General Terms and Conditions

Rijker Advisory
Sole proprietorship, registered with the Netherlands Chamber of Commerce (KvK) under number 70443718
VAT number NL001131887B30
Business address available on request; correspondence via rion@rijkeradvies.nl
Website: rijkeradvies.nl
Founder and Principal Counsel: Rion Rijker

Rijker Advisory provides independent advice in the areas of governance forensics, sports governance and integrity advisory, privacy and IT law. Rion Rijker acts as counsel (adviser) and not as an attorney at law (advocaat). No attorney-client relationship arises through Rijker Advisory's services and the Dutch bar disciplinary regime does not apply. Rion Rijker acts as external Data Protection Officer (DPO) within the meaning of Article 37 GDPR for Clients who designate Rijker Advisory in that role; the DPO's contact details are notified to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) by the designating Client.

This English translation is available at /en/legal/general-terms/. In the event of any inconsistency between the Dutch and English versions, the Dutch text prevails.

Article 1: Definitions

1.1 Rijker Advisory: the sole proprietorship Rijker Advisory, registered with the Netherlands Chamber of Commerce under number 70443718, also referred to as "Contractor".

1.2 Client: the natural or legal person entering into, or wishing to enter into, an agreement with Rijker Advisory for the purchase of Services or products. Where these general terms and conditions refer to Client as consumer, this means a natural person not acting in the exercise of a profession or business.

1.3 Agreement: any assignment agreement, subscription agreement, purchase agreement or other legal relationship between Rijker Advisory and Client, including a written quotation accepted by Client.

1.4 Services: all activities and deliverables that Rijker Advisory performs on the basis of the Agreement, including governance forensics, sports governance and integrity advisory, privacy and IT law advice, DPO services, training, Academy access, AI tools, digital products and speaking engagements.

1.5 DPO service: the service pursuant to which Rijker Advisory acts as external Data Protection Officer (DPO) within the meaning of Article 37 GDPR.

1.6 Governance forensics: the independent review of governance, compliance and integrity systems within an organisation as to their operation, shortcomings and opportunities for improvement, resulting in a report to the client with findings and recommendations at system, process and policy level. In that context, Rijker Advisory does not perform investigative activities within the meaning of the Dutch Private Security Organisations and Detective Agencies Act (Wet particuliere beveiligingsorganisaties en recherchebureaus, Wpbr) and does not conduct person-focused factual investigations into specific natural persons on behalf of third parties.

1.7 Sports governance and integrity advisory: a specific form of governance forensics focused on governance, disciplinary and integrity systems within sports federations, associations, clubs, unions or related organisations, including the review of reporting channels, disciplinary regulations, policy frameworks and procedural safeguards for preventing and handling transgressive behaviour, match-fixing, doping-related governance shortcomings, conflicts of interest and financial irregularities.

1.8 Participant: the natural person participating in a training, workshop, in-company programme or education by Rijker Advisory, whether or not also Client.

1.9 Academy: the online learning platform of Rijker Advisory (the "AI Governance Academy"), including all courses, video content, assessments, certificates and other digital learning environment.

1.10 AI tool or Quickscan: the online assessment instrument of Rijker Advisory whereby users complete a questionnaire and receive a report or assessment based on artificial intelligence.

1.11 Digital products: downloadable files and templates offered by Rijker Advisory, including DPIA templates, AI governance starter kits and policy templates.

1.12 Rijker Governance Adoption Model: the methodology, structure and approach for governance implementations, developed and applied by Rijker Advisory, including all associated frameworks, models, diagrams and working methods.

1.13 Materials: all documents, presentations, workbooks, templates, frameworks, methodologies, e-learning modules, video recordings and other content developed or used by Rijker Advisory.

1.14 GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation).

1.15 UAVG: the Dutch GDPR Implementation Act (Uitvoeringswet AVG).

1.16 AI Act: Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence.

1.17 DCC: the Dutch Civil Code (Burgerlijk Wetboek).

1.18 Written or in writing: communication by letter, e-mail or via a digital platform designated by Rijker Advisory, provided that receipt can reasonably be established.

1.19 Confidential Information: all information that a party receives from the other party, the existence of which becomes known or comes to its knowledge, and that must reasonably be considered confidential or is designated as such. Confidential Information includes in any event: (i) the identity of Client as a recipient of Rijker Advisory's services; (ii) the existence, nature, scope, status and outcome of the assignment or negotiations thereon; (iii) the review questions, assignment questions, hypotheses and working hypotheses formulated by the parties; (iv) the identity of persons involved, including reporters, witnesses, subjects, directors, employees and third parties; (v) business information, client data, financial data, rates, fee arrangements, strategic plans and policy intentions; (vi) findings, interim reports and final reports of Rijker Advisory; (vii) whistleblower information and reports; (viii) personal data; (ix) trade secrets within the meaning of the Dutch Trade Secrets Protection Act; and (x) all other information that is confidential by its nature.

1.20 E-mail Disclaimer: the e-mail disclaimer published by Rijker Advisory, available at rijkeradvies.nl/en/legal/email-disclaimer/, which applies as an integral part of these general terms and conditions to all e-mail correspondence.

1.21 RCLUU (Recipient Confidentiality and Limited Use Undertaking): the separate written undertaking by which a third party, prior to receiving Confidential Information or a report, commits to at least equivalent confidentiality obligations and limited-use conditions and, where applicable, waives any independent right of reliance vis-à-vis Rijker Advisory.

Article 2: Applicability

2.1 These general terms and conditions apply to all offers, quotations, agreements and other legal relationships between Rijker Advisory and Client, whether arising from governance forensics, sports governance and integrity advisory, privacy and IT advisory work, DPO services, training, Academy subscriptions, AI tools, digital products or speaking engagements. To the extent Client qualifies as consumer, the mandatory consumer-protection provisions of Book 6 and Book 7 DCC prevail over any conflicting provision of these general terms and conditions.

2.2 Deviations from these general terms and conditions are only valid if and to the extent agreed in writing. Any such deviation applies only to the specific Agreement to which it relates.

2.3 The applicability of Client's general terms and conditions is expressly rejected, unless Rijker Advisory has expressly accepted their applicability in writing.

2.4 If a separate agreement deviates from these general terms and conditions, the provision in the separate agreement prevails to the extent it relates to the specific subject of the deviation.

2.5 Rijker Advisory reserves the right to amend these general terms and conditions. Amendments will be communicated in writing to Client at least thirty (30) days in advance, or by publication of an amended version at rijkeradvies.nl/legal/algemene-voorwaarden combined with a written notice. Amendments apply to agreements entered into after the effective date of the amendment. For ongoing agreements, material amendments require the express written consent of Client. To the extent that Client is a consumer, Client is entitled to terminate the Agreement free of charge with effect from the proposed amendment's effective date if Client does not accept a material amendment.

2.6 If Client has made use of Rijker Advisory's services more than once, these general terms and conditions also apply to all future agreements, regardless of whether they have been declared applicable again. This provision does not apply to Client-consumer.

Consumers

2.7 These general terms and conditions are primarily drafted for business Clients. If Client is a consumer (a natural person not acting in the exercise of a profession or business), the following applies: (i) provisions in these general terms and conditions that are unreasonably onerous or presumed to be unreasonably onerous towards consumers under Section 6.5.3 of the Dutch Civil Code (DCC) remain inapplicable towards that Client; (ii) mandatory consumer protection (including Title 7.1 DCC on sale and Title 7.7 DCC on assignment, as well as the provisions on distance contracts in Section 6.5.2B DCC) prevails over any conflicting provisions in these general terms and conditions; (iii) where these general terms and conditions provide that an obligation arises tacitly or that applicability continues tacitly, express consent is required for consumers; (iv) references to collection periods, payment periods and default are read towards consumers in accordance with Article 6:96 DCC and the Dutch Extrajudicial Collection Costs Act (Wik), including the fourteen-day notice; (v) the forum-choice clause of Article 17.3 applies towards consumers only insofar as Article 6:236 sub n DCC permits; and (vi) the right of withdrawal of Article 7.9 applies in full and may only lapse in the cases referred to therein after the consumer's express prior consent and declaration in accordance with Article 6:230p DCC.

Article 3: Quotations and formation

3.1 All quotations by Rijker Advisory are non-binding, unless they expressly state a validity period. A quotation lapses if Client does not accept it within the stated period or, failing that, within thirty (30) days.

