# SUPPLEMENTARY TERMS AND CONDITIONS CONSULTING ## Rule Step B.V. [besloten vennootschap; private limited liability company] --- **Version:** 1.0 **Date of entry into force:** 30 September 2026 These Supplementary Terms and Conditions Consulting ("AVC") are, in addition to the General Terms and Conditions of Rule Step B.V. (hereinafter: "AW") and — insofar as applicable — the Order Form, applicable to every agreement between Rule Step B.V. and a Customer with respect to consulting and advisory services. Definitions from the General Terms and Conditions (AW Art. 1.1) apply mutatis mutandis. The AVC contain exclusively rules that are specific to consulting; generic rules are set out in the AW. --- ## Article 1 — Definitions and Applicability **Statutory basis:** Articles 7:400, 7:401, 7:402 BW (Dutch Civil Code). ### 1.1 Supplementary definitions In these Supplementary Terms and Conditions, the following shall be understood to mean: a. **Consulting Services**: the ICT advisory and consultancy work to be performed by Rule Step, including but not limited to EU sovereignty and infrastructure advice, data and product advice, technical analyses, audits and related advisory assignments, in each case as further described in the Order Form; b. **Assignment** (Opdracht): the contract for services (overeenkomst van opdracht) within the meaning of article 7:400 BW between Rule Step and the Customer with regard to Consulting Services; c. **Work** (Werkzaamheden): the work to be performed by Rule Step within the framework of the Assignment, as described in the Order Form; d. **Work Product** (Werkproduct): all results of the Work, in whatever form, including but not limited to advisory reports, analyses, documentation, recommendations, plan and architecture documents, code examples and presentations; e. **Order Form** (Opdrachtformulier): the signed document in which the specific Assignment is recorded (see AW Art. 1.1 under g). ### 1.2 Applicability 1.2.1 These Supplementary Terms and Conditions apply to every Assignment for the performance of Consulting Services, in addition to the General Terms and Conditions and the Order Form. In the event of conflict, the Order Form prevails over these Supplementary Terms and Conditions, and these Supplementary Terms and Conditions prevail over the General Terms and Conditions, without prejudice to the protection of the Consumer pursuant to article 6:231 et seq. BW (Dutch Civil Code). 1.2.2 These Supplementary Terms and Conditions do not apply to online services (hosting, domains, e-mail, certificates, licences, back-ups). For those services, the Supplementary Terms and Conditions Online Services apply. --- ## Article 2 — Nature of the Agreement; Independent Performance **Statutory basis:** Articles 7:400, 7:401, 7:402, 7:408 BW (Dutch Civil Code); 6:248 BW (Dutch Civil Code); 7:610 BW (Dutch Civil Code). ### 2.1 Contract for services 2.1.1 The Assignment is a contract for services (overeenkomst van opdracht) within the meaning of article 7:400 BW. The parties have deliberately chosen this legal form and not an employment contract (arbeidsovereenkomst) within the meaning of article 7:610 BW or any other form of employment relationship (dienstbetrekking). 2.1.2 Rule Step bears an obligation of best efforts (inspanningsverbintenis), not an obligation of result (resultaatsverbintenis), unless a specific result has been expressly agreed in the Order Form as an obligation of result (article 7:401 BW). ### 2.2 Independent performance; 7:402 BW 2.2.1 Rule Step performs the Work independently and without supervision. Rule Step itself determines the manner in which the Work is performed, the working hours and the order of the work, within the framework of the Order Form. 2.2.2 The Customer may only give instructions regarding the result of the Work, not regarding the manner of performance, in accordance with article 7:402 BW. 2.2.3 Rule Step is authorised to engage third parties for the performance of (parts of) the Work, provided that Rule Step continues to bear the responsibility for the performance by those third parties and confidentiality and quality remain guaranteed. ### 2.3 Other principals permitted 2.3.1 Rule Step is permitted to perform work for other principals, provided these activities do not create a conflict of interest with the Customer and do not impede the performance of the present Assignment. ### 2.4 No employment-law protection 2.4.1 The provisions of employment law, including but not limited to articles 7:610 et seq. BW (Dutch Civil Code), the Wet minimumloon en minimumvakantiebijslag [Minimum Wage and Minimum Holiday Allowance Act], the Wet werk en inkomen naar arbeidsvermogen (WIA) [Work and Income (Capacity for Work) Act], and the applicable CAO [collective labour agreement] provisions, do not apply to the Assignment. Rule Step itself organises its social and occupational-incapacity protection. --- ## Article 3 — Performance of the Assignment **Statutory basis:** Articles 7:401, 7:402 and 7:403 BW (Dutch Civil Code). ### 3.1 Due care and industry standards 3.1.1 Rule Step performs the Work with the due care that may be expected of a reasonably acting and competent ICT consultant, in accordance with the applicable industry standards, methodologies and guidelines (article 7:401 BW). 