Master Services Agreement

How this Agreement works

These are the standard terms on which Gallivanter Australia Pty Ltd, ABN 45 687 023 365, trading as Biz Secure Online, of Level 9, Wyndham Building, 1 Corporate Court, Bundall, Queensland 4217, Australia (BSO) supplies services to business clients.

They apply when BSO and a client sign a Statement of Work (which may be a proposal) that refers to them. The Statement of Work records the client's details and the commercial particulars of the engagement: the services, deliverables, timing, fees and any minimum term. These terms contain everything else.

Each version of these terms has a permanent web address. A Statement of Work is governed by the version it names, so a later version never changes an existing engagement unless both parties agree in writing (clause 2.6).

Background

A. BSO supplies software testing and quality assurance, Microsoft 365 managed security services, compliance and AI governance services, website and application security scanning, and related professional services.

B. The Client wishes to engage BSO to supply such services from time to time.

C. This Agreement sets out the terms that apply to every engagement between the parties. The particular services for each engagement are described in a Statement of Work that incorporates this Agreement.

1. Definitions and interpretation

1.1 In this Agreement, unless the context requires otherwise:

(a) Agreement means these terms, in the version that applies under clause 2.6, together with every Statement of Work that incorporates them.
(b) Background IP means Intellectual Property Rights in anything created, acquired or licensed by a party before the Commencement Date or independently of this Agreement, including BSO's methodologies, assessment frameworks, questionnaires, checklists, scanning and testing tooling, report templates, scoring models, software (including the Biz Secure Online platform), and any improvement to any of them.
(c) BSO means Gallivanter Australia Pty Ltd, ABN 45 687 023 365, trading as Biz Secure Online, of Level 9, Wyndham Building, 1 Corporate Court, Bundall, Queensland 4217, Australia.
(d) Business Day means a day that is not a Saturday, Sunday or public holiday in Brisbane, Queensland.
(e) Claim means any claim, demand, action, proceeding or cause of action, however arising, whether in contract, tort (including negligence), under statute or otherwise.
(f) Client means the person named as the client in a Statement of Work.
(g) Client Data means all data, documents, records, configurations, logs, scan output and other material provided by or on behalf of the Client to BSO, or collected by BSO from the Client Systems in performing the Services, including any Personal Information contained in it.
(h) Client Systems means the information technology systems, networks, applications, websites, cloud services, accounts and devices owned, operated, leased or controlled by the Client or used in its business.
(i) Commencement Date means the date on which the first Statement of Work between the parties is signed by both of them or, if earlier, the date on which BSO first supplies Services to the Client.
(j) Confidential Information has the meaning given in clause 14.1.
(k) Consequential Loss means loss of profit, loss of revenue, loss of anticipated savings, loss of business opportunity, loss of goodwill or reputation, and any indirect or consequential loss, in each case however arising; but does not include a party's liability to pay Fees properly due, or the costs of reconstituting data from a back-up.
(l) Contact means, for the Client, the person named as its contact in the Statement of Work and, for BSO, the person BSO names in the Statement of Work or, if none, projects@bizsecure.online; or in either case a replacement the party notifies to the other in writing.
(m) Deliverables means the reports, assessments, documents, scripts, configurations, websites, software and other materials identified in a Statement of Work as deliverables, in the form in which they are delivered to the Client.
(n) Eligible Data Breach has the meaning given in the Privacy Act.
(o) Extended Engagement means a Statement of Work that is not a Short-Term Engagement, including any engagement performed over more than one calendar month and any monthly service or retainer.
(p) Fees means the fees payable for the Services as set out in a Statement of Work.
(q) GST and Tax Invoice have the meanings given in the GST Act.
(r) GST Act means the A New Tax System (Goods and Services Tax) Act 1999 (Cth).
(s) Insolvency Event means, for a party, an event described in sections 459C(2) or 585 of the Corporations Act 2001 (Cth), the appointment of an administrator, receiver, controller or liquidator, entry into a scheme of arrangement with creditors, or an analogous event in any jurisdiction.
(t) Intellectual Property Rights means all present and future intellectual property rights anywhere in the world, including copyright, patents, trade marks, designs, circuit layouts, trade secrets and know-how, whether or not registered or registrable, but excluding Moral Rights.
(u) Managed Services means Services under which BSO administers, monitors or changes the configuration of Client Systems on an ongoing basis, including Microsoft 365 managed security services.
(v) Minimum Term means a minimum period stated in a Statement of Work for which the Services under it are committed.
(w) Moral Rights has the meaning given in the Copyright Act 1968 (Cth).
(x) Personal Information has the meaning given in the Privacy Act.
(y) Personnel means, for a party, its officers, employees, agents, contractors and (in the case of BSO) permitted subcontractors.
(z) Privacy Act means the Privacy Act 1988 (Cth), including the Australian Privacy Principles.
(aa) Services means the services described in a Statement of Work, and any other services BSO agrees in writing to supply under this Agreement.
(bb) Short-Term Engagement means a Statement of Work under which BSO's total estimated effort is 10 working days or fewer and the Services are expected to be completed within a single calendar month.
(cc) Statement of Work or SOW means a document, including a proposal, quotation or order form, that describes an engagement, refers to this Agreement, and is signed by both parties.
(dd) Target Systems means the Client Systems identified in a Statement of Work as the systems against which Testing Services are to be performed.
(ee) Testing Services means any Services that involve active interrogation of, or attempted access to, the Target Systems, including vulnerability assessment, vulnerability scanning, penetration testing, load and performance testing, phishing simulation and social engineering assessment.
(ff) Third-Party Products means software, subscriptions, licences, hosting, cloud services and other products supplied by a third party, including Microsoft 365 licences, that BSO resells or arranges for the Client.

