General Terms and Conditions

The following General Terms and Conditions (GTC) govern the business relationship between NodeZero GmbH, registered in the Austrian commercial register (hereinafter "NodeZero" or "Contractor"), and its business clients (hereinafter "Client"). By commissioning services from NodeZero GmbH, the Client acknowledges these GTC as binding.

§ 1 Scope of Application

These General Terms and Conditions apply to all contracts, deliveries, and services between NodeZero GmbH and the Client, provided both parties are entrepreneurs within the meaning of Section 1 of the Austrian Commercial Code (UGB). They apply to all current and future business relationships, even if they are not expressly agreed upon again.

Deviating, conflicting, or supplementary general terms and conditions of the Client shall only become part of the contract if NodeZero has expressly consented to their applicability in writing. This consent requirement applies in all cases, even if NodeZero performs services without reservation while being aware of the Client's terms and conditions.

§ 2 Contract Formation

Offers by NodeZero are non-binding and subject to change, unless they are expressly marked as binding. A contract is only concluded upon written order confirmation by NodeZero or upon actual performance of the service.

In accordance with the Austrian E-Commerce Act (ECG), the technical steps leading to the conclusion of the contract are transparently presented to the Client during the ordering process. The contract language is German. Amendments and supplements to the contract require written form. This also applies to the amendment of this written form clause.

§ 3 Service Description

NodeZero provides services in the field of cybersecurity education and training. The range of services comprises three core areas: Workshops (hands-on training sessions), Hosted CTFs (Capture-the-Flag competitions as a service), and the CyberSkills Platform (digital learning platform). The specific services owed in each case result from the respective order confirmation.

NodeZero is entitled to engage third parties for the fulfilment of contractual obligations. Services are provided in accordance with the current state of the art and in compliance with applicable legal provisions.

§ 4 Workshops

Workshop bookings are concluded on the basis of an individual offer or the service description published on the website. The booking becomes binding upon written order confirmation by NodeZero.

In the event of cancellation by the Client, the following rules apply: Cancellation up to 14 calendar days before the agreed workshop date incurs no cancellation fees. Cancellation between 14 and 7 calendar days before the date incurs 50% of the agreed fee. For later cancellation or no-show, the full fee shall be charged.

The Client is entitled to substitute registered participants with other employees of its company, provided NodeZero is informed in a timely manner. All workshop materials, documents, and handouts are protected by copyright and may not be reproduced or passed on to third parties without the express permission of NodeZero.

§ 5 Hosted CTFs

As part of the Hosted CTF service, NodeZero provides the Client with a customized Capture-the-Flag platform for the agreed event period. The scope of services, including the number and type of challenges, is defined in the order confirmation.

All intellectual property rights in the CTF challenges developed by NodeZero, the platform software, and the associated content remain with NodeZero. The Client receives a simple, non-transferable right of use for the duration of the agreed event.

NodeZero endeavors to ensure a platform availability of 99.5% during the agreed event period. Scheduled maintenance work will be announced to the Client in advance. For the processing of personal data of event participants, reference is made to the separate Data Processing Agreement (DPA).

§ 6 CyberSkills Platform

Access to the CyberSkills Platform is granted to the Client on the basis of a license model in accordance with the individual agreement. The usage rights extend to the agreed user group of the Client and are non-transferable.

The Client is responsible for the proper use of user accounts and shall ensure that access credentials are not disclosed to unauthorized third parties. Use of the platform beyond the agreed scope, in particular the disclosure of access credentials to unauthorized persons, constitutes a material breach of contract.

The content provided on the platform, including course materials, labs, and exercises, shall be used exclusively for training purposes within the scope of the contract. Reverse engineering, decompilation, or other attempts to ascertain the source code of the platform are prohibited.

§ 7 Prices and Payment

All prices are net prices in euros (EUR) plus the applicable statutory value-added tax. The prices stated in the order confirmation are binding.

Invoices are due for payment within 14 calendar days of the invoice date without deduction. In the event of late payment, NodeZero is entitled to charge default interest at a rate of 9.2 percentage points above the respective base interest rate pursuant to Section 456 UGB (Austrian Commercial Code). The right to claim further damages is reserved.

