Legal Notice and Data Management Policy

Company Identity

SecOps Forces ("SecOps Forces") is a simplified joint-stock company registered in the Marseille Trade and Companies Register under the number 941 434 615, with its registered office at 4 Boulevard Saade, Quai Arenc Tour Le Mirabeau – 13002 MARSEILLE.

Purpose

Forces develops and makes available to its client (the "Client") a SaaS solution (the "Solution") accessible through the platform https://app.secopsforces.com (the "Platform") designed to enhance cybersecurity posture, addressing various vulnerabilities, primarily by providing the following services (the "Services"):

• Orchestrating phishing and security awareness training campaigns to educate and strengthen internal teams against engineering threats;
• Protecting brand reputation and security standards by proactively identifying and mitigating risks;
• Preventing identity theft and impersonation through advanced monitoring and protective measures.
• Monitoring and assessing public-facing IP addresses and detect lookalike or typosquatted domains that could be used in phishing or impersonation attacks.
• Conducting thorough audits of Microsoft 365 services and Active Directory configurations to ensure they align with security best practices.
• Producing KPI dashboard focused on email protection (Microsoft Defender for Office 365, Mimecast), identity security (Microsoft Entra), and endpoint protection (Microsoft Defender for Endpoint). This dashboard provides clear visibility into threats, detection rates, policy effectiveness, helping security teams track performance and prioritize actions efficiently.

Contractual Documents

The contractual relationship between the Client and SecOps Forces is governed, in descending hierarchical order, by the following documents:

If applicable: The quotation (the "Quotation")

The terms and conditions (the "Terms and Conditions")

They define:

• It is established on the basis of needs of the Client;
• The Client must accept it in writing (including by email) within 30 days of its issue. This acceptance implies acceptance of the Terms and Conditions in their version in force at the date of the Quotation;
• In the event of contradiction, the Quotation shall prevail over the Terms and Conditions;
• In the event of contradiction, the most recent Quotation shall prevail over the oldest one (s).
• The terms of use of the Services;
• The respective obligations of the parties.

Hierarchy with the Payment Service Provider's Terms of Service

All payments made through the Platform are handled by the payment service provider indicated on the Platform (the "Payment Service Provider").

The Client will contract directly with the Payment Service Provider for implementation of these payments by accepting its terms and conditions, by ticking a box on the Platform.

If the Payment Service Provider rejects or terminates the Client’s subscription, the Client may not use the Services.

Conversely, termination of the contractual relationship between the Client and SecOps Forces will result in termination of the Client’s contract with the Payment Service Provider.

In the event of any contradiction between the Payment Service Provider's general terms and conditions and the Terms and Conditions, the latter shall prevail.

The Client expressly mandates SecOps Forces to transmit to the Payment Service Provider all instructions relating to payments made on the Platform.

Conditions of Access to the Services

In order to access the Services, the Client must meet the following cumulative conditions:

(i) The Client is a legal entity acting through a natural person with the power or authorization required to contract in the Client's name and on its behalf;

(ii) The Client is a professional, defined as any individual or legal entity acting for purposes relating to its commercial, industrial, artisanal, liberal or agricultural activity, including when acting in the name or on behalf of another professional.

Access and Subscription to the Services

The Client may subscribe the Services from two available options.

SecOps Forces remains free to refuse any subscription request for the Services, in particular if the Client does not meet the conditions set out in the article "Conditions of Access to the Services"or if the Services prove to be incompatible with the Client's needs.

Direct Subscription to the Services with SecOps

The Client must contact and exchange with SecOps Forces, by any written or oral means, concerning the Services to which he wishes to subscribe. This exchange may also occur following an appointment scheduled by the Client on the Platform, via the dedicated button.

During the exchanges between the parties, SecOps Forces will present the Solution and associated Services to the Client and will consider the Client's needs in order to issue the Quotation accordingly.

SecOps Forces will send the Quotation to the Client. Upon receipt by SecOps Forces of the Quotation duly completed and signed by the Client, SecOps Forces will provide the Client with a link to create its account (the “Account”) and access the Solution.