1.2 In this Agreement, unless the context requires otherwise:

(a) the singular includes the plural and the reverse;
(b) a reference to a statute includes any amendment, replacement or re-enactment of it and any subordinate legislation made under it;
(c) a reference to a party includes that party's successors and permitted assigns;
(d) headings and the section titled "How this Agreement works" are for convenience only and do not affect interpretation;
(e) "includes" and "including" are not words of limitation;
(f) a reference to dollars, $ or A$ is to Australian dollars.

2. Structure of this Agreement

2.1 This Agreement sets out the terms on which BSO supplies Services to the Client. It does not oblige either party to enter into any Statement of Work.

2.2 Each Statement of Work, once signed by both parties, forms a separate contract between the parties on the terms of this Agreement as supplemented by that Statement of Work.

2.3 If there is any inconsistency between the documents forming this Agreement, the order of precedence is:

(a) the Statement of Work, but only in respect of a matter that the Statement of Work expressly states is a variation of this Agreement and identifies the clause varied, and in respect of any Minimum Term, notice period or service hours stated in it;
(b) the clauses of this Agreement; and
(c) any other document incorporated by reference.

2.4 Neither party's standard terms of business, purchase order terms or online terms apply to this Agreement, whether or not the other party has signed or acknowledged them, except as stated in clause 2.5.

2.5 BSO's Terms of Service published at bizsecure.online/au/terms govern the Client's use of the Biz Secure Online platform as a subscription service. Where those terms conflict with this Agreement in relation to Services supplied under a Statement of Work, this Agreement prevails.

2.6 BSO publishes this Agreement at bizsecure.online/au/msa, and each version at its own permanent web address. A Statement of Work is governed by the version of this Agreement it names or, if it names none, the version published on the date it is signed by the second party. BSO may publish new versions, but a new version applies to a Statement of Work already signed only if both parties agree in writing, which may be by email from an authorised representative of each party.

3. Term

3.1 This Agreement commences on the Commencement Date and continues until it is terminated under clause 24.

3.2 Each Statement of Work starts on the date stated in it or, if none is stated, the date it is signed by the second party, and continues for the period stated in it. Where a Statement of Work states a Minimum Term and does not state what happens at its end, the Statement of Work continues month to month after the Minimum Term until terminated under clause 24.

3.3 Termination of this Agreement does not of itself terminate a Statement of Work that is on foot. Unless the parties agree otherwise in writing, this Agreement continues to apply to that Statement of Work until the Services under it are completed or the Statement of Work is terminated.

4. Statements of Work

4.1 The parties may enter into one or more Statements of Work. A Statement of Work takes effect when signed by an authorised representative of each party.

4.2 Each Statement of Work must, as a minimum, set out:

(a) the Client's legal name and contact details, and a unique reference or title and its date;
(b) a description of the Services, including what is expressly out of scope;
(c) the Deliverables and, where relevant, their acceptance criteria;
(d) the Fees and the basis on which they are calculated (fixed fee, time and materials, monthly service or retainer);
(e) the planned start date and, where relevant, completion date, milestones and any Minimum Term;
(f) the assumptions on which the Fees and timing are based, the Client dependencies BSO relies on, and the personnel each party will make available; and
(g) where the Services include Testing Services, the Target Systems and the testing window.

4.3 A quotation, proposal, estimate or scoping document issued by BSO is an invitation to treat and does not bind either party until it is signed by both parties as a Statement of Work.

4.4 BSO is not obliged to commence Services under a Statement of Work until it has been signed by both parties and, where clause 8 applies, BSO has received the authorisation described in that clause.

4.5 A Statement of Work records the commercial particulars of an engagement: scope, Deliverables, timing, Fees and resources. It is not required to repeat the terms of this Agreement, and the terms of this Agreement apply to it whether or not it repeats them.

5. Provision of the Services

5.1 BSO must supply the Services with due care and skill and in accordance with the Statement of Work, this Agreement and all applicable laws.

5.2 BSO must use suitably qualified and experienced Personnel to perform the Services.

5.3 Any dates, timeframes or estimates given by BSO are estimates only and are given on the basis of the assumptions and Client dependencies recorded in the Statement of Work, unless the Statement of Work expressly states that a date is a firm commitment.

5.4 BSO may perform the Services remotely unless the Statement of Work requires attendance at a Client site. Where BSO attends a Client site, the Client must provide a safe working environment and BSO's Personnel must comply with the Client's reasonable site, security and work health and safety requirements notified to them in advance.

5.5 BSO does not warrant that the Client Systems are or will be free from vulnerabilities, that all vulnerabilities or security events will be identified, or that implementing BSO's recommendations will prevent a security incident. Except for changes BSO makes as part of Managed Services, the Client is responsible for deciding whether and how to act on BSO's findings and recommendations.

5.6 BSO does not provide legal, accounting, insurance or financial advice. Where a Deliverable refers to a legal or regulatory obligation, it does so as a matter of general information and the Client should obtain its own advice.

5.7 BSO will report on progress at the frequency stated in the Statement of Work or, if none is stated, by written update to the Client's Contact at least fortnightly while project Services are being performed.

5.8 Each party must notify the other in writing within 2 Business Days after becoming aware of any matter likely to have a material effect on the scope, cost or timing of a Statement of Work. Any resulting change is dealt with under clause 6.

