Cyberr User Agreement

1. The Agreement

1.1 Parties

This Agreement is concluded between you and Cyberr SA, a Luxembourg public limited company (société anonyme) having its registered office at 16, Rue Beck, L-1222 Luxembourg, Grand Duchy of Luxembourg, registered with the Luxembourg Trade and Companies Register (Registre de Commerce et des Sociétés) under number B222843 ("Cyberr", "we", "our" or "us").

1.2 What this Agreement covers

This Agreement governs your access to and use of the Cyberr professional network, Heelr Marketplace and related account features, including the websites, any Cyberr-branded or Heelr-branded mobile applications, communications and any related online features that reference this Agreement (together, the "Service").

Heelr Marketplace is a service of Cyberr SA. Your Cyberr Account is the account you use to access Heelr Marketplace, and this Agreement applies to that Account, your Content, messages, files, notices, safety obligations and use of shared Cyberr features. Marketplace-specific rules apply in addition where you hire or sell through Heelr.

This Agreement does not cover Cyberr's recruitment services or its software-as-a-service products, which are subject to separate contractual terms agreed with the relevant client. Where information from the Service is made available to clients of those other Cyberr offerings, this is expressly addressed in this Agreement (see Section 3.3).

1.3 Documents that form part of this Agreement

The following documents are incorporated by reference and form an integral part of this Agreement:

• our Privacy Policy, which explains how we process personal data;
• our Cookie Policy, which explains how we use cookies and similar technologies;
• our Community Guidelines, which expand on the rules of conduct set out in Section 6;
• our Coordinated Vulnerability Disclosure Policy (see Section 7);
• where you use Heelr Marketplace, the following Heelr Marketplace documents:
  • Heelr Marketplace Terms;
  • Payment and Release Instructions;
  • Engagement Terms;
  • Testing Authorisation and Rules of Engagement;
  • Provider Verification and Badges Policy;
  • Provider Tax Information Notice;
  • Heelr Marketplace Privacy Supplement;
  • Heelr Legal Notice.

If there is any conflict between this Agreement and a linked document, this Agreement prevails unless the linked document expressly states otherwise.

1.4 Defined terms

Where capitalised in this Agreement, the following terms have the meanings set out below:

• "Account" means the personal account you create to access the Service.
• "Content" means any information that is uploaded, posted, transmitted or otherwise made available by a Member through the Service, including profile information, posts, comments, articles, messages, images, audio, video, code samples and documents.
• "Heelr Marketplace" means the Cyberr-operated marketplace features through which eligible Members may browse, post, propose, offer, contract for, deliver, fund, release, review or dispute cybersecurity services.
• "Member" means a person who has created an Account.
• "SaaS Clients" means organisations that subscribe to Cyberr's separate software-as-a-service products for the purpose of identifying and contacting cybersecurity professionals.
• "Visitor" means a person who accesses the Service without creating an Account.

2. Your Account

2.1 Eligibility

To use the Service, you must be at least 18 years old, or older where your local law requires a higher age for you to enter into this Agreement and to consent to the processing of your personal data without the involvement of a parent or legal guardian. You must also have the legal capacity to enter into a binding contract.

The Service is intended for cybersecurity professionals, students, researchers and other persons with a genuine interest in the field. It is not designed for general public use or for persons whose primary purpose is unrelated to cybersecurity.

2.2 One Account, registered in your real name

You may hold only one Account, and your Account must be registered in your real name. Although the cybersecurity community frequently uses online handles, the integrity of the Service — and its usefulness to other Members and to recruiters — depends on every Member being identifiable as a real person. You may display a professional handle on your profile in addition to your real name, but you must always provide your real name and accurate identifying information.

You undertake to keep the information on your profile truthful, accurate and up to date. Creating an Account using false information, an alias instead of your real name or in the name of someone other than yourself is a material breach of this Agreement.

2.3 Security of your Account

You are responsible for keeping your credentials confidential and for any activity that takes place through your Account. You agree to:

• choose a strong password and not share it with any other person;
• enable any additional authentication mechanism that we make available;
• promptly notify us at the address in Section 15 if you suspect unauthorised access to your Account.

You may not transfer your Account, sell or trade access to it, or allow another person to use it.

