Terms of Service

What these terms cover

These terms apply to every service, appliance, piece of software and engagement that NBS Maritime OOD supplies under the SeaDirect Protect name, whether you run the platform yourself, share the work with us, or hand us the whole job. They also govern the use of the client portal by everyone you give an account to.

The documents that make up the contract

Your contract with us is made of the documents below. If two of them disagree, the one higher in the list wins, but only on the point where they disagree:

• the Order: the signed quote, order form or subscription record naming the products, quantities, sites, prices and term;
• the Data Processing Agreement, for personal data we process on your behalf;
• the Service Level Schedule for your plan, where your Order includes one;
• the statement of work for a professional engagement, such as an evaluation, a penetration test or training;
• these terms;
• the product documentation and user manual published in the portal.

Written to be read

We have written these terms in plain language on purpose. Each section opens with a short summary to help you find your way; the clauses underneath are what binds us both.

Which version applies

The version of these terms in force on the day your Order is signed applies to that Order. How later versions apply is described under Changes to these terms.

Definitions

• We, us, our: NBS Maritime OOD, the company that operates SeaDirect Protect.
• You, your, the customer: the organisation named in the Order, or, for a Router Subscription, the organisation or private person named in the accepted order, and the people it authorises to use the Services.
• Platform: the SeaDirect Protect cloud services, the client portal, the fleet management service, and the update and threat intelligence services behind them.
• Appliance: a network gateway running our router software at a Site, whether we supplied the hardware or you did.
• Agent: our endpoint software installed on your computers, servers or virtual machines.
• Services: everything we supply under an Order: the Platform, Appliances, Agents and professional engagements.
• Site: a location protected by an Appliance: a vessel, an office, an industrial site or a cloud instance.
• Endpoint: a computer, server or virtual machine running an Agent.
• Administrator seat: a named person's account in the client portal.
• Your data: everything your networks, devices and people send to the Platform, and everything you enter into it, including registers, evidence and documents.
• Plan: Essentials, Custom or Complete, as described on our website and fixed in your Order.
• Deployment: how your estate is protected and counted: per environment, per endpoint, as a cloud firewall, or as staff and crew training.
• Security incident: an event that compromises, or may compromise, the confidentiality, integrity or availability of systems or data.
• Router Subscription: one or more Appliances, each with Fairway Router and the per-router features chosen, ordered on this website or in the client portal, as described under Router Subscriptions ordered online.
• Consumer: a private person who takes a Router Subscription for purposes outside their trade, business, craft or profession.
• Business day: Monday to Friday, except public holidays in Bulgaria. Business hours: 09:00 to 18:00 Bulgarian time on a business day.

Who we are

SeaDirect Protect is operated by NBS Maritime OOD (НБС МЕРИТАЙМ ООД), registered in the Commercial Register of the Republic of Bulgaria under UIC 127595228, VAT number BG127595228, with its registered address at 1 Primorski Blvd., 9000 Varna, Bulgaria.

Organisations, with one exception

These terms apply to organisations buying for their business, professional or public purposes. Apart from the Router Subscription, they are not consumer terms, and the rules that protect consumers buying for personal use do not apply to contracts made under them. If we supply any other service to an individual buying for personal use, for example the private owner of a yacht, that contract is made on separate consumer terms.

The exception is the Router Subscription: a Consumer may order one, and the consumer rights described under Router Subscriptions ordered online then apply to that contract.

Authority to sign

The person who accepts an Order confirms that they are authorised to bind the organisation named in it.

Affiliates and managed vessels

An Order may cover your affiliates, for example the companies that own the individual vessels you manage, if the Order names them. You remain responsible for the obligations of every affiliate you bring under your Order, and for its payment.

People who work with us

The platform is built for us by our technology partner and operated by our own team. Where we use subcontractors to deliver part of a service, for example installation in a distant port or a specialist test, we remain responsible for their work as if it were our own, and they are bound by the same confidentiality and data protection duties as we are.

Quotes

A quote lists the products by name, the quantity each one is charged against, the Sites by type, the term, and every discount applied. A quote is valid for 30 days from its date unless it states otherwise.

