Terms of service
Last updated: 2026-09-15
1. Definitions
In these terms, the following definitions apply:
- Client: The natural person or legal entity that engages CivSec S.M.A.R.T B.V. for services as described in a Quote.
- Service Provider: CivSec S.M.A.R.T B.V., registered at the Dutch Chamber of Commerce under number 98045768.
- Services: All services provided by the Service Provider, including but not limited to website development (including webshops built on Shopify), custom software development, mobile app development, AI and automation, security testing, maintenance, support and hosting, AI strategy consulting, and the Digital Partner plan.
- Deliverables: All tangible and intangible outputs created by the Service Provider as part of a Project.
- Project: A defined scope of work as described in an accepted Quote.
- Package: A predefined service offering with a fixed scope and deliverables as described on the website. Pricing is specified in the Quote.
- Add-on: An additional service or feature that may be added to a Package via a Quote.
- Retainer: An ongoing monthly service agreement for Maintenance and Support, AI Ongoing, or AI Advisory services.
- Quote: A written proposal issued by the Service Provider specifying scope, pricing, timeline, and terms for a Project.
- Acceptance Period: The period of 10 to 15 business days during which the Client reviews Deliverables on a staging environment.
2. Applicability
These terms apply to all services provided by CivSec S.M.A.R.T B.V. Any terms or conditions submitted by the Client that conflict with these terms are hereby rejected, unless explicitly agreed in writing by the Service Provider.
3. Quotes and agreement
Quotes issued by the Service Provider are valid for 30 calendar days from the date of issue. An agreement is formed upon the Client's written acceptance of the Quote (including acceptance via email). The scope of the Project is defined in the accepted Quote. Any changes to scope require written agreement and may affect pricing and timeline.
4. Scope of services
The Service Provider offers the services described on its website (civsecsmart.com). The following are explicitly excluded from all services:
- Gambling, casino, or betting platform development
- Adult content platform development
- Illegal services or services that violate applicable law
- Building new websites on template or low-code platforms (including Wix, Squarespace, Webflow, and WordPress). Maintaining, hosting and supporting existing websites on those platforms is available under Maintenance, support and hosting and under the Digital Partner plan.
Webshops are delivered on Shopify, where the Service Provider is a Shopify Partner. Shopify's own terms and fees apply to the Client's Shopify subscription.
5. Payment terms, project payment
For project-based services, the following payment structure applies:
| Project value (EUR equivalent) | Payment structure |
|---|---|
| EUR 5,000 to EUR 15,000 | 50% upon agreement, 50% upon approval and file transfer |
| EUR 15,000 and above | 40% upon agreement, 30% at agreed milestone, 30% upon approval and file transfer |
The final payment is linked to the Client's approval and file transfer, not to the launch or publication of the Deliverables.
6. Payment terms, retainer services
Maintenance and Support, AI Ongoing, and AI Advisory services are billed monthly. No surcharge applies to retainer services.
7. Late payment
In the event of late payment, the Service Provider is entitled to charge statutory interest as defined under Dutch commercial law, to suspend ongoing work until payment is received, and to retain Deliverables that have not yet been delivered or that are still within the Acceptance Period. Deliverables already in production, and the Client's access to the domain, DNS, hosting, repository and analytics, are never withheld and are transferred on request regardless of any dispute.
8. Client obligations
| Deliverable | Deadline | Consequence of delay |
|---|---|---|
| Content (text, images, assets) | 5 business days before design start | Project timeline shifts accordingly |
| Design feedback | 5 business days after design presentation | Project timeline shifts accordingly |
| Revision feedback | 5 business days per revision round | Additional revision rounds may be billed |
| UAT/acceptance | 10 to 15 business days after staging delivery | Silent acceptance after deadline |
9. Delivery and acceptance
Upon completion of internal quality assurance, the Service Provider delivers the Project to a staging environment. The Client has 10 to 15 business days to review and test the Deliverables. If the Client does not provide written feedback or rejection within the Acceptance Period, the Deliverables are considered approved. Revision rounds beyond those included in the Package are billed at the applicable add-on rate.
10. Intellectual property
Intellectual property rights to a Deliverable transfer from the Service Provider to the Client upon payment of the invoices relating to that Deliverable. Where a Project is invoiced per phase, rights transfer per Deliverable as it is paid. This transfer is documented in a written deed.
Exceptions: In Germany, due to §29 of the German Copyright Act (Urheberrechtsgesetz), copyright assignment is legally not possible. The Client receives an exclusive, perpetual, irrevocable license. In Switzerland and the Netherlands, a written IP transfer deed is legally required.