3.1.2 In the performance of the Work, Rule Step takes into account the state of the art, relevant security and privacy standards (such as ISO 27001, NIST CSF, ENISA guidance) and the interests of the Customer. ### 3.2 Information and cooperation 3.2.1 The Customer provides in good time all information, documentation and access that is reasonably necessary for the performance of the Assignment. Rule Step is not liable for delays or defects in the Work Product that are the result of incorrect, incomplete or late information provided by the Customer. ### 3.3 Location 3.3.1 The Work is performed from the location stated in the Order Form, or — failing that — from the location that Rule Step reasonably deems appropriate. The Customer may request that work be performed at a specific location, provided the associated travel and accommodation costs have been agreed in writing in advance. --- ## Article 4 — Advisory Character; No Guarantee of Result **Statutory basis:** Articles 6:74 and 6:248 BW (Dutch Civil Code). ### 4.1 Advisory character 4.1.1 The Work consists of rendering advice, analyses and recommendations. The Work Product is advice the content of which depends on complex technical, legal and organisational factors that lie partly outside the control of Rule Step. ### 4.2 No guarantees of outcomes 4.2.1 Rule Step does not guarantee that the outcomes of the Work will produce a particular (financial, technical or strategic) result for the Customer. The Customer is itself responsible for assessing the applicability of the advice and for the decision-making taken in response thereto. 4.2.2 If specific milestones or deliverables have been agreed in the Order Form, the provisions of article 4.2.1 apply without prejudice; the delivery of a milestone is an obligation of best efforts (inspanningsverbintenis) with regard to the realisation of the agreed document or the agreed advisory result. ### 4.3 Excluding implementation 4.3.1 The Assignment does not comprise the actual execution (implementation) of the advice, unless this has been expressly agreed in the Order Form. For implementation work, a separate Assignment is, where applicable, concluded. --- ## Article 5 — Remuneration and Payment **Statutory basis:** Articles 6:119 and 6:248 BW (Dutch Civil Code); AW Art. 5. ### 5.1 Remuneration structure 5.1.1 The remuneration for the Work is recorded in the Order Form, either as a fixed fee (fixed price), or as an hourly rate (time & materials), or as a combination thereof. 5.1.2 All prices are exclusive of BTW [Belasting over de Toegevoegde Waarde; VAT]. Rule Step applies the VAT rate applicable under or pursuant to the Wet op de omzetbelasting 1968 [Turnover Tax Act 1968], unless the Work falls under a reverse-charge or exemption scheme. ### 5.2 Invoicing and payment 5.2.1 [B2B] Invoicing takes place monthly in arrears, or in accordance with the invoicing schedule agreed in the Order Form (for example at milestones). The payment term is fourteen (14) days after the invoice date. 5.2.2 [B2C] Invoicing takes place upon delivery of (parts of) the Work Product, or in accordance with the schedule agreed in the Order Form. The payment term is fourteen (14) days after the invoice date. 5.2.3 Non-payment, default (verzuim), interest and collection costs are governed by the General Terms and Conditions (AW Art. 5.2). ### 5.3 Cost reimbursement 5.3.1 Any costs incurred by Rule Step (such as travel, accommodation and material costs) are not reimbursed separately, unless this has been agreed in advance in the Order Form. Cost reimbursements are provided with a proper invoice or receipt, so that the Customer can process these correctly for tax purposes. --- ## Article 6 — Intellectual Property in the Work Product **Statutory basis:** Auteurswet 1912 [Dutch Copyright Act 1912] articles 2, 12a and 25; BW 3:83 (Dutch Civil Code). ### 6.1 Transfer of rights in the Work Product 6.1.1 All intellectual property rights, including but not limited to copyrights and neighbouring rights, arising out of or connected with the Work Product, vest solely and exclusively in the Customer upon delivery of the relevant Work Product and after full payment of the remuneration agreed therefor. 6.1.2 The transfer comprises, insofar as transferable, all exploitation rights, adaptation rights and the right to modify, to reproduce, to make public and to sublicence the Work Product, for the full duration of the copyright protection. 