Download editable text · Use your browser’s Print command to save a PDF.

Services Agreement — review draft

Version 0.1 • 7 November 2026 • Business-to-business engagements

DRAFT FOR DISCUSSION — NOT AN OFFER OR EXECUTED AGREEMENT. Complete all bracketed fields, confirm the supplier’s legal identity and signing authority, and have the final terms reviewed by Dutch counsel before signature. Time periods, payment terms, intellectual-property arrangements and liability provisions below are proposed terms, not existing RELAY policy. Downloading this document does not create a contract.

1. Parties and effective date

Supplier: IT Service International, trading as RELAY / n0hup, Tomasso Albinonistraat 94, 1083HM Amsterdam, the Netherlands; KvK 72316185; VAT NL422256031B01; email engage@n0hup.nl.
Supplier legal form and full legal contracting identity: [confirm; if a sole proprietorship, identify the proprietor as appropriate]. Authorised signatory: [name and capacity].
Client: [full legal name, legal form, registered address, registration and VAT numbers]. Authorised signatory: [name and capacity].
Effective date: [date of last signature or other agreed date]. Each party acts in the course of its business. This template is not intended for consumers.

2. Agreement and scope

The Supplier will perform only the services and deliver the items identified in the signed Statement of Work (Schedule A, “SOW”), exercising reasonable professional skill and care. No purchase obligation arises from preliminary discussions or the website alone. Each engagement requires both parties to sign this Agreement and its completed SOW, including by an agreed electronic-signature method.
The SOW specifies systems, boundaries, exclusions, deliverables, responsibilities, timing and objective acceptance criteria. No promise is made of uninterrupted service, complete vulnerability detection, regulatory certification or a particular commercial outcome unless expressly agreed in the SOW.
A data processing agreement governs conflicts concerning personal-data processing. A separately signed NDA governs conflicts concerning confidentiality; clause 8 otherwise applies. An SOW overrides this Agreement only where it expressly identifies the clause and agreed variation. Website text and later website edits do not amend a signed agreement. Any additional general terms must be identified, supplied before signature and expressly accepted.

3. Access, safety and client responsibilities

The Client confirms its authority to commission work on the named systems and to provide relevant information. It appoints an accountable contact, supplies accurate information and timely decisions, maintains suitable backups and recovery arrangements, and confirms authorised access before work starts.
Assessments are read-only unless the SOW explicitly authorises changes. Production changes require a documented approval, agreed window, rollback plan and responsible approver. Penetration testing, destructive testing, remediation, continuous monitoring and emergency support are excluded unless specifically included. A read-only assessment can still create system load; collection methods and timing must be agreed.
For client-run collection, the Client executes the agreed collector and shares the approved output through an agreed secure channel. Do not email passwords, tokens or unrestricted production exports. Supplier access, where needed, is named, least-privilege, time-limited and revoked on completion. The Supplier may pause activity reasonably believed unsafe or outside scope and promptly explain the issue and next steps.

4. Delivery and changes

The SOW records the start conditions and milestones. The Supplier notifies the Client promptly of delays, dependencies and their expected effects. Delays caused by missing inputs or approvals require a revised schedule agreed in writing; they do not automatically authorise additional charges.
Either party may request a change. Work outside the agreed scope begins only after authorised representatives approve the change, price, impact on schedule and acceptance criteria in writing. Agreed email approval is sufficient for scope changes unless the SOW requires signatures.

5. Review and acceptance

Proposed review period: 10 business days after delivery. “Business day” means Monday to Friday excluding public holidays in the Netherlands, unless the SOW states otherwise.
The Client either accepts in writing or identifies material non-conformities against the SOW criteria with supporting detail. The Supplier corrects attributable non-conformities without additional charge within an agreed reasonable period and resubmits the affected items for review. Minor issues that do not prevent agreed use are logged with a correction date.
Silence alone does not constitute acceptance. If no response is received, the parties escalate to their named contacts and agree a review date. Acceptance does not waive remedies for defects that could not reasonably have been identified during review. New requirements are handled under clause 4.

