General terms and conditions

This translation is provided for information only. The German version is legally binding.

These terms apply to cooperation with companies and public-sector clients. They govern the process, the cooperation required and the responsibilities – the arrangements in the respective offer always take precedence.

Provider

Can Yildiz Security Consulting
Owner: Can Yildiz
Dietrich-Bonhoeffer-Str. 23
61440 Oberursel (Taunus), Germany
Email: kontakt@cyi-consulting.de
USt. ID (VAT): DE439989086

§ 1 Scope and contracting parties

(1) These general terms and conditions (GTC) apply to all contracts for consulting, training, audit, interim and speaking services between Can Yildiz Security Consulting (hereinafter the “contractor”) and the client.

(2) The services are aimed exclusively at entrepreneurs within the meaning of § 14 of the German Civil Code (BGB), at legal entities under public law and at special funds under public law. Contracts with consumers within the meaning of § 13 BGB are not concluded.

(3) Deviating, conflicting or supplementary terms of the client do not become part of the contract unless the contractor expressly agrees to them in text form. This also applies if the contractor performs the service without reservation while aware of such terms.

(4) These GTC, in the version current when the contract is concluded, also apply to all future contracts of the same kind without any further reference being required.

(5) Individual agreements, in particular the offer and the order confirmation, take precedence over these GTC (§ 305b BGB).

§ 2 Offer and conclusion of contract

(1) The presentation of services, training courses and speaking topics on the website is non-binding and does not constitute an offer.

(2) Angebote des Auftragnehmers sind, soweit nicht anders angegeben, 30 Kalendertage ab Angebotsdatum bindend. Nach Ablauf dieser Frist ist der Auftragnehmer an das Angebot nicht mehr gebunden.

(3) The contract is concluded when the contractor confirms the engagement in text form or begins to perform the service. Throughout these GTC, text form means that an email is sufficient.

(4) Estimates of effort and cost are non-binding unless they are expressly designated as a fixed price.

§ 3 Subject matter and performance of the services

(1) The subject matter of the contract is the agreed service (contract for services, §§ 611 et seq. BGB), not a particular economic, legal or technical outcome. An outcome is owed only where it has expressly been agreed as a contract for work.

(2) The contractor performs his services professionally, to the best of his knowledge and in line with the recognised rules of technology and the current state of information security. He is free to choose methods and tools unless agreed otherwise.

(3) The contractor may engage professionally qualified third parties as subcontractors. He remains the client’s contracting party and binds any third parties engaged to the confidentiality obligations under § 12.

(4) Services are provided on site or remotely. The parties agree in advance which form is suitable.

(5) The contractor’s recommendations are proposals for decisions. The decision on their implementation, the operation of the systems and compliance with the legal obligations incumbent on the client remain with the client.

(6) Ist ausdrücklich eine Werkleistung vereinbart – etwa ein Bericht oder eine Dokumentation als geschuldetes Ergebnis –, gilt ergänzend: Der Auftraggeber nimmt die Leistung nach Bereitstellung in Textform ab. Die Abnahme gilt als erteilt, wenn der Auftraggeber sie nicht binnen 14 Kalendertagen ab Bereitstellung unter Angabe der Mängel in Textform verweigert; auf diese Wirkung weist der Auftragnehmer bei der Bereitstellung hin. Unwesentliche Mängel berechtigen nicht zur Verweigerung der Abnahme. Bei Mängeln hat der Auftragnehmer zunächst das Recht zur Nacherfüllung; weitergehende Rechte des Auftraggebers bestehen erst nach erfolglosem Ablauf einer angemessenen Nachfrist.

(7) Der Auftragnehmer darf zur Leistungserbringung KI-gestützte Werkzeuge einsetzen. Vertrauliche Informationen und personenbezogene Daten des Auftraggebers werden dabei nur in Werkzeugen verarbeitet, die vertraglich zur Vertraulichkeit verpflichtet sind und die eingegebenen Daten nicht zum Training verwenden; im Übrigen werden solche Daten vor der Nutzung entfernt oder pseudonymisiert. Ergebnisse KI-gestützter Werkzeuge werden vor Verwendung fachlich geprüft; die Verantwortung für die Leistung bleibt beim Auftragnehmer. Auf Verlangen benennt er die eingesetzten Werkzeuge. Abweichende Vorgaben des Auftraggebers gehen vor.