A quote keeps its numbers

Once issued, a quote freezes its own breakdown. A later change to our price list never rewrites a figure you have already been given, for the life of that quote and of the contract made from it.

Prices on the website

Prices shown by the plan builder on our website are indicative list prices, not an offer. A contract is made only by an Order we have confirmed in writing.

Accepting an Order

A contract is formed when both of us sign the Order, including by electronic signature, or when you accept a quote in writing and we confirm it. Starting to use the Services under a quote you have not signed also counts as accepting it.

Prerequisites are included

If a product needs another product underneath it to work, the Order includes that prerequisite from the start. A quote you are given is one that can actually be delivered.

The evaluation stands on its own

An Organisation Evaluation is priced and delivered as its own piece of work. Ordering one commits you to nothing else, and the report is yours to use as you wish, including with one of our competitors.

Pilots and trials

A pilot, proof of concept or trial is agreed in writing, with its own scope, length and price, which may be zero. Unless that agreement says otherwise, a pilot carries no service levels and ends automatically on its end date, and what was installed for it is removed or converted into an Order.

Your purchase terms do not apply

Terms printed on your purchase order, or accepted in a supplier portal to get an invoice paid, do not apply to the contract, even if we accept the purchase order.

Orders made online

A Router Subscription is not made by a signed Order. It is ordered on this website or in the client portal, at the prices the order form shows, and the contract is made when we accept the order, as described under Router Subscriptions ordered online. The rest of this section applies to it only where that section does not say otherwise.

The platform

The Platform protects networks, endpoints and people, and keeps the evidence that proves it. Its capabilities include network protection and filtering, threat detection, network discovery, vulnerability and patch management, endpoint protection and device control, endpoint backup, remote access, identity and access governance, notifications, threat intelligence, compliance registers and reporting, and staff and crew training. Your Order names which of them you receive.

Four ways to deploy

Every Order uses one of four deployments:

• per environment: an Appliance at each Site, protecting the network and the machines behind it;
• per endpoint: Agents on the machines you choose, reporting to our cloud with no Appliance needed;
• Next-Generation Cloud Firewall: an Appliance running as an instance in a cloud you choose;
• staff and crew training: the training and skills evaluation products on their own.

Three plans

Essentials gives you the platform to run yourself, with onboarding planned with you. Custom gives you the capabilities you choose and the split of work you choose. Complete is the service run by us: the platform, its operation, a Security Operations Centre watching 24 hours a day, a named virtual CISO, evaluation and training, and incident handling up to the regulatory deadline. What each plan includes is described on our website and fixed in your Order; where they differ, your Order wins.

What you bought is what is switched on

The Platform enforces your Order: a product you have not ordered is hidden in the portal and cannot be configured on your devices. A product you have ordered is usable by your own people in the client portal, not only by our operators. Adding a product is a change to your Order, not a setting.

Early-access capabilities

Some capabilities are marked as early access while we shape them with design partners. We tell you which parts of your Order are early access. They are provided as they are, may change or be withdrawn, and are not covered by service levels or service credits.

What is not included

Unless your Order lists them, the fees do not include:

• hardware other than the Appliances your Order lists;
• your internet links, satellite airtime and data charges;
• licences for third-party software we monitor, patch or back up, such as operating systems and office or line-of-business software;
• work outside the agreed scope, which we quote before doing rather than invoice afterwards;
• travel and accommodation for work on site or on board.

Up to two weeks

We aim to take you from the first call to a running, evidenced estate within two weeks: evaluation in the first days, the plan after it, and onboarding in the second week. It takes longer only when your side needs more time, for example to reach a vessel. The timeline is a plan we commit to working towards, not a deadline with penalties, unless your Order sets one.

What we need from you

• a named contact with the authority to make decisions;
• accurate information about your sites, links, networks and machines;
• physical or remote access to connect Appliances, or someone on site who can follow our instructions;
• administrator rights to install Agents, or someone who holds them;
• answers to the onboarding questionnaire.

When the subscription starts

Unless the Order fixes a date, the subscription for each Site or Endpoint starts on the day its Appliance or Agent first reports to the Platform, and for the Order as a whole no later than 30 days after it is signed.