Registration on the Platform

The Client must fill in the form provided for this purpose on the Platform.

Registration for the Services shall conclude with the booking of an appointment with SecOps, which will enable SecOps Forces to onboard the Client and allow him to access its Account and the Services using its login and password.

Once the Account has been created, the Client may freely create accesses for users (the "Users") up to the number provided for in the subscribed Services.

The Client remains solely responsible for creating access for Users, for setting their access rights and for their personal use of the Solution and the Services.

The Services

Description of the Services

SecOps Forces provides a 360-degree approach to email vulnerability and security, empowering the Client to opt-in for a full spectrum of protective services. SecOps Forces offerings are designed to fortify the Client’s defenses and cultivate a resilient cybersecurity posture, including:

All these services are supported by comprehensive KPIs and Dashboards, providing clear visibility into the Client’s security posture.

The Client acknowledges that the Services require an Internet connection and that the quality of the Services depends on this connection, for which SecOps Forces is not responsible. The Client also acknowledges that in order to benefit optimally from the Solution and the Services, it must be equipped with:

All the Services available to the Client are detailed on the Platform.

The Services that the Client has actually subscribed to are listed on the Platform, on its dashboard, and if applicable in the Quotation.

SecOps Forces reserves the right to offer any other Service.

Subscription to new Services may be initiated directly by the Client on the Platform. The Client acknowledges and agrees, however, that while an upgrade from one Services subscription plan to a more premium plan may be performed by the Client on the Platform at any time, a downgrade from a premium subscription plan to a less expensive subscription plan is not permitted during the term of the current subscription plan.

• Brand Protection & Email Authentication: a Service focused on safeguarding the Client’s brand reputation and upholding security standards. This includes preventing email-based identity theft, enabling the Client to prove the legitimacy of its email senders, and rejecting non-compliant emails;
• User Awareness & Training: SecOps Forces conducts targeted phishing and security awareness training campaigns to educate and empower the Client’s employees;
• External Vulnerability Scanning: SecOps Forces proactively identify external vulnerabilities by scanning the Client’s domain names (NDM) and IP addresses;
• Audit & Configuration Services: SecOps Forces offers expert audit and configuration services to assist with the implementation of cybersecurity best practices.
• A device equipped with a compatible operating system (such as Windows, macOS, Linux, or Chrome OS);
• An up-to-date web browser (such as Google Chrome, Mozilla Firefox, Microsoft Edge, or Safari) and a stable high-speed Internet connection.

Additional Services

Maintenance of the Solution

For the duration of the Services, the Client benefits from maintenance of the Solution, in particular corrective and evolutionary maintenance. In this context, access to the Solution and/or the Platform may be limited or suspended.

Concerning corrective maintenance, SecOps Forces makes its best efforts to provide the Client with corrective maintenance in order to correct any malfunction or bug found in the Solution.

Concerning evolutionary maintenance, the Client benefits for the duration of its subscription from evolutionary maintenance, which SecOps Forces may carry out automatically and without prior notice, and which includes improvements to the functionalities of the Solution, and the addition of new functionalities and/or technical installations used within the framework of the Services (aiming to introduce minor or major extensions).

Access to the Solution may also be limited or suspended for planned maintenance purposes, which may include the above-mentioned corrective and evolutionary maintenance operations.

Hosting

SecOps Forces ensures, under the terms of an obligation of means, the hosting of the Solution, as well as the data produced and/or entered by/on the Solution, directly by the Client, through the intermediary of a professional hosting provider.

Technical Support

In the event of any difficulty encountered when using the Services, the Client may contact SecOps Forces at the following address: support[@]secopsforces.com

The technical support service is available from Monday to Friday, excluding public holidays, from 9 am to 6 pm. Depending on the need identified, SecOps Forces will estimate the response time and keep the Client informed.

Term of the Services

The Client subscribes to the Services on a subscription plan basis.

The subscription begins on the date and for the initial period indicated on the Platform or, if applicable, in the Quotation, provided that:

The term of the Services is tacitly renewed for successive periods of the same duration as the initial period (together with the initial period, the "Periods"), from date to date, unless the subscription is terminated under the conditions set out in the "Termination of the Services" article.

