Digital Forensics Agreement

This Agreement contains terms applicable specifically to digital forensics services provided by Artificer

Definitions and Interpretation

Definitions

In the Agreement, capitalised terms and phrases have their defined meaning as set out below, unless the context provides otherwise:

Agreement means the contractual agreement formed by executing, the Statement of Work, including the terms of this Digital Forensics Agreement, the Artificer General Terms of Business and any documents identified in the Statement of Work as forming part of the same contractual agreement with the aforementioned documents.
Acceptance Criteria means the criteria (or criterion) specified on a Statement of Work that determines how one or more Deliverables are deemed accepted by the Client.
Business Day means 9:00AM to 5:00PM on a day that is not a Saturday, Sunday or public holiday in Sydney, New South Wales.
Client Instructions means without limitation any terms, letter of instruction, engagement letter, scope of work, competing terms of engagement/service or similar instrument issued to Artificer by or on behalf of the Client (including by the Client's legal advisers), together with any annexures, protocols or other documents accompanying or referred to in such instrument, to the extent that any of them purport to modify or supersede the provisions of the Agreement.
Confidential Information of a party (the Disclosing Party) means information of every kind and form (including written and oral) that is treated or designated by the Disclosing Party or any Related Body Corporate of the Disclosing Party as confidential or which would be reasonably regarded as confidential, and which is disclosed by the Disclosing Party or otherwise comes to the knowledge of the other party (the Receiving Party) in connection with the Agreement. The terms of the Agreement are Confidential Information of both parties.
Deliverable means an agreed outcome or item specified on a Statement of Work to be achieved or provided as a result of Artificer's digital forensics services (and not from any legal services) subject to any inputs, instructions or Materials to be provided by the Client.
Intellectual Property Rights includes any copyright, design, patent, trademark (whether registered, unregistered or applied for), trade, business, company or domain name, know-how, inventions, processes, confidential information (whether in writing or recorded in any form), and any other proprietary, licensed or personal rights arising from intellectual activity in the business, industrial, scientific or artistic fields.
Material includes computer software, data, documentation, designs, drawings, reports, notes, calculations, specifications, photographs, audio-visual materials, recordings, and anything else which is in a material form (and includes information stored in an electronic form).
Privilege Protocol means any part of the Client Instructions (however titled) consisting of reasonable directions, consistent with the Agreement, that the Client or its legal representatives seek Artificer to comply with for the purpose of maintaining the Client's claim to legal professional privilege.
Related Body Corporate has its meaning from the Corporations Act 2001 (Cth).
Statement of Work means the document by the same name which incorporates the Digital Forensics Agreement by reference.
Work Product means any Material produced by Artificer as part of a digital forensics service performed under the Agreement, including any Deliverable, it excludes Materials produced as a result of any legal services.
Variation means a document signed by the parties to the Agreement which expressly varies the terms of the Agreement.

Other defined terms have their meaning derived from context wherever provided in the remainder of the Agreement.

General Terms of Business

The Agreement incorporates the Artificer General Terms of Business, they apply as though set out in full here.

Rules of Interpretation

The provisions in this document are interpreted according to the Rules of Interpretation.

Survival of Clauses

The provisions under the headings Confidentiality, Data Security, Evidence Retention, Intellectual Property, Insurance and Liability, along with any provisions required for their proper operation, survive termination or expiry of the Agreement for any reason.

Statements of Work

Creation

The parties will create and negotiate a suitable document entitled 'Statement of Work' containing terms for any services to be provided to the Client as well as any Deliverables. Once the document is agreed between the parties, they will execute it and it will become the Statement of Work.

Precedence

Where there is an inconsistency between this Digital Forensics Agreement and any terms in a Statement of Work, the provisions of the Statement of Work will supersede those conflicting terms in this Digital Forensics Agreement but only to the extent of the inconsistency.

Any terms of the Statement of Work will prevail over the terms of any other document incorporated into it by reference to the extent of any inconsistency.

Pre-contractual representations and terms

The terms set out in the Agreement are the whole and entire agreement in relation to its subject matter and supersede all oral and written communications by or on behalf of the parties leading up to its creation and execution. This includes any pre-contractual representations of any form, including a Client's request for proposal/quote/information issued prior to the creation of the Agreement, regardless of language that purports to import terms into a future agreement.

Client Instructions

Application

Client Instructions apply to the engagement only to the extent they are consistent with the Agreement. To the extent of any inconsistency, the Agreement prevails over the Client Instructions.

Privilege Protocol

The Privilege Protocol applies to the engagement at all times, and Artificer will comply with it. Where compliance with the Privilege Protocol would materially affect the scope, timing or cost of services or Deliverables, the parties will address the impact by Variation.