3.2 An agreement is formed at the moment Client accepts the quotation in writing, or through unambiguous conduct from which acceptance can be inferred (such as an assignment kick-off, provision of system access, or delivery of instructions to perform work). Mere silence by Client does not constitute acceptance. For Client-consumer, an agreement is only formed upon express acceptance in writing or electronically.

3.3 Rijker Advisory is not bound by quotations that contain obvious errors or misprints. Client cannot derive rights from such quotations.

3.4 Composite quotations do not oblige Rijker Advisory to perform part of the assignment against a proportionate part of the stated price.

3.5 Oral undertakings or agreements only bind Rijker Advisory after they have been confirmed in writing.

3.6 Additional or amended assignments (extra work) are only binding if agreed in writing. Extra work will be invoiced at the hourly rate applicable at that time, unless otherwise agreed.

3.7 Prior to any assignment, Rijker Advisory may conduct an integrity and sanctions check as referred to in Article 19. Formation of the Agreement is subject to the suspensive condition of a positive outcome of that check.

Article 4: Performance of the assignment

4.1 Rijker Advisory will perform the assignment to the best of its insight and ability, in accordance with the standards of good craftsmanship. Rijker Advisory has a best-efforts obligation, not a results-based obligation, unless the contrary has been expressly agreed in writing.

4.2 Rijker Advisory determines the manner in which the assignment is performed. Client acknowledges that Rijker Advisory uses its own methodologies, including the Rijker Governance Adoption Model, in performing the assignment.

4.3 Rijker Advisory is entitled to engage third parties, including independent freelancers and subcontractors, in performing the Agreement. Rijker Advisory remains responsible at all times towards Client for the quality of the work delivered and for compliance with these general terms and conditions. The applicability of Articles 7:404 and 7:407(2) DCC is expressly excluded, unless personal performance by Rion Rijker has been expressly agreed in the Agreement. For agreements with consumers, the exclusion of Article 7:404 DCC only applies to the extent that Client has expressly agreed to such exclusion.

4.4 Client is responsible for the accuracy, completeness and timeliness of the information and cooperation provided to Rijker Advisory. Rijker Advisory is not liable for damage arising from incorrect, incomplete or late information provided by Client.

4.5 If a period has been agreed for the performance of the Agreement, this is an indicative and not a strict deadline, unless expressly agreed otherwise in writing. Exceeding a period does not entitle Client to dissolution or damages, unless Rijker Advisory has acted intentionally or with conscious recklessness. For Client-consumer, notice of default is not required in the cases referred to in Article 6:83a DCC, and the statutory right of dissolution under Book 6, Title 5, Section 5 DCC applies unabridged.

4.6 Rijker Advisory is entitled to suspend performance of the Agreement if Client fails to meet its obligations, including the obligation to pay or to provide required cooperation.

4.7 If during the performance of the assignment it becomes apparent that a change of approach is necessary to achieve a qualitatively good result, Rijker Advisory will inform Client thereof in good time. The parties will consult on the consequences for planning, scope and price.

Article 5: DPO as a service (external Data Protection Officer)

5.1 This Article applies in addition to the other provisions of these general terms and conditions, to the extent that Rijker Advisory acts as external Data Protection Officer (DPO) within the meaning of Article 37 GDPR.

5.2 The DPO service is provided on the basis of an ongoing retainer agreement for the agreed period. The DPO's tasks include the statutory tasks referred to in Article 39 GDPR, as well as tasks further described in the Agreement.

Independence of the DPO

5.3 Rijker Advisory performs the DPO tasks in full independence, in accordance with Article 38(3) GDPR. Client does not give the DPO instructions regarding the exercise of the DPO's tasks. The DPO is not bound by Client's instructions regarding the manner in which the tasks are performed, the conclusions drawn or the advice given.

5.4 Nothing in these general terms and conditions and nothing in the Agreement limits or undermines the statutory independence of the DPO as referred to in Article 38 GDPR. If a contractual provision conflicts with the DPO's statutory independence, the statutory provision prevails.

5.5 Client enables the DPO, in accordance with Article 38(2) GDPR, to perform its tasks by providing sufficient resources and access, including access to relevant processing activities and systems, involvement in all matters concerning the protection of personal data and the possibility to report independently to the highest management level of Client.

5.6 Rijker Advisory reports periodically to Client's board or management, in accordance with the reporting frequency agreed in the Agreement.

5.7 The DPO service does not give rise to an employment relationship between Rijker Advisory (or its staff) and Client. The DPO acts as an independent contractor.

5.8 On termination of the DPO service, Rijker Advisory will, in consultation with Client, facilitate an orderly transfer of the DPO's tasks, in accordance with statutory requirements and the continuity of data protection within Client's organisation.

5.9 Rijker Advisory's advice in its capacity as DPO constitutes recommendations. Ultimate responsibility for GDPR compliance lies with Client as controller or processor. Rijker Advisory's liability as DPO is limited in accordance with Article 14 of these general terms and conditions.

5.10 The role qualification is determined per processing activity. For the DPO core tasks under Article 39 GDPR (monitoring, advising, awareness-raising, cooperation with the supervisor and act as point of contact), the DPO enjoys statutory independence under Article 38 GDPR and does not receive instructions from Client. To that extent, the DPO does not qualify as processor within the meaning of Article 28 GDPR and Rijker Advisory processes the personal data of which it becomes aware for the specific purpose of the DPO function under its own responsibility, subject to the confidentiality obligation of Article 38(5) GDPR and Article 12 of these general terms and conditions. To the extent that Rijker Advisory, in the context of the DPO engagement, additionally performs activities that fall outside the DPO core tasks (such as executing operational privacy tasks on instruction of Client), the parties will separately assess and record whether processor status arises for that specific activity and, if so, conclude a data processing agreement in accordance with Article 28 GDPR. Client shall not disadvantage or dismiss the DPO for the exercise of the DPO tasks (Article 38(3) GDPR).

Article 6: Training and education

6.1 This Article applies to all open-enrolment training, in-company training, workshops and board briefings of Rijker Advisory.

Open enrolment

6.2 Registration for open-enrolment training is via the registration form on the Rijker Advisory website or via a written confirmation. After registration, Participant receives a confirmation. The Agreement is formed at the moment of that confirmation.

6.3 Client or Participant may cancel the registration free of charge up to fourteen (14) calendar days before the training date. For cancellation between seven (7) and fourteen (14) calendar days before the training date, fifty percent (50%) of the enrolment fee is payable. For cancellation within seven (7) calendar days before the training date, the full enrolment fee is payable.

6.4 Cancellation must be made by e-mail to rion@rijkeradvies.nl. The date of receipt of the cancellation is decisive.

6.5 Replacement of a Participant by another person is always permitted, provided Rijker Advisory is informed in writing no later than two (2) business days before the start of the training.

6.6 Rijker Advisory reserves the right to cancel or reschedule a training due to insufficient registrations, illness of the trainer, force majeure or other compelling circumstances. In that case Client will receive a full refund of the enrolment fee already paid, or the training may be rescheduled.

In-company training and workshops

6.7 For in-company training, workshops and board briefings the agreed price and terms as set out in the relevant quotation or Agreement apply. For cancellation by Client: free of charge up to thirty (30) calendar days before the date; fifty percent (50%) of the agreed price for cancellation between fifteen (15) and thirty (30) calendar days before the date; the full agreed price for cancellation within fifteen (15) calendar days before the date.

6.8 Client provides a suitable location, required equipment and facilities for in-company training, unless otherwise agreed in writing. The costs of the location and facilities are for Client's account.

Materials and certificates

6.9 Participants receive digital or physical training materials for use during and after the training. These materials are intended solely for internal use by Participant. Participant is not permitted to reproduce, share with third parties or commercially exploit the materials without Rijker Advisory's prior written consent.

6.10 Participation in a training entitles the Participant to a certificate of attendance, provided that the Participant has attended the full training. In case of partial attendance, issuance of a certificate is at Rijker Advisory's discretion.

6.11 The content of training and educational programmes is compiled by Rijker Advisory at its own discretion and professional judgement. Rijker Advisory reserves the right to update, adjust or amend the content of training, also in connection with changes in law and regulation or market conditions.