§ 4 Delimitation of the services

(1) The contractor does not provide legal services within the meaning of the German Legal Services Act (RDG). Assessments of regulatory frameworks such as NIS 2, the Cyber Resilience Act, DORA, ISO/IEC 27001, BSI IT-Grundschutz, the GDPR or the EU AI Act are made from the technical perspective of information security. They do not replace a legal review; the legal assessment of the individual case is reserved for a lawyer.

(2) The contractor does not provide tax advice or audit services within the meaning of public accounting.

(3) The contractor is not an accredited certification or conformity assessment body. He does not issue certificates and does not carry out certification audits; he prepares for them and provides support. Certification success or a particular assessment by certification bodies, auditors, customers or authorities is not owed.

(4) Statutory obligations of the client and its management – in particular governance, supervisory and reporting duties arising from NIS 2, the German BSI Act, the Cyber Resilience Act or the GDPR – do not pass to the contractor by placing an engagement.

§ 5 Training courses, workshops and talks

(1) Training courses are delivered as in-house events, on site or remotely. Content, duration, target group and number of participants are agreed in advance; published agendas are a framework, not a definitive script.

(2) For on-site events the client provides suitable rooms and equipment; for remote formats a functioning conferencing solution and suitable devices for the participants.

(3) The agreed number of participants may not be exceeded without prior consent in text form. If it is exceeded, the contractor is entitled to charge the additional effort at the agreed rates.

(4) Training materials are made available to participants for their personal use. Audio and video recordings of the event and passing the materials on to third parties are permitted only with the contractor’s prior consent in text form.

(5) Ist der Auftragnehmer an der Durchführung verhindert, bietet er einen Ersatztermin an oder stellt – nach Abstimmung – eine gleich qualifizierte Vertretung. Weitergehende Ansprüche richten sich nach § 9 Abs. 5 und § 15.

§ 6 Audits, security analyses and simulations

(1) This section applies in addition to gap analyses, internal and supplier audits, technical tests, phishing simulations as well as crisis and tabletop exercises.

(2) The client warrants that it is entitled to dispose of all systems, data, networks and premises involved. Where third parties are affected – such as data centres, cloud or managed service providers, group companies or landlords – the client obtains their consent and provides the contractor with the necessary authorisations in text form before the work begins.

(3) The client indemnifies the contractor against claims by third parties based on the fact that an authorisation or consent under paragraph 2 was missing, late or insufficient in scope.

(4) Even when carried out carefully, effects on live operations cannot be ruled out entirely. Before the work begins, the client ensures a complete, restorable data backup and names an emergency contact who is reachable while the work is carried out.

(5) For measures involving employees – in particular phishing simulations and awareness campaigns – the client is responsible for involving the competent employee representative bodies and its data protection organisation. Monitoring the performance or conduct of individuals is not part of the service; evaluations are aggregated and are not attributed to individual persons unless expressly and lawfully agreed otherwise.

(6) The results of an examination are a snapshot at the time of the examination, based on the information accessible and the agreed scope. No warranty is given that they are complete or that the area examined is free of vulnerabilities.

§ 7 Interim mandates and independent status

(1) Interim services – for example as external information security officer (ISB) or interim CISO – are provided by the contractor as an independent entrepreneur in his own name and for his own account. No employment relationship is established; the temporary provision of workers within the meaning of the German Temporary Employment Act (AÜG) is not the subject of the contract.

(2) The contractor is not subject to any employer’s right to issue instructions and is free in the time and place of his work, unless the task by its nature requires attendance or fixed appointments. Technical coordination, project requirements and compliance with the client’s security and access rules remain unaffected.

(3) The contractor uses his own working equipment unless systems of the client are required for security reasons. Using such systems and taking part in regular technical meetings do not constitute integration into the client’s work organisation.

(4) The contractor does not assume disciplinary responsibility for the client’s employees; technical direction within the scope of the mandate remains possible.

(5) The contractor is named to authorities, certification bodies or customers only after prior agreement. The statutory responsibility of the client’s management remains unaffected in any case and cannot be transferred by the mandate.

§ 8 The client’s duties to cooperate

(1) The client provides everything required for the performance of the services in good time, in full and free of charge, in particular:

• information, documents, policies and earlier assessments relating to the subject of the engagement
• the necessary access to systems, premises and contact persons
• a named contact person with sufficient decision-making authority, plus a deputy
• the involvement of the departments concerned, in particular IT operations, data protection and employee representatives

(2) Der Auftraggeber verantwortet Richtigkeit und Vollständigkeit der überlassenen Informationen. Der Auftragnehmer darf ohne besonderen Anlass auf ihre Richtigkeit vertrauen und ist nicht verpflichtet, sie eigenständig zu überprüfen, soweit die Prüfung nicht Gegenstand des Auftrags ist.