• An upgrade from one subscription plan to a more premium subscription plan shall not result in any modification to the duration of the Services;
• Any additional Services subscribed during the term of the Services shall have their own distinct subscription anniversary date.

Financial Conditions

Price of the Services

The prices of the Services to which the Client has subscribed are indicated on the Platform and, if applicable, in the Quotation.

Any Period started is due in its entirety.

SecOps Forces is free to propose promotional offers or price reductions.

SecOps Forces prices may be revised at anytime under the conditions of the article "Modification of the Terms and Conditions".

Invoice and Payment Terms

Invoicing and payment terms of SecOps Forces are specified on the Platform and, if applicable, in the Quotation.

The Client guarantees SecOps Forces that it has the necessary authorizations to use this method of payment.

Consequences of Late or Non-payment

In the event of non-payment or late payment, SecOps Forces reserves the right, from the day after the due date shown on the invoice, to:

• immediately suspend the Services in progress until full payment has been received;
• charge late payment interest equal to 3 times the legal interest rate, based on the amount of sums not paid by the due date, and a flat-rate indemnity of 40 euros for collection costs, without prejudice to additional compensation if the collection costs actually incurred exceed this amount;
• where applicable, declare all sums owed by the Client to be in arrears and payable without delay.

Intellectual Property

Intellectual Property Rights on the Solution

The Solution and the Platform are the property of SecOps, as are the softwares, infrastructures, databases and content of any kind (texts, images, visuals, music, logos, trademarks, etc.) that it uses. They are protected by all intellectual property rights or database producers' rights in force. The license granted by SecOps Forces to the Client does not entail any transfer of ownership.

The Client benefits from anon-exclusive, personal and non-transferable SaaS license to use the Solution for the duration specified in the article "Term of the Services".

The Client agrees not to carry out any act of reverse engineering or more generally any expertise by any means whatsoever on the SecOps Forces Solution and Services.

Intellectual Property Rights on Data Shared by the Client

The data owned by the Client and sent to SecOps Forces for the purpose of providing the Services remain the property of the Client and are protected by all applicable intellectual property rights or database producers' rights.

Any disassembly, decompilation, decryption, extraction, reuse, copying and more generally, any act of reproduction, representation, distribution and use of any of these elements, in whole or in part, when such acts are not made necessary by the execution of the present, or when they have not been previously authorized by the Client, are strictly forbidden and may be subject to legal proceedings.

SecOps Forces hereby only benefits from a license to use the data which will be transmitted to it by the Client, for the duration of the subscription and for the sole purpose of executing the Services.

However, SecOps Forces may freely use this data, in particular to improve its Services, it being specified that SecOps Forces undertakes to reuse only aggregated or statistical data that does not allow the Client to be identified.

Commercial References

The parties may use their respective names, brands and logos, and refer to their respective services, as commercial references, for the duration of their contractual relationship and 3 years thereafter.

Obligations and Liability of the Client

Regarding the Provision of Information

The Client undertakes to provide SecOps Forces with all the information necessary for the subscription and use of the Services.

Regarding the Use of the Services

The Client is responsible for its use, and the Users’ use, of the Services and for any information it shares in this connection. It undertakes to use the Services personally and not to allow any third party to use them in its place or on its behalf.

The Client shall refrain, and make sure that the Users refrain from using the Services for purposes other than those for which they were designed, and in particular for:

The Client also refrains, and makes sure that the Users refrain from:

Furthermore, the Client and the Users agree not to upload any content on the Solution (this list is not exhaustive):

The Client indemnifies SecOps Forces against any claim and/or action that may be brought against it as a result of the breach of any of the Client's obligations. The Client shall indemnify SecOps Forces for any loss suffered and shall reimburse SecOps Forces for any sums it may have to bear as a result.