5.9 Managed Services. Where a Statement of Work includes Managed Services:

(a) BSO performs the administration, monitoring and review tasks described in the Statement of Work, using the access the Client grants to BSO, such as delegated administration of the Client's Microsoft 365 tenant;
(b) BSO changes the configuration of Client Systems only with the Client's prior approval, which may be given by email or through the Biz Secure Online portal, except that BSO may take reasonable urgent action to contain an active security incident where the Client's Contact cannot be reached, and must then tell the Client promptly what it did and why;
(c) monitoring, scans and reviews are performed at the intervals stated in the Statement of Work and are scheduled checks, not continuous surveillance of the Client Systems;
(d) hands-on time is included up to the hours stated in the Statement of Work, and BSO will tell the Client before any work beyond those hours becomes chargeable; unused hours do not carry over unless the Statement of Work says so; and
(e) the Client may remove BSO's access at any time, and BSO must remove its own administrative roles within 2 Business Days after the Managed Services end.

5.10 Websites and software. Where BSO builds, hosts or maintains a website or software for the Client, BSO will set it up in hosting, domain and source code accounts owned by the Client wherever reasonably practicable, with BSO given the access it needs. The Client remains responsible for its domain registrations and for the content it supplies.

6. Change control

6.1 Either party may request a change to the scope, Deliverables, Fees or timing of a Statement of Work by written notice to the other party's Contact.

6.2 BSO must respond within a reasonable time with the effect of the requested change on the Fees, the timing and any assumptions, or with its reasons for declining the request.

6.3 A change takes effect only when recorded in writing and signed or confirmed by email by an authorised representative of each party (a Change Order). BSO is not obliged to perform work outside the scope of a Statement of Work until a Change Order is agreed.

6.4 If a Client dependency recorded in a Statement of Work is not met, or an assumption recorded in it proves incorrect, and this materially affects BSO's cost or ability to perform, BSO may request a Change Order under this clause. BSO is not in breach of this Agreement to the extent that a delay or additional cost is caused by that failure or incorrect assumption.

7. Client obligations

7.1 The Client must, at its own cost:

(a) provide BSO with the access, information, documents, systems, credentials, facilities and cooperation reasonably required for BSO to perform the Services, in a timely way;
(b) ensure that the information it provides to BSO is accurate, complete and not misleading in any material respect, and promptly correct it if it becomes aware that it is not;
(c) ensure its Contact has authority to give BSO directions, approvals and acceptances under this Agreement;
(d) make available the personnel BSO reasonably requires for interviews, workshops, reviews and evidence collection;
(e) obtain and maintain all consents, licences and authorisations required for BSO to perform the Services, including from third parties who host, operate or supply the Client Systems; and
(f) comply with all laws applicable to it in connection with this Agreement.

7.2 Except for the tasks a Statement of Work assigns to BSO as Managed Services, the Client is responsible for the operation, configuration, patching, backup and security of the Client Systems, and for its own business continuity and disaster recovery arrangements.

7.3 The Client must maintain current, tested and restorable back-ups of the Client Systems and Client Data at all times during any period in which Services are being performed, unless a Statement of Work expressly makes BSO responsible for a particular back-up.

7.4 Credentials issued to BSO must be issued to named individuals or to BSO's partner account, be limited to the access required for the Services, and be revocable by the Client at any time. The Client must revoke BSO's access promptly on completion of the relevant Services or on termination.

8. Authorisation for Testing Services

8.1 This clause 8 applies whenever a Statement of Work includes Testing Services. It is a fundamental term of this Agreement.

8.2 The Client:

(a) authorises BSO and its Personnel to perform the Testing Services against the Target Systems during the testing window described in the Statement of Work, and acknowledges that this authorisation is the Client's consent for the purposes of Part 10.7 of the Criminal Code Act 1995 (Cth) and any corresponding State or Territory law relating to computer offences;
(b) represents and warrants that it owns, operates or otherwise controls each Target System, or has obtained the written authority of the owner or operator of each Target System to permit the Testing Services;
(c) represents and warrants that it has obtained all consents required from any third party whose systems, networks, data or services may be affected, including hosting providers, cloud providers, managed service providers, payment providers and landlords; and
(d) must not include in the Target Systems any system that it is not entitled to authorise testing against.

8.3 The Client's signature of a Statement of Work that identifies Target Systems constitutes the authorisation, representations and warranties in clause 8.2 in respect of those Target Systems. No separate authorisation document is required, although BSO may request written confirmation from the owner of a Target System that the Client does not itself own.

8.4 The Client must identify in the Statement of Work any Target System that is shared, third-party hosted, business critical, or subject to a third party's acceptable use policy, and any period during which testing must not occur.

8.5 The Client acknowledges that Testing Services carry inherent risk, and that despite BSO exercising due care and skill they may result in:

(a) degraded performance, instability, unavailability or interruption of a Target System or a connected system;
(b) the corruption, alteration or loss of data;
(c) the triggering of security controls, rate limits, account lockouts, alerts or automated blocking; and
(d) notifications to, or action by, third-party providers, monitoring services or law enforcement.

The Client accepts these risks, and BSO is not liable for loss to the extent it arises from the inherent nature of the Testing Services performed within the scope authorised by the Client. This clause does not limit BSO's liability for its own negligence, wilful misconduct or failure to comply with the Statement of Work.

8.6 Before the Testing Services commence, the Client must complete a current back-up of the Target Systems and confirm to BSO that it has done so.

8.7 Each party must nominate a contact who is available during the testing window and empowered to halt the Testing Services immediately. BSO must cease the Testing Services as soon as reasonably practicable after receiving a request to do so from the Client's nominated contact.