2.4 Notices and electronic communications

You agree that we may give you notices, send you messages and provide you with information relating to the Service through the Service itself or using the contact details associated with your Account (in particular your email address). You undertake to keep those contact details current. You can manage the categories of optional messages you receive in your Account settings.

3. The Service

3.1 What we offer

The Service allows Members to create a professional profile, publish and share Content, follow and interact with other Members, join groups, exchange messages, publish or apply to job-related information, access Heelr Marketplace features and otherwise build a presence within the cybersecurity community.

We may add, change, suspend or discontinue features at any time. The Service is offered on an evolving basis and we do not guarantee that any specific feature will remain available, or that the Service will be available without interruption. We will use reasonable efforts to give you advance notice of material changes that adversely affect your use of the Service.

3.2 Visitors

Some features of the Service are accessible without an Account. Visitors are also bound by the relevant provisions of this Agreement, in particular Sections 4 (Your Content), 6 (Acceptable Use), 7 (Coordinated Vulnerability Disclosure), 11 (Disclaimers and Liability) and 12 (Governing Law and Disputes).

3.3 Profile visibility — access by SaaS Clients

By creating a profile, you acknowledge and agree that the information on your profile is, by default, made available to SaaS Clients for the purpose of identifying and contacting candidates within the cybersecurity field. SaaS Clients access profiles through Cyberr's separate recruitment products under their own contractual terms with Cyberr.

If you wish to restrict who can see and contact you, please review the visibility and discoverability settings available in your Account. Note however that being discoverable by SaaS Clients is a core benefit of joining the Service; substantially restricting your visibility may significantly reduce the value the Service can offer you.

Further information on how your data is shared with SaaS Clients is set out in our Privacy Policy.

3.4 Third-party data sources

To improve the relevance and completeness of profiles within our community, Cyberr supplements information that Members provide with information licensed from professional data providers, including Mixrank (https://mixrank.com). This may include professional history, public profile information from other platforms, employer details and other professionally relevant data.

You can correct or remove third-party-sourced information that appears on your own profile through your Account settings or by contacting us at the address in Section 15. The processing of personal data in this context is described in detail in our Privacy Policy.

3.5 Recommendations and automated processing

The Service uses signals about you, your activity and other Members to suggest connections, content, jobs and features that we believe may be relevant to you, and to order what you see in your feed and in search results. The accuracy and relevance of these suggestions depend in large part on the information you provide and on how you use the Service.

We do not use these recommendation systems to make decisions that produce legal effects on you or that similarly significantly affect you, except where you are clearly informed and where any applicable legal requirements are complied with.

3.6 AI-assisted features

Some features of the Service use automated content-generation tools (sometimes referred to as "generative AI") — for example, to help you draft a profile summary, suggest skills, assist you in composing a post or message, or summarise interactions.

You should be aware that:

• the output of these features may be inaccurate, incomplete, biased, outdated or unsuitable for your purposes;
• you remain responsible for any Content you publish, regardless of whether it was produced or assisted by an AI feature, and for verifying its accuracy and appropriateness before sharing;
• you must not rely on AI-generated output for security-critical decisions — including incident response, vulnerability assessment, threat intelligence triage, compliance assessments or hiring decisions — without independent expert verification;
• you must comply with our Community Guidelines when using AI features, including any prohibition on misleading or deceptive content and any labelling requirements that we communicate to you.

We may add, change, restrict or withdraw AI features at any time, including in response to legal, security or quality concerns.

3.7 Heelr Marketplace

Heelr Marketplace allows eligible Members and organisations to browse service listings and jobs, create marketplace listings, submit proposals, make or accept direct offers, use workrooms, exchange marketplace messages and files, manage milestones or timesheets, fund work, request releases or refunds, raise disputes, receive invoices and use related marketplace tools.

Marketplace use is governed by this Agreement and by the Heelr Marketplace documents listed in Section 1.3. Those documents cover marketplace roles, contracting, payment collection and release, refunds, disputes, default engagement terms, provider verification and badges, intrusive testing authorisation, tax reporting, marketplace privacy details, legal notice information and CYRA-assisted marketplace features.

You remain responsible for evaluating any counterparty, service, job, proposal, offer, deliverable, authorisation, tax position and security risk before entering into a marketplace engagement. Verification badges, rankings, search results and CYRA suggestions are informational signals and are not guarantees.