Article 7: Academy and digital products

7.1 This Article applies to access to the AI Governance Academy and to the purchase of digital products, including templates and downloadable files.

Academy and LMS

7.2 Access to the Academy is granted on the basis of a subscription for the access period specified in the Agreement or on the website. Upon expiry of the subscription period, access lapses, unless the subscription is renewed.

7.3 Access to the Academy is personal and non-transferable. Client or Participant is not entitled to share login credentials with third parties.

7.4 Rijker Advisory will use best efforts to make the Academy available via the internet, but does not guarantee uninterrupted availability. Rijker Advisory is not liable for temporary unavailability due to maintenance, malfunctions or circumstances beyond its control.

7.5 Course content, videos, assessments and certificates within the Academy are protected by copyright and are the property of Rijker Advisory. Client and Participant are granted only a non-exclusive, non-transferable right of use for personal, non-commercial use during the subscription period.

7.6 Rijker Advisory reserves the right to update the content of the Academy, to add or remove courses and to adjust the technical environment, without giving Client the right to a reduction of the subscription fee or damages, unless the core functionality of the Academy is structurally unavailable.

Digital products

7.7 On purchase of digital products (templates, starter kits, policy templates and comparable downloads), Rijker Advisory grants Client a non-exclusive, non-transferable licence for internal use within Client's own organisation. It is not permitted to resell digital products, to share them with third parties outside Client's own organisation or to use them as the basis for a commercial product of third parties.

7.8 Digital products are delivered "as is". Rijker Advisory does not warrant that the content of templates is fully tailored to Client's specific situation. Client is responsible for assessing whether a template is suitable for the intended use and should seek professional advice in case of doubt.

Right of withdrawal

7.9 For the supply of digital content that is not supplied on a material medium, including Academy subscriptions and digital products, the right of withdrawal for Client-consumer under Article 6:230p sub g DCC is excluded only if cumulatively: (i) performance has commenced with express prior consent of Client-consumer; (ii) Client-consumer has acknowledged that on commencement of performance the right of withdrawal lapses; and (iii) Rijker Advisory has provided this confirmation on a durable medium. The order confirmation and the checkbox during purchase serve as evidence of these three requirements. For orders placed via the website, Rijker Advisory provides the withdrawal-button and withdrawal-form functionality in accordance with the ACM's implementation policy applicable from 19 June 2026.

Article 8: AI tools and Quickscan

8.1 Rijker Advisory offers online assessment instruments ("AI tools" or "Quickscan") whereby users complete a questionnaire and receive a report or assessment based on answers processed by artificial intelligence. This Article applies to all use of such tools, whether such use is free of charge or paid.

Classification under the AI Act

8.2 The AI tools and Quickscan of Rijker Advisory are designed as informational assessment instruments for first orientation, awareness and knowledge transfer. Given their purpose and output, they do not qualify as high-risk AI systems within the meaning of Annex III to the AI Act. The AI tools are expressly not offered for:

• access decisions to education or vocational training, or the assessment of learning outcomes or examinations (Annex III, point 3);
• recruitment, selection, performance evaluation or other HR decisions concerning employees or applicants (Annex III, point 4);
• access decisions to essential private or public services, including credit scoring or benefits assessment (Annex III, point 5);
• law enforcement, migration management, administration of justice or democratic processes (Annex III, points 6, 7 and 8);
• biometric identification or categorisation of natural persons (Annex III, point 1);
• automated decision-making with legal effects or similarly significant consequences for the data subject within the meaning of Article 22 GDPR.

Rijker Advisory periodically assesses the risk classification of each AI tool and documents that assessment.

8.2a If Rijker Advisory in the future deploys an AI tool that does qualify as high-risk on the basis of Annex III to the AI Act, separate contractual arrangements will apply to that tool. Such a tool will not be made operational until the conformity assessment under Article 43 of the AI Act has been completed, the required technical documentation and risk management measures have been implemented, and the tool has been registered in the EU database in accordance with Article 71 of the AI Act.

8.3 Rijker Advisory in principle qualifies as deployer within the meaning of Article 3(4) of the AI Act for the AI tools it deploys, and not as provider. To the extent that Rijker Advisory places an AI tool on the market under its own name or trademark, or substantially modifies it, Rijker Advisory may also qualify as provider; in that case Rijker Advisory takes the provider obligations applicable to the system concerned.

8.3a As deployer, Rijker Advisory complies with the deployer obligations under Article 26 of the AI Act, including: (i) use of the AI system in accordance with the instructions for use and the intended purpose; (ii) human oversight in accordance with Article 14 of the AI Act for systems where this is required; and (iii) informing natural persons subjected to AI-supported decision-making in accordance with Article 26(11) of the AI Act. To the extent that Rijker Advisory qualifies as provider of an AI system, the machine-readable marking of AI-generated content of Article 50(2) of the AI Act rests primarily on the provider role. For deep-fake output that could be perceived as authentic, Rijker Advisory as deployer discloses the AI origin in accordance with Article 50(4) of the AI Act. The AI tools of Rijker Advisory do not process biometric data and do not perform emotion recognition within the meaning of Article 50 of the AI Act.

Informational nature: no legal advice

8.4 The output of the AI tools is informational in nature only. The reports, assessments, scores and recommendations generated by the AI tool do not constitute legal advice, a compliance opinion or a substitute for professional judgement by a qualified adviser. Nothing in the output of the AI tool can be construed as giving rise to a professional service relationship within the meaning of Article 7:400 DCC between Rijker Advisory and the user.

8.5 The user is responsible for the interpretation and use of the output generated by the AI tool. Decisions based on the output of an AI tool fall entirely within the user's responsibility. Save for mandatory law and subject to Article 14, Rijker Advisory's liability for decisions, acts or omissions based wholly or in part on AI-generated output is limited in accordance with Article 14.

Limitations of AI output

8.6 Rijker Advisory does not warrant the accuracy, completeness, timeliness or suitability of the AI tools' output. AI-generated output may contain errors, omissions or misinterpretations due to the limitations of the technology used, the quality of the input information or changes in laws and regulations that have not yet been incorporated into the model.

8.7 The AI tools make use of external technology services and third-party language models. Rijker Advisory is not liable for outages, incorrect output or privacy incidents arising from the operation of these external services, to the extent that Rijker Advisory could not reasonably have prevented these.

8.8 Users should always consult a qualified professional before making legal, compliance or governance decisions. The Quickscan is intended solely as a first orientation and not as a definitive assessment.

Log retention and prohibited use

8.9 Rijker Advisory retains logs of interactions with the AI tools for the purposes of security, quality control and incident handling. The retention period is determined per tool on the basis of purpose, necessity and applicable law, in accordance with the storage-limitation principle of Article 5(1)(e) GDPR. To the extent that Rijker Advisory qualifies as provider of a high-risk AI system under Annex III of the AI Act, the log retention period of Article 19 of the AI Act applies (at least six months, unless a longer period is prescribed by applicable law). To the extent that Rijker Advisory qualifies as deployer of a high-risk AI system, the log retention period of Article 26(6) of the AI Act applies (at least six months, unless a longer period is prescribed by applicable law). For AI systems that are not classified as high-risk, the retention period is determined per tool on the basis of purpose and necessity. Processing of personal data in logs takes place in accordance with the privacy policy.

8.9a For its own professional activities, Rijker Advisory preferably deploys locally running, open-source AI models on Rijker Advisory's own hardware. Where such local processing is used: (i) input is not made available to third parties and is not used for training or fine-tuning of models by third parties; (ii) model weights and processing environment are under Rijker Advisory's control; and (iii) use of external AI services for the processing of Client's Confidential Information or personal data takes place only in compliance with Article 12.5b and, where applicable, Article 13.

8.10 The user is not permitted to use the AI tools in a manner that violates the AI Act (including the prohibited practices listed in Article 5 of the AI Act), the GDPR or other applicable law, nor to generate misleading deepfakes or other content that harms third parties. Nor is it permitted to circumvent security measures of the tool or to elicit prohibited output. Rijker Advisory reserves the right to block access with immediate effect in case of a violation.

Liability for AI tools

8.11 For AI tools and Quickscan services offered free of charge, Rijker Advisory excludes all liability in full, to the extent permitted under Dutch law. This exclusion does not apply to damage resulting from intent or conscious recklessness on the part of Rijker Advisory, nor to mandatory statutory liabilities, including product liability and liability for death or personal injury.

