Terms and Conditions of Service

This English translation is provided for convenience only. In the event of any discrepancy, the Spanish version prevails.

These Terms and Conditions of Service govern the provision of professional cybersecurity services by QUANTUMSEC S.L. to its clients. They are addressed exclusively to businesses, professionals and organizations (B2B relationships) and not to consumers.

They are supplemented by the Legal Notice, the Privacy Policy and the Cookie Policy of the website, and by the signed agreement or proposal for each project, which prevails over this document in the event of any discrepancy.

1. Identification of the service provider

• Company name: Quantumsec S.L.
• Tax ID (CIF): B19439413
• Registered office: C/ Trafalgar 52, esc. 2, 9D, 46023, Valencia (Spain)
• Email: contacto@quantumsec.es
• Phone: +34 960 730 013
• Registered with the Commercial Registry of Valencia (Registro Mercantil de Valencia).

2. Purpose and scope of application

2.1. Quantumsec provides professional offensive security and regulatory compliance services: penetration testing (pentesting), Red Team exercises, technical audits, code review, vulnerability assessment, cyber threat intelligence, social engineering, managed security, training, and support with regulations such as NIS2, DORA, the ENS (Spain's National Security Framework, Esquema Nacional de Seguridad), ISO 27001, the CRA and the AI Act.

2.2. The website www.quantumsec.es is for information purposes only. It is not an e-commerce platform: it does not allow services to be contracted, paid for or downloaded online. The forms, calculators and scoping sheets available on the website are guidance tools, and submitting them does not constitute an order, booking or contract.

2.3. These terms apply to every proposal issued by Quantumsec, unless the agreement signed with the client expressly provides otherwise.

3. Engagement process

Engagements are always formalized in writing and outside the website, in the following stages:

• 1. Initial contact. The client requests information by email, through the contact form or by booking a call. This entails no commitment for either party.
• 2. Scope definition. The subject matter of the work is defined: assets included, type of testing, depth, testing windows, restrictions and deliverables. This may draw on the scoping sheets published on the website.
• 3. Proposal. Quantumsec issues a written proposal setting out the scope, methodology, team, schedule, deliverables, price and financial terms.
• 4. Acceptance. The contract is concluded when the client accepts the proposal in writing (signature, electronic signature or express confirmation by email) and, where applicable, the services agreement and the non-disclosure agreement are signed.
• 5. Authorization of testing. Before any technical testing begins, the express authorization described in clause 6 is signed.
• 6. Execution and delivery. The work is carried out and the agreed reports are delivered, together with the results presentation session, if one has been agreed.

4. Prices and quotes

4.1. Prices are those set out in the accepted proposal. The website does not publish fixed rates: the price depends on the actual scope of each project.

4.2. The calculators and estimators published on the website provide indicative orders of magnitude for information purposes. They are not offers and are not binding on Quantumsec.

4.3. Unless otherwise stated, prices are expressed in euros and do not include VAT or any other applicable taxes, which will be charged in accordance with the regulations in force.

4.4. Proposals are valid for thirty (30) calendar days from their issue date, unless they state a different period.

4.5. Any extension of scope requested once the work has started will be documented and quoted separately before it is carried out.

5. Invoicing and payment

5.1. The payment method, invoicing schedule and applicable milestones are detailed in the accepted proposal. As a general rule, projects are invoiced by milestone or upon completion, and paid by bank transfer.

5.2. Unless otherwise agreed, the payment term is thirty (30) days from the invoice date, in accordance with Law 3/2004 establishing measures to combat late payment in commercial transactions.

5.3. Non-payment of an overdue invoice entitles Quantumsec to suspend the provision of the services and the delivery of pending reports, following written notice to the client, without prejudice to the late-payment interest applicable by law.

5.4. Quantumsec does not request or process payments through the website or by phone, and never asks for card details by email.

6. Prior authorization of security testing

6.1. Pentesting, Red Team, social engineering, technical audit and vulnerability assessment services involve intrusive testing of information systems. Quantumsec does not carry out any testing without the client's prior, express and written authorization, which defines the systems in scope, the addresses and domains affected, the testing windows and the excluded actions.