• engage in any illegal or fraudulent activity;
• undermine public order and morality;
• infringe the rights of third parties in any way whatsoever;
• violate any contractual, legislative or regulatory provision;
• engage in any activity likely to interfere with a third party's computer system, in particular for the purpose of violating its integrity or security;
• promote its services and/or sites or those of a third party;
• assist or incite a third party to commit one or more of the acts or activities listed above.
• copy, modify or misappropriate any element belonging to SecOps Forces or any concept it exploits within the framework of the Services;
• adopt any behavior likely to interfere with or hijack SecOps’ computer systems or undermine its computer security measures;
• infringe the financial, commercial or moral rights and interests of SecOps;
• market, transfer or give access in any way whatsoever to the Services, to the information hosted on the Solution or to any element belonging to SecOps.
• infringing public or der or morality (pornographic, obscene, indecent, shocking or unsuitable for a family audience, defamatory, abusive, violent, racist, xenophobic or revisionist);
• infringing the rights of third parties (infringing content, personality rights, etc.) and more generally violating a contractual, legislative or regulatory provision;
• prejudicial to third parties in any way whatsoever;
• misleading, deceptive or proposing or promoting illegal, fraudulent or deceptive activities;
• harmful to the computer systems of SecOps Forces and/or third parties.

Obligations and Liability of SecOps Forces

General Obligations and Service Delivery Timelines

SecOps Forces undertakes to provide the Services with diligence, it being specified that it is bound by an obligation of means.

SecOps Forces undertakes to comply with the regulations in force.

SecOps Forces shall use its best efforts to comply with the timetable for the provision of the Services indicated in the Quotation, if applicable. As these deadlines are provided as an indication, SecOps Forces shall not be held liable in the event of non-compliance.

Any delay attributable to the Client shall delay the agreed delivery dates accordingly.

Regarding the Quality of the Services

SecOps Forces makes every effort to provide the Client with quality Services.

To this end, it carries out regular checks to verify the functioning and accessibility of its Services and may thus carry out maintenance under the conditions specified in the article "Maintenance of the Solution".

However, SecOps Forces is not liable for any temporary difficulties or impossibilities of access to its Services which may be due to:

Furthermore, SecOps Forces does not guarantee that the Services, subject to constant research to improve performance and progress, will be totally freeof errors, defects or faults,

• circumstancesexternal to its network (and in particular the partial or total failure of the Client's servers);
• thefailure of equipment, cabling, services or networks not included in its Services or not under its responsibility;
• interruption of the Services by telecom operators or Internet service providers;
• intervention by the Client, in particular through incorrect configuration of the Services;
• force majeure.

Regarding the Solution Service Level Guarantee

SecOps Forces makes its best efforts to maintain access to the Solution 24 hours a day, 7 days a week, except in the event of scheduled maintenance under the conditions defined in the "Maintenance of the Solution" article or in the event of force majeure.

Regarding Data Backup on the Solution

SecOps Forces makes its best efforts to save all data entered or produced on the Solution.

Except in the case of proven fault on the part of SecOps, SecOps Forces is not responsible for any loss of data during maintenance operations.

Regarding Data Storage and Security

SecOps Forces provides sufficient storage capacity for the operation of the Services.

SecOps Forces makes its best efforts to ensure data security by implementing measures to protect the infrastructures and the Solution, to detect and prevent malicious acts and to recover data.

Regarding Subcontracting and assignment

SecOps Forces may use subcontractors in the performance of the Services, who are subject to the same obligations as SecOps Forces within the framework of the irintervention. Nevertheless, SecOps Forces remains solely responsible to the Client for the proper execution of the Services.

SecOps Forces may substitute any person who will be subrogated in all its rights and obligations under its contractual relationship with the Client. Where applicable, SecOps Forces will inform the Client of this substitution by any written means.

Limitation of SecOps’ Liability

SecOps’ liability is limited solely to proven direct damage suffered by the Client as a result of using the Services.

With the exception of bodily injury, death and gross negligence, and subject to having made a claim by registered letter with acknowledgement of receipt, within a period of one month following the occurrence of the damage, SecOps’ liability shall not exceed the amounts it has received during the 12 months preceding the event giving rise to liability or the duration of the provision of its Services if this period is shorter, within the limit of the ceiling of its professional liability insurance.

Methods of Proof

Proof may be established by any means.