Delays on your side

If onboarding is held up because something we need from you does not arrive, the subscription still starts as described above. Extra work caused by the delay may be charged at our standard rates, after we have told you and you have agreed.

Accepting the onboarding

Onboarding is complete when the products in your Order are reporting and we have given you the onboarding report. You then have 10 business days to tell us about anything that does not work as described; we fix it, and the onboarding is accepted once it does.

What we do

We operate the Platform to the scope your plan sets: we watch the queue, decide what is real, triage and prioritise findings, stage and roll out updates, chase anything that stops reporting, keep the registers current and write the month up. On Complete that includes carrying an incident to its regulatory deadline.

What stays with you

The decisions that are yours to make stay with you: accepting a risk, approving an exception, saying who we call at three in the morning, and signing off what goes to a regulator. So do the capabilities you chose to run yourself.

What runs with nobody in the loop

Some protection acts on its own: a failed link fails over, a configuration that would cut a site off reverts itself, known-hostile traffic is refused, machines back themselves up and registers fill from what was observed. How far automation may go is yours to set, as described under Automatic protection and response.

The split is written down

Whichever plan you are on, the Order, or the responsibility matrix attached to it, says which capabilities we operate and which your team keeps. It can change later without reinstalling anything, as a change to the Order.

Accountability does not transfer

Under the NIS2 Directive (EU) 2022/2555 and the national laws implementing it, and under the maritime cyber risk rules that apply to vessels, responsibility for managing cybersecurity risk rests with your management body and cannot be delegated by contract. We can carry the work; we cannot carry the accountability, and nothing in these terms claims to transfer it.

Decisions we need from you

When the Platform or our team needs your decision, we ask the contacts you named, through the channel agreed at onboarding. We are not responsible for the consequences of a decision that was not made in time, provided we asked through that channel and told you why it was urgent.

Authority over what we protect

You confirm that you own, or are authorised by the owner to have us protect, monitor, scan and change, every network, device, cloud account and system you bring into scope. For vessels or premises you do not own, for example under a management agreement, a charter or a lease, obtaining the owner's consent is your responsibility.

Accurate information and reachable contacts

Keep the information about your estate and your contacts accurate, and tell us of changes that affect the Services, such as a new site, a new link or a vessel changing hands. On plans with round-the-clock monitoring, keep at least one contact reachable at all hours.

Accounts

Portal accounts are personal. Protect them with multi-factor authentication, do not share them, remove people who leave, and tell us at once if you suspect an account has been misused. Actions taken through your accounts are treated as yours.

Looking after Appliances

Keep Appliances powered, ventilated and physically secure. Do not open them, install other software on them, or move them to another Site without telling us.

Leaving protection switched on

Do not uninstall Agents, bypass Appliances or switch protection off except through the portal or with our agreement. Protection that has been switched off is not protection we can answer for.

Everything outside the scope

You remain responsible for systems outside the scope of your Order, for your own suppliers, and for the licences of the software on your machines.

What you must not do

You must not, and must not allow anyone else to:

• use the Services to break the law or infringe anyone's rights;
• scan, attack or test systems you are not authorised to, using the Services or their results;
• copy, modify, reverse engineer or decompile the Appliance or Agent software, except where the law allows it regardless of this clause or an open-source licence permits it;
• resell, sublicense or provide the Services to anyone else, unless you are our authorised partner;
• probe, load-test or attack the Platform itself, or try to reach another customer's data;
• use our threat intelligence, vulnerability data or detection content to build a competing product or feed;
• remove or obscure our notices and markings.

Finding a flaw in our products

If you find a vulnerability in our products, tell us as described under How we secure the service. Good-faith research on the Appliances and Agents you have, reported to us first and not disclosed until we have had a reasonable time to fix it, is welcome and is not a breach of this section.

You are the controller

For personal data in your networks, devices and records, you are the controller and we are your processor. We act only on your documented instructions: the Order, these terms, the Data Processing Agreement and the settings you choose in the portal.