6.2. The client represents and warrants that it owns the systems subject to testing or holds sufficient authorization from their owner. Where the assets are hosted by third-party providers (cloud, hosting, SaaS), it is the client's responsibility to obtain, and provide evidence of, any permissions those providers require.

6.3. The client will designate a technical point of contact who is available during the testing and will provide the access, test credentials and environments committed to in the proposal.

6.4. Quantumsec will carry out the work in accordance with recognized industry methodologies (including, among others, OWASP, PTES, OSSTMM and any applicable CCN-CERT guides), avoiding destructive actions and stopping any test that puts the continuity of the client's service at risk.

7. Timelines and scheduling

7.1. The timelines set out in the proposal run from the time when the written acceptance, the authorization of testing and the effective availability of the necessary access and environments are all in place.

7.2. Delays attributable to the client (lack of access, unavailable environments, scope changes, unavailability of the point of contact) may lead to a rescheduling of the timeline, which will be communicated in writing.

7.3. Neither party shall be liable for any failure to perform arising from force majeure.

8. Deliverables and intellectual property

8.1. The usual deliverables are the technical report, the executive report, the details of the vulnerabilities with their severity and remediation recommendations and, where agreed, a subsequent verification of the fixes (retest) and a results presentation session.

8.2. The reports and results produced specifically for the client become the client's property once the agreed price has been paid in full, and the client may use them internally and before third parties to whom it must demonstrate its security (auditors, customers, insurers, regulatory bodies).

8.3. Quantumsec retains ownership of its methodologies, tools, templates, scripts and pre-existing or general know-how, which are not assigned to the client by virtue of the provision of the service.

8.4. Use of the client's name or brand as a commercial reference requires the client's prior and express authorization.

9. Confidentiality and data protection

9.1. All information to which Quantumsec has access during the provision of the services is strictly confidential, including the vulnerabilities identified. This obligation survives the termination of the contract.

9.2. The assigned personnel are bound by individual confidentiality undertakings.

9.3. Where the provision of the services involves the processing of personal data on behalf of the client, the parties will enter into the corresponding data processing agreement pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR). The processing of contact details provided through the website is governed by the Privacy Policy.

9.4. Reports and evidence are delivered through encrypted channels and retained for the agreed period, after which they are securely deleted.

10. Liability

10.1. Quantumsec provides its services with the professional diligence required and undertakes an obligation of means (a best-efforts obligation): a penetration test reflects the security posture of the in-scope assets during the testing window and cannot guarantee the complete absence of vulnerabilities, whether present or future.

10.2. Implementation of the recommended remediation measures is the client's responsibility.

10.3. Except in cases of willful misconduct or gross negligence, and to the extent permitted by applicable law, Quantumsec's total liability for any claim arising from the contract is limited to the amount actually paid by the client for the service giving rise to the claim.

10.4. Quantumsec shall not be liable for loss of profits or for indirect or consequential damages.

11. Modification, cancellation and termination

11.1. Any modification of the agreed scope must be recorded in writing and accepted by both parties.

11.2. Cancellation by the client of an already scheduled project with less than seven (7) calendar days' notice before the start date may give rise to invoicing of the preparatory work already carried out and of the team reservation, under the terms set out in the proposal.

11.3. Either party may terminate the contract for serious breach by the other party, following written notice and a cure period of fifteen (15) calendar days. In that case, the work actually performed up to that date will be settled.

12. Right of withdrawal

Quantumsec's services are provided exclusively to businesses, professionals and organizations in the course of their economic activity. As there is no consumer relationship, the right of withdrawal provided for in Royal Legislative Decree 1/2007, approving the consolidated text of the General Law for the Protection of Consumers and Users (Ley General para la Defensa de los Consumidores y Usuarios), does not apply. Cancellation of services is governed by clause 11.

13. Communications

Communications between the parties relating to the performance of the contract will be sent by email to the addresses designated in the proposal. Quantumsec's general contact address is contacto@quantumsec.es.

14. Governing law and jurisdiction

14.1. These Terms and Conditions of Service are governed by Spanish law, in particular Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE), the Spanish Commercial Code (Código de Comercio) and the Spanish Civil Code (Código Civil).

14.2. For the resolution of any dispute, the parties expressly submit to the Courts and Tribunals of the city of Valencia, waiving any other jurisdiction to which they may be entitled.