(3) The client makes the necessary approvals and decisions without unreasonable delay.

(4) The client is responsible for backing up its own data in line with the state of the art, in particular before technical tests and interventions.

(5) If the client does not meet its duties to cooperate, deadlines and dates are extended appropriately. Demonstrable additional effort and waiting times for which the client is responsible may be charged at the agreed rates.

§ 9 Dates, postponement and cancellation

(1) Dates for workshops, training courses, talks, audits and on-site work are binding once they have been confirmed in text form.

(2) If the client cancels or postpones a confirmed date, the contractor may charge the following cancellation fee:

• more than 14 calendar days before the date: free of charge
• 14 to 8 calendar days before the date: 50 % of the agreed fee
• 7 calendar days or less before the date: 100 % of the agreed fee

(3) In addition, the client reimburses travel and incidental costs already incurred that can no longer be cancelled, against evidence.

(4) The contractor sets off against the cancellation fee any expenses saved and whatever he acquires, or maliciously fails to acquire, by using the freed-up time otherwise. The client remains entitled to prove that no damage or substantially lower damage was incurred.

(5) Ist der Auftragnehmer aus Gründen, die er nicht zu vertreten hat – insbesondere Krankheit oder höhere Gewalt –, an der Durchführung gehindert, informiert er den Auftraggeber unverzüglich und bietet einen Ersatztermin an. Findet die Leistung nicht statt, entfällt die Vergütung; bereits gezahlte Beträge werden erstattet. Weitergehende Ansprüche bestehen nur nach Maßgabe von § 15.

§ 10 Remuneration, travel expenses and payment

(1) Die Vergütung erfolgt nach Stundensatz, nach Tagessatz oder nach vereinbartem Festpreis. Ein Tagessatz umfasst acht Stunden Leistungszeit; darüber hinausgehender Aufwand wird nach Abstimmung anteilig oder nach dem vereinbarten Stundensatz berechnet. Alle Preise verstehen sich netto zuzüglich der gesetzlichen Umsatzsteuer.

(2) Travel time and travel expenses are charged separately according to actual effort and against evidence, unless agreed otherwise.

(3) Abgerechnet wird bei Aufwandsvergütung monatlich nachträglich, bei einzelnen oder kurzen Leistungen auch unmittelbar nach Leistungserbringung, bei Festpreisen nach Abschluss der vereinbarten Leistung oder nach Meilensteinen. Bei Projekten mit einer Dauer von mehr als vier Wochen sind Abschlagsrechnungen entsprechend dem Leistungsfortschritt zulässig.

(4) Rechnungen sind innerhalb von 14 Kalendertagen ab Rechnungsdatum ohne Abzug zahlbar, sofern die Rechnung kein abweichendes Zahlungsziel ausweist.

(5) In the event of late payment the statutory provisions apply, in particular default interest under § 288 (2) BGB and the flat rate under § 288 (5) BGB. The right to claim further damages is reserved.

(6) If the client is more than 21 calendar days late with a payment due, the contractor may suspend further performance until payment is made, after prior notice in text form and the fruitless expiry of a reasonable grace period. The client is responsible for any resulting postponements.

(7) Gegen Forderungen des Auftragnehmers kann der Auftraggeber nur mit unbestrittenen, entscheidungsreifen oder rechtskräftig festgestellten Gegenforderungen aufrechnen. Mit Gegenansprüchen aus demselben Vertragsverhältnis kann er unbeschränkt aufrechnen. Ein Zurückbehaltungsrecht steht ihm nur wegen Gegenansprüchen aus demselben Vertragsverhältnis zu.

(8) For contracts with a term of more than twelve months, the contractor may offer an adjustment of the rates once twelve months have elapsed. The adjustment takes effect only if the client agrees to it in text form; otherwise the previous rates continue to apply until the end of the agreed term.

§ 11 Changes to the services

(1) Changes to the content or scope of the services require an agreement in text form.

(2) The resulting additional effort is remunerated at the agreed rates; agreed dates are postponed appropriately.

(3) The contractor may reject change requests where they are unreasonable for him in technical terms or in terms of capacity. He communicates this without undue delay and with reasons.