Features that observe people

Depending on your Order and your settings, the Services can include:

• inspection of encrypted web traffic, which requires a certificate trusted by your devices;
• records of which devices connected to which services, and when;
• remote access to computers, including recordings of sessions;
• control and logging of removable media, drivers and applications;
• internet access for guests and crew through vouchers;
• vessel position data;
• training, quiz and questionnaire results of your staff and crew;
• detection of unapproved AI services used on your network.

Your duties before switching them on

Before you switch any of these on, you must have a lawful basis for it, carry out any data protection impact assessment and any consultation with employees or their representatives that your law requires, and tell the people affected in a clear notice. This includes crew and visiting personnel on board, contractors, and guests on your networks.

Sensitive traffic

You can exempt destinations and categories from inspection of encrypted traffic, and we recommend exempting banking, healthcare and other sensitive categories. Which traffic is inspected is your decision.

Remote sessions

Our staff open remote sessions to your machines only to deliver the Services, within the approval rules you set in the portal. Every session is logged and recorded, and the recordings are kept for the period you set in the portal, as the Data Processing Agreement describes.

Guest and crew networks

Where you provide internet access to guests or crew through the Platform, you are the provider of that access and are responsible for any obligations your law places on providing it.

What can act automatically

Depending on your Order and settings, the Platform can block traffic, quarantine files, isolate a machine from the network, revert a configuration that would cut a site off, fail over to another link and install updates, without waiting for a person.

You set the limits

The portal lets you choose which response actions run automatically, which need approval, and which are only proposed. Our team acts within those limits, except to stop an attack in progress when we cannot reach you, in which case we take the least disruptive action that contains it and tell you at once.

Actions taken in good faith

An action taken in good faith to contain a threat can interrupt legitimate work, for example by blocking a service that looked hostile. We design the defaults so that such interruptions are rare and reversible, and we help you reverse one quickly. We are not liable for the interruption itself where the action followed your settings and was reasonable on the information available at the time.

No detection is perfect

The Platform will sometimes flag harmless activity and will sometimes miss harmful activity. Tuning detection to your environment is part of the service, and a missed detection is not by itself a breach of contract.

It stays yours

Your data belongs to you. We use it only to provide, secure and support the Services for you, and as this section allows. We never sell it.

The Data Processing Agreement

The Data Processing Agreement under Article 28 of the GDPR forms part of every Order that involves personal data. Where none was signed separately, our standard Data Processing Agreement applies.

Where it is kept

Your data is stored and processed in the European Union, in Germany. Two things travel further: notification emails to your users, delivered through an email service in the United States, and text sent to an AI provider to prepare a draft, as described under AI-assisted features. Both travel under the European Commission's standard contractual clauses or the EU-US Data Privacy Framework, as the Data Processing Agreement sets out. Otherwise we do not transfer your data outside the European Economic Area without your prior written agreement.

Sub-processors

We use a small number of sub-processors, such as the companies that host our servers. They are listed in the Data Processing Agreement. We give you 30 days' notice before adding or replacing one, and you may object on reasonable data protection grounds.

What we learn from attacks

When the Platform detects a threat, the processing produces technical findings about the threat itself: a hostile network address or domain, the fingerprint of a malicious file, a detection signature, an attack pattern. These findings, and nothing else, may be used across our customer base and in our threat intelligence, and shared with partners and third-party organisations, such as national computer security incident response teams, information sharing and analysis centres, security vendors and researchers, for research and for collective defence: the security equivalent of herd immunity, where an attack seen once can be blocked everywhere.

What is never shared

We never share your data itself, and never share anything that identifies you or could be associated with you, even by inference or guesswork. In particular, we never share:

• anything that names or describes you, your sites, vessels, people, networks, devices, accounts or configuration;
• addresses, domain names, host names, user names, file names, paths or file contents from your environment;
• a suspicious file itself: only its fingerprint;
• a finding that would point to you by its nature, such as a domain imitating yours or an attack aimed only at you;
• context that could tie a finding to you, such as which customer, site or machine saw it, or when.

Suspicious files

Where file analysis is part of your Order, a suspicious file may be copied to our isolated analysis environment. It is kept only as long as the analysis and your quarantine settings require.

