Terms & Conditions

1.1 Scope of Application

These General Terms and Conditions ("T&C" or "Terms") govern all legal relationships between Stormtec GmbH ("Stormtec", "we", "us") and any natural or legal person ("Client", "User", "you") who (i) accesses or uses the website www.stormtec.ch (the "Website"), or (ii) enters into an agreement for any service offered by Stormtec GmbH.

These Terms apply to all offers, service proposals, contracts, mandates, consulting engagements, software deliverables, and support services provided by Stormtec GmbH, unless otherwise expressly agreed in a separate written agreement signed by both parties.

1.2 Acceptance

By visiting the Website, requesting a service quotation, or signing a service order, the Client unconditionally accepts these T&C. In the event of a conflict between these T&C and a separately negotiated contract, the specific contract terms prevail to the extent of the conflict.

1.3 Amendments

Stormtec GmbH reserves the right to modify these T&C at any time. Changes are published on the Website and take effect 30 days after publication, unless a shorter period is required by applicable law. Continued use of the Website or services after the effective date constitutes acceptance of the amended T&C.

1.4 Language

These T&C are issued in English. In the event of a translation, the English version shall prevail unless mandatory Swiss law requires otherwise.

2.1 Nature of Services

Stormtec GmbH provides, among others, the following professional services:

• Cybersecurity consulting and strategy (CISO-as-a-Service, security architecture, risk assessment, penetration testing, vulnerability management)
• AI and Agentic AI solutions design, development, and integration
• DevSecOps, Cloud Security, and Zero Trust Architecture (ZTNA)
• Identity and Access Management (IAM), Single Sign-On (SSO), and Public Key Infrastructure (PKI)
• Cryptography, data protection, and digital signature consulting
• IT Architecture, Solution Architecture, and Enterprise Architecture advisory
• Internet of Things (IoT) security design and review
• Training, workshops, and awareness programs in information security

Services are rendered on a project, mandate, or retainer basis as agreed in the relevant service order or statement of work ("SOW").

2.2 Service Orders

All services require a written service order, SOW, or engagement letter (collectively "Service Agreement") specifying deliverables, timelines, fees, and any special conditions. No services are provided on the basis of verbal arrangements alone.

2.3 Subcontracting

Stormtec GmbH may engage qualified subcontractors or partners to perform parts of the services, provided that Stormtec GmbH remains fully responsible to the Client for the quality and confidentiality of the work delivered.

2.4 Client Cooperation Obligations

The Client shall provide Stormtec GmbH with timely access to all information, systems, personnel, and resources reasonably necessary for the performance of the services. Failure to cooperate may result in adjusted timelines, additional costs, or termination of the Service Agreement without liability on the part of Stormtec GmbH.

2.5 Acceptance of Deliverables

Unless otherwise agreed, the Client shall review and formally accept deliverables within ten (10) business days of receipt. Silence after this period is deemed acceptance. Objections must be raised in writing with a specific description of alleged defects.

3.1 Permitted Use

The Website is made available for informational purposes. Users may access and use the Website solely for lawful purposes and in accordance with these T&C. Any commercial use of Website content without prior written consent is prohibited.

3.2 Prohibited Conduct

Users must not:

• Use automated means (bots, crawlers, scrapers) to access the Website without prior written authorisation
• Probe, scan, or test the vulnerability of the Website or any associated system
• Introduce malicious code, viruses, or any software intended to disrupt the Website
• Reproduce, distribute, or create derivative works from Website content without permission
• Impersonate Stormtec GmbH or any of its representatives
• Place an unreasonable or disproportionate load on the Website infrastructure

3.3 Availability

Stormtec GmbH strives to maintain Website availability but does not warrant uninterrupted or error-free access. Maintenance, updates, or circumstances beyond our control may temporarily affect availability. No liability arises from downtime.

3.4 External Links

The Website may contain links to third-party websites. Stormtec GmbH does not control and is not responsible for the content, privacy practices, or availability of such sites. Links do not constitute endorsement.

4.1 Fees

Fees are set out in the applicable Service Agreement. Unless otherwise stated, all prices are in Swiss Francs (CHF) and are exclusive of Swiss VAT (MWST) at the applicable rate.

4.2 Payment Terms

Payment is due within thirty (30) calendar days of invoice date. Stormtec GmbH reserves the right to charge default interest at 5% per annum (Art. 104 OR) on overdue amounts without further notice.

