General Terms and Conditions of Phishnoo

Version 2025-06

These Terms and Conditions apply to all offers, agreements, and services provided by Phishnoo, established at:

Phishnoo
K.P. van der Mandelelaan 41-43
3062 MB Rotterdam
The Netherlands
info@phishnoo.com
+44 (0) 20 34 33 1777

1. Definitions

Phishnoo: The private company with limited liability Phishnoo B.V., the service provider.
Client: Any natural or legal person entering into an agreement with Phishnoo.
Agreement: Any contract between Phishnoo and the Client for the provision of services.
Services: All products and services provided by Phishnoo, including but not limited to phishing simulations, e-learning modules, reporting dashboards, and support.
Written: Includes communication via email or other digital means.

These general terms and conditions apply to all quotations, agreements, and service provisions between Phishnoo and the Client.
Deviations from these conditions are only valid if explicitly agreed upon in writing.
The Client’s own general terms and conditions are expressly excluded.

All offers from Phishnoo are non-binding unless explicitly stated otherwise.
Agreements come into effect once the Client accepts an offer in writing, or once Phishnoo has commenced the provision of services.
Any additional work requested by the Client that is not part of the original agreement will be invoiced separately.

Agreements are entered into for the duration specified therein. If no duration is stated, the default term is 12 months.
Unless terminated in writing at least one month before expiry, agreements will automatically renew for successive 12-month periods.
Either party may terminate the agreement with immediate effect in the event of:
- material breach not remedied within 14 days of notice;
- suspension of payments or bankruptcy;
- cessation of business activities.

All prices are exclusive of VAT and other levies imposed by authorities.
Invoicing occurs annually in advance unless agreed otherwise.
Payment must be made within 30 days of the invoice date.
If payment is late:
- statutory commercial interest (wettelijke handelsrente) shall apply;
- Phishnoo may suspend service delivery;
- All collection costs, both judicial and extrajudicial, are borne by the Client.

The Client will provide Phishnoo with all necessary data and cooperation to perform the agreement effectively and securely.
The Client is responsible for the legality of the email addresses and personal data uploaded into the platform.
The Client will ensure its users are adequately informed about the nature of the phishing simulations and training.

Phishnoo shall make reasonable efforts to ensure continuous availability and proper functioning of its services.
Planned maintenance will be announced in advance where possible.
Phishnoo is not liable for interruptions caused by external infrastructure, third-party platforms, or force majeure.

All intellectual property rights related to the software, content, and materials provided by Phishnoo remain with Phishnoo or its licensors.
The Client receives a non-exclusive, non-transferable license to use the services for internal business purposes during the term of the agreement.
The Client may not copy, distribute, modify, reverse-engineer, or create derivative works based on Phishnoo’s services without written consent.

Both parties agree to maintain the confidentiality of all information marked as confidential or that should reasonably be considered confidential.
Confidentiality obligations continue to apply for three (3) years after termination of the agreement.

Phishnoo processes personal data in accordance with the GDPR and Dutch privacy legislation.
If Phishnoo processes data on behalf of the Client, a data processing agreement (verwerkersovereenkomst) shall be entered into.
The Client is responsible for ensuring a lawful basis for processing end-user data within its organization.

Phishnoo’s total liability arising from any agreement is limited to the total amount paid by the Client in the 12 months preceding the event giving rise to the liability.
Phishnoo is not liable for indirect or consequential damages, including loss of profits, data loss, or reputational harm.
The Client indemnifies Phishnoo against third-party claims resulting from the Client’s unlawful use of the services or breach of the agreement.

Phishnoo is not liable for delays or non-performance caused by circumstances beyond its reasonable control, including but not limited to cyberattacks, natural disasters, or legal restrictions.
If force majeure lasts longer than 30 days, both parties may terminate the agreement without liability.

All agreements are governed by Dutch law.
Disputes shall be submitted exclusively to the competent court in Rotterdam, unless mandatory law provides otherwise.

If any provision of these terms is found invalid, the remaining provisions remain in effect.
Phishnoo reserves the right to amend these terms. Updates will be communicated to the Client in writing or via the platform at least 30 days before taking effect.