Terms and Conditions of Service

1. Definitions

Platform: the FENSIVO 360 software accessible remotely as a service (SaaS), including its credential monitoring, phishing simulation, microtraining, and risk scoring features.

Services: the Platform and the professional services FENSIVO provides to the Client under the Purchase Order.

Purchase Order: the document, quote, or order form accepted by the Client, detailing the scope, plan, number of users, term, and price of the Services.

Users: the Client's employees authorized to access the Platform or on whom the Services are performed.

Content: the simulation templates, training modules, reports, methodologies, and other materials provided through the Platform.

2. Purpose and formation of the contract

The contract between the parties is formed upon the Client's acceptance of the Purchase Order. The Purchase Order, these Terms, and the Privacy Policy constitute the entire agreement between the parties. In the event of conflict between these documents, the Purchase Order shall prevail as to scope and price, and these Terms as to all other conditions.

FENSIVO grants the Client a non-exclusive, non-transferable, and revocable right to access and use the Platform, limited to the term and number of Users stated in the Purchase Order. FENSIVO does not install software on the Client's servers nor grant any license over the Platform's code.

3. Phishing simulations and Client authorization

As part of the Services, FENSIVO runs controlled social engineering attack simulations (including simulated phishing emails) directed at the Client's Users, in order to measure and validate their behavior against real threats.

The Client, as employer and Controller of its employees' data, expressly authorizes FENSIVO to run such simulations on its own personnel and declares that it has the necessary legal basis and internal authorizations to do so. FENSIVO acts as Processor, following the Client's instructions and in accordance with the data processing agreement signed between the parties.

The Client is responsible for informing its employees of the applicable internal security and monitoring policies, in accordance with current labor and data protection legislation.

4. Acceptable use and Client obligations

The Client agrees to use the Services only for lawful purposes and in accordance with these Terms. In particular, the Client MAY NOT:

• Use the Services to assess, attack, or monitor systems, domains, or individuals over which it has no legitimate authorization.
• Reverse engineer, decompile, or attempt to access the Platform's source code or algorithms.
• Resell, sublicense, or make the Platform available to third parties without FENSIVO's written authorization.
• Introduce malicious software, interfere with the Platform's operation, or attempt unauthorized access to other accounts or systems.
• Use the Services in a way that infringes third-party rights or applicable regulations.

The Client is responsible for the accuracy of the information it provides, for maintaining the confidentiality of its access credentials, and for all activities carried out under its accounts. It must notify FENSIVO immediately of any unauthorized use or security compromise.

5. Pricing and payment terms

The prices of the Services are those stated in the Purchase Order and are expressed before VAT, unless expressly indicated otherwise. The Client is responsible for applicable taxes, fees, and contributions.

Payment shall be made within the terms and by the means indicated in the Purchase Order. In the event of default, FENSIVO may charge late interest at the maximum rate legally permitted in Colombia and suspend access to the Platform upon notice to the Client, without prejudice to its right to collect the amounts owed.

FENSIVO may adjust prices for future service periods. Any change will be communicated in writing and will apply from the next renewal or new Purchase Order, never retroactively.

6. Term, renewal, and termination

The Services have the term stated in the Purchase Order. The subscription does not renew automatically; any renewal requires a new Purchase Order or written agreement between the parties.

Either party may terminate the contract in the event of a material breach by the other that is not cured within thirty (30) days of written notice. FENSIVO may suspend or terminate access immediately in the event of fraud, misuse of the Platform, or conduct that endangers the integrity of the service or of other clients.

Upon termination, the Client's access right ceases and it must discontinue use of the Platform. Provisions that by their nature must survive, such as confidentiality, intellectual property, limitation of liability, and indemnification, shall remain in force.

7. Intellectual property

The Platform, its Content, code, methodologies, algorithms, risk scoring models, trademarks, and other elements are and shall remain the exclusive property of FENSIVO or its licensors. These Terms do not transfer to the Client any ownership right over such elements, other than the limited right of use described in Clause 2.

The Client retains ownership of the data it uploads to the Platform and grants FENSIVO a limited license to process it for the sole purpose of providing the Services. Any suggestion or feedback the Client provides may be used by FENSIVO to improve the Services without any obligation to compensate.

8. Personal data protection

The processing of personal data is governed by Law 1581 of 2012, its implementing decrees, and FENSIVO's Privacy Policy, which forms an integral part of these Terms. With respect to the data of the Client's employees processed on the Platform, the Client acts as Controller and FENSIVO as Processor, in accordance with the data processing agreement signed between the parties.

For clients located outside Colombia, FENSIVO adopts the safeguards applicable to international data transfers. Details on data categories, purposes, retention, and data subject rights are set out in the Privacy Policy.

9. Confidentiality

Each party undertakes to keep confidential the other's information to which it gains access in connection with the contract, including technical, commercial, and financial information and the results of security assessments. This obligation remains in force during the term of the contract and for three (3) years after its termination, and indefinitely with respect to information that constitutes a trade secret.

10. Warranties and limitations

FENSIVO provides the Services with the diligence of a professional and endeavors to ensure the Platform functions in accordance with the published description. Notwithstanding the foregoing, the Platform is provided “as is” and “as available”. FENSIVO does not warrant that the service will be uninterrupted or error-free, nor the accuracy or completeness of information obtained from third-party sources, such as breach databases.

The Client is responsible for independently verifying the information obtained through the Services before making decisions based on it.

11. Limitation of liability

To the maximum extent permitted by Colombian law, neither party shall be liable to the other for indirect damages, loss of profit, loss of data, loss of business opportunities, or reputational harm.

FENSIVO's total and aggregate liability for any claim arising from the contract shall not exceed the total amount paid by the Client to FENSIVO in the twelve (12) months prior to the event giving rise to the claim. This limitation does not apply in cases of willful misconduct or gross negligence.

To be admissible, any claim must be submitted in writing within thirty (30) calendar days of the occurrence of the event giving rise to it.

12. Indemnification

The Client shall hold FENSIVO harmless against any claim, loss, or expense arising from use of the Services in breach of these Terms or the law, from the infringement of third-party rights, or from claims by its own employees related to the performance of the Services on its personnel.

13. Force majeure

Neither party shall be liable for non-performance caused by force majeure or fortuitous events under article 64 of the Colombian Civil Code, including natural disasters, pandemics, cyberattacks, network failures, or acts of authority. The affected party shall notify the other as soon as possible. If the event persists for more than thirty (30) days, either party may terminate the contract without liability.

14. Changes to the Terms

FENSIVO may modify these Terms to reflect changes in the Platform or in applicable regulations. Changes will be communicated in writing or published on the website with their effective date and will apply from the next Purchase Order or renewal. Continued use of the Services after the changes take effect constitutes acceptance of them.

15. Governing law and jurisdiction

These Terms are governed by the laws of the Republic of Colombia. Any dispute will be addressed in good faith between the parties and, if no agreement is reached within thirty (30) days, will be submitted to the exclusive jurisdiction of the competent courts of Medellín, Colombia.

16. General provisions

The Client may not assign the contract without FENSIVO's written consent. FENSIVO may assign the contract in the context of a corporate reorganization, notifying the Client. If any provision of these Terms is declared void or unenforceable, the remainder shall remain in full force. One party's tolerance of the other's breach does not constitute a waiver of its rights. Notices shall be made in writing to contacto@fensivo.co and to the email the Client indicates in the Purchase Order.