General terms and conditions DigiTrust B.V.

1. Definitions

The term "Services" means all services provided by DigiTrust to the customer;
"Agreement " means the agreement for the provision of the Services including all attachments thereto.

2. The Services

Through the Services, only compliance with the applicable norm(s) or standard(s) expressly agreed in writing with the customer is assessed.

3. Additional work

DigiTrust reserves the right to charge a fee for all additional work agreed in addition to that originally stated in the quotation.

If there is extra work in addition to the amounts included in the quotation, DigiTrust will notify the customer. The situation regarding this, the associated costs and the reasons for the extra work will be communicated to the customer and the customer must give formal approval. Only after consultation and agreement will the extra work be scheduled. After completion of the work, it will be invoiced in accordance with the initially agreed rate.

4. Invoicing and payment terms

The fees for performing the Services are listed under "Fee" in the offer.
Reasonable costs incurred by DigiTrust in performing the Services, which are not mentioned in the "Fee", will be paid by the customer after consultation. See also Article 3 of these General Conditions in this respect.
DigiTrust reserves the right to increase its rates annually by an amount not exceeding 10% of the last rate charged. In such a case, DigiTrust will notify the customer. Upon receipt of such notification, the customer has the right to terminate the Agreement. This right to terminate the Agreement by the customer expires if the customer does not exercise this right within 30 days of written notification from DigiTrust. In that case, the customer is deemed to accept the increase;
The reference date is the date on which tariffs were most recently set. Tariff changes take effect on 1 January.
Invoices should be paid promptly within 30 days of the invoice date. Invoices are sent to the customer after each visit by DigiTrust.
DigiTrust makes arrangements in consultation with the customer regarding the dates for the certification process and reserves the right to charge the full fee for the originally booked visit if the customer does not cancel in time or does not have the required information, documentation and processes complete.
DigiTrust reserves the right to charge commercial interest at the applicable statutory rate on amounts unpaid for more than 30 days, as well as any legal or collection costs if applicable, and may halt performance of any Service or all Services until overdue payments including interest and any collection costs are paid.

If timely payment of an invoice is not made, DigiTrust will first send a reminder to the customer before commercial interest is charged.

An application fee (if applicable) will be invoiced upon receipt of the signed Agreement. Additional accreditation and/or regulation fees are invoiced on an annual basis. Please note that all outstanding fees and charges must be paid before the certificate is issued.
Failure to pay the invoice on time, may lead to suspension of the certificate

5. Cancelling or rescheduling appointments

If, on its own initiative, the customer cancels the appointment within forty (40) working days prior to an agreed appointment for performance of the Services or wishes to reschedule the appointment, DigiTrust is entitled to charge fifty per cent (50%) of the budgeted cost for these Services.

If, on its own initiative, the customer cancels the appointment within 20 working days prior to an agreed appointment to perform the Services or wants to reschedule the appointment, DigiTrust is entitled to charge one hundred per cent (100%) of the budgeted costs for these Services.

The results of a phase 1 assessment may give rise to:

Repeating the phase 1 assessment;
Moving the phase 2 audit:
If the phase 2 audit needs to be rescheduled due to the results of the phase 1 assessment, the above deadlines and cancellation conditions will apply.

Official Dutch holidays will be not counted as a working day. This provision shall remain in force even after termination of the Agreement.

6. Customer obligations

The customer declares:

that it will grant DigiTrust and its accreditation bodies access to the information and facilities necessary to provide the Services, including permission for regulators to attend the audit to review the activities of relevant DigiTrust employees. If supervisors are present during a visit, DigiTrust will ensure that their role in the visit is clearly communicated and will not affect the audit process or the outcome of the audit.
That it will maintain its management system(s) in accordance with the relevant standard(s).
that it complies with DigiTrust's rules applicable to the use of its trademarks

for management systems and will comply with the logos of its accreditation body. DigiTrust will provide this procedure to the customer together with the Agreement and these General Terms and Conditions. Monitoring visits will verify that the trademarks and logos are used appropriately.

that it will notify DigiTrust of changes to the approved management system if they are likely to affect the management system's compliance with the stated criteria and approvals issued under this Agreement prior to the changes.
That it will inform DigiTrust if the organisation has been involved in a serious data breach reported to the Personal Data Authority.
That it enables DigiTrust to schedule its surveillance audits in a timely manner. Failure to schedule a monitoring audit in the right period/cycle may result in suspension of the certificate.

The Customer is obliged to provide DigiTrust's assessors with a safe workplace and suitable protective equipment. This duty relates to workplaces under the Customer's control. Travel restrictions for high-risk countries, or specific corona guidelines, apply to DigiTrust employees under this agreement. These may result in the postponement of visits or conducting the audit through TEAMS.

The Customer is required to notify DigiTrust as soon as it becomes aware of a breach of an applicable legal requirement that may (if identified by or reported to the regulator) result in prosecution by a regulatory authority or a legally enforceable notice to improve or discontinue a process or activity related to the certified management system. DigiTrust will review the details of breaches brought to its attention and may choose to conduct additional verifications at the customer's premises to ensure compliance with the specified requirements.

DigiTrust reserves the right to suspend or revoke certificates of approval/verification statements and assessments if DigiTrust or the relevant regulator has not been informed of such violations.

