Referral Partner Terms

1. What these terms cover

These terms govern the Referral track of the SQUR Partner Program. They apply between SQUR UG (haftungsbeschränkt), Hegelstrasse 7, 76356 Weingarten (Baden), Germany ("SQUR") and the company that applies to the program and is accepted by SQUR ("Partner"). By submitting the application form on squr.ai/partners and by making a first referral, the Partner accepts these terms.

The Reseller track and technology integrations are not covered here. They are agreed in a separate written partner agreement.

2. Who can be a referral partner

• A legal entity or a registered sole trader. Private individuals are not admitted.
• Established in the EU, the EEA, the United Kingdom or Switzerland. Other countries on request.
• Holds a valid VAT identification number if established in the EU, and a business bank account in the Partner's own name.
• Corresponds with SQUR from an email address on the Partner's own company domain.

SQUR confirms acceptance by email, normally within 24 hours of the application. SQUR may decline an application without giving reasons.

3. How a referral is attributed

A referral is attributed to the Partner in one of two ways:

• Partner link. A visitor who first reaches squr.ai through the Partner's personal referral link is attributed to the Partner for 180 days from that first visit, also across later visits.
• Registered introduction. The Partner names the client (company, domain, contact person) by email to partners@squr.ai before the client has any contact with SQUR. Once SQUR confirms the registration, the opportunity is protected for the Partner for 90 days, extendable once by a further 90 days if the client is in an ongoing procurement, budget or audit process.

Not attributable are: clients that were already in contact or negotiation with SQUR when the referral was made, clients that were SQUR customers within the previous 6 months, the Partner itself and companies under common control with the Partner, and any referral made through paid advertising on SQUR brand terms.

Where two partners claim the same client, the earlier confirmed registration or the earlier first click wins.

4. The client contracts with SQUR

The referred client contracts directly with SQUR under the SQUR Terms of Service. SQUR is solely responsible for delivering the pentest, for account management, for support and for invoicing the client. The Partner is not party to that contract, does not deliver any part of the service and does not receive access to the client's targets, configuration, test data or reports.

5. Authorization to test comes only from the target owner

A pentest runs only against a system whose owner has authorized it. Authorization is given by the client itself, inside the client's own SQUR account, in two steps that SQUR verifies before any test starts:

• proof of control over the target domain by publishing a DNS TXT record with a token SQUR issues (squr-verify=…), and
• a recorded authorization of the exact scope to be tested, given by the client's account holder.

A Partner cannot authorize a test on behalf of a client, and SQUR does not accept authorizations forwarded by a Partner. A Partner who submits a target for testing must itself be the owner of that target and completes the same steps.

6. Commission

• 20% of the net invoice amount of each single pentest that an attributed client orders and pays. At the current list price of €1,995 net this is €399 net. Discounts granted to the client reduce the base.
• The commission is earned only when the client has paid the invoice in full and irrevocably. A pentest that is completed but not paid, or paid and later refunded or charged back, earns no commission; a commission already paid out for it is offset against the next payout.
• Repeat orders count. Every further single pentest the same attributed client orders and pays within 12 months of its first paid pentest earns the same commission. Orders after that period do not. The 12 months run from the first paid pentest and independently of the attribution window in section 4: that window only has to be open when the client places its first order.
• The commission applies to single pentests at list price. Subscriptions, volume packs, custom scopes and enterprise contracts are commissioned only if SQUR agrees this in writing before the order.

7. Payout

• Commissions are settled monthly on the 15th for all client payments received in the previous calendar month, by SEPA bank transfer to the Partner's business account.
• SQUR issues a self-billing credit note for each payout, showing every attributed pentest, the client's payment date and the amount. The Partner agrees to this self-billing procedure and does not issue its own invoice.
• Amounts are net. For a Partner established in Germany, statutory VAT is added. For a Partner established in another EU member state, the reverse-charge mechanism applies and the credit note shows both parties' VAT identification numbers. For a Partner outside the EU, no German VAT is charged.
• Payouts below €50 are carried forward to the next month.

8. How the Partner may promote SQUR

• The Partner may describe SQUR and its pricing using the material SQUR provides, and may use the SQUR name and logo for that purpose while the partnership lasts.
• The Partner does not represent SQUR, does not conclude contracts in SQUR's name, does not accept payments for SQUR and does not give any warranty about SQUR's services.
• No unsolicited bulk email, no misleading claims, no bidding on SQUR brand terms in paid search, and no incentives to clients that SQUR has not approved.
• The Partner passes on a client contact only where it is entitled to do so under data protection law, and tells the contact that SQUR will get in touch.

9. Data protection

A referral partner does not process personal data on SQUR's behalf, so no data processing agreement between SQUR and the Partner is needed. SQUR receives the contact details of the introduced person as an independent controller and handles them under the SQUR Privacy Policy. SQUR's data processing agreement and subprocessor list are provided to the contracting client, together with its order.

10. Confidentiality

Each party keeps the other's non-public business information confidential and uses it only for the purpose of the partnership. This obligation survives the end of the partnership. A separate mutual NDA can be signed on request.

11. Term and termination

• The partnership runs for an indefinite period. There is no minimum term, no minimum volume and no exclusivity on either side.
• Either party may terminate at any time with 30 days' notice to the end of a month, by email.
• Commissions earned before the termination date are paid out on the normal schedule. Registered opportunities keep their protection period until it expires, and a client whose first paid pentest falls inside that period is commissioned under section 6.
• No new attribution arises after the termination date. Partner links stop attributing on that date.
• SQUR may terminate immediately, and unpaid commissions are forfeited, if the Partner breaches section 5 or section 8, makes false statements to SQUR or to clients, or refers itself or a company under common control.

12. Changes to these terms

SQUR may change these terms with 30 days' notice by email to the Partner's registered address. Commissions on pentests paid before the change takes effect are not affected. A Partner who does not accept a change may terminate under section 11 before it takes effect.

13. Liability, law and jurisdiction

SQUR is liable without limit for intent, gross negligence and injury to life, body or health. For ordinary negligence SQUR is liable only for breach of a material contractual obligation and only up to the commission paid to the Partner in the preceding twelve months. The parties are independent businesses; these terms create no agency, partnership, employment or joint venture.

The laws of the Federal Republic of Germany apply, excluding the UN Convention on Contracts for the International Sale of Goods. Place of jurisdiction, to the extent permitted, is Karlsruhe, Germany.

Contact

SQUR UG (haftungsbeschränkt)
Hegelstrasse 7, 76356 Weingarten (Baden), Germany
Managing Director: Adam Lundqvist
Commercial register: Amtsgericht Mannheim, HRB 753863
VAT ID: DE 453660591
Email: partners@squr.ai