General Terms and Conditions (GTC)

Bi-Bala Consulting GmbH

Version 1.0
Effective Date: 01 August 2026

1. Scope

These General Terms and Conditions (“GTC”) govern all business relationships between Bi-Bala Consulting GmbH (hereinafter referred to as “Bi-Bala”) and its clients (hereinafter referred to as the “Client”).

These GTC apply to all offers, contracts, services, projects, consulting engagements, audits, training activities, and any other services provided by Bi-Bala.

Any terms and conditions of the Client shall only apply if expressly accepted by Bi-Bala in writing.

2. Services

Bi-Bala provides services including, but not limited to:

Information Security Consulting
Data Protection and Privacy Consulting
Compliance Consulting
Governance, Risk & Compliance (GRC) Services
CISO-as-a-Service
Audit Preparation and Audit Support
ISO Management System Consulting
FINMA, DORA, NIS2, PCI DSS and EASA Part-IS Compliance Support
Security Awareness and Training Services
Project Management
Development of Policies, Frameworks and Documentation

The scope, deliverables and fees shall be defined in the relevant proposal, contract, Statement of Work (SoW), or other written agreement.

Bi-Bala may engage qualified employees, subcontractors or business partners to perform the services.

3. Client Responsibilities

The Client shall provide all information, documentation, systems, access rights and contact persons required for the performance of the services in a timely manner.

The Client warrants that all information provided is accurate, complete and up to date.

Any delays, additional work or costs resulting from insufficient cooperation by the Client shall be borne by the Client.

4. Fees and Payment Terms

Unless otherwise agreed:

Invoices are payable within fourteen (14) calendar days from the invoice date.
All fees are quoted in Swiss Francs (CHF).
Applicable Value Added Tax (VAT) shall be charged separately where required by law.
Travel expenses and other reasonable out-of-pocket expenses shall be charged separately.
Bi-Bala may require advance payments or milestone payments.

In the event of late payment, Bi-Bala may charge statutory default interest and reminder fees in accordance with Swiss law.

Bi-Bala reserves the right to suspend services until all outstanding payments have been settled.

5. Appointments and Cancellations

Agreed appointments and project dates are binding.

Requests for rescheduling or cancellation must be submitted in writing.

Unless otherwise agreed, the following cancellation fees apply:

up to 10 business days before the scheduled appointment: no charge;
5 to 9 business days before the appointment: 50% of the agreed fee;
less than 5 business days before the appointment: 100% of the agreed fee.

Any third-party costs already incurred shall be charged separately.

6. Contract Duration and Termination

Contracts terminate upon completion of the agreed services.

Recurring service agreements may be terminated with thirty (30) days’ written notice to the end of a calendar month unless otherwise agreed.

Services already performed shall remain fully payable.

7. Audit, Certification and Compliance Projects

Bi-Bala assists Clients in preparing for and implementing regulatory and standard-related requirements.

Bi-Bala does not guarantee:

successful completion of audits;
granting, renewal or maintenance of certifications;
regulatory approvals;
decisions made by certification bodies, regulators or supervisory authorities.

Responsibility for compliance with applicable laws, regulations and standards remains solely with the Client.

8. Confidentiality

Both parties shall treat all non-public information as confidential.

The confidentiality obligation shall remain in force during the contractual relationship and for at least five (5) years after termination.

For trade secrets, security concepts, risk assessments and confidential client information, confidentiality obligations shall remain in effect indefinitely to the extent permitted by law.

9. Data Protection

Bi-Bala processes personal data in accordance with:

the Swiss Federal Act on Data Protection (FADP);
the General Data Protection Regulation (GDPR), where applicable.

Where required, the parties shall enter into a Data Processing Agreement (DPA).

10. Information Security

Bi-Bala implements appropriate technical and organisational security measures.

However, absolute protection against cyber-attacks, malware, data loss or service interruptions cannot be guaranteed.

The Client remains responsible for the security of its own systems and data.

11. Use of Artificial Intelligence and Digital Tools

Bi-Bala may use modern digital tools, automation solutions and artificial intelligence systems to support service delivery.

Confidential client information shall not be entered into publicly accessible AI systems unless the Client has expressly authorised such use or appropriate safeguards have been implemented.

12. Intellectual Property Rights

All methodologies, frameworks, templates, mappings, policies, concepts, documentation and work products developed by Bi-Bala remain the intellectual property of Bi-Bala Consulting GmbH.

The Client receives a non-exclusive and non-transferable right to use the deliverables for internal business purposes.

Any disclosure, transfer or commercial use by third parties requires Bi-Bala’s prior written consent.

13. Limitation of Liability

Bi-Bala shall only be liable for damages caused by wilful misconduct or gross negligence.

To the maximum extent permitted by law, liability for:

ordinary negligence;
indirect damages;
consequential damages;
loss of profit;
business interruption;
data loss;
reputational damage;
third-party claims;

is expressly excluded.

Bi-Bala’s maximum aggregate liability shall be limited to the lower of:

the value of the relevant engagement; or
CHF 100,000.

14. References

Bi-Bala may only use a Client as a reference upon the Client’s prior written approval.

15. Force Majeure

Bi-Bala shall not be liable for delays or failures caused by events beyond its reasonable control, including natural disasters, pandemics, war, strikes, governmental actions or cyber-attacks affecting third parties.

16. Miscellaneous

Should any provision of these GTC be held invalid or unenforceable, the remaining provisions shall remain unaffected.

Any amendments to these GTC must be made in writing.

17. Governing Law and Jurisdiction

These GTC shall be governed exclusively by Swiss substantive law.

The exclusive place of jurisdiction for all disputes arising out of or in connection with these GTC shall be Moosseedorf (BE), Switzerland, to the extent permitted by law.

18. Language Clause

These GTC may be made available in multiple languages.

In the event of discrepancies, inconsistencies or differing interpretations between language versions, the German version shall prevail and be legally binding.