8.8 Unless the Statement of Work expressly authorises it in writing, BSO must not, in performing the Testing Services:

(a) conduct a denial of service or volumetric attack;
(b) exploit a vulnerability in a way intended or likely to render a Target System unavailable;
(c) modify or delete production data, or create or alter user accounts other than accounts issued to BSO;
(d) attempt physical intrusion, or social engineering directed at Client personnel; or
(e) test any system that is not a Target System.

8.9 BSO must not intentionally exfiltrate, publish or retain Client Data beyond what is reasonably necessary to demonstrate a finding and to prepare the Deliverables, and must handle any credentials or data obtained during the Testing Services in accordance with clauses 14, 15 and 16.

8.10 If BSO discovers evidence of an active compromise, an unauthorised third party in the Client Systems, or a vulnerability that in BSO's reasonable opinion presents an immediate and serious risk, BSO must notify the Client's nominated contact as soon as reasonably practicable and in any event within 24 hours, and may suspend the Testing Services pending the Client's instructions.

8.11 The Client indemnifies BSO against any Claim brought by a third party, and any loss, damage or cost (including reasonable legal costs) suffered or incurred by BSO, to the extent arising out of a breach by the Client of clause 8.2 or 8.4.

8.12 BSO indemnifies the Client against any Claim brought by a third party, and any loss, damage or cost (including reasonable legal costs) suffered or incurred by the Client, to the extent arising out of BSO performing Testing Services against a system that is not a Target System or outside the testing window, other than because of information supplied by the Client.

9. Personnel and subcontractors

9.1 BSO may engage subcontractors to perform any part of the Services. BSO remains liable for the acts and omissions of its subcontractors as if they were its own.

9.2 BSO must ensure that its Personnel and subcontractors are bound by confidentiality, privacy and security obligations no less protective than those in this Agreement.

9.3 Where a Statement of Work names key personnel, BSO must not replace them without the Client's prior written consent (not to be unreasonably withheld or delayed), except where the person ceases to be available to BSO, in which case BSO must provide a replacement of comparable skill and experience.

9.4 The Client may, acting reasonably and giving written reasons, require BSO to remove any of its Personnel from performing the Services. BSO must comply and provide a suitable replacement within a reasonable time.

9.5 Each party is an independent contractor. Nothing in this Agreement creates a partnership, joint venture, employment or agency relationship, and neither party may hold itself out as having authority to bind the other.

10. Fees, expenses and payment

10.1 The Client must pay BSO the Fees set out in each Statement of Work.

10.2 Unless the Statement of Work says otherwise, Fees are exclusive of GST and of expenses payable under clause 10.3.

10.3 The Client must reimburse BSO for reasonable travel, accommodation and out-of-pocket expenses that are approved in writing in advance by the Client or expressly provided for in the Statement of Work. BSO must provide supporting documentation with the relevant invoice.

10.4 BSO will issue invoices as follows, unless the Statement of Work expressly provides otherwise:

(a) for a Short-Term Engagement, a single invoice for the whole of the Fees, issued on completion of the Services;
(b) for an Extended Engagement other than a monthly service or retainer, a monthly invoice issued on the first Business Day of each month for the Services performed in the preceding month, and a final invoice on completion;
(c) for a monthly service or retainer, a monthly invoice issued in advance on the first Business Day of the month to which it relates; and
(d) for any deposit or milestone payment, only where the Statement of Work expressly provides for it.

Where a Statement of Work does not state whether the engagement is a Short-Term Engagement or an Extended Engagement, the definitions in clause 1.1 determine which applies.

10.5 The Client must pay each valid Tax Invoice within 14 days after the date of the invoice, without set-off or deduction except as required by law.

10.6 Where the Services are supplied on a time and materials basis, BSO must keep reasonable records of the time spent and make a summary available with each invoice.

10.7 The Client may dispute an invoice in good faith by giving BSO written notice within 10 Business Days of receiving it, setting out the disputed amount and the reasons. In that case:

(a) the Client must pay the undisputed portion by the due date;
(b) the parties must deal with the dispute under clause 27; and
(c) BSO must not exercise its rights under clause 23 in respect of the disputed amount while the dispute is being resolved in accordance with this Agreement.

10.8 BSO may charge interest on any amount not paid by its due date (other than an amount disputed in accordance with clause 10.7) at 2% per annum above the Reserve Bank of Australia cash rate target, accruing daily from the due date until payment.

10.9 BSO may change its standard rates, and the monthly Fees for a monthly service or retainer, once in any 12 month period by giving the Client at least 60 days' written notice. A change does not apply to a fixed fee Statement of Work already signed, or to a Statement of Work during its Minimum Term. If a change applies to a Statement of Work that is on foot, the Client may terminate that Statement of Work by written notice given before the change takes effect, without any early termination charge.

10.10 Amounts prepaid for Services not yet performed are not refundable except as expressly provided in clause 25.

10.11 Third-Party Products. Where BSO resells or arranges Third-Party Products for the Client:

(a) the Third-Party Products are supplied on the third party's own terms, such as the Microsoft Customer Agreement, which the Client must accept where the third party requires it;
(b) the price is the third party's price to BSO plus any margin or administration charge stated in the Statement of Work, and BSO may pass on a change in the third party's price by giving the Client at least 30 days' written notice, or as much notice as the third party gives BSO if that is less; the Client may then reduce or cancel the affected Third-Party Products at the next point the third party allows;
(c) if the Client terminates for convenience, or BSO terminates because of the Client's breach or Insolvency Event, the Client must pay for any subscription or commitment term it chose for the rest of that term, where the third party does not allow BSO to cancel or reduce it; and
(d) BSO does not give any warranty about Third-Party Products beyond the warranties the third party gives, but will use reasonable endeavours to pass on to the Client the benefit of those warranties and of the third party's support.

