Terms & Conditions

1. Scope

These General Terms and Conditions (GTC) apply to all contracts between Exploit Labs GmbH ("Exploit Labs", "we") and its customers. Deviating terms of the customer do not become part of the contract unless we expressly agree to them in text form.

2. OffSec training and certifications

For the purchase of OffSec products (including Learn One, Learn Enterprise, Course + Cert Bundle, CyberCore), Exploit Labs acts as an authorised reseller of OffSec Services Limited. Use of the learning platform, course content and admission to OffSec examinations is governed exclusively by the Terms and Conditions of OffSec Services Limited as amended from time to time, available at https://www.offsec.com/legal/terms-and-conditions/. By purchasing, the customer confirms that they have read and accept these OffSec terms. Licences and exam vouchers are activated by OffSec or by us after receipt of payment and are non-transferable. Availability, content and technical operation of the OffSec learning environment are the sole responsibility of OffSec.

3. Bootcamps (Exploit Iceland, Exploit Dubai)

A bootcamp seat is booked upon full receipt of payment. The customer is responsible for travel, visa, insurance and accommodation unless stated otherwise in the offer. Cancellations are free of charge up to 30 days before the start; after this, the full participation fee is due. Rebooking to another cohort is possible subject to seat availability. We reserve the right to cancel a cohort due to insufficient participants or for good cause; in this case the amount paid is refunded in full, further claims are excluded.

4. Penetration testing, red teaming and TIBER/DORA services

For penetration tests, red team engagements, TIBER-EU and DORA TLPT projects and other advisory services, the respective project-specific terms set out in the offer, Statement of Work (SoW) and Rules of Engagement (RoE) ("Project ToC") take precedence. These GTC apply only in a supplementary capacity to the extent the Project ToC do not contain a deviating provision. The customer warrants that it holds all rights necessary to have the target systems tested and grants Exploit Labs the required written test authorisation prior to execution.

5. Prices, payment, taxes

All prices are in Euro plus statutory VAT unless stated otherwise. Online purchases (training, bootcamps) are due immediately upon order via our integrated payment provider Stripe. Project services are invoiced in accordance with the payment schedule agreed in the offer with a payment term of 14 days from invoice date. For purchases from other EU countries with a valid VAT ID, VAT is handled under the reverse-charge procedure.

6. Right of withdrawal for consumers

Consumers within the meaning of § 13 German Civil Code (BGB) have a 14-day right of withdrawal for contracts concluded online. For digital content (e.g. OffSec licences, exam vouchers) the right of withdrawal expires as soon as performance has begun after the consumer has expressly consented and confirmed knowledge of the loss of the right of withdrawal (§ 356 (5) BGB). Our services are directed predominantly at entrepreneurs within the meaning of § 14 BGB; no right of withdrawal exists for them.

7. Liability

Exploit Labs is liable without limitation for intent and gross negligence and under the German Product Liability Act. For breach of essential contractual obligations ("cardinal obligations"), our liability for simple negligence is limited to the foreseeable damage typical for this type of contract. Otherwise, liability for simple negligence is excluded. Liability for injury to life, body or health remains unaffected. More specific liability provisions in Project ToC take precedence.

8. Confidentiality

Both parties treat all information of the other party obtained in the context of the cooperation as strictly confidential and use it exclusively for the purpose of contract performance. For penetration testing and red team projects, the confidentiality and data-processing provisions agreed in the SoW/NDA apply in addition.

9. Governing law and jurisdiction

The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods. To the extent permitted by law, the exclusive place of jurisdiction for all disputes arising out of or in connection with these GTC is Frankfurt am Main.

10. Final provisions

Should individual provisions of these GTC be or become invalid, this shall not affect the validity of the remaining provisions. Amendments and additions require text form. The European Commission provides a platform for online dispute resolution (ODR): https://ec.europa.eu/consumers/odr/. We are neither willing nor obliged to participate in dispute-resolution proceedings before a consumer arbitration board.