8.12 For paid AI tools, Rijker Advisory's liability is limited to the amount paid for the specific transaction, with a maximum of five hundred euros (EUR 500.00). Indirect damage, consequential damage, loss of profit and other non-direct heads of loss are excluded in all cases.

Article 9: Prices and payment

9.1 All prices used by Rijker Advisory are exclusive of VAT and other government-imposed levies, unless expressly stated otherwise.

9.2 For services invoiced on an hourly basis, the hourly rate specified in the Agreement or quotation applies. Rijker Advisory records the time spent and invoices on the basis of actual hours worked, unless a fixed price has been agreed.

9.3 Rijker Advisory is entitled to index its rates annually, effective 1 January of each calendar year, on the basis of the CBS price index for business services or by a maximum of five percent (5%), at Rijker Advisory's option. For ongoing agreements, Client will be informed in writing at least thirty (30) days before the effective date of the adjustment.

9.4 Invoices must be paid within fourteen (14) calendar days after the invoice date, unless otherwise agreed in writing.

9.5 On exceeding the payment term, Client is in default by operation of law, without a further notice of default being required. From the due date, Client owes statutory commercial interest as referred to in Article 6:119a DCC, or, if Client is a consumer, statutory interest as referred to in Article 6:119 DCC, calculated on the outstanding amount.

9.6 All out-of-court collection costs incurred by Rijker Advisory to obtain payment are for Client's account. Collection costs are calculated in accordance with the Decree on compensation for out-of-court collection costs (Stb. 2012, 141), with a minimum of forty euros (EUR 40.00).

9.7 Client is not entitled to set off outstanding amounts against claims on Rijker Advisory, unless such claims have been acknowledged in writing by Rijker Advisory or established irrevocably by a court. This set-off prohibition does not apply to Client-consumer, for whom the set-off right pursuant to Article 6:127 DCC applies unreservedly.

9.8 Rijker Advisory is entitled to require prepayment or a deposit before commencing performance of the Agreement. For open-enrolment training, Academy subscriptions and digital products, prepayment is required, unless otherwise agreed.

9.9 For retainer agreements (including DPO services and long-running sports governance and governance forensics assignments), the agreed monthly or quarterly retainer is invoiced in advance at the start of the relevant period.

9.10 Work at Client's request outside regular business hours (Monday to Friday, 08:00 to 18:00) is invoiced at one hundred and fifty percent (150%) of the agreed hourly rate. Work on Saturdays, Sundays and official public holidays is invoiced at two hundred percent (200%) of the agreed hourly rate, unless otherwise agreed in writing.

Article 10: Cooperation by Client

10.1 Client ensures that all information, documents, data and access that Rijker Advisory reasonably needs to perform the Agreement are provided to Rijker Advisory on time and in full.

10.2 Client enables Rijker Advisory to perform its work, including by granting access to relevant systems, locations and staff, insofar as this is reasonably necessary for the performance of the assignment.

10.3 Client warrants the accuracy and completeness of the information provided by it. If incorrect or incomplete information leads to additional work or revision of work already delivered, such extra costs will be charged as extra work at the applicable rate.

10.4 Client designates a contact person who is authorised on behalf of Client to make decisions and grant approvals necessary for the performance of the assignment. Delays in decision-making on Client's side that impede the progress of the work relieve Rijker Advisory of any deadline obligations.

10.5 Client accepts the products and advice delivered by Rijker Advisory on time. If Client fails to accept the products or to schedule the agreed activities within the agreed period, Rijker Advisory is entitled to regard the assignment as completed and to invoice the agreed fee in full.

10.6 Client warrants that it is authorised to accept the assignment and to provide the information, data, systems and access necessary for its performance, and that it has an adequate legal basis under Articles 6 and, where applicable, 9 and 10 GDPR for making such information available to Rijker Advisory. Client indemnifies Rijker Advisory against all third-party claims arising from a breach of this warranty.

Article 11: Intellectual property

11.1 For the purposes of this Article, a distinction is made between: (a) Background IP: all intellectual property rights of Rijker Advisory that existed prior to the Agreement or are or will be developed independently of it, including the Rijker Governance Adoption Model, frameworks, methodologies, templates, general training materials, e-learning modules, Academy content, software tools, checklists and generic reporting structures; (b) Client Material: information, data and documentation provided by Client to Rijker Advisory; (c) Specific Work Product: advisory documents, reports and other written products that Rijker Advisory has produced specifically for Client on the basis of Background IP and Client Material.

11.2 All intellectual property rights in the Background IP rest exclusively with Rijker Advisory. Intellectual property in Client Material remains with Client or its rights holders. Intellectual property in the Specific Work Product rests with Rijker Advisory, with a right of use for Client as described below.

11.3 Upon full payment of the agreed fee, Rijker Advisory grants Client a perpetual, non-exclusive, non-transferable and non-sublicensable right of use of the Specific Work Product for Client's internal business operations and for the purposes for which it was prepared. This right of use of the Specific Work Product is not affected by termination of the Agreement. To the extent that Background IP is incorporated in the Specific Work Product to such a degree that internal use of the Specific Work Product is not reasonably possible without continued use of that Background IP, the right of use of the Background IP concerned continues in that respect for as long as the Specific Work Product is used internally.

11.4 The right of use of Background IP made available to Client alongside the Specific Work Product (such as templates, checklists or e-learning modules) is non-exclusive, non-transferable and non-sublicensable and limited to internal use within Client's own organisation. This right of use ends at the end of the Agreement, unless expressly agreed otherwise or unless the last sentence of Article 11.3 applies.

11.5 By way of derogation from Article 11.4 and in addition to Article 11.3, Client is entitled to provide the Specific Work Product to: (i) its executive board, supervisory board, board of commissioners or comparable supervisory body; (ii) its shareholders or members insofar as required by statute or law; (iii) its attorney at law, tax advisor or auditor under a confidentiality obligation; (iv) its liability or directors' and officers' liability insurer in connection with a claim; (v) a competent supervisor, disciplinary body or court pursuant to a statutory obligation or court order; and (vi) other third parties to the extent that Rijker Advisory has given prior written consent. Prior to provision under (i) through (iv), Client shall ensure that the receiving third party is bound in writing to at least equivalent confidentiality and limited-use obligations, by means of a Recipient Confidentiality and Limited Use Undertaking (RCLUU) as referred to in Article 1.21, or a comparable already-existing professional confidentiality regime that provides at least equivalent protection. In all cases the confidentiality obligations of Article 12 remain fully applicable. A provision under this paragraph does not establish any independent right for the receiving third party against Rijker Advisory and no right to rely directly on the report (no reliance right), unless Rijker Advisory has agreed thereto in writing on the basis of a separate reliance agreement (RCLUU).

11.6 Beyond what is permitted under this Article, Client is not permitted to reproduce, publish, sell, rent, distribute to third parties or otherwise commercially exploit Materials or Specific Work Product without Rijker Advisory's prior written consent.

11.7 Client indemnifies Rijker Advisory against third-party claims arising from the use of Client Material, data or instructions provided by Client for the performance of the Agreement, if and to the extent that such material infringes third-party rights.

11.8 Rijker Advisory retains the right to use the methodologies, frameworks and approaches contained in the Specific Work Product for other assignments, provided that Client's specific confidential information is not recognisable therein.

11.9 Rijker Advisory refers to Client, the name of Client and the assignment title in reference lists, testimonials, marketing communications or portfolio pages only with prior express written consent of Client. This consent applies per assignment and can be revoked in writing by Client at any time, in which case Rijker Advisory shall remove the reference within a reasonable period from its own communications. This provision does not derogate from statutory disclosure obligations of Rijker Advisory towards supervisors, professional bodies or in court proceedings, subject to Articles 1.21 and 12.7.

Article 12: Confidentiality

12.1 The parties undertake to maintain confidentiality of all Confidential Information they receive from the other party or that comes to their knowledge in the context of proposed, negotiated or concluded assignments, including the precontractual phase (intake, exploratory meeting, quotation process, conflict check, screening), the performance of the Agreement and the period after termination. The parties use this information solely for the performance of the Agreement or, in the precontractual phase, for the assessment and conclusion thereof.