4.3 Expenses

Out-of-pocket expenses (travel, accommodation, third-party licences) incurred on behalf of the Client are invoiced at cost plus a handling fee of 5%, unless a flat-rate arrangement is agreed.

4.4 Disputed Invoices

Disputes must be raised in writing within ten (10) business days of invoice receipt. Undisputed portions remain payable by the original due date.

4.5 Suspension of Services

If an invoice remains unpaid beyond 30 days of the payment deadline and no written dispute has been raised, Stormtec GmbH may, after giving 10 days' written notice, suspend ongoing services until full payment is received.

5.1 Stormtec GmbH Background IP

All intellectual property rights — including copyrights, trademarks, trade secrets, know-how, methodologies, tools, and proprietary software — owned or licensed by Stormtec GmbH prior to or independently of any engagement ("Background IP") remain exclusively with Stormtec GmbH. No rights in Background IP are granted unless expressly stated in a Service Agreement.

5.2 Client Materials

All data, systems, and materials provided by the Client remain the exclusive property of the Client. Stormtec GmbH shall use such materials solely for the purpose of delivering the agreed services.

5.3 Deliverable Ownership

Upon full payment, Stormtec GmbH grants the Client a non-exclusive, non-transferable, royalty-free licence to use deliverables produced under the relevant Service Agreement. Background IP embedded in deliverables remains the property of Stormtec GmbH.

5.4 Website Content

All content on www.stormtec.ch is the intellectual property of Stormtec GmbH or its licensors and is protected under Swiss copyright law (URG). Reproduction without prior written consent is prohibited.

6.1 Mutual Obligation

Each party agrees to maintain in strict confidence all Confidential Information received from the other party. "Confidential Information" means all non-public information disclosed in connection with any engagement, including technical data, security architectures, source code, financial data, and client lists.

6.2 Exceptions

Confidentiality obligations do not apply to information that:

• Is or becomes publicly known through no fault of the receiving party
• Was already known to the receiving party at the time of disclosure without a duty of confidentiality
• Is independently developed without reference to the Confidential Information
• Is required to be disclosed by court order or law, with prompt prior notice given

6.3 Duration

Confidentiality obligations survive termination for five (5) years, or longer where required by the sensitivity of the information or applicable law.

7.1 Applicable Law

Stormtec GmbH processes personal data in compliance with the Swiss Federal Act on Data Protection (nDSG, in force since 1 September 2023), the Ordinance on Data Protection (DSV), and the EU General Data Protection Regulation (GDPR) for processing involving data subjects in the European Economic Area.

7.2 Data Controller / Processor

For personal data collected via the Website, Stormtec GmbH acts as Data Controller. For data processed on behalf of Clients under a services engagement, Stormtec GmbH may act as Data Processor; in that case, a Data Processing Agreement (DPA) shall be executed in accordance with Art. 28 GDPR.

7.3 Legal Bases for Processing

• Performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR; Art. 31 nDSG)
• Compliance with legal obligations (Art. 6(1)(c) GDPR)
• Legitimate interests — IT security, fraud prevention, business development (Art. 6(1)(f) GDPR)
• Consent, where separately obtained (Art. 6(1)(a) GDPR)

7.4 Data Retention

Personal data is retained only for as long as necessary for the stated purpose or as required by applicable law (e.g. ten-year retention for accounting records under Art. 958f OR).

7.5 International Data Transfers

Where personal data is transferred outside Switzerland or the EEA, Stormtec GmbH ensures an adequate level of protection through recognised mechanisms — EU Standard Contractual Clauses, Swiss SCCs, or adequacy decisions.

7.6 Your Data Subject Rights

Requests should be submitted to: privacy@stormtec.ch. We will respond within 30 days (extendable once by a further 30 days).

7.7 Cookies

The Website uses cookies and similar tracking technologies. A consent banner obtains informed consent prior to placing non-essential cookies, in compliance with Swiss telecommunications law (TUG Art. 45c) and the GDPR / ePrivacy Directive where applicable. Full details are provided in our Cookie Policy.

8.1 Exclusion of Consequential Damages

Stormtec GmbH shall not be liable for any indirect, incidental, special, punitive, or consequential damages — including loss of profits, loss of data, business interruption, or reputational harm — except in cases of wilful misconduct (Absicht) or gross negligence (grobe Fahrlässigkeit) under Art. 100 OR.

8.2 Security Assessments

Security assessment results represent the state of systems at the time of testing. Stormtec GmbH does not guarantee that systems are free from all vulnerabilities, nor assumes liability for incidents occurring after delivery of a report if the Client has not acted upon the findings.