4. Your Content

4.1 You retain ownership of your Content

As between you and Cyberr, you retain all ownership and intellectual property rights in the original Content you submit to the Service.

4.2 The licence you grant to Cyberr

To enable us to operate the Service and to make your Content visible to those you wish to reach (including, by default, to SaaS Clients as described in Section 3.3), you grant Cyberr and its affiliates a non-exclusive, worldwide, royalty-free, transferable and sub-licensable licence to host, store, copy, reproduce, adapt, modify (in particular for technical reasons such as resizing, format conversion, translation or transcription), publicly display, communicate, distribute and otherwise use your Content within the Service and in connection with the operation, promotion and improvement of the Service.

This licence is granted subject to the following safeguards:

• (a) we will respect the audience choices you make using the available settings (for example, posts limited to your connections);
• (b) we will not include your Content in third-party advertising without your separate consent, although general advertising may appear alongside your Content, and your name and profile picture may appear within the Service to indicate that you have used a feature, subject to your settings;
• (c) we will not materially alter the meaning of what you publish when we adapt your Content for technical reasons;
• (d) you can end this licence with respect to specific Content by deleting it from the Service, or generally by closing your Account, except (i) where you have already shared the Content with others who have copied or re-shared it, (ii) where we have already sub-licensed it before you delete it or close your Account, (iii) where we are required by law to retain it, and (iv) for the reasonable period that is needed for the Content to be removed from backup systems.

4.3 Your warranties about your Content

By submitting Content to the Service, you warrant that:

• you own the Content or hold all rights and authorisations necessary to share it on the Service and to grant the licence in Section 4.2;
• the Content does not infringe the rights of any third party (including intellectual property, privacy, image, publicity, contractual or confidentiality rights);
• the Content does not contain confidential information of your employer, client or any other person whose consent you do not have;
• the Content complies with this Agreement, with the Community Guidelines and with applicable law.

4.4 Other Members' Content

You may encounter Content posted by other Members that is inaccurate, incomplete, misleading, offensive or unlawful. We are not responsible for the Content of other Members. While we apply automated tools and human review to detect violations, we cannot guarantee that all problematic Content will be identified or removed.

You acknowledge the risk that other persons may share inaccurate or misleading information about you and that you may be mistakenly associated with content concerning others. You can use the reporting mechanisms set out in Section 8 to draw any such Content to our attention.

4.5 Feedback

If you provide us with suggestions, ideas or feedback about the Service, you agree that we may use that feedback freely for any purpose, without obligation or compensation to you.

5. Sharing and connecting

The Service is built around the sharing of professional information. When you share Content or interact with others through likes, comments, follows, group participation or messages, that information may be seen, copied or further shared, both by Members and (where applicable) by people outside the Service.

We will respect the audience settings available in the Service. Where you choose a public audience, your Content may be indexed by external search engines and displayed off the Service. For job-related interactions, our default settings are designed to limit notifications to your connections in order to preserve your discretion.

We are not obliged to publish, store or continue to display any Content. The Service is not a storage service: you should keep your own copy of any Content that is important to you.

6. Acceptable Use

6.1 What you must do

You agree to:

• comply with all applicable laws, including laws on intellectual property, privacy, data protection, anti-spam, export controls and computer crime;
• use the Service in good faith and for genuine professional purposes;
• provide accurate identifying information and keep it up to date;
• respect the rights, reputation and dignity of other Members and third parties;
• comply with the Community Guidelines.

6.2 What you must not do — general rules

You agree that you will not:

• create a false identity, impersonate another person or organisation, or hold more than one Account;
• create or attempt to create an Account on behalf of someone else, or use another person's Account;
• harass, threaten, defame, intimidate or discriminate against any person;
• publish Content that is unlawful, deceptive, fraudulent, hateful, sexually explicit, gratuitously violent or harmful to minors;
• publish Content that infringes the intellectual property, privacy, image or other rights of any third party;
• send unsolicited commercial messages, chain messages or other forms of spam;
• use the Service to recruit candidates as a professional recruiter or sourcer outside the framework offered by Cyberr to its SaaS Clients;
• collect, scrape or store the personal data of other Members in any way that is inconsistent with this Agreement or with applicable data protection law;
• use any robot, scraper, crawler, spider, browser plug-in, automated script or other means to access, copy, index or monitor any part of the Service or any Content (except as permitted under the limited and conditional exception set out in Section 7);
• circumvent, disable or otherwise interfere with security features, rate limits or access controls of the Service;
• reverse engineer, decompile or disassemble any part of the Service, except to the extent that the law expressly permits this notwithstanding any contractual restriction (including, where applicable, the limited rights granted under Article 6 of Directive 2009/24/EC);
• frame, mirror or otherwise simulate the appearance of the Service, or overlay or modify it (including by inserting, hiding or covering elements such as advertisements);
• introduce viruses, worms, trojans, ransomware or any other malicious code into the Service;
• use the Service to perform denial-of-service or other attacks against the Service or any third party;
• rent, lease, sell, sub-license or otherwise commercially exploit the Service or any Content obtained through it without our prior written consent;
• imply that you are affiliated with, sponsored by or endorsed by Cyberr without our prior written consent.

6.3 What you must not do — cybersecurity-specific rules

Because Cyberr is a community of cybersecurity professionals, certain conduct that might be tolerated on a generic platform is prohibited here. In addition to Section 6.2, you must not use the Service to:

• (a) Distribute malicious code or attack tooling — publish, link to or distribute malware, ransomware, exploit kits, stealer logs, command-and-control infrastructure, packed payloads or other malicious code, except in clearly labelled, defanged form within a private group whose stated purpose is academic or defensive research;
• (b) Disclose unpatched vulnerabilities — publicly disclose specific, exploitable details of an unpatched vulnerability affecting an identified third-party product, system or person before the vendor or owner has had a reasonable opportunity to remediate it under a coordinated vulnerability disclosure process;
• (c) Distribute stolen or leaked data — share, link to or facilitate the trade of leaked credentials, stolen personal data, breach dumps, illicit databases or any other data obtained without authorisation, including under the guise of "research" or "awareness";
• (d) Designate targets — name or otherwise identify a specific individual, organisation, system, IP range or domain as a target for attack, doxxing, harassment or "ethical hacking" without the express prior authorisation of the owner;
• (e) Offer or solicit offensive services — offer, advertise or seek services that involve unauthorised access to systems or data, including hack-for-hire, account takeover, surveillanceware, deepfake fraud, harassment-as-a-service or similar offerings;
• (f) Use the Service as attack infrastructure — use any Cyberr feature (including profiles, posts, messages, file attachments or links) for command-and-control, phishing infrastructure, malware delivery, credential harvesting, reconnaissance staging or data exfiltration;
• (g) Test third parties through the Service — launch, route, plan or coordinate any unauthorised security testing — including scans, fuzzing, social-engineering campaigns or red-team operations — against any third party, whether through the Service or merely documented on it;
• (h) Misuse messaging or contact features — use direct messages, mentions, comments or contact features for phishing, social-engineering pretexting, "watering hole" recruitment or other deceptive practices, even where framed as research or awareness.

These prohibitions apply equally regardless of whether your stated framing is defensive, offensive, "research" or "educational". The Community Guidelines provide further examples and clarifications.

6.4 Enforcement

We reserve the right, but assume no obligation, to monitor the Service for compliance with this Agreement. Where we identify Content or conduct that we reasonably consider to violate this Agreement, the Community Guidelines or applicable law, we may take any of the measures described in Section 8, including removing Content, restricting features, suspending or terminating Accounts.

7. Coordinated Vulnerability Disclosure

We welcome good-faith security research on the Service.

If you believe you have discovered a vulnerability affecting the Service, you may test, report and obtain authorisation to continue research in accordance with our Coordinated Vulnerability Disclosure Policy (the "CVD Policy"), or by writing to security@cyberr.ai.

Conduct that strictly complies with the CVD Policy will not be treated as a violation of Sections 6.2 or 6.3 (in particular the prohibitions on automated access, circumvention of access controls, reverse engineering and the cybersecurity-specific rules), and Cyberr will not pursue legal action in respect of such conduct.

Any conduct that goes beyond the scope of the CVD Policy — including testing on third parties, accessing data of other Members beyond what is strictly necessary, or public disclosure inconsistent with the CVD Policy — remains a violation of this Agreement and may result in the measures described in Section 8.