§ 12 Confidentiality and protection of trade secrets

(1) Both parties treat all confidential information of the other party that becomes known in the course of the cooperation as confidential, use it exclusively for the purposes of the contract and disclose it only to persons who need to know it in order to perform the contract and who are bound accordingly. Both parties take appropriate confidentiality measures within the meaning of the German Trade Secrets Act (GeschGehG).

(2) Information is not confidential if it is generally known or becomes so without a breach of this agreement, if it was already lawfully known to the receiving party, or if that party lawfully obtained it from a third party or developed it independently.

(3) Where there is a statutory or official duty of disclosure, the party concerned informs the other party in advance, as far as legally permissible and possible in time, and limits the disclosure to what is necessary.

(4) The obligation applies for the term of the contract and for three years thereafter. For information that constitutes a trade secret within the meaning of the GeschGehG, it applies for as long as statutory protection exists.

(5) After the contract ends, the contractor returns or deletes documents provided to him on request. Retention within the scope of statutory retention obligations remains permitted, as does one copy of the work results and the related correspondence for evidentiary purposes, which is subject to the same confidentiality obligations.

(6) If the client is subject to a special duty of secrecy, in particular under § 203 of the German Criminal Code (StGB), it formally obliges the contractor to maintain secrecy before the cooperation begins (§ 203 (4) StGB). The contractor cooperates in this.

(7) Supplementary or deviating non-disclosure agreements (NDAs) take precedence over this section.

§ 13 Data protection

(1) Both parties comply with the data protection provisions applicable to them, in particular the GDPR and the German Federal Data Protection Act (BDSG).

(2) Where the contractor processes personal data on behalf of the client in the course of the service – for example through access to systems, log data or personnel data – the parties conclude a data processing agreement pursuant to Art. 28 GDPR before that processing begins.

(3) The contractor processes the contact details of the client’s contact persons as an independent controller in order to initiate and perform the contract. Details are set out in the privacy policy.

(4) The client ensures that it is entitled to provide the data made available. It limits personal data to what is necessary for the engagement and provides it in pseudonymised or anonymised form where possible.

§ 14 Rights of use, work results and use as a reference

(1) An den für ihn erstellten Arbeitsergebnissen – insbesondere Berichten, Analysen, Konzepten und Dokumentationen – erhält der Auftraggeber ein einfaches, zeitlich und räumlich unbeschränktes, nicht übertragbares Nutzungsrecht für eigene interne Zwecke. Die Nutzung durch mit ihm verbundene Unternehmen im Sinne des § 15 AktG ist eingeschlossen, soweit der Auftraggeber diese entsprechend verpflichtet. Eingeschlossen ist die Vorlage bei Zertifizierungsstellen, Auditoren, Behörden, Versicherungen und Kunden, soweit dies zum Nachweis erforderlich ist.

(2) The granting of the rights of use is subject to the condition precedent of full payment of the agreed remuneration.

(3) Publishing the work results or passing them on to third parties for their commercial purposes, in particular to competitors of the contractor, requires prior consent in text form. Third parties who are given access to work results do not acquire claims of their own against the contractor.

(4) The contractor’s methods, tools, templates, checklists and training materials remain his property. The client receives only an internal right of use in them; editing, reproducing or passing them on outside its organisation is not permitted without consent in text form.

(5) The contractor may also use the general knowledge acquired while performing the services – ideas, concepts, procedures and experience – for other clients, provided that no confidential information of the client is disclosed.

(6) Naming the client as a reference, using its name or logo and describing the project take place exclusively with prior consent in text form. Consent may be withdrawn at any time with effect for the future.

§ 15 Liability and limitation period

(1) The contractor is liable without limitation for intent and gross negligence, for fraudulent concealment of a defect, for injury to life, body or health, to the extent of a guarantee given and under the German Product Liability Act.

(2) In the event of a slightly negligent breach of a material contractual obligation, liability is limited to the foreseeable damage typical for such contracts. Material contractual obligations are those whose fulfilment makes the proper performance of the contract possible in the first place and on whose observance the client may regularly rely.

(3) Die Haftung nach Absatz 2 ist je Schadensfall auf 1.000.000 € und für alle Schadensfälle eines Vertragsjahres zusammen auf 2.000.000 € begrenzt. Übersteigt die für den betroffenen Auftrag vereinbarte Nettovergütung – bei Dauerschuldverhältnissen die in den letzten zwölf Monaten vor dem schädigenden Ereignis gezahlte Nettovergütung – diese Beträge, gilt stattdessen diese Vergütung je Schadensfall und ihr Doppeltes je Vertragsjahr als Höchstgrenze.