Set-off by the Client is only permissible with undisputed or legally established counterclaims.

§ 8 Warranty

NodeZero warrants that the services provided correspond to the agreed scope of services and meet the current state of the art. For business-to-business transactions, a warranty period of 12 months from the date of service provision applies in accordance with the provisions of the Austrian Commercial Code (UGB).

The Client shall report defects in writing without delay after discovery, but no later than 14 calendar days. If defects are not reported in time, the service shall be deemed accepted. NodeZero shall remedy justified defects at its own discretion by repair or replacement delivery.

§ 9 Limitation of Liability

NodeZero shall only be liable to the Client for damages caused by intent or gross negligence, to the extent permitted by the provisions of the Austrian Civil Code (ABGB) and the Austrian Commercial Code (UGB). Liability for slight negligence is excluded to the extent permitted by law.

Liability for indirect damages, lost profits, data loss, unrealized savings, and consequential damages is excluded in all cases to the extent permitted by law. The total liability of NodeZero is in any case limited to the net order value of the respective individual order.

Damage claims by the Client shall become time-barred within 12 months of knowledge of the damage and the party causing the damage. Events of force majeure (in particular natural disasters, pandemics, strikes, official orders) shall release NodeZero from the obligation to perform on time for the duration of the disruption.

§ 10 Confidentiality

Both contracting parties undertake to treat all confidential information of the respective other party obtained in the course of the business relationship as strictly confidential and neither to disclose it to third parties nor to use it for purposes other than those provided for in the contract.

The confidentiality obligation does not apply to information that (a) was publicly known at the time of communication or subsequently becomes publicly known without the fault of the receiving party, (b) was already lawfully known to the receiving party prior to the communication, or (c) must be disclosed due to legal obligation, official order, or court decision.

§ 11 Data Protection

NodeZero processes personal data in accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG). Further information on data processing can be found in NodeZero's Privacy Policy at https://nodezero.at/privacy.

If NodeZero processes personal data on behalf of the Client, the parties shall conclude a separate Data Processing Agreement (DPA) pursuant to Art. 28 GDPR. The DPA is available on the website at https://nodezero.at/dpa.

§ 12 Intellectual Property

All copyrights, trademark rights, and other intellectual property rights in materials, software, platforms, CTF challenges, and training documents developed or provided by NodeZero remain expressly with NodeZero. The Client receives a simple, non-transferable, and non-sublicensable right of use within the scope of the respective contract.

The Client may use the provided materials exclusively for the contractually agreed purpose. Any use beyond this, in particular reproduction, distribution, making available to the public, or modification, requires the prior written consent of NodeZero.

§ 13 Termination

Contracts for individual services (workshops, individual CTF events) end upon complete performance of the agreed service. Ongoing service contracts (in particular CyberSkills Platform access) may be terminated with three months' notice to the end of the respective contract term.

The right of both contracting parties to extraordinary termination for good cause remains unaffected. Good cause exists in particular if a contracting party violates material contractual obligations despite written warning, if insolvency proceedings are opened against the assets of a party, or if such proceedings are rejected for lack of assets.

§ 14 Final Provisions

Should individual provisions of these GTC be or become wholly or partially invalid or unenforceable, the validity of the remaining provisions shall not be affected thereby. In place of the invalid or unenforceable provision, that valid and enforceable provision shall be deemed agreed which comes closest to the economic purpose of the invalid provision.

Amendments and supplements to these GTC require written form. This also applies to the amendment of this written form clause. No oral side agreements exist.

§ 15 Applicable Law and Jurisdiction

Austrian law shall apply exclusively, excluding the conflict of laws rules of private international law and excluding the UN Convention on Contracts for the International Sale of Goods (CISG).

For all disputes arising out of or in connection with these GTC or the business relationship between NodeZero and the Client, the exclusive place of jurisdiction shall be the competent court at the registered office of NodeZero GmbH.

Last updated: March 2026