6. Fees, invoices and tax

The SOW specifies the currency, fixed fee or rates and cap, payment milestones, invoice details and any pre-approved expenses. Fees exclude VAT where applicable; the invoice states the applicable tax treatment. No expenses are chargeable without prior written approval.
Proposed default: invoices payable within 14 calendar days of receipt, unless the SOW specifies otherwise. The Client promptly explains any genuine invoice dispute and pays undisputed amounts on time. The parties seek to resolve disputed amounts promptly. Suspension for overdue undisputed payment requires written notice and a further 10 business days to remedy, with reasonable care to avoid unnecessary operational harm.
For the advertised standard AD Health Check only, an agreed SOW may use EUR 500 excluding VAT and 100% payment on order, consistent with the offer. That payment schedule does not apply automatically to other engagements. Any unused advance is reconciled under clause 11.

7. Intellectual property and permitted use

Each party retains ownership of its pre-existing materials, methods, tools, software and know-how. The Client retains ownership of its data and grants the Supplier only the rights needed to perform the services.
Proposed default: on full payment for the relevant deliverables, the Supplier grants the Client a perpetual, worldwide, non-exclusive licence to use, copy and adapt those deliverables for its internal business and to share them with advisers and service providers bound by confidentiality for that purpose. The Supplier retains ownership of its original work. Any assignment, exclusive rights, resale rights, source-code delivery or additional rights must be expressly agreed in the SOW.
Third-party and open-source components retain their own licences; relevant components and restrictions must be disclosed before delivery. Nothing permits the Supplier to reuse Client confidential information or personal data in another engagement. General skills and independently developed know-how may be used without disclosing that information.

8. Confidentiality

Each party uses the other’s non-public information only to evaluate or perform the engagement, protects it with reasonable care, and limits access to people who need it and are bound by confidentiality. Protected information includes system details, credentials, reports, business information and the Client’s identity. No publicity, logo use or case study is permitted without prior written consent.
Exceptions apply to information demonstrably public without breach, already lawfully known, independently developed without use of protected information, or lawfully received without restriction. Legally required disclosures are limited to what is required, with advance notice where permitted. Lawful reporting to authorities and protected disclosures are not restricted.
Proposed duration: five years after termination, with trade secrets protected while they qualify as such under applicable law. On request or termination, information is returned or deleted within 30 days, except legally required records and inaccessible routine backups retained under normal deletion cycles; retained information remains protected and cannot be used for other purposes. Security incidents affecting protected information are reported without undue delay, with reasonable cooperation to contain them.

9. Personal data and subcontractors

Before receiving personal data, the parties determine their actual roles, purpose, necessary data, locations and retention. Where the Supplier acts as a processor for the Client, the parties must sign a separate applicable Article 28 GDPR data processing agreement before that processing starts. This Agreement and an NDA do not replace it or authorise an international transfer.
The DPA must address instructions, security, authorised personnel, subprocessors, assistance, incidents, deletion or return, audit rights and any required transfer safeguards. No production personal data is to be submitted until those arrangements are complete. Minimise or redact collection output where feasible.
Subcontractors with access to Client systems or confidential information require prior written Client approval and equivalent confidentiality obligations. Personal-data subprocessors are governed by the DPA. The Supplier remains responsible for its subcontractors’ performance.

10. Liability — proposal requiring specific review

Proposed allocation for negotiation: each party’s aggregate contractual liability arising from an SOW is capped at 100% of the fees paid or payable under that SOW. Proposed exclusion: indirect or consequential loss, including lost profit and lost business opportunities. The parties must review whether this cap and these exclusions suit the engagement, insurance and foreseeable risks before agreeing them.
The cap and exclusions do not apply to fraud, wilful misconduct, gross negligence, death or personal injury caused by negligence, confidentiality breaches, infringement of the other party’s intellectual property, or liability that cannot lawfully be limited. They do not restrict data subjects’ or regulators’ statutory rights or payment obligations. Personal-data liability between the parties must be expressly addressed in the DPA; no statutory duty is waived.
Neither party guarantees that all risks will be detected. This does not excuse failure to exercise the agreed professional care. Each party takes reasonable steps to mitigate loss and notifies the other promptly of claims. No contractual penalties or indemnities are created by this draft.