7. Certificate and complaints

The certificate of approval is valid from the original approval date, subject to the findings of subsequent visits, as set out in the service offer(s), showing that they were satisfactory. The certificate remains the property of DigiTrust. When the approval has expired or is revoked, it is the customer's obligation to destroy the certificate and any electronic or hard copies thereof.

In the event of complaints against the customer within the scope of the services of this Agreement or if the customer informs DigiTrust of significant changes that are likely to cause the management system to fail to meet the stated criteria and approvals issued under this Agreement, DigiTrust shall have the right to visit the customer to investigate the complaint or assess the changes that have occurred. The fees payable for these visits shall be DigiTrust's daily rate at the time of the visit.

In the event of complaints against the customer within the scope of the services of this Agreement which, after investigation, are found to be founded, DigiTrust will take one or some of the following actions:

require the customer to take corrective action within a specified time;
suspend the certificate and require the client to take corrective action within a specified time;
revoke the certificate if the required corrective action has not been taken within the specified time; or
withdraw the certificate in case of very serious complaints, where corrective actions are not considered appropriate and are not specified.

DigiTrust may, at its discretion, refuse to issue or revoke a certificate or report if a fee has not been paid.

8. Confidentiality

DigiTrust, its officers, employees and auditors declare that they will treat information obtained from the Customer in connection with performance of the Services as confidential and will not use or disclose to any third party without the Customer's consent, unless it is necessary for the provision of the Service in accordance with the provisions of this agreement or required by law. If DigiTrust is required by law to disclose confidential information to a third party, the affected Customer or individual will be notified in advance of the information being provided, unless otherwise required by law.

The above confidentiality is to be maintained during and after the term of this agreement, with the exception of:

information already available to DigiTrust prior to disclosure by the customer;
publicly known information;
information provided to DigiTrust by a source independent of the customer;
information to be provided to obtain or maintain DigiTrust's Accreditation.

9. Liability

If the customer suffers damage or incurs costs which are proven to have been caused by an attributable failure of DigiTrust, its officers, employees or auditors in the

performance of the Services, DigiTrust shall be liable for proven direct damage up to the amount of €125,000 (one hundred and twenty-five thousand euros).

If DigiTrust suffers damage or incurs costs that are proven to be caused by an attributable shortcoming of the Customer, its officers, employees or agents in the execution of the Services, the Customer is liable for proven direct damage up to the amount of €125,000 (one hundred and twenty-five thousand euros).

10. Indemnification

The Customer agrees to indemnify DigiTrust against losses suffered by or claims brought against DigiTrust as a result of the Customer's misuse of any representations, confirmations, approvals, certificates or licences to use any accreditation mark that may be granted by DigiTrust under this Agreement.

11. Exclusion of third party rights

Nothing in these terms creates any rights in favour of persons who are not parties to the Agreement with any DigiTrust entity.

12. Force majeure

No claim may be made by either party for any default or omission that could be considered a breach of this Agreement if the cause of the default or omission is reasonably beyond the control of either party.

13. Customer conditions

Terms used by the customer are hereby expressly rejected and shall in no way apply to this Agreement or any future agreement with DigiTrust.

14. Modification of conditions

Additions, modifications or substitutions to these terms shall only be binding on DigiTrust, or form part of the Agreement, if expressly accepted in writing by an authorised representative of DigiTrust. In the event of any conflict between the terms of this Agreement and any document purporting to make other terms applicable to the Agreement, the terms of this Agreement shall prevail.

15. Notification of changes by a customer

The Customer must immediately notify DigiTrust of matters that may affect the management system's ability to meet the requirements in the standard used for certification on an ongoing basis. These include, for example, changes relating to:

the legal form, commercial status, organisational form or ownership;
organisation and management (e.g. key personnel in leadership, decision-making or technical positions);
contact address and branches;
the scope of the certified management system; and
significant changes to the management system and/or processes.

16. Termination of the agreement

The Agreement enters into force on the date of written acceptance of the offer by the customer and continues until the end of the certification period.
If the customer wishes to terminate the agreement mid-term, we apply a 30-day notice period. The termination must be submitted to DigiTrust in writing.
On the termination date, any certificate issued under the terms of this agreement shall immediately become invalid and must be destroyed by the customer.
If the customer, wishes to transfer the ongoing certification to another certification body, DigiTrust will cooperate.
If the Agreement is terminated by DigiTrust or the customer, the services delivered up to that point shall be invoiced pursuant to the Agreement. Any reasonable costs directly attributable to premature termination and all amounts then payable by the customer to DigiTrust shall become immediately due and payable.
The estimated audit costs involved in follow-up audits, which are included in the contract and have not yet been performed at the time of termination, will not be charged.
After the termination of this agreement in accordance with Article 16, regardless of the cause thereof, those articles which by their nature are intended to do so shall remain in force, which in any case includes Articles 5, 8, 10, 11 and 17 of these terms and conditions.

17. Applicable law and dispute resolution

Dutch law applies to this Agreement. All disputes arising at any time between DigiTrust and the customer in connection with this Agreement or the Services must be submitted to the District Court in Arnhem. Nothing in this provision limits DigiTrust's right to institute collection proceedings against the customer in another competent court.

Version 01-2023