12.1a To the extent that Confidential Information is passed on to third parties (including advisors, subcontractors, group companies, insurers, financiers or acquiring parties), the passing party remains fully responsible for confidentiality maintenance. Prior to passing on, an RCLUU (Article 1.21) must be concluded with the receiving third party, unless an already-existing professional confidentiality regime with at least equivalent protection applies. A third party who wishes to invoke Confidential Information or report content directly against Rijker Advisory can do so only on the basis of a separate reliance agreement (RCLUU) expressly agreed with Rijker Advisory.

12.2 Each party will take appropriate organisational and technical measures to protect the other party's Confidential Information against unauthorised access or use, with at least the same level of care as that party applies in protecting its own confidential information. Access to Confidential Information within the receiving party's organisation is limited to persons who reasonably need it for the performance of the Agreement (need-to-know), who are bound by a confidentiality obligation at least equivalent to this Article.

12.3 The confidentiality obligation does not apply to information:

• that was already public at the time of receipt, without breach of a confidentiality obligation;
• that the receiving party demonstrably already knew before receipt from the other party, without breach of a confidentiality or loyalty obligation;
• that the receiving party has received from a third party entitled to provide this information without restrictions;
• that the receiving party has developed independently without using the Confidential Information.

12.4 The confidentiality obligation also applies to third parties engaged by Rijker Advisory in performing the Agreement. Rijker Advisory ensures that these third parties accept a confidentiality obligation at least equivalent to the obligations in this Article.

12.5 If a party is required to provide Confidential Information pursuant to a statutory obligation, court order, request from a supervisor, disciplinary body, investigative authority or other competent authority, or a Woo (Open Government Act) request, it will inform the other party thereof as soon as possible in advance, to the extent permitted by law, so that the other party may take appropriate measures. The provision remains limited to what is strictly necessary to comply with the obligation. The parties consult where possible on the scope and form of the provision.

12.5a Nothing in this Article prevents a party or a person working for it from (i) making a report protected under the Dutch Whistleblower Protection Act, comparable foreign legislation or Directive (EU) 2019/1937; (ii) filing a report with an investigative authority; (iii) providing information to a competent supervisor, disciplinary body or the Dutch House for Whistleblowers; or (iv) obtaining confidential legal advice. Provisions that impede such reports are void to that extent. Rijker Advisory will not treat such a report or seeking of advice as a breach of this Article.

12.5b Neither party enters or processes Confidential Information into generative AI services, language models (LLM), cloud services or other external processing services, unless cumulatively: (i) prior written consent from the other party has been obtained or the use of the service concerned forms part of a sub-processor list (where the service qualifies as processor within the meaning of Article 28 GDPR) or an approved external service provider list (where the service qualifies otherwise, for example as independent controller or as service under Rijker Advisory's own responsibility); (ii) the service is delivered via an environment in which input is demonstrably not used for training or fine-tuning of models by the provider or third parties; (iii) the processing location, retention periods and rights separation are contractually established; and (iv) appropriate technical and organisational measures have been taken that safeguard the agreed level of protection. Rijker Advisory documents which AI and cloud environments are used and notifies Client of changes on request.

12.5c In the event of loss, theft, misdirection, unauthorised access, unauthorised disclosure or other breach of the confidentiality of the other party's Confidential Information, irrespective of whether there is also a personal-data breach within the meaning of Article 33 GDPR, the receiving party notifies the other party in writing without undue delay and no later than within seventy-two (72) hours after discovery. The notification includes a description of the nature of the breach, the information concerned, the containment and remediation measures already taken and the further steps to be taken. The parties cooperate on containment, evidence preservation, root-cause analysis and remediation, and ensure that forensically relevant evidence is not lost.

12.5d Upon termination of the Agreement and on first written request of the other party, the receiving party returns or destroys within thirty (30) days all Confidential Information of that party and confirms the return or destruction in writing. This obligation does not apply to: (i) information contained in routine back-ups, provided that those back-ups are overwritten within the applicable retention cycle and remain protected by this Article until then; (ii) information that the receiving party must retain under mandatory law; (iii) information that the receiving party reasonably needs in connection with a threatened or pending dispute, claim, insurance claim or legal hold; and (iv) Rijker Advisory's file as referred to in Articles 13.7, 14.6 and 20.11.

E-mail correspondence

12.6 All e-mail correspondence between Rijker Advisory and Client is subject to the applicable version of the Rijker Advisory E-mail Disclaimer, which is provided as annex on formation of the Agreement or is made available at rijkeradvies.nl/en/legal/email-disclaimer/. The E-mail Disclaimer supplements these general terms and conditions for e-mail traffic. Changes to the E-mail Disclaimer are subject to Article 2.5 (changes to general terms and conditions) and only apply to existing Agreements after express or, for Client not being a consumer, tacit acceptance in accordance with that Article.

12.6a To the extent that between the parties a specific non-disclosure agreement was already in force prior to the entry into force of the Agreement or these general terms and conditions, that agreement remains in force alongside this Article 12 and prevails where it offers a higher level of protection. Termination of that non-disclosure agreement only occurs on express written agreement of both parties.

Use for marketing and portfolio

12.7 Rijker Advisory is entitled to use anonymised descriptions of assignments performed, results achieved and methodologies applied for marketing purposes, including publication on the website rijkeradvies.nl, LinkedIn, newsletters and in quotations and proposals. Rijker Advisory will ensure at all times that the anonymisation is such that Client's identity is not recognisable. For governance forensics and sports governance assignments, no publication takes place without Client's prior written consent, not even in anonymised form. If Client objects to a specific description, the parties will consult on an adjustment. Rijker Advisory will remove the description in question within fourteen (14) days after receipt of a substantiated objection.

12.8 The confidentiality obligation remains in force for the duration of the Agreement and after termination thereof, subject to the following periods: (i) for trade secrets within the meaning of the Dutch Trade Secrets Protection Act: as long as the information qualifies as a trade secret; (ii) for the identity of reporters, witnesses and protected sources, whistleblower information, report content, evidence from governance reviews and material from pending or threatened proceedings: for an indefinite period; (iii) for personal data: for the applicable statutory retention periods; and (iv) for other Confidential Information: for a period of five (5) years after termination of the Agreement.

Article 13: Privacy and data processing

13.1 In the context of performance of the Agreement, personal data may be processed. Rijker Advisory processes personal data in accordance with applicable privacy legislation, including the GDPR and the UAVG.

13.2 The privacy policy of Rijker Advisory, as published on rijkeradvies.nl, applies to the processing of personal data of (staff of) Client and Participants in its capacity as independent controller.

13.3 Per processing activity, the parties assess which role Rijker Advisory fulfils under the GDPR. In performing its own professional activities (advice, investigation, reporting, file-keeping, quality assurance and liability accountability), Rijker Advisory in principle qualifies as independent controller within the meaning of Article 4(7) GDPR: Rijker Advisory determines itself the purpose and means of processing, subject to statutory frameworks, professional standards and the confidentiality obligation of Article 12. This position is consistent with EDPB Guidelines 07/2020 on the concepts of controller and processor. The contractual label chosen by the parties is not decisive; the factual role in the specific processing activity determines the qualification (recital 79 GDPR).

13.4 To the extent that, upon factual assessment of a specific processing activity, Rijker Advisory qualifies as processor within the meaning of Article 28 GDPR (Client determines purpose and means; Rijker Advisory processes on written instruction), the parties will conclude a data processing agreement that meets the requirements of Article 28 GDPR prior to the commencement of the work concerned. Rijker Advisory reserves the right to reassess the assignment in that case with regard to scope, approach and fee.

13.5 In performing its services, Rijker Advisory uses external suppliers and service providers. Depending on the specific processing activity, these suppliers can qualify as processor for Rijker Advisory (Article 28 GDPR), as joint controller with Rijker Advisory (Article 26 GDPR) or as independent controller (Article 4(7) GDPR). Rijker Advisory selects these suppliers on the basis of adequate technical and organisational security measures and concludes with each supplier the type of agreement appropriate for the qualification concerned (data processing agreement, joint-controllership arrangement or general services agreement including confidentiality). An up-to-date overview of these suppliers, indicating role, location, categories of data processed and security level, is available on request via rion@rijkeradvies.nl.