The Client is informed that the messages it has exchanged with SecOps Forces on any support, as well as the data collected, captured and/or produced on the Solution and SecOps’ computer equipment constitute one of the admissible methods of proof, in particular to demonstrate the reality of the Services performed and the calculation of their price.

Personal Data

Processing of Personal Databy the Parties as Data Controllers

As part of their contractual relations, each party shall undertake to comply with the applicable regulations on personal data processing and, in particular, the General Data Protection Regulation (regulation EU 2016/679of the European Parliament and of the Council of 27 April 2016) and to the French Data Protection Act of 6 January 1978 (hereinafter referred together as the “Applicable Regulation”).

Each party processes personal data of contact person of the other party involved in the execution of the Terms, as controller within the meaning of the Applicable Regulation for the purpose of managing the contractual relations between the parties and for the duration of the subscription. These processing are carried out for the execution of the Terms and Conditions and only identification data (in particular surname, first name, email address, telephone number) are processed by the parties.

Personal data are retained during the duration strictly necessary for the purposes of managing the business relationship between the parties. The staff of each party, their control services (notably auditor) and their processors could have access to personal data.

The data subjects have the right to access, rectify, erase, restrict, object, request the portability of their personal data and the right to set guidelines on their personal data in case of death, together with the right to lodge a complaint before the competent supervisory authority.

Processing Carried Out by SecOps Forces on Behalf of the Client Within the Framework of the Provision of the Services

Description of the Subcontracted Processing

As part of the Services, SecOps Forces may process personal data on behalf of and for the account of the Client, in its capacity as data processor, while the Client acts as data controller within the meaning of the Applicable Data Protection Regulation. The characteristics of the processing activities are described in Appendix 1 of this Terms and Conditions.

SecOps Forces undertakes to process personal data solely for the purposes listed in Appendix 1 and in accordance with the Client’s documented instructions, including with regard to the transfer of data outside the European Union. SecOps Forces agrees to inform the Client if, in its opinion, an instruction constitutes a violation of the Applicable Data Protection Regulation. Furthermore, if SecOps Forces is required to transfer data to a third country or an international organization pursuant to applicable law under this Terms and Conditions, it shall inform the Client of such legal obligation prior to the processing, unless the relevant law prohibits such disclosure on important grounds of public interest.

SecOps Forces undertakes to implement appropriate technical and organizational measures to ensure the security and integrity of personal data, their backup, and the restoration of their availability in the event of a physical or technical incident. SecOps Forces shall also ensure that individuals authorized to process personal data are subject to a duty of confidentiality.

SecOps Forces is authorized to engage sub-processors (the “Subsequent Sub-processor”) listed in Appendix 1 of this Terms and Conditions to carry out specific processing activities. In the event of any changes to the list of authorized Subsequent Sub-processors, SecOps Forces shall inform the Client in advance and in writing. Such notice must clearly identify the processing activities subcontracted, as well as the identity and contact details of the Subsequent Sub-processor. The Client shall have a period of fifteen (15) days from the date of receipt of such notice to raise any legitimate and reasoned objections. In the absence of any objections notified within that period, the Client shall be deemed to have accepted the engagement of the Subsequent Sub-processor.

The Subsequent Sub-processor shall be bound by the obligations set forth in this Terms and Conditions on behalf of and in accordance with the instructions of the Client. It is the responsibility of SecOps Forces to ensure that the Subsequent Sub-processor provides sufficient guarantees with respect to the implementation of appropriate technical and organizational measures so that the processing complies with the requirements of the Applicable Data Protection Regulation. If the Subsequent Sub-processor fails to fulfil its data protection obligations, SecOps Forces shall remain fully liable to the Client for the performance by the Subsequent Sub-processor of its obligations.

SecOps Forces is authorized to transfer personal data processed under this Terms and Conditions to countries located outside the European Union, provided that appropriate safeguards, as defined under Chapter V of the aforementioned Regulation, are implemented.

SecOps Forces undertakes to assist the Client and to respond promptly to any request for information submitted by the Client, whether in connection with a data protection impact assessment or are quest made by data protection authorities or by the Client’s data protection officer.