8. Content moderation, reporting and complaints

8.1 Our moderation measures

Where Content or conduct violates this Agreement or applicable law, we may, in a manner that is proportionate to the violation:

• restrict the visibility or accessibility of specific items of Content;
• remove specific items of Content;
• suspend or terminate the use of specific features by a Member;
• suspend, restrict or terminate an Account;
• demote Content in feeds, search results or recommendations;
• decline to publish or distribute Content.

We may take these measures with or without prior notice, depending on the nature and seriousness of the violation and on what is required by law.

8.2 Statement of reasons

Where we restrict the visibility, remove, demote or otherwise act against your Content, or suspend or terminate the provision of the Service to you, on the basis of an alleged violation of this Agreement, we will provide you, where required by applicable law, with a clear and specific statement of reasons explaining our decision and your possibilities of redress.

8.3 Reporting violations and rights infringements

You can report Content that you believe violates this Agreement, the Community Guidelines or your rights (including intellectual property rights or rights relating to illegal content) using the in-Service reporting tools or by writing to the address set out in Section 15.3. Reports will be handled in a timely, diligent and non-arbitrary manner. We may ask for additional information in order to assess your report properly.

8.4 Internal complaints

If we restrict the availability of your Content, suspend the provision of the Service to you or close your Account on the basis of an alleged violation of this Agreement, you have the right to lodge a complaint with us, free of charge, within six months of our decision. Your complaint will be reviewed by a person who did not take the original decision, and we will inform you of the outcome and of the reasons for it without undue delay.

8.5 Out-of-court dispute settlement

You may also seek to resolve disputes about our content-moderation decisions through certified out-of-court dispute settlement bodies in accordance with applicable law. Recourse to such bodies is without prejudice to your right to bring proceedings before a court at any time, in accordance with Section 12.

8.6 Misuse of reporting and complaints mechanisms

We may suspend, for a reasonable period and after a prior warning, the processing of notices and complaints submitted by Members or other persons who frequently submit notices or complaints that are manifestly unfounded.

9. Intellectual property of Cyberr

The Service and all of its components — software, design, structure, databases, trademarks, logos, sounds and any associated documentation — are protected by intellectual property laws. Cyberr (or its licensors) retains all rights, title and interest in the Service that are not expressly granted to you in this Agreement.

"Cyberr" and the Cyberr logo are trademarks of Cyberr SA. You may not use them without our prior written consent, except as strictly necessary to refer factually to the Service.

10. Suspension and termination

10.1 Termination by you

You may terminate this Agreement at any time, and free of charge, by closing your Account through your Account settings or by writing to us at the address in Section 15. Termination by you takes effect from the closure of your Account, without prejudice to obligations and licences that survive termination as set out in Section 10.3.

10.2 Termination or suspension by Cyberr

We may suspend or terminate your Account or this Agreement, with or without notice, where:

• you have committed a material or repeated violation of this Agreement;
• your conduct exposes Cyberr, its Members or third parties to legal, security or reputational risk;
• we are required to do so by law, by a competent authority or by court order;
• we cease to operate the Service or any material part of it.

For violations that are not serious or irremediable, we will, where appropriate and feasible, notify you and give you the opportunity to remedy the violation before terminating your Account.

10.3 Effects of termination

When this Agreement ends, you lose the right to access and use the Service. The provisions that, by their nature, are intended to survive termination — including Section 4.2 (subject to its carveouts), Section 4.5, Section 6, Section 8, Section 9, Section 11, Section 12, Section 13 and Section 14 — will continue to apply. Any liabilities accrued by either party before termination remain owed after termination.

11. Disclaimers and limitation of liability

11.1 Service provided "as is"

To the fullest extent permitted by law, the Service is provided "as is" and "as available", without any warranty of any kind, whether express, implied or statutory, including warranties of merchantability, fitness for a particular purpose, accuracy, completeness, uninterrupted availability, security or non-infringement.

In particular, we make no warranty:

• that the Service will be available without interruption, error or delay;
• that any Content (including Content sourced from third-party data providers such as Mixrank) is accurate, current or complete;
• that the output of recommendation features or AI-assisted features (where offered) is accurate, useful or fit for any particular purpose.