Statistics

We may produce statistics about the use and performance of the Platform that cannot identify you or any person, and use them to run and improve the Services.

How long we keep it

Each kind of data is kept for a defined period, set out in the data retention schedule in the portal and in the Data Processing Agreement. Where the law sets a minimum, for example security logs that must be kept for at least 12 months or accounting records kept for 10 years, we keep the data at least that long. You can ask for longer retention, and you can place a legal hold on your records when you need them preserved.

Export at any time

You can export your registers, evidence, reports and records from the portal at any time during the contract, in common formats, at no extra charge.

AI-assisted features

Some features use artificial intelligence to prepare drafts, such as register entries, policy texts or report summaries. A draft is a starting point for a person to check; it is never a decision and never legal advice. Only the text needed for the draft is sent to the AI provider, which may process it inside or outside the European Union under the safeguards described under Where it is kept. Neither we nor any AI provider we use trains AI models on your data, and the provider processes it only to produce the draft, under contract and without keeping it for its own purposes.

Requests from authorities

If an authority asks us for your data, we refer it to you and tell you about the request, unless the law forbids us to. We disclose only what we are legally compelled to.

Our own measures

We protect the Platform with the controls we sell: encryption between every component, signed and verified updates, separation between customers, least-privilege access for our staff with every access logged, monitoring of our own infrastructure, and regular backups.

If something happens to us

If we become aware of a security incident affecting your data or the Services we provide to you, we tell you without undue delay, and for a personal data breach no later than 24 hours after we become aware of it, so that you can meet your own 72-hour notification duty under the GDPR. We tell you what happened, what it affects and what we are doing about it, and keep you updated.

Our duties as a manufacturer

As a manufacturer under the EU Cyber Resilience Act (Regulation (EU) 2024/2847), we handle vulnerabilities in our products, report actively exploited vulnerabilities and severe incidents to the authorities as that Regulation requires, and inform affected customers of the measures they can take.

Reporting a vulnerability in our products

Report it to the security contact published on our website. We acknowledge reports, keep the reporter informed, and credit them publicly if they wish.

Questionnaires and audits

We answer one reasonable security questionnaire a year from you or your auditor at no charge, and support audits as the Data Processing Agreement describes.

Availability target

We aim for the cloud Platform (the portal, the fleet management service and the update and intelligence services) to be available 99.5% of each calendar month, excluding planned maintenance and the exclusions below.

Protection does not depend on the cloud

Appliances and Agents keep protecting your Sites and machines when the link to our cloud is down, including at sea. What pauses is reporting, remote management and updates, which catch up when the link returns.

Support

Support is available through the portal and by email during business hours. On plans that include our Security Operations Centre, security incidents are handled 24 hours a day, 365 days a year.

Response times

We respond to support requests within the times below, counted from when the request reaches us through an agreed channel. They are response times, not fix times: we keep working on an issue until it is resolved or a workaround is in place, and keep you informed.

• Critical (a site cut off, an active attack, or the Platform unavailable): within 1 hour, at any time on plans with the Security Operations Centre, otherwise within 2 business hours;
• High (a major function not working, with no workaround): within 4 business hours;
• Normal (a function impaired, with a workaround): within 1 business day;
• Low (questions, requests and cosmetic issues): within 3 business days.

Planned maintenance

We schedule maintenance of the cloud Platform outside business hours where we can, and announce it in the portal at least 3 business days ahead. Urgent security maintenance may take place at shorter notice.

What availability does not cover

• your internet links, satellite services, power and local network;
• equipment or software that is not ours;
• suspension under these terms;
• problems caused by changes made against our advice or outside the portal;
• early-access capabilities;
• events beyond reasonable control.

Service credits

If availability falls below the target in a month, you can claim a credit against your next invoice of 5% of that month's Platform fees below 99.5%, 10% below 99.0%, and 25% below 95.0%. Claims are made within 30 days of the end of the month. Service credits are your only financial remedy for missing the availability target, but they do not limit your right to end the contract for persistent failure.