Providing the Services

Artificer’s Role

Unless expressly modified in a Statement of Work, Artificer will:

perform the services, and provide the Deliverables, identified in the Statement of Work in accordance with the reasonable directions of the Client;
comply with its statutory obligations as an employer in the delivery of the services under the Agreement, including but not limited to its own employees' long service leave, annual leave, parental leave and sick leave; and
co-operate in a collaborative manner with any other contractors of the Client working on related services to those under the Agreement, but subject to any limitations on the scope of services set out in the Agreement.

Client's Role

Unless expressly modified in a Statement of Work, the Client will:

provide Artificer or its subcontractors with appropriate access to any digital assets, materials or infrastructure duly required for the performance of any services contemplated by the Agreement;
produce or provide any inputs or directions required for Artificer (or its agents or subcontractors) to provide the services or produce the Deliverables in a timely fashion wherever requested, especially those provided by the Statement of Work; and
provide Artificer with full disclosure any matters which may impact the timely delivery of any services or Deliverables by Artificer to the Client.

Dependency Failure

In the Statement of Work, Artificer may set out assumptions, as well as any inputs and responsibilities of the Client in connection with the delivery of the services or production of Deliverables (each being a Dependency). If the Client fails to produce any inputs, discharge its responsibilities or if an assumption proves not to be true (a Dependency Failure), then:

Artificer will not be responsible for any failure to perform obligations under the Agreement in connection with the Dependency Failure;
the Client will not unreasonably withhold its approval to a Variation to the extent reasonably required to reflect the impact of the Dependency Failure (including on any agreed timeframes and fees or expenses); and
Artificer may terminate the Agreement giving 5 Business Days' notice if a suitable Variation is not entered into between the parties to address the Dependency Failure.

Deliverables and Acceptance

SOW to specify

Any Deliverables to be provided under the Agreement resulting from digital forensics services, along with any Client inputs or instructions required to produce those Deliverables, will be specified on the Statement of Work.

If the Statement of Work provides a specific procedure for acceptance of Deliverables, then that procedure will apply. If it does not provide a specific procedure, then the Default Acceptance Procedure subclause below will apply to any Deliverables with Acceptance Criteria.

Default Acceptance Procedure

If this default procedure applies and the Statement of Work does not specify any Acceptance Criteria for a Deliverable, then the Deliverable is deemed accepted when it is provided to the Client.

If this default procedure applies and there are Acceptance Criteria provided on the Statement of Work for a Deliverable, then:

Artificer will provide the Deliverable to the Client according to the provisions of the Agreement;
The Client will, within 3 Business Days, examine the Deliverable to determine, acting reasonably, whether the Acceptance Criteria for the Deliverable have been met;
If the Client considers that the Acceptance Criteria have not been met, the Client must notify Artificer within the above timeframe, giving reasons;
Artificer will take all reasonable steps to ensure that the Acceptance Criteria are met for the Deliverable; and
If the Client does not give the notice that it considers the Acceptance Criteria have not been met within the above timeframe, then the Deliverable is deemed to be accepted by the Client.

Legal Services

If the Statement of Work includes legal services, the provisions in this Deliverables and Acceptance section do not apply to Deliverables for legal services, which are instead governed by the terms in the Retainer and Costs Agreement for legal deliverables.

Confidentiality

Obligation of Confidentiality

Except as set out in this clause, when a party receives (Receiving Party) Confidential Information of the other party (Disclosing Party), it must:

keep the Confidential Information confidential and not directly or indirectly disclose, divulge or communicate any Confidential Information to other person without the prior written approval of the Disclosing Party;
take all reasonable steps to secure and keep secure all Confidential Information of the Disclosing Party coming into the Receiving Party’s possession or control, and only use the Confidential Information for the purposes of performing, and to the extent necessary to perform, the Receiving Party’s obligations under the Agreement.

Exceptions to Obligation

The obligations of confidentiality under this clause do not apply to any Confidential Information that:

is disclosed to the Receiving Party on a non-confidential basis by a third party entitled to do so;
was already lawfully in the Receiving Party's possession when it was given to the Receiving Party; or
is or becomes generally available to the public other than by reason of a breach of the Agreement or any breach of confidence; or
must be disclosed by the Receiving Party to comply with any court order or law if, to the extent practicable and as soon as reasonably possible, the Receiving Party:
1. notifies the Disclosing Party of the proposed disclosure; and
2. uses reasonable endeavours to comply with any reasonable request by the Disclosing Party concerning the proposed disclosure.

Permitted Disclosures

A Receiving Party may disclose Confidential Information to any Related Body Corporate or its employee, agent, (sub)contractor, officer, professional adviser, banker, auditor or other consultant of the Receiving Party or its Related Body Corporate (each a Recipient) but only on confidentiality terms at least as restrictive as those contained in the Agreement. The Receiving Party is liable for any breach of confidentiality by a Recipient.