11. Termination and handover

Either party may terminate for a material breach not remedied within 15 business days after a written notice identifying it, or immediately for a material breach incapable of remedy. Either party may terminate an SOW for convenience on 15 business days’ written notice unless a different arrangement is expressly agreed.
The Client pays for conforming work actually completed and documented, non-cancellable third-party costs previously approved. The Supplier refunds any remaining unearned advance within 14 calendar days after the final reconciliation. There is no automatic forfeiture of all prepaid fees.
The Supplier provides paid-for completed work and an orderly status handover; additional transition assistance is separately agreed. Access is revoked and data returned or deleted as agreed. Accrued payment rights, intellectual-property licences, confidentiality, applicable liability provisions and dispute provisions survive termination.

12. Events beyond reasonable control

A party unable to perform because of an event beyond its reasonable control promptly notifies the other, mitigates the impact and provides updates. This does not excuse accrued payment obligations or avoidable security failures. If the event continues for 30 calendar days, either party may end the affected SOW, with payment and refund reconciliation under clause 11.

13. Notices, disputes and general terms

Formal notices go to the contacts and email addresses in Schedule A; receipt must be acknowledged or otherwise evidenced. Representatives first try to resolve disputes within 20 business days of written escalation, without preventing urgent protective relief.
Proposed governing law: the laws of the Netherlands. Proposed forum: the competent courts of Amsterdam, subject to mandatory law. Both choices require confirmation before signature, particularly for cross-border clients.
This Agreement and its signed schedules contain the parties’ agreement. Amendments require written agreement by authorised representatives. An unenforceable provision does not invalidate the remaining terms; the parties seek a lawful replacement reflecting the original purpose. Neither party may assign the agreement without the other’s written consent, except as otherwise agreed. The Supplier is an independent contractor. Neither party may bind the other.

14. Signatures

For the Supplier: [full legal contracting identity]
Name / capacity: [complete]
Signature / date: [complete]
For the Client: [full legal contracting identity]
Name / capacity: [complete]
Signature / date: [complete]

Schedule A — Statement of Work

SOW reference and version: [complete]
Agreement date: [complete]
Client and Supplier legal identities: [complete]
Business objective: [complete]
Systems, sites, environment limits and authorised activities: [complete]
Deliverables, format and handover contents: [complete]
Explicit exclusions: [complete]
Client inputs, access, backups and responsibilities: [complete]
Supplier responsibilities and named personnel: [complete]
Start conditions and agreed milestones: [complete]
Change windows and rollback / approval contacts, if applicable: [complete or not applicable]
Acceptance criteria for each deliverable and review period: [complete]
Fee model, currency, amount or cap, VAT and expenses: [complete]
Invoice milestones, payment due dates and billing contact: [complete]
Intellectual-property arrangements and disclosed third-party licences: [complete]
Support, correction period and response commitments: [complete; no ongoing support unless agreed]
Confidentiality document reference: [clause 8 or separately signed NDA reference]
Data categories, roles, secure transfer channel and processing locations: [complete]
DPA and transfer arrangement references, if applicable: [complete before processing]
Retention / deletion and handover arrangements: [complete]
Approved subcontractors: [none or list]
Any expressly agreed variations, including liability and governing law: [identify clause and replacement wording]
Operational, security-incident and formal-notice contacts for both parties: [complete]
Supplier signature / name / date: [complete]
Client signature / name / date: [complete]

Optional AD Health Check scope example — not an order

One forest, up to two domains, six domain controllers and 2,000 user accounts; client-run read-only collection; no Supplier credentials required. Deliverables: findings report, prioritised action list and a 60-minute review call. Proposed delivery: five business days after receipt of complete agreed collection output and satisfaction of agreed start conditions. Fee: EUR 500 excluding VAT; 100% on order. Excludes remediation, Entra ID / Microsoft 365, on-site work and penetration testing. Agree the evidence set, collection safety, report acceptance criteria and call scheduling in the actual SOW. Findings describe the evidence available; unavailable evidence must be marked unknown rather than passed.