11. GST

11.1 Words used in this clause 11 that are defined in the GST Act have the meaning given in that Act.

11.2 Unless expressly stated otherwise, amounts payable under this Agreement are expressed exclusive of GST.

11.3 If GST is payable on a taxable supply made under this Agreement, the recipient must pay to the supplier an additional amount equal to the GST payable, at the same time as the consideration for the supply, subject to the supplier issuing a valid Tax Invoice.

11.4 If an adjustment event occurs, the supplier must issue an adjustment note and any resulting difference must be paid or refunded.

11.5 A party may claim reimbursement of an expense only for the amount of the expense net of any input tax credit to which that party is entitled.

12. Deliverables and acceptance

12.1 BSO must deliver the Deliverables in accordance with the Statement of Work.

12.2 Where a Statement of Work specifies acceptance criteria, the Client must review each Deliverable and give BSO written notice of acceptance, or of rejection with reasonable detail of how the Deliverable fails to meet the acceptance criteria, within 10 Business Days of delivery (or the period stated in the Statement of Work).

12.3 If the Client does not give notice within that period, BSO will send the Client a written reminder. The Deliverable is taken to be accepted if the Client does not give notice within 5 Business Days after the reminder, or if the Client puts the Deliverable into live use in its business.

12.4 If the Client rejects a Deliverable, BSO must, at its cost, correct the identified failures and re-deliver within a reasonable time, after which the process in clause 12.2 applies again. If a Deliverable is properly rejected twice, the Client may terminate the affected Statement of Work immediately by written notice, and BSO must refund the Fees paid for that Deliverable.

12.5 The Client must not reject a Deliverable for a failure that is caused by inaccurate or incomplete information supplied by the Client, or by a Client dependency not being met.

12.6 A report or assessment describes the state of the Client Systems as at the date and within the scope stated in it. BSO is not responsible for updating it to reflect changes occurring after that date, except as part of Managed Services.

13. Intellectual property

13.1 Each party retains ownership of its Background IP. Nothing in this Agreement transfers ownership of Background IP.

13.2 On payment in full of the Fees for the relevant Statement of Work, or for the relevant Deliverable where the Statement of Work prices it separately, BSO assigns to the Client all Intellectual Property Rights in the Deliverables, other than BSO Background IP and third-party material incorporated in them.

13.3 To the extent a Deliverable incorporates BSO Background IP, BSO grants the Client a perpetual, irrevocable, non-exclusive, royalty-free, worldwide licence to use, copy, modify and reproduce that Background IP as part of, and for the purpose of using, that Deliverable in the Client's business. That licence does not permit the Client to supply BSO's Background IP as a standalone product or service to a third party. Third-party material, including open source software, is licensed on its own terms.

13.4 The Client grants BSO a non-exclusive, royalty-free licence to use Client Data and Client Background IP to the extent necessary to perform the Services and to exercise its rights under this Agreement.

13.5 BSO may use the general knowledge, skills, techniques and experience acquired in performing the Services in its other engagements, provided it does not disclose the Client's Confidential Information or Personal Information.

13.6 BSO may use aggregated and de-identified data derived from the Services for benchmarking, threat intelligence and improving its services, provided the data cannot reasonably be used to identify the Client, any individual, or any specific vulnerability in the Client Systems.

13.7 Each party consents, and must use reasonable endeavours to procure the consent of its Personnel, to any act or omission by the other party that would otherwise infringe their Moral Rights in material created under this Agreement.

13.8 Neither party may use the other's name, logo or trade marks, or refer to the other as a client or supplier in marketing material, without the other's prior written consent. Consent for a specific use, such as a testimonial or case study, may be recorded in a Statement of Work, and the Client approves the final wording before BSO publishes it.

13.9 The Client may reproduce a Deliverable and share it within its own group of companies and with its professional advisers, auditors, insurers and regulators. Any wider distribution of a report or assessment, including publication or supply to a customer or prospective investor, requires BSO's prior written consent, which must not be unreasonably withheld and may be given subject to reasonable conditions. This clause does not limit clause 14, and does not restrict the Client's use of a website or software Deliverable it owns under clause 13.2.

14. Confidentiality

14.1 Confidential Information of a party means information disclosed by or on behalf of that party in connection with this Agreement that is by its nature confidential, is marked or described as confidential, or that the recipient knows or ought reasonably to know is confidential. It includes:

(a) in the case of the Client, the Client Data, the Client Systems architecture, credentials, and the contents of any Deliverable so far as it identifies vulnerabilities in the Client Systems; and
(b) in the case of BSO, its Background IP, methodologies, tooling, and any pricing that BSO has not published.

14.2 The recipient must:

(a) keep the discloser's Confidential Information confidential and use it only for the purposes of this Agreement;
(b) protect it using at least the standard of care it applies to its own confidential information of like importance, and in any event a reasonable standard of care; and
(c) disclose it only to its Personnel and professional advisers who need to know it for those purposes and who are bound by obligations of confidence.

14.3 Clause 14.2 does not apply to information that:

(a) is or becomes public other than through a breach of this Agreement;
(b) the recipient can show was known to it, or independently developed by it, without reference to the discloser's Confidential Information; or
(c) is required to be disclosed by law, a court, a regulator or the rules of a securities exchange, provided the recipient gives the discloser reasonable prior notice where it is lawfully able to do so.

14.4 On termination or expiry, or on the discloser's written request, the recipient must return or destroy the discloser's Confidential Information, except to the extent it is required to retain it by law, by a professional or insurance requirement, or in routine back-ups that are not readily accessible. Retained information remains subject to this clause 14.