Disclosures to Support Privilege

A Receiving Party may disclose Confidential Information of the Disclosing Party to the Disclosing Party's external legal advisers (and to any other person directed in writing by those advisers) to the extent the disclosure is necessary or appropriate to support a claim of legal professional privilege over the engagement or any of its outputs. Any such disclosure is a permitted disclosure for the purposes of this clause.

Return of Confidential Information

Immediately on the written request of the Disclosing Party or on the expiry or the termination of the Agreement for any reason, a Receiving Party must (at the election of the Disclosing Party) return or securely destroy the Confidential Information of the Disclosing Party.

Relief

Each party acknowledges that a breach of confidentiality would be harmful to the business interests of the other party and monetary damages alone would not be a sufficient remedy, therefore the Disclosing Party is entitled to interim, interlocutory and/or permanent injunctions to prevent a breach of this clause and/or to compel specific performance of it.

Data Security

Security Safeguards

Artificer will implement and maintain reasonable and appropriate technical, administrative and physical safeguards designed to protect Materials provided by the Client, Confidential Information of the Client, and forensic evidence in Artificer's possession or control (together, Protected Information), from unauthorised access, use, disclosure, alteration, loss or destruction. Artificer will:

restrict access to Protected Information to personnel, subcontractors and agents who have a legitimate need to access it for the performance of the services and who are bound by confidentiality obligations materially equivalent to those in the Agreement;
apply encryption in transit and at rest to a standard reasonable having regard to the sensitivity of the information and industry practice; and
maintain logging and monitoring of access to, and activities involving, Protected Information sufficient to detect and respond to unauthorised access or use.

Incident Response

If Artificer becomes aware of any actual or suspected unauthorised access to, or disclosure, loss or corruption of, Protected Information (a Data Security Incident), Artificer will:

promptly notify the Client, with such particulars of the Data Security Incident as are then reasonably known to Artificer;
take reasonable steps to investigate, contain and remediate the Data Security Incident;
keep the Client reasonably informed of material developments, including the nature and extent of any Protected Information affected, the cause, whether the incident is ongoing, and any remediation steps taken or proposed;
preserve logs and other data reasonably necessary to identify the nature, extent and cause of the Data Security Incident; and
cooperate reasonably with the Client's investigation of the Data Security Incident, including by providing information reasonably necessary for the Client to make any determination or notification required of it under applicable data protection or privacy laws.

The Client is responsible for making any determination, and for giving any notification, required of it under applicable data protection or privacy laws in respect of a Data Security Incident.

Evidence Retention

Retention Period

Artificer will retain the forensic evidence collected, preserved or generated in the performance of the services for the period specified in the Statement of Work (the Retention Period). The fees for the Retention Period are included in the fees for the services under the Statement of Work.

Extension on Request

If the Client requests that Artificer retain forensic evidence beyond the Retention Period, Artificer may, at its option, agree to do so subject to payment of additional fees notified by Artificer. Any longer-term or recurring retention arrangement will be the subject of a separate agreement between the parties.

Destruction

On expiry of the Retention Period (or any extension agreed under this clause), Artificer may securely destroy or delete the forensic evidence at its discretion, without further notice to the Client.

Intellectual Property

Prior Materials

Nothing in the Agreement affects the ownership of any Intellectual Property Rights subsisting in Materials which were already in existence as at the date of the Agreement, or which are created by either party independently of the Agreement.

Licence to use Client Materials

The Client grants Artificer (and any of its personnel or subcontractors) an unlimited, royalty free, non-exclusive, non-assignable, non-transferable licence to use any Material it provides to Artificer for the sole purpose of the performance of Artificer’s obligations under the Agreement. The licence grant commences at the start of the Agreement and is revocable after the Agreement’s expiry or termination.

Licence for Work Products

Artificer grants the Client and its Related Bodies Corporate a non-assignable and non-transferable licence to use the Work Product wherever Intellectual Property Rights subsist, subject to any limitations in the Agreement.

The licence does not extend to the use, publication, disclosure or tender of any Work Product (or any derivative of it) in any court, tribunal, arbitration, regulatory, governmental or disciplinary proceeding without Artificer's prior written authorisation of the specific use, which Artificer may grant, withhold or condition as it considers appropriate (including by requiring the execution of a further or varied Statement of Work to scope and price any additional services required to support that use). Artificer's authorisation will not be unreasonably withheld where the Client is compelled by law, court order or regulatory process to produce the Work Product.

Nothing in the paragraph above restricts the Client from disclosing Work Product, in confidence, to the Client's legal advisers for the purpose of obtaining legal advice.