8.3 AI-Related Services

Where Stormtec GmbH delivers AI or Agentic AI solutions, the Client acknowledges that AI systems may produce outputs requiring human review before implementation. The Client assumes responsibility for decisions made based on AI outputs without appropriate human oversight.

8.4 Force Majeure

Stormtec GmbH is not liable for failure to perform due to circumstances beyond reasonable control, including acts of God, war, cyber attacks against Stormtec infrastructure, governmental action, pandemic, or telecommunications failures. The affected party shall promptly notify the other and use reasonable efforts to mitigate impact.

9.1 By Stormtec GmbH

Stormtec GmbH represents and warrants that it is duly incorporated under Swiss law, has legal capacity to enter into service agreements, will perform services with qualified professionals and reasonable skill, and complies with all applicable Swiss and EU laws.

9.2 By the Client

The Client represents and warrants that it has legal authority to accept these T&C, will not use services for any unlawful purpose, and will comply with all applicable export control, sanctions, and anti-money-laundering laws.

9.3 Disclaimer

Except as expressly provided herein, all services and Website content are provided "as is" and "as available" without warranty of any kind, express or implied, including warranties of merchantability, fitness for a particular purpose, or non-infringement.

10.1 Termination for Convenience

Either party may terminate a Service Agreement for convenience by giving thirty (30) calendar days' written notice. Stormtec GmbH is entitled to payment for all work completed up to the effective termination date, plus reasonable demobilisation costs.

10.2 Termination for Cause

Either party may terminate with immediate effect if the other party commits a material breach unremedied within fifteen (15) business days of written notice, becomes insolvent, or if continued performance would violate applicable law.

10.3 Effect of Termination

Upon termination: (i) all outstanding fees become immediately due; (ii) each party shall return or certifiably destroy the other's Confidential Information; (iii) provisions that by their nature survive (Sections 5, 6, 7, 8, and 12) continue in force.

11.1 Anti-Bribery

Both parties warrant compliance with applicable anti-corruption laws, including the Swiss Penal Code (Art. 322ter et seq. StGB) and, where applicable, the UK Bribery Act 2010 and the US Foreign Corrupt Practices Act (FCPA).

11.2 Export Controls & Sanctions

The Client must not use Stormtec GmbH's deliverables in violation of applicable export control regulations, including Swiss export controls (GKG), EU dual-use regulations, and US Export Administration Regulations (EAR). The Client warrants it is not listed on any Swiss, EU, UN, or US sanctions list.

11.3 Anti-Money-Laundering

Stormtec GmbH complies with Swiss anti-money-laundering law (GwG) as applicable and reserves the right to request identification documents necessary to fulfil due-diligence obligations.

12.1 Governing Law

These T&C are governed exclusively by substantive Swiss law, to the exclusion of conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods (CISG).

12.2 Jurisdiction

The exclusive place of jurisdiction for all disputes is Zürich, Switzerland, subject to mandatory consumer-protection provisions that may confer jurisdiction on courts of the Client's domicile.

12.3 Mediation

Before initiating formal proceedings, the parties agree to attempt in good faith to resolve disputes through negotiation or, if unsuccessful within 30 days, through mediation at the Swiss Chamber of Commercial Mediation (SCCM) in Zürich.

12.4 EU Consumers

If the Client is a consumer domiciled in the EU, they may additionally use the EU Online Dispute Resolution platform: ec.europa.eu/consumers/odr.

13.1 Entire Agreement

These T&C, together with any applicable Service Agreement, constitute the entire agreement and supersede all prior negotiations or understandings. No modification is effective unless made in writing and signed by authorised representatives of both parties.

13.2 Severability

If any provision is found invalid or unenforceable, it shall be modified to the minimum extent necessary, and remaining provisions shall continue in full force.

13.3 Waiver

No waiver of any right or obligation is effective unless made in writing. A waiver on one occasion does not constitute a waiver of the same right on any future occasion.

13.4 Assignment

Neither party may assign rights or obligations without prior written consent, except that Stormtec GmbH may assign to an affiliate or successor in a merger or acquisition upon 30 days' notice.

13.5 Notices

All notices must be in writing and delivered by (i) registered mail to the address on record, or (ii) email to the designated contact, with receipt confirmed. Notices to Stormtec GmbH: legal@stormtec.ch.

13.6 Independence

Nothing in these T&C creates an employment, partnership, or agency relationship. Stormtec GmbH and its personnel are independent contractors.