To the extent possible, SecOps Forces shall assist the Client in fulfilling its obligation to respond to requests made by data subjects seeking to exercise their rights under the Applicable Data Protection Regulation. Where such requests are addressed directly to SecOps, SecOps Forces shall promptly forward them to the Client by email, using the address provided by the Client.

SecOps Forces undertakes to notify the Client without undue delay after becoming aware of any personal data breach relating to the processing activities governed by this Terms and Conditions, and to provide the Client with all relevant information and documentation concerning such breach.

SecOps Forces undertakes, at the Client’s option, to delete the personal data upon the termination of the Terms and Conditions or to return such data to the Client and not to retain any copythere of, unless retention is required under Applicable Data Protection Regulation. The Client shall have a period of one (1) month from the end of the Terms and Conditions to exercise this option. Failing such instruction within that time frame, SecOps Forces shall delete all personal data.

SecOps Forces shall make available to the Client, upon request, all information and documentation necessary to demonstrate compliance with its obligations and to enable the performance of audits. The Client may carry out such audits once (1) per year, at its own expense, to verify SecOps’ compliance with the obligations set forth in this clause. The Client shall provide SecOps Forces with at least two (2) weeks’ prior written notice of the audit. The identity of the auditor must be mutually agreed upon by the parties.

SecOps Forces reserves the right to reject the proposed auditor if they are affiliated with a competing company.The audit must be conducted during SecOps’ business hours and in a manner that minimizes disruption to its operations. The audit must not, in any way: (i) compromise the technical and organizational security measures implemented by SecOps; (ii) jeopardize the security and confidentiality of data belonging to other clients of SecOps; or (iii) interfere with the proper functioning and production organization of SecOps. To the extent possible, the parties shall agree in advance on the scope of the audit. The audit report shall be provided to SecOps Forces to allow it to submit any comments or observations in writing, which shall be appended to the final version of the audit report. Each audit report shall be treated as confidential information.

The Client hereby authorizes SecOps Forces to process personal data collected in the course of providing the Services (including connection and identification data) for the purpose of improving SecOps’ services. In this context, SecOps Forces shall act as a data controller within the meaning of the Applicable Data Protection Regulation and undertakes to comply with all relevant legal provisions concerning data protection with respect to the aforementioned processing activities.

The Client undertakes to:

(a) provide SecOps Forces with the personal data specified in Appendix 1, excluding any irrelevant, disproportionate, or unnecessary personal data, and excluding any “special category data” within the meaning of the Applicable Data Protection Regulation, unless the processing justifies such data, in which case the Client shall be responsible for establishing such justification and for implementing all appropriate measures, including prior information, obtaining consent, and ensuring security, with respect to such special category data;

(b) collect, under its own responsibility, in a lawful, fair, and transparent manner, the personal data provided to SecOps Forces for the performance of its services, and in particular, ensure that there is a valid legal basis for such collection and that the data subjects are properly informed;

(c) maintain a record of processing activities and, more generally, comply with the principles set out in the Applicable Data Protection Regulation;

(d) ensure, both prior to and throughout the duration of the processing, compliance with the obligations set forth in the Applicable Data Protection Regulation.

Unless otherwise agreed in writing by the other party, the parties respectively undertake to keep confidential, for the duration of their contractual relationship and 3 years thereafter, all information relating to or held by the other party, of which they may have become aware during the conclusion and performance of their contractual relationship.

This obligation does not extend to information:

Confidential information may be passed on to the parties' respective employees, Users, collaborators, trainees, agents and co-contractors, provided that they are subject to the same obligation of confidentiality.

The following are essential obligations to the Client (the "Essential Obligations"):

In the event of a breach of any of these Essential Obligations, SecOps Forces may:

These sanctions are without prejudice to any damages that SecOps Forces may claim from the Client.

In the event of breach of any obligation other than an Essential Obligation, SecOps Forces will request the Client by any useful written means to remedy the breach within a maximum period of 15calendar days. The Services will be terminated at the end of this period if the breach is not remedied.

