Terms and Conditions — Spain

1. Purpose

These terms govern the use of the website forquantiq.com/en/ and the commercial information presented about FORQUANTIQ's services for the Spanish market, including Secure Web 360, provided from Colombia.

2. Nature of the information published

Prices are not published on this website. The commercial conditions applicable to each service, including fees and the applicable tax (VAT), are set out in a specific written proposal. VAT is determined according to the rules in section 4 and is confirmed in writing before the service is contracted.

3. Classification of the service

Secure Web 360 is classified commercially and for tax purposes as a specialized professional managed cybersecurity service (Managed Cybersecurity / technical-professional service), not as a pure SaaS product nor as an automated electronic service. FORQUANTIQ directly provides the professional service of vulnerability assessment, technical analysis of digital exposure, identification and classification of findings, criticality and risk analysis, vulnerability tracking, comparison of results between periods, progress and mitigation analysis, production of technical and executive reports, and technical support and recommendations.

The technology tools used for monitoring, testing, automation, evidence generation or information visualization are part of the methodology and technical means with which FORQUANTIQ provides the service, but they do not in themselves constitute the main object sold to the client. The use of technology, automation or dashboards does not by itself change the professional nature of the service — what matters is the actual object contracted and the way in which it is effectively provided.

4. VAT treatment: B2B and B2C

As the service is provided from Colombia (a provider not established in the EU) to clients in Spain, the VAT treatment depends on the type of client:

• B2B (business client, Spanish entrepreneur or professional with a valid VAT number): the general B2B place-of-supply rule locates the service in the country where the client is established. The transaction is invoiced without Spanish VAT: the client self-assesses the corresponding VAT through the reverse-charge mechanism (art. 69 of the Spanish VAT Act), a mechanism that the AEAT expressly contemplates for services provided by providers not established in Spain. The model operates as an export of services from Colombia, without the need to incorporate a Spanish company.
• B2C (private client not acting as an entrepreneur or professional): since Secure Web 360 is a professional service with FORQUANTIQ's technical intervention and judgment — and not a "service supplied by electronic means" according to the European Commission's criteria, which require a degree of automation with minimal human intervention — the special place-of-supply rule for B2C electronic services does not apply and, therefore, neither does the Union scheme of the One-Stop Shop (OSS) by default. The general B2C place-of-supply rule applies instead, which locates the supply where the provider is established. As FORQUANTIQ is established in Colombia, with no permanent establishment in Spain, the supply is not located in Spain merely because the client resides there, unless a specific place-of-supply exception applies to the particular case.

This classification — Secure Web 360 as a professional/technical managed cybersecurity service, not considered an electronic service for VAT purposes, subject to the general B2C place-of-supply rule — is kept consistent across contracts, commercial proposals, invoicing and the description of the service, and is subject to confirmation by a Colombia–Spain tax advisor before operating at scale in the B2C segment. In B2C transactions, EU/Spanish consumer protection rules may also apply (pre-contractual information, right of withdrawal in distance contracts).

5. Contracting of services

The contracting of Secure Web 360 or other FORQUANTIQ services will be formalized through a specific commercial proposal, expressly accepted by the client before the service begins.

6. Applicable law

See the "Applicable law" section of the legal notice, which likewise distinguishes between B2B and B2C scenarios.

7. Effective date

These terms are effective from 10 October 2026 and remain in force until replaced by a later version. Any modification will be published on the FORQUANTIQ website.