Artificer's IP Indemnity

Artificer will indemnify the Client and its Related Bodies Corporate against any loss, damage, cost (including reasonable legal costs) or liability suffered or incurred by them in connection with any claim by a third party that use of the Work Product in accordance with the Agreement infringes that third party's Intellectual Property Rights. This indemnity does not apply to the extent the claim arises from:

any modification of the Work Product by or on behalf of the Client;
the combination of the Work Product with any other material not provided by Artificer, where the infringement would not have arisen but for that combination;
Materials provided to Artificer by or on behalf of the Client; or
any use of the Work Product that is not permitted by the Agreement.

Client's IP Indemnity

The Client warrants that it has the right to provide, and to permit Artificer to use, any Material it provides to Artificer under the Agreement. The Client will indemnify Artificer and any of its personnel or subcontractors against any loss, damage, cost (including reasonable legal costs) or liability suffered or incurred by them in connection with any claim by a third party that Artificer's use of such Material, in accordance with the Agreement, infringes that third party's Intellectual Property Rights.

Conduct of IP Claims

If a party (the Indemnified Party) becomes aware of a claim or threatened claim that would give rise to an indemnity under the Agreement, the Indemnified Party must:

promptly notify the other party (the Indemnifying Party) in writing, giving reasonable particulars of the claim;
not make any admission or settlement of the claim without the Indemnifying Party's prior written consent (which is not to be unreasonably withheld);
give the Indemnifying Party conduct of the defence and settlement of the claim; and
provide the Indemnifying Party with reasonable cooperation and assistance, at the Indemnifying Party's cost, in connection with the defence and settlement of the claim.

Insurance

Artificer to maintain insurance policies

If insurance policies are required to deliver the services they will be specified in the Statement of Work, and Artificer will hold and maintain valid and enforceable insurance policies to levels and for the durations specified in the Statement of Work.

Proof of currency of insurance

Artificer must, on request by the Client, provide to the Client within 5 Business Days proof of the currency of insurances required by the Statement of Work, in the form of an insurance certificate from the insurer certifying that the insurance is in force.

Liability

Liability Cap

The total aggregate liability of Artificer (whether under statute, in contract or in tort, including for negligence, or otherwise) for loss or liability suffered or incurred by the Client under or in connection with the Agreement (the Liability Cap), is limited to an amount equal to 1.5 times the total fees paid or payable by the Client under the Agreement.

Exclusions from Liability Cap

Unless specified otherwise in a Statement of Work, the Liability Cap does not apply to any loss or liability arising out of:

an indemnity given by a party under the Intellectual Property clause of this Digital Forensics Agreement;
a material breach of the Confidentiality clause of this Digital Forensics Agreement;
a breach of the Data Security clause of this Digital Forensics Agreement (which is instead subject to the Data Security Cap);
loss of, or damage to, tangible property; or
any fraud or any unlawful act or omission.

Data Security Cap

The total aggregate liability of Artificer for loss or liability arising out of a breach of the Data Security clause of this Digital Forensics Agreement is limited to $500,000 (the Data Security Cap). The Data Security Cap applies in place of the Liability Cap to any such breach and is not in addition to it.

Consequential loss

To the extent permitted by law, under no circumstances whether in tort, contract, or otherwise, will Artificer be liable to the Client for the following types of loss, damage or liability:

any indirect, special, incidental, or consequential loss or damage of any character; or
any claims, losses or damages (whether actual or anticipated) for loss of goodwill, profits, revenue, future contracts, opportunity or anticipated savings;

The above applies regardless of whether such loss, damage or liability was foreseeable, known or may have reasonably been within the contemplation of the parties before, during or after the Agreement was made.

Mitigation

Each party shall take reasonable steps to mitigate any losses, damages, costs or expenses sustained or incurred as a result of any act or omission (including any breach or default of the Agreement) by the other party.

Other warranties excluded

Other than the warranties expressly provided for in the Agreement, each party excludes all implied warranties whether statutory or otherwise, relating to the subject matter of the Agreement, to the extent such warranties can be excluded under law.

Term and Termination

The rights of termination in this clause are granted and exercisable without limiting any other rights or remedies a party may have against the other party arising out of or in connection with the Agreement or its breach.

Term of Agreement

The Agreement begins on the date the Statement of Work is executed by its last party (the Commencement Date) and will continue until it is terminated or expires in accordance with its terms.

Termination at common law

The parties retain all rights at common law to terminate the Agreement, for example for breach or frustration, according to the common law rules of contract.

Termination by Artificer for payment failure

Artificer may immediately terminate the Agreement, in whole or in part, at any time by giving to the Client notice in writing if the Client fails to pay any fees under the Agreement when they fall due.

Termination by Artificer for Dependency Failure

Artificer may terminate the Agreement as set out in the 'Dependency Failure' subclause above.