6.1.3 Transfer without mention of the makers involved in the creation (Rule Step and/or the third parties engaged by Rule Step) is null and void insofar as it concerns the transfer of the copyright, in accordance with article 12a Auteurswet 1912 [Dutch Copyright Act 1912]. Rule Step will state all involved makers by first name and surname (naam en toenaam) in the Order Form or in an accompanying transfer document. ### 6.2 Moral right; attribution [B2C] 6.2.1 [B2C] The Consumer is informed that the moral rights (persoonlijkheidsrechten) of the maker (including the right to attribution (naamsvermelding), article 25 Auteurswet) are not fully transferable. Insofar as the law permits this, Rule Step grants the Customer the broadest possible licence to exercise these moral rights (persoonlijkheidsrechten), including the right to waive attribution (article 25 paragraph 3 Auteurswet). ### 6.3 Reservation in case of non-payment 6.3.1 If the Customer fails to fulfil his payment obligations, Rule Step reserves the right to withhold the transfer mentioned in this article until the Customer has paid in full, without prejudice to Rule Step's right to remuneration for the performances already rendered. ### 6.4 Rights reserved by Rule Step 6.4.1 Rule Step reserves all rights to its own pre-existing methodologies, templates, and tooling that have not been developed specifically for the Customer, and to generic knowledge acquired by Rule Step during the Assignment that does not contain confidential information of the Customer. --- ## Article 7 — Confidentiality **Statutory basis:** Articles 6:162 and 6:248 BW (Dutch Civil Code); AW Art. 14. ### 7.1 Duty of confidentiality 7.1.1 The parties keep confidential all information that they receive from each other within the framework of the Assignment and that is confidential in nature or of which one must reasonably understand that it is confidential. The duty of confidentiality applies without prejudice to the exceptions included in AW Art. 14. 7.1.2 Rule Step uses confidential information of the Customer exclusively for the purpose for which it was provided and not for its own or other purposes. ### 7.2 Duration 7.2.1 The duty of confidentiality remains in force during the term of the Assignment and for five (5) years after termination thereof. ### 7.3 Breach 7.3.1 A breach of the duty of confidentiality constitutes an unlawful act (onrechtmatige daad) within the meaning of article 6:162 BW and is grounds for immediate termination of the Assignment, without prejudice to the right of the aggrieved party to full compensation. --- ## Article 8 — Non-solicitation **Statutory basis:** Articles 6:248, 6:258, 7:428 BW (Dutch Civil Code); for B2C: 6:236 BW (Dutch Civil Code). ### 8.1 Restriction 8.1.1 During the term of the Assignment and for six (6) months after termination thereof, Rule Step shall not approach customers of the Customer with whom Rule Step has maintained direct business relations within the framework of the Assignment, with the aim of recruiting these customers for itself or for third parties (non-solicitation), other than via the Customer. The same applies conversely for the Customer vis-à-vis employees of Rule Step who have been directly involved in the performance of the Assignment. 8.1.2 This non-solicitation obligation does not apply to: (a) customers with whom Rule Step already maintained business relations prior to the commencement of the Assignment; (b) customers who contact Rule Step on their own initiative; (c) generic, non-targeted marketing efforts (such as public website content or general newsletters). ### 8.2 Proportionality and moderation 8.2.1 The parties acknowledge that the scope of this article in duration (six months) and scope (limited to direct customers and directly involved employees) is proportionate to the interest to be protected, in accordance with articles 6:248, 6:258 and 7:428 BW. A court may moderate (matigen) or annul this clause (beding) if, in view of the circumstances of the case, it is deemed unreasonably onerous. ### 8.3 Consumer protection [B2C] 8.3.1 [B2C] A clause that unreasonably restricts the professional practice (beroepsuitoefening) or the obtaining of income of the Customer (Consumer) is null and void pursuant to article 6:231 et seq. BW (Dutch Civil Code). ### 8.4 Remuneration 8.4.1 The remuneration for the Work is deemed to include a reasonable remuneration by way of compensation for the restriction of Rule Step under this article. --- ## Article 9 — Duration, Termination and Return **Statutory basis:** Articles 7:408, 7:411 BW (Dutch Civil Code); 6:265, 6:271 BW (Dutch Civil Code); for B2C: 6:233 BW (Dutch Civil Code). ### 9.1 Duration 9.1.1 The Assignment is entered into for the duration stated in the Order Form. In the absence of a specific duration, the Assignment is deemed to have been entered into for an indefinite period. ### 9.2 Termination [B2B] 9.2.1 [B2B] Both parties may terminate the Assignment for an indefinite period in writing, with due observance of a notice period of one (1) month, unless a longer period has been agreed in the Order Form. Article 7:408 paragraph 2 BW applies mutatis mutandis. ### 9.3 Termination [B2C] 9.3.1 [B2C] The Consumer may terminate the Assignment at any time with a notice