(4) Liability is otherwise excluded, in particular for slightly negligent breaches of non-material contractual obligations.

(5) For the loss of data, the contractor is liable only up to the expense that would have been required for restoration had the client backed up its data properly and regularly.

(6) No liability is accepted for the consequences of decisions by the client that deviate from the contractor’s recommendations or implement them not at all or only in part, for the accuracy and completeness of the information provided by the client, or for services of third parties engaged by the client itself.

(7) The limitations of liability also apply to the personal liability of the contractor’s vicarious agents and subcontractors.

(8) Claims against the contractor become time-barred twelve months after the statutory limitation period begins. This does not apply to claims in the cases listed in paragraph 1; the statutory limitation periods apply to those.

§ 16 Force majeure

(1) Events beyond a party’s control – in particular natural events, epidemics and official measures, war, strikes, large-scale failures of power or telecommunications networks and serious cyber attacks on a party – release the affected party from its obligations to perform for the duration of the disruption. Dates and deadlines are postponed accordingly.

(2) The affected party informs the other party without undue delay of the start, expected duration and end of the impediment.

(3) If the impediment lasts longer than eight weeks, either party may terminate the affected engagement in text form. Services already rendered are remunerated pro rata; further claims do not exist.

§ 17 Term and termination

(1) Individual engagements end when the agreed service has been rendered in full.

(2) Contracts for ongoing services – in particular interim mandates and continuous support as external information security officer – may be terminated with four weeks’ notice to the end of a month unless agreed otherwise.

(3) Für Verträge über laufende Leistungen ist das Recht zur jederzeitigen Kündigung nach § 627 BGB ausgeschlossen; es gilt stattdessen die Kündigungsfrist nach Absatz 2 oder eine abweichend vereinbarte Laufzeit oder Kündigungsfrist. Das Recht zur Kündigung aus wichtigem Grund (§§ 314, 626 BGB) bleibt für beide Parteien unberührt.

(4) Notice of termination must be given in text form.

(5) Services rendered up to termination are to be remunerated. If the client terminates for a reason for which the contractor is not responsible, § 9 applies accordingly to dates already firmly scheduled.

(6) At the client’s request, the contractor assists with an orderly handover – in particular by handing over documentation and returning access rights. The effort required for this is remunerated at the agreed rates.

§ 18 Initial consultation, self-check and content of this website

(1) The free initial consultation serves mutual orientation. It does not establish a contractual or advisory relationship; statements made in it are non-binding. Liability in this respect is excluded, subject to § 15 (1).

(2) The self-check on this website as well as published articles, checklists and presentation materials are based on simplified criteria and serve general information purposes. They replace neither an examination of the individual case nor legal advice. No liability is accepted for decisions based solely on this content.

(3) Using this website does not in itself establish a contractual relationship.

§ 19 Final provisions

(1) The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods.

(2) The place of performance is the contractor’s registered office, unless the service by its nature has to be rendered at the client’s premises.

(3) The exclusive place of jurisdiction for all disputes arising from or in connection with the contract is the contractor’s registered office, provided the client is a merchant, a legal entity under public law or a special fund under public law. The contractor is also entitled to bring an action at the client’s general place of jurisdiction.

(4) Amendments and additions to the contract must be made in text form; this also applies to the waiver of this text form requirement. The precedence of individual agreements (§ 305b BGB) remains unaffected.

(5) Rechte und Pflichten aus dem Vertrag darf der Auftraggeber nur mit vorheriger Zustimmung des Auftragnehmers in Textform auf Dritte übertragen. § 354a HGB bleibt unberührt. Der Auftragnehmer darf den Vertrag auf einen Rechtsnachfolger oder ein mit ihm verbundenes Unternehmen im Sinne des § 15 AktG übertragen; er zeigt dies dem Auftraggeber in Textform an. Die Zustimmung des Auftraggebers gilt als erteilt, wenn er ihr nicht binnen vier Wochen ab Zugang der Anzeige in Textform widerspricht; auf diese Wirkung weist der Auftragnehmer in der Anzeige hin.

(6) The language of the contract is German. Translations of these terms serve information purposes only; the German version prevails.

(7) Should a provision of these GTC be or become invalid, the validity of the remaining provisions remains unaffected. The statutory provision takes the place of the invalid provision.

(8) The version of these GTC current when the contract is concluded is authoritative. Later versions apply only to contracts concluded thereafter.

Last updated: 6 September 2026 · Version 3.0

Can Yildiz Security Consulting·https://www.cyi-consulting.de/en/agb