13.6 In the context of the AI tools and Quickscan services, users may enter personal data. As independent controller, Rijker Advisory takes appropriate technical and organisational measures to safeguard data minimisation (Article 5(1)(c) GDPR). Users are advised not to enter more personal data than strictly necessary for use of the tool. Rijker Advisory processes personal data entered in the AI tools only to the extent necessary for the service and in accordance with the privacy policy.

13.7 Retention periods are determined per data category, with a maximum of seven (7) years after termination of the Agreement, subject to legal hold or ongoing proceedings. Applicable are: (i) tax and administration data: seven (7) years pursuant to the Dutch tax retention obligation (Article 52 AWR); (ii) advice files, correspondence and final deliverables: five (5) years after end of the assignment, in view of the two-year contractual limitation period (Article 14.6) plus a professional accountability margin; (iii) working papers and internal notes: twelve (12) months after end of the assignment; (iv) technical logs (access, security, AI interactions): twelve (12) months, unless a longer period is prescribed by law (including Article 19 and 26(6) AI Act for high-risk AI systems); (v) legal hold: for the duration of a legal claim, proceedings or supervisor investigation. For governance review files within the meaning of Articles 20 and 21, the specific retention period of Article 20.11 applies.

13.8 If Rijker Advisory, as independent controller, becomes aware of a personal data breach, Rijker Advisory itself notifies the Dutch Data Protection Authority within seventy-two (72) hours after discovery pursuant to Article 33 GDPR, unless it is unlikely that the breach entails a risk to the rights and freedoms of natural persons. Where required, Rijker Advisory informs the data subjects concerned in accordance with Article 34 GDPR. To the extent that Rijker Advisory acts as processor for a specific processing activity, Rijker Advisory informs the responsible controller without undue delay after becoming aware of a personal data breach, in accordance with Article 33(2) GDPR, so that the controller can meet its own notification obligation.

13.9 Rijker Advisory does not in principle process personal data of a criminal nature within the meaning of Article 10 GDPR on behalf of third parties. Processing of Article 10 GDPR data requires, in addition to a basis under Article 6 GDPR, a specific ground under Articles 32 and 33 of the Dutch GDPR Implementation Act (UAVG). Article 162 of the Dutch Code of Criminal Procedure (reporting obligation) is limited to specifically designated public officials and does not apply to Rijker Advisory. Rijker Advisory's governance forensics and sports governance services are directed at the review of systems, processes and policy and not at person-focused factual investigations into specific natural persons.

13.9a Where in a specific assignment integrity signals concerning identifiable natural persons are nevertheless factually observed, Rijker Advisory will discuss the further route with Client and, where appropriate, refer Client to a Wpbr-licensed party for the person-focused part, in accordance with Article 20.12. Where a criminal offence is factually observed, Rijker Advisory follows the further route in consultation with Client and, where required, in accordance with a separately established reporting protocol.

13.9b Investigative activities within the meaning of Article 1(1)(f) of the Dutch Private Security Firms and Investigation Agencies Act (Wpbr) are performed only by holders of a Wpbr licence. Rijker Advisory does not perform such activities and, where such activities are required, refers Client to a Wpbr-licensed party or works exclusively under the auspices thereof, in accordance with Article 20.12.

If, during the performance of an assignment, Rijker Advisory incidentally becomes aware of indications that may point to criminally relevant conduct, disciplinary offences or breaches of the GDPR, Rijker Advisory reports the observation to Client and, where required or appropriate by law, to the competent authority (including the Public Prosecution Service, the Dutch Data Protection Authority, the Vechtsport Autoriteit, a disciplinary tribunal or the House for Whistleblowers). Rijker Advisory does not itself qualify the conduct and does not determine whether a criminal offence has occurred; that assessment is reserved to the competent authority. The legal basis for such reporting is Article 6(1)(c) GDPR (legal obligation, including Article 162 of the Dutch Code of Criminal Procedure to the extent applicable) or Article 6(1)(f) GDPR (legitimate interest).

For assignments requiring person-focused factual investigation within the meaning of Article 1(1) Wpbr, Rijker Advisory refers Client to a holder of a Wpbr licence, or works exclusively under the auspices of such a licence holder. See further Article 20.12.

13.10 The contact details of Rijker Advisory's DPO are available via rion@rijkeradvies.nl. For the DPO role for Clients, the provisions of Article 5 apply in addition.

Article 14: Liability

14.1 Rijker Advisory is liable only for direct damage that is the immediate consequence of an attributable failure to perform the Agreement or of an unlawful act, subject to the limitations in this Article.

14.2 Rijker Advisory has taken out professional indemnity insurance with HDI Global Specialty SE, Netherlands branch (policy number available on request). Rijker Advisory's total liability towards Client per claim (or connected series of claims) is limited to the amount paid out under the professional indemnity insurance in the specific case, increased by the deductible for which Rijker Advisory is liable under the policy. The insured amount under the policy at the date of filing of these general terms and conditions is five hundred thousand euros (EUR 500,000.00) per claim and per contract year.

14.3 If for any reason no payment is made under the insurance referred to in Article 14.2, including situations in which the insurer refuses coverage or the claim falls outside the policy coverage, Rijker Advisory's liability is limited to an amount of fifty thousand euros (EUR 50,000.00) per claim.

14.3a Specifically for DPO services within the meaning of Article 5, it applies additionally that Rijker Advisory's liability for administrative fines, penalties, or other sanctions imposed by supervisory authorities on Client, including the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), is excluded. The obligation to comply with the GDPR, the UAVG, and other applicable data protection legislation rests with Client as controller or processor within the meaning of the GDPR. The exclusion in this paragraph does not apply in case of intent or conscious recklessness on the part of Rijker Advisory.

14.3b Without prejudice to paragraphs 2 and 3, Rijker Advisory's liability per claim for the following specific services is further limited to:

• Training and workshops: the amount charged for the specific training or workshop;
• Academy subscription: the amount paid for the ongoing subscription;
• Digital products: the amount paid for the specific digital product;
• Paid AI tools and Quickscan: the amount paid for the specific transaction, with a maximum of five hundred euros (EUR 500.00);
• Free AI tools and Quickscan: Rijker Advisory accepts no liability.

14.4 Rijker Advisory is in no event liable for:

• indirect damage, consequential damage, loss of profit, loss of revenue, loss of data, reputational damage, missed savings or damage due to business interruption;
• damage arising from incorrect, incomplete or late information provided by Client;
• damage arising from decisions taken by Client based on advice, reports or output of Rijker Advisory, where Client had its own decision-making responsibility and the circumstance was reasonably foreseeable;
• damage arising from force majeure as referred to in Article 15;
• damage arising from malfunctions, errors or downtime of third-party systems, software or services used by Rijker Advisory, to the extent Rijker Advisory could not reasonably have prevented such.

14.5 The liability limitations in this Article do not apply to the extent that the damage results from intent or conscious recklessness on the part of Rijker Advisory or its senior management, nor to the extent that unlimited liability is mandatorily prescribed.

14.6 Client is obliged to notify damage in writing to Rijker Advisory within a reasonable period after discovery (Article 6:89 DCC). For Client not being a consumer, notification must in any event take place within ninety (90) days after discovery. Late notification results in forfeiture of the claim to the extent that Rijker Advisory has been prejudiced in its ability to limit or recover the damage. For Client not being a consumer, claims for damages lapse in any event two (2) years after the moment Client became aware or could reasonably have become aware of the damage, without prejudice to the statutory limitation periods of Article 3:310 DCC. For Client-consumer, the statutory limitation periods of Article 3:310 DCC apply unabridged, without contractual forfeiture period.

14.7 Client is obliged to take all reasonable measures to limit the damage. Rijker Advisory is entitled to reduce the damage to be compensated if Client has failed to take adequate measures.

14.8 The liability limitation in this Article is expressly agreed by Rijker Advisory as third-party stipulation within the meaning of Article 6:253 DCC in favour of third parties engaged by Rijker Advisory in performing the Agreement, and in favour of Rion Rijker personally as owner of the sole proprietorship, whereby it is acknowledged that under the sole proprietorship-legal form Rion Rijker in principle is liable in person for the obligations of Rijker Advisory.

Article 15: Force majeure

15.1 Rijker Advisory is not obliged to perform any obligation under the Agreement if and to the extent that performance is prevented by force majeure. Force majeure includes any external cause, foreseen or unforeseen, over which Rijker Advisory has no control and as a result of which performance of the Agreement cannot reasonably be required of it. This provision applies mutatis mutandis to Client, provided that payment obligations are not suspended by force majeure.