period of at most one (1) month, unless the nature of the Assignment opposes a shorter period. ### 9.4 Dissolution for breach 9.4.1 Each of the parties may, without prejudice to the provisions of article 7:411 BW, dissolve the Assignment without judicial intervention if the other party, after a written notice of default (ingebrekestelling) in which a reasonable period for remedy has been offered, remains in default. ### 9.5 Return of materials 9.5.1 Upon termination of the Assignment, for whatever reason, Rule Step returns without delay, but no later than within fourteen (14) calendar days, all materials, documents and data received from the Customer, or destroys these irretrievably and provides written proof thereof. ### 9.6 Remuneration upon premature termination 9.6.1 In the event of premature termination, the Customer owes the remuneration for the Work already performed and the costs incurred, pro rata to the performed part of the Assignment. The provisions of article 6:271 BW (withholding/retention (onthouding)) apply mutatis mutandis. --- ## Article 10 — Force Majeure **Statutory basis:** Articles 6:75 and 6:265 BW (Dutch Civil Code); AW Art. 11. ### 10.1 Definition 10.1.1 Force majeure (overmacht) is understood to mean every circumstance independent of the will of Rule Step, unforeseeable and unavoidable, that makes compliance with the Assignment reasonably impossible, including but not limited to: natural disasters, war, terrorism, pandemics, government measures, strikes at third parties, disruptions in (internet) infrastructure, and essential suppliers becoming unavailable. ### 10.2 Notification 10.2.1 The party invoking force majeure notifies the other party thereof in writing within seven (7) calendar days after the occurrence of the force majeure situation, stating the nature of the force majeure and the expected duration. ### 10.3 Consequences 10.3.1 During the force majeure period, the performance obligations of Rule Step are suspended. Rule Step is not liable for damage as a result of failures during the force majeure period. 10.3.2 If the force majeure situation continues for longer than ninety (90) days, each of the parties is entitled to dissolve the Assignment in writing for the part of the Work that is affected by the force majeure, without prejudice to the remuneration for performances already rendered. ### 10.4 Consumer — shorter period [B2C] 10.4.1 [B2C] A Consumer may dissolve the Assignment in the event of force majeure that lasts longer than fourteen (14) calendar days, in accordance with article 6:265 BW, without prejudice to his right to restitution of performances already paid but not yet delivered. --- ## Article 11 — Privacy and Data Processing **Statutory basis:** AVG (GDPR) articles 5, 6, 28, 32-34; Uitvoeringswet AVG [GDPR Implementation Act]; AW Art. 12. ### 11.1 Division of roles 11.1.1 For the administrative processing operations that are necessary for the performance of the Assignment (contact details, project communication, invoicing), Rule Step acts as controller (verwerkingsverantwoordelijke) in accordance with the Privacy Policy. 11.1.2 If Rule Step, within the framework of the Assignment, processes personal data on behalf of the Customer (for example when advising on a data breach (datalek) or analysing a customer database), Rule Step acts as processor (verwerker) within the meaning of article 4 paragraph 8 AVG (GDPR) and the Customer as controller (verwerkingsverantwoordelijke). In that case, the parties conclude a Data Processing Agreement (Verwerkersovereenkomst, DPA) in accordance with article 28 AVG (GDPR). 11.1.3 The nature, the purpose, the categories of data subjects (betrokkenen) and the categories of personal data are recorded per Assignment in the Data Processing Agreement or in an annex to the Order Form. ### 11.2 Security 11.2.1 Rule Step takes appropriate technical and organisational measures to safeguard the confidentiality, integrity and availability of the personal data, in accordance with article 32 AVG (GDPR). The standard measures are described in the Data Processing Agreement (DPA Annex C). ### 11.3 Data breaches (datalekken) — 48 hours 11.3.1 If Rule Step, within the framework of an Assignment, identifies a data breach (datalek) with regard to personal data that it processes on behalf of the Customer, Rule Step informs the Customer thereof without delay, but no later than within forty-eight (48) hours after identification, in accordance with article 33 paragraph 2 AVG (GDPR) and the Data Processing Agreement (DPA Art. 7). 