SecOps Forces may modify its Terms and Conditions at any time and will inform the Client by any written means (and in particular by email) 2 months at least before they come into force.

The modified Terms and Conditions will apply when the Client's subscription is renewed or when new Services are subscribed.

If the Client does not accept these modifications, it must terminate its subscription in accordance with the terms and conditions set out in the "Termination of the Services" article.

If the Client uses the Services after the entry into force of the modified Terms and Conditions, SecOps Forces considers that the Client has accepted them.‍

The parties shall not be liable for any failure or delay in the performance of their contractual obligations due to force majeure occurring during the term of their relationship. Force majeure includes:

If one of the parties is prevented from fulfilling its obligations due to force majeure, it must inform the other party by registered letter with acknowledgement of receipt. Obligations will be suspended on receipt of the letter, and must be resumed within a reasonable time once the force majeure has ceased.

The prevented party nevertheless remains bound by the performance of obligations not affected by force majeure, and by all payment obligations.

The subscription may be terminated no later than 1 month before the end of the current Period, by:

Any Period started is due in full.

Upon termination of the Services, the Client no longer has access to the Solution.

The termination of the subscription has no effect on the provisions hereof which are intended to continue beyond the end of the subscription, and in particular the "Intellectual Property" and "Confidentiality" articles.

• of which the party receiving it was already aware;
• already public at the time of communication, or which would become public without breach of this clause;
• which has been lawfully received from a third party;
• the communication of which would be required by judicial authorities, inapplication of laws and regulations or in order to establish the rights of a party within the framework of the contractual relationship between the parties.
• payment of the price;
• not to provide incorrect or incomplete information to SecOps;
• to respect the usual rules of politeness and courtesy in exchanges with SecOps;
• not to use the Services for a third party;
• not to carry out any act of reverse engineering or more generally any expertise by any means whatsoever of SecOps Forces tools and Services;
• not to engage in any illegal, fraudulent or infringing activities against the rights or safety of third parties, the breach of public order or the violation of applicable laws and regulations.
• suspend or terminate the Client's access to the Services;
• warn any competent authority, cooperate with it and provide it with all information useful for the investigation and repression of illegal or illicit activities;
• take any legal action.
• any case meeting the conditions of article 1218 of the French Civil Code and recognized by jurisprudence;
• strikes, terrorist activities, riots, insurrections, wars, government actions, epidemics, natural disasters or failure attributable to a third-party telecommunications service provider.
• The Client, by sending a request to SecOps Forces at the following address:4 Boulevard Saade, Quai Arenc Tour Le Mirabeau – 13002 MARSEILLE, FRANCE or through the dedicated button on the Platform;
• SecOps, by sending an email to the Client.

Applicable Law and Jurisdiction

The Terms and Conditions are governed by French law.

In the event of a dispute between the Client and SecOps, and in the absence of an amicable agreement within 2 months of the first notification, the dispute will be submitted to the exclusive jurisdiction of the courts of Paris (France), except in the case of mandatory provisions to the contrary.

APPENDIX 1

Personal Data

Provision of the Services as defined in this Agreement

Collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Users' connection data to the Platform (Last name, first name, professional email address), email address from a data breach, IP address in case of vulnerability scanning, results of phishing campaign tests, results of training campaign tests, Employee risk level

The Client's customers, the Client's employees

Term of the contract

Microsoft Azure - Hosting and infrastructure services for the Platform - France (Azure France Region) Data hosted within the EU – no transfer outside the EU

PowerDMARC - Email authentication analysis and DMARC reporting - United States

Standard Contractual Clauses (SCCs) and security certifications (ISO 27001, SOC 2)

Kinde - User authentication and identity management - United States - Standard Contractual Clauses (SCCs) and compliance with GDPR requirements

CanIPhish - Phishing simulation and security awareness training - Germany / Australia

Data stored in Germany; for Australian access, SCCs and GDPR-compliant hosting provided

Have I Been Pwned - Verification of email addresses exposed in public data breaches

United States Australia Microsoft Azure data centre - Standard Contractual Clauses (SCCs); GDPR-aligned public breach data usage only