15.2 Force majeure includes in any event, but is not limited to: malfunctions, downtime or unavailability of external technology platforms, cloud providers or AI service providers used by Rijker Advisory; malfunctions in telecommunications or internet connections; illness or incapacity for work of the performing person (Rion Rijker or engaged freelancers), to the extent that replacement is not reasonably possible; government measures; fire, water damage, flooding or other natural disasters; strikes or labour disputes at third parties on which Rijker Advisory depends; cyberattacks and data breaches at Rijker Advisory or its technology platforms, to the extent that Rijker Advisory has taken reasonable security measures.

15.3 Rijker Advisory will inform Client in writing as soon as possible of the occurrence of a force majeure situation and its expected duration.

15.4 If the force majeure situation continues for more than thirty (30) calendar days, each party is entitled to dissolve the Agreement in writing, without the other party being entitled to damages. In that case, Rijker Advisory will refund the amount paid by Client for services not yet delivered, less costs already incurred.

Article 16: Term and termination

16.1 The Agreement commences on the date specified in the Agreement and has the agreed duration. If no duration has been agreed, the Agreement is entered into for an indefinite period.

16.2 Agreements for a definite period are not tacitly renewed, unless expressly agreed otherwise. For subscription agreements (including Academy and retainer services), renewal is offered in writing at least thirty (30) days before the end of the term.

16.3 Agreements for an indefinite period may be terminated by each party with due observance of a notice period of two (2) calendar months, unless otherwise agreed. Termination is in writing. For Client-consumer, a notice period of maximum one (1) month applies pursuant to Article 7:408(3) DCC.

16.4 Rijker Advisory is entitled to dissolve the Agreement in whole or in part in writing with immediate effect, without judicial intervention and without any obligation to pay damages, if: Client fails to meet its payment obligation and, after a written notice of default with a period of fourteen (14) days, remains in default; Client applies for suspension of payments, is declared bankrupt, is subject to a debt restructuring or is otherwise unable to meet its obligations; Client breaches Rijker Advisory's intellectual property rights or confidentiality obligations; continuation of the Agreement cannot reasonably be required of Rijker Advisory due to acts or omissions of Client; or a circumstance as referred to in Article 19 (integrity and sanctions conflict) arises.

16.5 In case of dissolution on the basis of paragraph 4, all outstanding claims of Rijker Advisory are immediately due and payable.

16.6 On termination or dissolution of the Agreement, for whatever reason: amounts already invoiced and payable remain fully payable; the right of use granted to Client with regard to the Materials ends, unless expressly agreed otherwise; the obligations regarding confidentiality (Article 12), intellectual property (Article 11), liability (Article 14), data processing (Article 13) and integrity (Article 19) remain in force for the periods stipulated therein.

16.7 On termination of the DPO service, the parties act in accordance with the transition arrangement described in Article 5.8. On termination of a governance forensics or sports governance assignment, Rijker Advisory delivers the final report subject to the chain-of-custody and retention arrangements of Article 20.

Article 17: Governing law and disputes

17.1 All agreements and other legal relationships between Rijker Advisory and Client are governed exclusively by Dutch law. The applicability of the Vienna Sales Convention (CISG) is excluded.

17.2 Disputes arising from or related to the Agreement will in the first instance be resolved by the parties through constructive consultation. The parties will enter into mutual consultation within fourteen (14) days after the dispute arises.

17.3 If the parties fail to resolve the dispute through mutual consultation within thirty (30) days after the first consultation, or if the other party does not respond to an invitation to consult, the dispute will be submitted for resolution to the competent court of the District Court of Amsterdam. For Client-consumer, the statutory forum choice of the consumer's place of residence applies as legally competent court, unless Client-consumer within one (1) month after Rijker Advisory has invoked the forum choice of Amsterdam in writing chooses for the statutorily competent court, pursuant to Article 6:236 sub n DCC.

17.4 Without prejudice to paragraph 3, Rijker Advisory is entitled to submit claims for payment directly to the competent court, without prior consultation being required.

17.5 For international assignments, the parties may agree in writing that a dispute will be resolved exclusively by arbitration at a reputable institute (including NAI, ICC or, for sports-related disputes, CAS in Lausanne). Failing such written agreement, paragraph 3 applies.

Article 18: Miscellaneous

Severability

18.1 If a provision of these general terms and conditions is null, annulled or otherwise without legal effect, this does not affect the validity of the remaining provisions. In that case, the parties will consult to replace the invalid provision with a valid provision that approximates the economic and legal purpose of the invalid provision as closely as possible.

Entire agreement

18.2 These general terms and conditions, together with the Agreement and any annexes (including a data processing agreement and the E-mail Disclaimer), constitute the entire agreement between the parties with regard to its subject matter and replace all previous agreements, correspondence and negotiations in this respect, subject to Article 12.6a for previously concluded non-disclosure agreements that remain in force alongside this Article 12 where they offer a higher level of protection.

Waiver of rights

18.3 A party's failure or delay in exercising a right or authority does not constitute a waiver of that right or authority, unless expressly stipulated otherwise in writing.

Notices and communications

18.4 All notices, communications and other correspondence in the context of the Agreement must be in writing and addressed to rion@rijkeradvies.nl or to the contact details specified in the Agreement. E-mail communication is deemed to constitute written communication, provided that receipt can reasonably be established. All e-mail communication is subject to Rijker Advisory's E-mail Disclaimer, as defined in Article 1.20 and further regulated in Article 12.6.

Speaking engagements

18.5 The provisions of these general terms and conditions apply mutatis mutandis to agreements for speaking engagements, keynote presentations and participation in panels, in particular the provisions on intellectual property (Article 11), liability (Article 14) and payment (Article 9). Recording, live broadcasting or publication of a speaking engagement requires the prior written consent of Rijker Advisory.

Assignment and third-party rights

18.6 Client is not entitled to transfer rights or obligations under the Agreement to third parties without Rijker Advisory's prior written consent. Rijker Advisory is authorised to continue the Agreement with its legal successor under universal or particular title, provided that the quality of service and confidentiality safeguards remain at least equivalent.

18.7 These general terms and conditions and the Agreement do not create rights for third parties (no third-party stipulation), unless expressly stipulated otherwise in the Agreement or in these general terms and conditions, including the third-party stipulation of Article 14.8.

Dynamic references

18.8 References to laws and regulations and case law are deemed to be dynamic and to refer to the version of the relevant regulation in force at any given time, unless a specific version is expressly designated. References to external rules, codes of conduct or standards that do not constitute mandatory law refer to the version in force at the time of conclusion of the Agreement; subsequent amendments thereto apply only insofar as the parties agree in writing or insofar as the amended version itself applies to the Agreement under mandatory law.

Filing and version control

18.9 These general terms and conditions (version 2.0.3, September 2026) are intended for filing with the Netherlands Chamber of Commerce and, upon conclusion of a new Agreement, replace all previous versions, including version 1.0 of April 2026 and versions 2.0, 2.0.1 and 2.0.2 of September 2026, subject to Article 2.5 for ongoing agreements. Rijker Advisory is registered with the Netherlands Chamber of Commerce under registration number 70443718. The current version is available at rijkeradvies.nl/legal/algemene-voorwaarden/. On request, Client will receive a free copy of these general terms and conditions. Filing, publication or transmission of these general terms and conditions does not in itself establish applicability; applicability requires that these terms have actually been made available to Client (per hand-out, electronic transmission or reference in accordance with Articles 6:233 sub b and 6:234 DCC) and have been accepted in accordance with Article 6:232 DCC.

Article 19: Integrity and sanctions check

19.1 Rijker Advisory operates an internal integrity policy. Prior to accepting an assignment, Rijker Advisory may conduct an integrity and sanctions check, including screening of Client, ultimate beneficial owners and key contact persons against public sanctions lists (including EU, UN and OFAC lists), reporting on integrity incidents and publicly known governance risks. Whether an assignment brings Rijker Advisory within scope of the Dutch Money Laundering and Terrorist Financing (Prevention) Act (Wwft) is assessed per assignment, in view of Article 1a(4)(d) and (e) Wwft (legal or tax advice on specifically listed transactions). To the extent that a Wwft-qualifying assignment is factually performed, Rijker Advisory complies with the associated obligations (client due diligence, reporting of unusual transactions). Rijker Advisory is not subject to the Dutch Act on the Supervision of Trust Offices (Wtt) given the nature of its services.

