GENERAL TERMS AND CONDITIONS OF ROOTSEC CYBER RISK MANAGEMENT L.L.C. (B2B)
Version 2.0 (UAE) — Last updated: 1 June 2026
Preamble
These general terms and conditions are intended to establish clear agreements regarding our cooperation. We provide cybersecurity services with the utmost care, expertise, and dedication. At the same time, we expect our clients to ensure proper information sharing, cooperation, and respect for confidentiality. These terms set out what you may expect from us, and what we expect from you.
Article 1 – Definitions
Rootsec Cyber Risk Management L.L.C., a limited liability company (single owner) registered in Dubai, United Arab Emirates, under commercial licence number 1495039 and commercial register number 2582687, with its registered office at Office 159, Ground Floor, Exchange Tower, Business Bay, Dubai, United Arab Emirates, is referred to as the “service provider”. The contracting party is referred to as the “client”. The agreement between the two parties is referred to as the “agreement”.
Article 2 – Applicability
These terms and conditions apply to all offers, quotations, agreements, and deliveries of services or goods by or on behalf of the service provider. Deviations are only valid if explicitly agreed upon in writing.
The agreement obligates the service provider to a best-effort obligation, not a result obligation.
Article 3 – Payment
Invoices must be paid within 14 days of the invoice date unless otherwise agreed in writing. Payments must be made without setoff or suspension.
If payment is not received on time, the client is in default and owes default interest at a rate of 9% per annum on the outstanding amount, together with reasonable collection costs, to the extent permitted under applicable UAE law.
In the event of liquidation, bankruptcy, attachment, or suspension of payment, all claims become immediately due. Refusing to cooperate does not relieve the client from their payment obligations.
Article 4 – Offers and Quotations
Quotations are valid for 1 month unless stated otherwise. Delivery times are indicative. Quotations do not automatically apply to follow-up assignments.
Article 5 – Prices
All prices, quotations, and invoices are denominated in UAE Dirhams (AED) and are exclusive of UAE VAT (currently 5%) and other levies. Price increases due to unforeseen circumstances may be passed on. Services may be invoiced at a fixed price, hourly rate, or as an estimate with a 10% deviation margin. Greater deviations will be communicated in advance.
Article 6 – Price Indexation
The service provider may annually index rates as of January 1 and will notify the client in a timely manner.
Article 7 – Information Provided by the Client
The client must provide all necessary information in a timely, accurate, and complete manner. Delays in submission may result in additional costs. Upon request, submitted materials will be returned to the client.
Article 8 – Cancellation of the Assignment
The client may cancel the assignment at any time but must pay for work performed and costs incurred up to that point.
Article 9 – Execution of the Agreement
The service provider performs the work with due care and expertise and may subcontract (parts of) the assignment. Where the service provider engages a subcontractor, that subcontractor is bound by the same confidentiality and security obligations, and the service provider remains fully responsible for the work. Execution begins after written approval and, if applicable, payment of an advance.
Article 10 – Duration of the Agreement
Unless agreed otherwise, the agreement is entered into for an indefinite period. Deadlines are never binding unless explicitly agreed in writing.
Article 11 – Amendments to the Agreement
Changes must be agreed upon in writing. Any impact on timelines or costs will be communicated in advance.
Article 12 – Force Majeure
In the event of force majeure, obligations are suspended. If the force majeure lasts longer than 30 days, either party may terminate the agreement in writing (in part). No damages are owed in such cases.
Article 13 – Setoff
The client waives the right to set off claims against the service provider.
Article 14 – Suspension
The client waives the right to suspend obligations.
Article 15 – Transfer of Rights
Rights under the agreement may not be transferred without written consent.
Article 16 – Expiry of Claims
The client must notify the service provider of any defect in writing within 12 months of its discovery, failing which the right to claim lapses. In all cases, claims against the service provider are subject to the limitation periods permitted under applicable UAE law.
Article 17 – Insurance
The client must insure the service provider’s property located on-site against damage and theft and provide proof of insurance upon request.
Article 18 – Liability of the Service Provider
The service provider is only liable for damages caused by intent or gross negligence. In all cases, liability is limited to the invoice amount of the relevant assignment or the amount covered by the service provider’s liability insurance, plus the deductible.
The service provider maintains professional liability insurance appropriate to the nature and scale of its activities. Evidence of cover can be made available to the client on reasonable request, subject to confidentiality.
Article 19 – Liability of the Client
If multiple clients are involved, each is jointly and severally liable. If a natural person acts on behalf of a legal entity, they may be personally liable if they are a decision-maker.
Article 20 – Indemnification
The client indemnifies the service provider against third-party claims related to the services provided.
Article 21 – Complaints
Complaints must be submitted in writing without delay. Complaints do not entitle the client to additional or substitute services unless agreed in writing.
Article 22 – Retention of Title, Suspension, and Right of Retention
All goods remain the property of the service provider until full payment is received. In case of non-payment, the service provider may suspend delivery or reclaim goods. The right of retention may also be exercised.
Article 23 – Intellectual Property
All intellectual property rights remain with the service provider unless agreed otherwise. Confidential information may not be disclosed or reused without written consent.
Article 24 – Confidentiality
Both parties shall maintain the confidentiality of all sensitive information. This obligation continues for up to three years after termination. Exceptions apply to publicly known information, third-party information lawfully obtained, or information that must be disclosed under a legal obligation.
Article 25 – Penalty for Breach of Confidentiality
Any breach of confidentiality entitles the service provider to liquidated damages, being a genuine pre-estimate of the loss, of AED 20,000 per violation and AED 2,000 for each day that the breach continues. This does not affect the right to claim additional damages where the actual loss exceeds this amount.
Article 26 – Processing of Personal Data
Where the service provider processes personal data on behalf of the client, it acts as a processor. The parties will sign a separate data processing agreement.
Processing is carried out in accordance with applicable UAE data protection law, in particular Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its implementing regulations.
The service provider shall implement appropriate technical and organizational measures to protect personal data and other confidential information from loss, unauthorized access, or unlawful processing.
Article 27 – Use of Security Systems and Software
If the service provider provides monitoring software, tools, or client portals (such as status.rootsec.nl or integrations with third-party tools like Cynet), additional usage terms apply. The service provider reserves the right to restrict or suspend access in case of abuse, non-payment, or termination of the agreement.
Article 28 – Data Breaches and Reporting Obligations
If the service provider detects (or suspects) a data breach affecting the client, it will immediately notify the client. The client is responsible for assessing the impact and reporting the breach to the competent supervisory authority (the UAE Data Office) and to data subjects, where required under the PDPL.
Article 29 – Governing Law and Jurisdiction
All legal relationships between the parties are governed exclusively by the laws of the United Arab Emirates as applicable in the Emirate of Dubai. Any disputes shall be submitted exclusively to the competent courts of Dubai (onshore).
Article 30 – Language
This agreement is concluded in the English language. If an Arabic translation is produced and there is any discrepancy between the two versions, the English version prevails as between the parties, save where mandatory UAE law or the procedure of the competent court requires the Arabic version to govern.
Rootsec Cyber Risk Management L.L.C.
Office 159, Ground Floor
Exchange Tower, Business Bay
Dubai, United Arab Emirates
[email protected] | +971 55 468 3363 | www.rootsec.ae