Client data (including personal data processed during the Project) is always the property of the Client. The Service Provider facilitates data export regardless of payment status, in compliance with GDPR Article 20.
11. Hosting
For project-based services, hosting is the responsibility of the Client. The Service Provider performs the initial hosting setup as part of the Package, in the Client's name or in an account of the Service Provider, as agreed. Under Maintenance, support and hosting or the Digital Partner plan, the Service Provider may host and manage the environment on its own infrastructure or manage the Client's existing hosting. The hosting and the associated accounts are managed by the Service Provider or by the Client, as agreed per engagement; in both cases access transfers to the Client on request, in accordance with clause 8.
| Provider | Typical cost | Used for |
|---|---|---|
| Cloudflare | See the provider's current pricing | DNS, caching and protection in front of the site |
| Vercel | USD 0 to 20 per seat per month | Website, custom software and app hosting |
| Neon PostgreSQL | USD 0 to 5 per month (Launch plan) | Database hosting |
12. SLA and support
| Maintenance, support and hosting plan | Response time | Support hours |
|---|---|---|
| Foundation | Within 24 business hours | CET Monday to Friday 9:00 to 18:00 |
| Growth | Within 8 business hours | CET Monday to Friday 9:00 to 18:00 |
| Scale | Within 4 business hours | CET Monday to Friday 8:00 to 20:00 |
13. Quality standards at delivery
For websites the Service Provider codes itself, the following values are the performance standard applied at delivery, measured in a lab on the delivered site before launch, in a Lighthouse mobile run: Largest Contentful Paint of 2.5 seconds or less, Cumulative Layout Shift of 0.1 or less, and Total Blocking Time of 200 milliseconds or less. Interaction to Next Paint is not part of this standard: it is defined as a percentile of interactions by real visitors, so it cannot be established before a site has visitors. These values are not warranted after launch, because they depend on content, third-party scripts and hosting changes made afterwards. For webshops built on Shopify, performance also depends on the theme, third-party apps and content chosen by the Client; the Service Provider optimises what it controls and these values do not apply to Shopify stores. Projects are tested against WCAG 2.2 AA and for cross-browser compatibility before delivery.
14. Upgrade path
After 6 months on a Maintenance and Support tier, the Client may upgrade to a higher tier. The investment in the current tier is credited toward the new tier.
15. Confidentiality
Both parties agree to treat all non-public project information as confidential. The Service Provider may include the Client's project in its portfolio unless the Client objects in writing prior to publication.
16. Liability
The Service Provider's total liability for any claim arising from or related to a Project is limited to the total value of that Project. The Service Provider is not liable for indirect, consequential, special, or incidental damages. Neither party is liable for delays or failures caused by circumstances beyond reasonable control (force majeure).
17. Termination
Either party may terminate the agreement by written notice. Upon termination, the Client is responsible for payment of all work completed. Intellectual property for paid work transfers to the Client. Retainer services require 30 days written notice.
18. Applicable law and disputes
These terms are governed by Dutch law, regardless of the Client's country of residence or operation. Any disputes will be submitted to the competent court in The Hague, the Netherlands.
19. Excluded countries and industries
The Service Provider does not accept projects from or connected to Russia, from active conflict zones, or from sanctioned entities. The Service Provider does not accept projects in: gambling or casino platforms, adult content platforms, and any service that violates applicable law.
20. Guarantees
The Service Provider guarantees the following, and provides the remedy stated with each. The remedy is work, not a payment.
(a) Transfer of access. On written request, whether or not the agreement has been terminated, the Service Provider transfers the DNS zone, the hosting project, the repository and the analytics property into accounts in the Client's name, and ends its administrative role on the Client's domain, at no charge and regardless of any dispute, in accordance with the final sentence of clause 8. The actions performed by the Service Provider are completed within five business days of the request. Waiting periods imposed by a registrar, platform or receiving party fall outside this period; the Service Provider names them in writing at the time of the request.
(b) Defects after delivery. For six months following acceptance under clause 10, the Service Provider remedies, at no charge, any defect in the Deliverables it built. A defect means that the Deliverables do not do what the accepted Quote describes. Anything not described in the accepted Quote is a change and is quoted separately. This guarantee concerns conformity at delivery. It does not cover ageing dependencies, changes in browsers, changes made by third parties, or vulnerabilities newly discovered in packages after delivery; those are maintenance and are a separate service. It does not apply to parts of the Deliverables that have been modified by the Client or by a third party.
(c) Quality standards at delivery. Where the values in clause 14 apply, the Service Provider works, at no charge, until those values are met on the delivered site at delivery, and at the delivery of any significant change made by the Service Provider. It does not apply where the values are affected by content, scripts, apps or other changes made by the Client or by a third party.