11.3.2 Rule Step lends its cooperation to the notification to the Autoriteit Persoonsgegevens [Dutch Data Protection Authority] (article 33 AVG) and, if required, to data subjects (article 34 AVG). ### 11.4 Data Processing Agreement (DPA) 11.4.1 If and insofar as Rule Step processes personal data on behalf of the Customer in an Assignment, the Data Processing Agreement (Verwerkersovereenkomst, DPA) of Rule Step forms part of the agreement. The current version of the DPA is available via privacy@rulestep.com. ### 11.5 Retention periods 11.5.1 Rule Step retains customer and project data after termination of the Assignment for a period of five (5) years, in view of the legitimate interest (gerechtvaardigd belang) of Rule Step to be able to defend itself against possible liability claims within the applicable limitation period (article 3:306 BW for unlawful acts, article 3:307 BW for contractual claims). For consulting assignments with consumers (B2C), the retention period is limited to two (2) years, unless a statutory obligation to retain longer opposes erasure. --- ## Article 12 — Dispute Resolution **Statutory basis:** Article 6:248 BW (Dutch Civil Code); Regulation (EU) No 1215/2012 (Brussels I bis); AW Art. 16. ### 12.1 Amicable settlement 12.1.1 The parties endeavour to resolve a dispute at first instance in mutual consultation. The party that believes it has a dispute notifies this in writing and with reasons to the other party, after which the parties have at least fourteen (14) calendar days to reach an amicable settlement. ### 12.2 Mediation 12.2.1 If the amicable settlement fails, the parties may jointly decide to engage an independent mediator. The costs of mediation are divided equally between the parties, unless the parties agree otherwise. ### 12.3 Arbitration 12.3.1 If mediation is not initiated or does not lead to a solution, the parties may jointly decide to submit the dispute to arbitration in accordance with the rules (reglement) of the Nederlands Arbitrage Instituut (NAI) [Netherlands Arbitration Institute]. The arbitral award is binding. ### 12.4 Court [B2B] 12.4.1 [B2B] If the parties do not jointly decide on arbitration, disputes shall be submitted to the competent court in the arrondissement [judicial district] in which Rule Step B.V. has its statutory seat (Amsterdam), without prejudice to mandatory statutory provisions. ### 12.5 Court [B2C] 12.5.1 [B2C] The Consumer may at all times choose the competent court in the arrondissement where the Consumer has his place of residence, in accordance with article 18 paragraph 1 of Regulation (EU) No 1215/2012 (Brussels I bis) The Consumer may furthermore make use of the European Online Dispute Resolution Platform (Europees Onlinegeschillenbeslechtingsplatform) (see AW Art. 16.3). --- ## Article 13 — Insurance **Statutory basis:** Article 6:248 BW (Dutch Civil Code). ### 13.1 Professional liability 13.1.1 Rule Step maintains during the term of the Assignment an adequate professional liability insurance (beroepsaansprakelijkheid / professional indemnity insurance) with a minimum cover of five hundred thousand euros (EUR 500,000) per claim, valid in the jurisdiction in which the Work is performed. 13.1.2 At the request of the Customer, Rule Step provides proof of this insurance (insurance certificate) and proof of timely premium payment. ### 13.2 Insurance of the Customer 13.2.1 The Customer is itself responsible for adequate insurance of its own business activities, including but not limited to a bedrijfsaansprakelijkheidsverzekering (AVB) [business liability insurance] and a cyber insurance policy insofar as appropriate to its risk profile. --- ## Article 14 — Final Provisions **Statutory basis:** Articles 3:41 and 6:93 BW (Dutch Civil Code). ### 14.1 Applicable law 14.1.1 These Supplementary Terms and Conditions and the Assignment are governed by Dutch law. The applicability of the Weens Koopverdrag (CISG) [Vienna Sales Convention; UN Convention on Contracts for the International Sale of Goods] is excluded. ### 14.2 Nullity 14.2.1 If one or more provisions of these Supplementary Terms and Conditions are null and void or voidable, the other provisions remain fully in force. In that case, the parties enter into consultation to replace the null provision with a provision that reflects as much as possible the original purport and economic intention. ### 14.3 Transfer 14.3.1 Neither party is authorised to transfer its rights and obligations under these Supplementary Terms and Conditions to a third party without the prior written consent of the other party. Consent will not be unreasonably withheld. ### 14.4 Precedence 14.4.1 In the event of conflict between these Supplementary Terms and Conditions, the General Terms and Conditions and the Order Form, the hierarchy of AW Art. 1.4 applies. In the event of conflict with mandatory consumer law, the mandatory provisions prevail. --- ## Execution These Supplementary Terms and Conditions Consulting have been adopted by the management board (bestuur) of Rule Step B.V. and enter into force on 30 September 2026. Place: Amsterdam, the Netherlands Date: 30 September 2026 ________________________________________ **J.J. van Grondelle** Director (alleen/zelfstandig bevoegd [solely/independently authorised]) --- *For questions about these Supplementary Terms and Conditions Consulting: hello@rulestep.com* *For questions about data processing in consulting assignments: privacy@rulestep.com*