19.2 Rijker Advisory is entitled to refuse an assignment or, if already accepted, to suspend or terminate it with immediate effect ("right to walk away") if:

• Client, an ultimate beneficial owner or a key contact person appears on an applicable sanctions list;
• during the assignment an integrity conflict arises that jeopardises the independence or professional integrity of Rijker Advisory;
• continuation of the assignment cannot reasonably be required of Rijker Advisory on the basis of reasonable suspicions of Client's involvement in a serious criminal offence, corruption, fraud or serious human rights breaches;
• Client refuses to provide reasonable additional information necessary for the integrity check.

19.3 In case of suspension or termination on the basis of this Article, Rijker Advisory does not owe any damages. Work already performed will be invoiced on a time-spent basis.

19.4 If during the performance of an assignment Rijker Advisory identifies indications that may point to a criminal offence, it may, subject to its confidentiality obligations and its own professional judgement, report this to a competent authority (including police, Public Prosecution Service, sports disciplinary body, whistleblower channel or supervisor). Rijker Advisory does not itself qualify the conduct. Rijker Advisory will notify Client prior to such a report, unless in Rijker Advisory's reasonable opinion this would harm the governance review, the protection of those involved or third-party interests. See also Article 13.9.

Article 20: Governance forensics

20.1 This Article applies to all assignments that qualify as governance forensics as defined in Article 1.6. Governance forensics by Rijker Advisory consists of the review of governance, compliance and integrity systems as to their operation, shortcomings and opportunities for improvement. The report contains findings and recommendations at system, process and policy level and does not qualify individual natural persons as offenders, suspects or violators.

Independence and method

20.2 Rijker Advisory conducts governance forensics in professional independence from the management board, the supervisory board and other stakeholders within Client's organisation. Rijker Advisory does not receive instructions on the conclusions or recommendations of the review. Client designates a client body (for example the supervisory board, board of trustees or a governance committee) that acts as point of contact and is not itself subject to the review.

20.3 Rijker Advisory works on the basis of a written plan established in advance with clear review questions, timeline, scope and methodology. Amendments are confirmed in writing.

Evidence gathering and chain of custody

20.4 Rijker Advisory applies principles of integrity, traceability, completeness and proportionality in the collection, recording and preservation of documentation for the governance review. For each item of documentation, it is recorded when, how and from whom it was obtained and who has had access to it subsequently. Digital documentation is stored in a sound manner and, where possible, provided with hash values to validate its integrity.

20.5 To the extent the review yields insights that may affect individual officeholders, Rijker Advisory applies the right of reply (hoor en wederhoor) as a general rule at system and process level. Those involved are given the opportunity to respond to relevant findings before these are included in a final report. Rijker Advisory may deviate from this on reasoned grounds if compelling reasons (such as security risk or confidentiality requirements) so require; any such deviation is mentioned in the report.

Reporting

20.6 Reporting takes place solely to the client body designated by Client. Rijker Advisory does not report directly to third parties, unless agreed in writing or required by a statutory obligation. Distribution of the final report to third parties by Client falls under Articles 11.5 and 12.1a, including the RCLUU requirement.

20.7 Rijker Advisory does not provide legal representation and does not act as attorney at law or disciplinary representative. Further enforcement, sanctions or legal proceedings after delivery of the report are the responsibility of Client and, where appropriate, its attorney.

Publicity during the review

20.8 During the term of the review, the parties will refrain from public statements about the review and the findings, save for (i) statements required by law, (ii) statements to competent disciplinary bodies or supervisors, and (iii) statements for which the other party has given prior written consent.

Conflict of interest

20.9 Prior to accepting a governance forensics or sports governance assignment, Rijker Advisory tests for conflicts of interest, including recent involvement with the same organisation or the same individuals concerned. In case of an identified conflict, Rijker Advisory will refuse the assignment or propose mitigations that must be accepted in writing by Client.

Scope of services

20.10 Rijker Advisory is not an accountant and not an attorney at law. Whether an assignment brings Rijker Advisory within scope of the Wwft is assessed per assignment in accordance with Article 19.1. The governance forensics work does not constitute a statutory audit within the meaning of the Dutch Audit Firms Supervision Act (Wta) and does not constitute an audit service. For work for which such a qualification is required by law, Rijker Advisory will refer Client on.

Retention of governance review file

20.11 The governance review file is retained per document category: (i) final report and formal deliverables: seven (7) years after completion of the assignment, in view of possible follow-up proceedings and evidence value; (ii) supporting evidence (documents, chain-of-custody registrations, expert reports): seven (7) years; (iii) interview transcripts and factual statements: twelve (12) months after final report, unless Client agrees to longer retention in view of ongoing proceedings; (iv) internal working papers and consultation notes: twelve (12) months after final report; (v) technical logs of access to the review file: twelve (12) months; (vi) legal hold: for the duration of a legal claim, disciplinary procedure or supervisor investigation, categories (i) through (v) are extended pro rata. Client may request destruction in writing, whereupon Rijker Advisory assesses whether the request is responsible in view of the retention framework of this paragraph.

Wpbr exclusion and referral

20.12 The Wpbr qualification is determined by the factual activities: collecting and analysing, on request of a third party and in connection with an interest of that third party, data relating to specific natural persons. Where an assignment factually contains such person-focused parts, that part is performed by a Wpbr-licensed party and by personnel screened by the Ministry of Justice (Article 7 Wpbr). Rijker Advisory limits itself in such assignments to the non-person-focused part (systems, processes, policy) and works, where required, alongside a Wpbr-licensed party that acts as contractor for the person-focused part and assumes the associated obligations. Rijker Advisory does not accept assignments in which the assignment as a whole would qualify as investigative activity in the sense of the Wpbr without licence.

Article 21: Sports governance and integrity advisory

21.1 This Article applies to all assignments that qualify as sports governance and integrity advisory as defined in Article 1.7. The provisions of Article 20 (governance forensics), including the Wpbr exclusion of Article 20.12, apply mutatis mutandis, with the following additions and clarifications.

Positioning

21.2 Rijker Advisory takes an independent position between the federation or association board on the one hand and the athletes, coaches, officials, whistleblowers and other persons involved on the other. Rijker Advisory does not represent any individual party and does not act as advocate of interests.

Confidentiality of whistleblowers and reports

21.3 Reports of (suspected) transgressive behaviour, match-fixing, doping-related integrity breaches, financial irregularities or other integrity issues are treated in strict confidence. The identity of a reporter is not disclosed to Client, those involved or third parties without the reporter's express written consent, save where a statutory obligation so requires. Whistleblower reports are also subject, where applicable, to the Dutch Whistleblowers Protection Act (Wet bescherming klokkenluiders), including the confidentiality obligation of Article 17k Wbk for persons involved in the handling of a report.

Relationship with sports disciplinary law and supervision

21.4 In sports-related assignments, Rijker Advisory applies the applicable regulatory framework. This framework is specified per assignment in the assignment confirmation, together with the procedural safeguards resulting from it.

21.5 Rijker Advisory does not itself pass disciplinary judgment. The final report may be introduced by Client in a disciplinary or arbitration procedure, subject to the distribution rules of Articles 11.5 and 12.1a. Rijker Advisory may, on terms to be agreed, be heard as an expert, provided that this has been agreed in writing in advance and independence is not thereby compromised.

Chain of custody and special-category data

21.6 The chain-of-custody principles of Article 20.4 apply in full. For the processing of personal data of a criminal nature within the meaning of Article 10 GDPR or of special categories of personal data within the meaning of Article 9(1) GDPR, Article 13.9 applies in addition, whereby for Article 9 data an appropriate exception under Article 9(2) GDPR is also required in combination with Articles 22 to 30 UAVG.

No legal representation

21.7 Rijker Advisory expressly does not provide legal representation in disciplinary, arbitration or civil proceedings arising from the findings. Where legal representation is appropriate, Rijker Advisory will refer Client to an attorney at law.

---

Rijker Advisory · Version 2.0.3 · September 2026
CoC 70443718 · VAT NL001131887B30
rion@rijkeradvies.nl · rijkeradvies.nl
Intended for filing with the Netherlands Chamber of Commerce