14.5 The obligations in this clause 14 survive termination or expiry of this Agreement for a period of 5 years, and indefinitely in respect of information that is a trade secret or that identifies a vulnerability in the Client Systems.

14.6 Each party acknowledges that damages may be an inadequate remedy for breach of this clause 14 and that the other party is entitled to seek injunctive relief.

15. Privacy and Personal Information

15.1 Each party must comply with the Privacy Act and any other applicable privacy law in connection with this Agreement, whether or not that party is otherwise bound by it.

15.2 The Client is responsible for ensuring it has the right to disclose to BSO any Personal Information contained in the Client Data, and that its own privacy notices and consents cover that disclosure and BSO's handling of it.

15.3 BSO must:

(a) collect, use, store and disclose Personal Information only as reasonably necessary to perform the Services or as required by law;
(b) disclose Personal Information outside Australia only to a sub-processor listed under clause 16.3 that is bound to protect it to a standard no less protective than this Agreement and the Australian Privacy Principles;
(c) take reasonable steps to protect Personal Information from misuse, interference, loss and unauthorised access, modification or disclosure; and
(d) co-operate with the Client in responding to requests from individuals to access or correct their Personal Information, and to enquiries from the Office of the Australian Information Commissioner.

15.4 BSO must notify the Client as soon as reasonably practicable, and in any event within 48 hours, after becoming aware of any unauthorised access to, disclosure of, or loss of Personal Information or Client Data held by BSO, and must provide the information reasonably required by the Client to assess whether the incident is an Eligible Data Breach.

15.5 The parties must co-operate to meet their respective obligations under Part IIIC of the Privacy Act. Neither party may make a notification or public statement that identifies the other in connection with an Eligible Data Breach without first consulting the other, unless it is required to do so by law and there is insufficient time to consult.

15.6 Where a Statement of Work provides for BSO to conduct a phishing simulation or social engineering assessment involving Client personnel, the Client is responsible for ensuring that the conduct of the assessment complies with its employment obligations and privacy notices, and for approving the scenario in advance.

15.7 BSO's Data Processing Addendum published at bizsecure.online/au/dpa, in the form published on the date a Statement of Work is signed, forms part of this Agreement where BSO processes Personal Information on the Client's behalf under that Statement of Work. BSO may update it only in a way that does not reduce the protection it gives the Client. If it conflicts with this clause 15, this clause 15 prevails.

16. Data security and Client Data

16.1 As between the parties, the Client owns all Client Data.

16.2 BSO must implement and maintain security controls appropriate to the sensitivity of the Client Data it holds, including access control on a need-to-know basis, multi-factor authentication for remote access, encryption of Client Data in transit and at rest, logging of access, and secure disposal.

16.3 BSO stores Client Data in Australia where its providers allow it. Some of BSO's sub-processors process data outside Australia. BSO lists its sub-processors, and where each one processes data, at bizsecure.online/au/sub-processors, and must give the Client at least 30 days' written notice before adding a sub-processor that processes Client Data outside Australia. If the Client reasonably objects, it may terminate each affected Statement of Work by written notice before the change takes effect, without any early termination charge.

16.4 BSO must not use Client Data for any purpose other than performing the Services and its obligations under this Agreement, and as permitted by clause 13.6.

16.5 BSO must retain Deliverables and the working papers supporting them for at least 12 months after delivery, and must securely destroy raw scan output, captured credentials and other testing artefacts that are not required for the Deliverables within 90 days after the relevant Services are completed, unless the Client requests otherwise in writing.

16.6 On termination or expiry, BSO must, at the Client's written election made within 30 days, return the Client Data in a commonly used electronic format or securely destroy it, subject to clause 14.4.

17. Warranties

17.1 Each party warrants that it has the power and authority to enter into and perform this Agreement, and that this Agreement is binding on it.

17.2 BSO warrants that:

(a) the Services will be performed with due care and skill by suitably qualified Personnel;
(b) the Deliverables will materially conform with the requirements set out in the relevant Statement of Work;
(c) to the best of its knowledge, the Deliverables (excluding Client Data, material supplied by the Client and third-party material) will not infringe the Intellectual Property Rights of any third party; and
(d) it holds the licences, registrations and insurances required to perform the Services.

17.3 If BSO breaches clause 17.2(a) or (b), and the Client notifies BSO within 60 days after delivery of the affected Deliverable or performance of the affected Services, BSO must re-perform the affected Services or correct the affected Deliverable at its own cost. This is in addition to, and does not limit, the Client's rights under clause 18.

17.4 The Client warrants that:

(a) it has the authority described in clause 8 in respect of every Target System; and
(b) the information and materials it provides to BSO do not infringe the rights of any third party.

17.5 Except as expressly set out in this Agreement, and subject to clause 18, all warranties, guarantees and conditions implied by law are excluded to the maximum extent permitted.

18. Australian Consumer Law

18.1 Nothing in this Agreement excludes, restricts or modifies any right or remedy, or any guarantee, warranty or other term or condition, implied or imposed by the Australian Consumer Law (Schedule 2 to the Competition and Consumer Act 2010 (Cth)) or any other law that cannot lawfully be excluded, restricted or modified.

18.2 To the extent that this Agreement relates to the supply of services that are not of a kind ordinarily acquired for personal, domestic or household use or consumption, and subject to clause 18.1, BSO's liability for failure to comply with a consumer guarantee is limited, at BSO's election, to supplying the services again or paying the cost of having the services supplied again.

18.3 If any provision of this Agreement would otherwise be void, unenforceable or an unfair contract term, it is to be read down to the minimum extent necessary so that it is not, and if it cannot be read down it is severed under clause 29.7.