Where you intend to rely on any Content for any purpose, it is your responsibility to verify its accuracy and suitability.

11.2 Limitation of liability

To the fullest extent permitted by law, Cyberr and its affiliates will not be liable for:

• indirect, incidental, special, consequential or punitive damages;
• loss of profits, loss of business, loss of opportunity, loss of goodwill or harm to reputation;
• loss of, alteration of or unavailability of data or Content;

in each case in connection with this Agreement or the Service. The aggregate liability of Cyberr to you in connection with this Agreement and the Service shall not, to the fullest extent permitted by law, exceed one thousand euros (EUR 1,000).

11.3 Exceptions

Nothing in this Agreement excludes or limits Cyberr's liability for:

• death or personal injury caused by Cyberr's fault;
• intentional misconduct (faute intentionnelle ou dol) or gross negligence (faute lourde);
• any other liability that cannot lawfully be excluded or limited under Luxembourg law or under any mandatory consumer protection law applicable to you.

Where Cyberr breaches a material obligation — that is, an obligation that is fundamental to the performance of this Agreement and on which you may legitimately rely — Cyberr's liability is limited to direct damages that were foreseeable at the time the Agreement was concluded and that are typical for a contract of this kind.

12. Governing law and disputes

12.1 Governing law

This Agreement is governed by the laws of the Grand Duchy of Luxembourg, excluding its conflict-of-law rules.

If you use the Service as a consumer and your habitual residence is in another country of the European Union or the European Economic Area, you also benefit from the mandatory protections of the consumer law of that country, in accordance with Article 6 of Regulation (EC) No 593/2008 (Rome I).

12.2 Jurisdiction

Subject to any mandatory provision of consumer law, any dispute arising out of or in connection with this Agreement shall be submitted to the exclusive jurisdiction of the courts of the City of Luxembourg, without prejudice to your right, as a consumer, to bring proceedings before the courts of your habitual residence.

13. Changes to the Agreement

We may amend this Agreement from time to time, in particular to reflect changes in the law, in the Service or in our business practices. Where we make a material change, we will give you reasonable advance notice through the Service or by email and, where possible, an opportunity to review the changes before they take effect.

If you do not agree with a change, you may stop using the Service and close your Account before the change takes effect. By continuing to use the Service after the effective date of a change, you accept the updated Agreement.

We will not apply changes retroactively. Where a change is required by law to take effect immediately, or where it relates to a newly-launched feature, we may not be able to provide advance notice.

14. Miscellaneous

Entire agreement. This Agreement (together with the documents listed in Section 1.3) constitutes the entire agreement between you and Cyberr regarding the Service and supersedes any previous agreement on the same subject.

Severability. If any provision of this Agreement is held to be invalid, illegal or unenforceable, the remaining provisions remain in full force; the invalid provision will be replaced by a valid provision that, to the extent possible, gives effect to the original intent of the parties.

No waiver. A failure or delay by Cyberr in enforcing any provision of this Agreement does not amount to a waiver of that provision.

Assignment. You may not assign or transfer this Agreement, or any of your rights or obligations under it, without our prior written consent. Cyberr may assign this Agreement, in whole or in part, to an affiliate or to a successor in connection with a merger, acquisition or sale of business.

No third-party beneficiaries. Except as expressly stated, this Agreement does not create rights for the benefit of third parties.

Language. This Agreement is concluded in English. Where Cyberr provides a translation, the English version prevails in case of discrepancy, unless otherwise required by law.

15. How to contact us

15.1 General contact and notices

For any question about this Agreement, you can contact us at:

Cyberr SA (a Luxembourg public limited company — société anonyme)
16, Rue Beck
L-1222 Luxembourg
Grand Duchy of Luxembourg
Email: dataprivacy@cyberr.ai

Formal legal notices to Cyberr must be sent in writing to the postal address above.

15.2 Single point of contact (Digital Services Act)

For the purposes of Articles 11 and 12 of Regulation (EU) 2022/2065 (Digital Services Act), our single point of contact for Members, recipients of the Service and authorities is: dataprivacy@cyberr.ai. Communications may be made in English or French.

15.3 Reporting illegal content

To report Content that you believe is illegal, please use the in-Service reporting tools or write to: support@cyberr.ai.