period to the extent the Customer is responsible for it. SLA availability commitments and service credits do not apply during a justified suspension.

12.1Objections to an invoice must be raised within 30 days of the invoice date in writing, specifying the disputed line items and the reasons.

12.2Undisputed portions remain payable on the original due date. The parties shall endeavour to resolve objections amicably within 15 business days; until then the disputed portion is suspended without interest.

12.3Failure to object within the period does not result in the loss of the Customer’s statutory rights.

13.1The Customer may set off only against undisputed or legally established counterclaims, and may exercise a right of retention only insofar as it arises from the same contractual relationship.

14.1Services outside the agreed scope — including change requests, forensic analysis, incident response beyond the agreed retainer volume, ad-hoc reporting and audit support — are charged on a time-and-materials basis at the rates of the applicable price list.

14.2Out-of-scope services require prior instruction in writing. In the case of an acute security incident, approval by the Customer’s nominated contact is sufficient and must be confirmed in writing without undue delay.

15.1Third-party licences, subscriptions and cloud resources procured for the Customer are passed through on the respective vendor’s terms, where applicable plus a handling fee.

15.2Vendor minimum terms, minimum quantities and notice periods apply correspondingly to the Customer; reductions during the committed term are excluded to that extent.

16.1Travel, accommodation and incidental costs for on-site services are charged against receipts and require the Customer’s prior approval. Travel time is charged at 50% of the agreed hourly rate.

17.1Ciberseg may adjust the prices for recurring services for the first time after 12 months of contract term, with 3 months’ prior notice, effective at the start of a contract year.

17.2Adjustments are based on demonstrable cost increases (personnel, licences, infrastructure) and are capped at 5% p.a. If an adjustment exceeds that cap, the Customer may terminate the affected order form within 30 days of receipt of the notice.

18.1Justified objections and SLA service credits are settled by credit note and offset against the next invoice; payout occurs only at the end of the contract.

18.2Advance payments for unused periods are credited pro rata upon ordinary termination, unless the order form provides otherwise.

19.1Prices, discounts and commercial terms are confidential and must not be disclosed to third parties; this does not apply to the Customer’s advisers or, to the extent required for resale, to aggregated pricing shown to end customers.

20.1Ciberseg may assign invoice receivables to third parties or use them for financing; the assignment is notified to the Customer and does not affect the defences the Customer may raise on the basis of the underlying contract.

20.2The Customer may assign rights under the contractual relationship only with Ciberseg’s prior written consent.

21.1Ciberseg processes the Customer’s billing and contact data as controller, for the purpose of performing the contract and complying with legal retention obligations.

21.2Processing of personal data in the course of service delivery is governed exclusively by the separate data processing agreement, under which Ciberseg acts as processor or sub-processor. These terms do not modify that agreement.

22.1The laws of the Republic of Cape Verde apply, excluding conflict-of-law rules. The competent forum is Mindelo, São Vicente, unless an arbitration agreement is agreed in the framework agreement.

22.2Amendments to these terms require written form. The invalidity of any provision does not affect the validity of the remaining provisions. The Portuguese version prevails; the English version is provided for ease of understanding.