19. Indemnities

19.1 BSO indemnifies the Client against any Claim by a third party that a Deliverable infringes that third party's Intellectual Property Rights, and against loss, damage and reasonable legal costs arising from such a Claim, except to the extent the Claim arises from Client Data, material supplied by the Client, third-party material, or the Client's modification or use of a Deliverable other than as contemplated by this Agreement.

19.2 If a Claim under clause 19.1 is made or is likely, BSO may at its cost procure the right for the Client to continue using the affected Deliverable, modify or replace it so that it is non-infringing while remaining materially equivalent, or if neither is reasonably achievable, refund the Fees paid for that Deliverable.

19.3 The Client indemnifies BSO as set out in clause 8.11, and BSO indemnifies the Client as set out in clause 8.12.

19.4 A party's liability under an indemnity in this Agreement is reduced proportionately to the extent that the loss was caused or contributed to by the other party or its Personnel. A party claiming under an indemnity must:

(a) notify the indemnifying party promptly after becoming aware of the Claim;
(b) not admit liability or settle the Claim without the indemnifying party's consent (not to be unreasonably withheld);
(c) permit the indemnifying party to conduct the defence and settlement of the Claim, provided it does so diligently and does not settle on terms that impose a non-indemnified obligation on the other party; and
(d) take reasonable steps to mitigate its loss.

20. Limitation of liability

20.1 This clause 20 is subject to clause 18 and to clause 20.5.

20.2 Neither party is liable to the other for any Consequential Loss arising out of or in connection with this Agreement, however caused, including by negligence.

20.3 The aggregate liability of each party to the other arising out of or in connection with a Statement of Work, whether in contract, tort (including negligence), under statute or otherwise, is limited to the total Fees paid and payable under that Statement of Work in the 12 month period immediately before the first event giving rise to the liability, excluding amounts payable for Third-Party Products.

20.4 A party's liability is reduced proportionately to the extent that the loss was caused or contributed to by the other party or its Personnel, or by the other party's failure to take reasonable steps to mitigate it.

20.5 Clauses 20.2 and 20.3 do not apply to:

(a) the Client's obligation to pay Fees properly due;
(b) liability for death or personal injury caused by a party's negligence;
(c) liability arising from fraud, wilful misconduct or a criminal act;
(d) a breach of clause 14 (Confidentiality);
(e) BSO's indemnities in clauses 8.12 and 19.1 or the Client's indemnity in clause 8.11; or
(f) any liability that cannot lawfully be excluded or limited.

20.6 The parties acknowledge that the Fees reflect the allocation of risk in this clause 20.

21. Insurance

21.1 BSO must maintain, with a reputable insurer authorised to carry on insurance business in Australia, for as long as any Statement of Work is on foot and for 3 years afterwards:

(a) professional indemnity insurance for not less than A$2,000,000 per claim;
(b) public liability insurance for not less than A$10,000,000 per occurrence; and
(c) cyber liability insurance for not less than A$1,000,000 in the aggregate.

21.2 BSO must provide certificates of currency on the Client's reasonable written request, and must notify the Client if a policy required by clause 21.1 is cancelled or materially reduced.

21.3 BSO must also maintain workers compensation insurance as required by law.

22. Non-solicitation

22.1 While any Statement of Work is on foot and for 12 months afterwards, neither party may solicit for employment or engagement any individual of the other party who was materially involved in the Services, without the other party's prior written consent.

22.2 Clause 22.1 does not prevent a party from employing or engaging a person who responds to a general advertisement not specifically directed at the other party's personnel, or who approaches that party on their own initiative without prior solicitation.

23. Suspension

23.1 If the Client fails to pay an undisputed amount within 14 days after receiving a written reminder from BSO, BSO may suspend the Services under the affected Statement of Work on 10 Business Days' written notice, until the amount is paid.

23.2 BSO may also suspend the Services immediately where continuing to perform them would, in BSO's reasonable opinion, breach a law, breach clause 8, or create a serious risk to the Client Systems or a third party. BSO must notify the Client of the reason and consult with the Client on how to resolve it.

23.3 BSO is not liable for any consequence of a suspension properly exercised under this clause 23, and any dates in the affected Statement of Work are extended by the period of suspension. BSO must resume the Services promptly once the reason for the suspension ends.

24. Termination

24.1 Either party may terminate this Agreement, or any Statement of Work, for convenience by giving the other party 30 days' written notice, or the notice period stated in the Statement of Work. A notice for convenience may not take effect before the end of a Minimum Term. Termination of this Agreement for convenience does not terminate a Statement of Work then on foot unless the notice says so.

24.2 Either party may terminate this Agreement or an affected Statement of Work immediately by written notice if the other party breaches a material term and, where the breach is capable of remedy, fails to remedy it within 20 Business Days after receiving written notice requiring it to do so.

24.3 Either party may terminate this Agreement and every Statement of Work immediately by written notice if the other party:

(a) suffers an Insolvency Event; or
(b) breaches clause 14 (Confidentiality) or, in the case of the Client, clause 8 (Authorisation for Testing Services), in a manner that is not capable of remedy.

24.4 The Client may also terminate an affected Statement of Work under clauses 10.9, 12.4 and 16.3.

24.5 Termination of a Statement of Work does not terminate this Agreement or any other Statement of Work.

25. Consequences of termination

25.1 On termination or expiry of a Statement of Work:

(a) BSO must stop work in an orderly way and deliver to the Client all completed Deliverables and, at the Client's request, work in progress in its then current state;
(b) the Client must pay BSO for all Services performed and expenses properly incurred up to the effective date of termination, including work in progress on a fixed fee engagement assessed on a proportionate basis;
(c) where the Client terminates for convenience under clause 24.1, the Client must also pay BSO's reasonable, unavoidable commitments made in reliance on the Statement of Work that BSO cannot cancel using reasonable endeavours, including Third-Party Products to the extent clause 10.11(c) applies;
(d) where the Client terminates under clause 10.9, 12.4, 16.3, 24.2 or 24.3, BSO must refund any Fees prepaid for Services not performed;
(e) BSO must remove its access to the Client Systems under clause 5.9(e), and help the Client transfer the administration of any accounts BSO managed for it; and
(f) each party must comply with clauses 14.4 and 16.6.

25.2 If the Client requests, BSO must provide reasonable transition assistance for up to 60 days after termination, at BSO's then current time and materials rates.

25.3 Termination does not affect any accrued right or remedy of either party.

25.4 Clauses 1, 8.11, 8.12, 10 (in respect of amounts accrued), 11, 13, 14, 15, 16.6, 18, 19, 20, 22, 25, 27, 28, 29 and 30 survive termination or expiry.

26. Force majeure

26.1 Neither party is liable for a failure or delay in performing its obligations (other than an obligation to pay money) to the extent it is caused by an event beyond its reasonable control, including natural disaster, fire, flood, pandemic, war, act of terrorism, industrial action affecting third parties, failure of a telecommunications, utility or cloud provider, or a large-scale cyber attack, in each case to the extent the affected party could not reasonably have avoided or mitigated it, including by maintaining reasonable security.

26.2 The affected party must notify the other as soon as reasonably practicable, use reasonable endeavours to mitigate the effect, and resume performance as soon as it is able.

26.3 If the event continues for more than 30 consecutive days, either party may terminate the affected Statement of Work by written notice, and clauses 25.1(a), (b), (e) and (f) apply. BSO must also refund any Fees prepaid for Services not performed.

27. Dispute resolution

27.1 A party must not commence court proceedings in relation to a dispute arising out of this Agreement without first complying with this clause 27, except for proceedings seeking urgent interlocutory relief.

27.2 The party raising the dispute must give the other party written notice setting out the nature of the dispute and the outcome it seeks.

27.3 The parties' Contacts must meet (in person or by video) within 10 Business Days of the notice and attempt in good faith to resolve the dispute.

27.4 If the dispute is not resolved within a further 10 Business Days, it must be escalated to a director or senior executive of each party, who must meet within 10 Business Days and attempt in good faith to resolve it.

27.5 If the dispute is still not resolved, either party may refer it to mediation administered by the Resolution Institute in Brisbane, Queensland, in accordance with the Resolution Institute Mediation Rules. The parties bear their own costs and share the mediator's costs equally.

27.6 Each party must continue to perform its obligations under this Agreement while a dispute is being resolved.

28. Notices

28.1 A notice under this Agreement must be in writing and sent:

(a) to BSO, by email to projects@bizsecure.online, or by hand or post to BSO's address in clause 1.1; and
(b) to the Client, to its Contact at the email address or postal address stated in the most recent Statement of Work,

or to any updated details a party notifies to the other in writing.

28.2 A notice is taken to be received:

(a) if delivered by hand, on delivery;
(b) if sent by post within Australia, on the fifth Business Day after posting; and
(c) if sent by email, at the time the email enters the recipient's information system, unless the sender receives an automated message that delivery failed.

28.3 A notice received after 5.00pm on a Business Day, or on a day that is not a Business Day, is taken to be received at 9.00am on the next Business Day.

29. General

29.1 Entire agreement. This Agreement, in the version that applies under clause 2.6, and the Statements of Work signed under it contain the entire agreement between the parties about their subject matter and supersede all prior negotiations, representations and agreements.

29.2 Variation. This Agreement may be varied only in writing agreed by an authorised representative of each party, which may be by email, including as provided in clause 2.6. A Statement of Work may be varied by a Change Order under clause 6.

29.3 Assignment. Neither party may assign or novate this Agreement without the other party's prior written consent, not to be unreasonably withheld, except that either party may assign to a related body corporate or to a purchaser of substantially the whole of its business on written notice.

29.4 Waiver. A right under this Agreement is waived only by written notice. A failure or delay in exercising a right does not operate as a waiver.

29.5 Electronic signature. A Statement of Work may be signed in counterparts and electronically, including through an electronic signature service. The parties consent to electronic execution for the purposes of the Electronic Transactions Act 1999 (Cth) and the Electronic Transactions (Queensland) Act 2001.

29.6 Further assurance. Each party must do all things reasonably necessary to give full effect to this Agreement.

29.7 Severability. If a provision of this Agreement is void or unenforceable, it is severed and the remainder of this Agreement continues in force.

29.8 Non-exclusivity. This Agreement is not exclusive. Each party may enter into similar arrangements with third parties, subject to clauses 14 and 22.

29.9 Costs. Each party bears its own costs of negotiating and entering into this Agreement.

29.10 No third party rights. This Agreement does not confer rights on any person who is not a party to it, other than a person expressly indemnified under it.

29.11 Existing agreements. If the parties have signed a separate master services agreement, that agreement continues to govern the Statements of Work made under it, and this Agreement applies only to a Statement of Work that names it.

30. Governing law and jurisdiction

30.1 This Agreement is governed by the laws of Queensland, Australia.

30.2 Each party irrevocably submits to the non-exclusive jurisdiction of the courts of Queensland and the courts competent to hear appeals from them, and waives any objection to proceedings in those courts on the ground of inconvenient forum.

30.3 The United Nations Convention on Contracts for the International Sale of Goods does not apply to this Agreement.