The Complete plan

On the Complete plan, the Service Level Schedule adds commitments for incident handling, regulatory notification drafting, reporting and the review cadence.

Kept current

Updates, security fixes and new detection content are part of the subscription. We deliver them to Appliances and Agents automatically, signed and verified before installation, and roll them out in stages so that a faulty update is caught early.

Your maintenance windows

You can set maintenance windows and approval rules for updates that restart a device. An urgent security update may be installed outside them where waiting would put you at risk; we tell you when we do.

Updates to other vendors' software

When we deploy updates to third-party software on your machines, we test and stage them, but the content of the update is its vendor's. We are not responsible for defects in a third-party update, and we help you roll it back where the vendor allows.

Changes to the Platform

The Platform evolves, and we may change, improve or replace features. During your term we do not materially reduce the functionality of a product you have ordered. If a change would do so, we give you at least 90 days' notice and, if you object, you may end that product without penalty and receive a refund of any fees paid in advance for it.

Support period

We support each Appliance model and each Agent platform with security updates for a support period we publish, of at least five years from when that model or version was first placed on the market, and never shorter than the Cyber Resilience Act requires. We tell you at least 12 months before support ends for something you use.

Supported environments

Agents run on the operating system versions listed in the documentation. When an operating system's vendor ends support for a version, we may end our support for it after giving you notice.

Traffic on your links

Updates and reporting travel over your links. On metered or satellite links, the portal lets you limit, schedule and compress that traffic. The charges of your link provider remain yours.

Supplied with the subscription

Appliances are supplied as part of your subscription and remain our property throughout; they are not sold. Only where your Order expressly provides it does our software run on suitable hardware you already own.

Delivery and risk

We deliver to the address in the Order. Risk of loss passes to you on delivery, and for delivery to a vessel on handover to you or your agent in port. Delivery costs, and customs duties and import taxes outside the EU, are charged as quoted.

Replacement

If an Appliance fails in normal use, we replace it at no cost by sending an identical spare, usually dispatched within 2 business days of diagnosis. Loss, theft, and damage from misuse, accident, water, power surges or unauthorised opening are charged at the replacement price. You may not sell, pledge or lend an Appliance, and you keep it free of any claim by your creditors.

Your own hardware

Where the Order lets our software run on your hardware, the hardware and its failures are yours. We support the software, and we may refuse hardware we consider unsuitable.

Returning appliances

When an Appliance is no longer under contract, return it with its power supply within 30 days. Ordinary returns are at our cost. An Appliance not returned is invoiced at its replacement price.

Data on returned devices

Before a returned Appliance is reused or recycled, we wipe it securely. If you prefer to destroy its storage yourself, tell us and we will agree how.

Marine and industrial certification

If your vessels, your class society or your industrial site require type approval or specific certificates for network equipment, tell us before ordering. Unless the Order says otherwise, Appliances are not certified to any particular classification.

Routers ordered online

The routers of a Router Subscription are rented under this section too. Their delivery and its charge, the prepaid return label, the return period and the price of a router not returned are as described under Router Subscriptions ordered online, which prevails over Delivery and risk and Returning appliances where they differ.

The licence

For the term of your Order, we grant you a non-exclusive, non-transferable right to use the Platform, and the software in the Appliances and Agents, for your own internal purposes and for the Sites, Endpoints and administrator seats in your Order. You may copy the documentation for internal use.

Open-source components

Our products include open-source components, each under its own licence. The licences are listed with the product, and nothing in these terms limits your rights under them. Where a licence entitles you to the source code of a component, we provide it on request.

Licence checks

Appliances and Agents check in with the Platform to confirm that they are covered by a live contract. A device whose contract has ended, or that we have revoked at your request because it was lost or stolen, stops receiving updates, intelligence and management.

What you have agreed

Your Order fixes the number of Sites (by type), Endpoints and administrator seats. Each Site brings an allowance of included endpoint licences, and only Endpoints beyond the allowance are charged. The number of included administrator seats is stated in the Order.

Going above it

The Platform checks new installations against the agreed capacity. Depending on what we agree with you, an installation beyond it is either refused until the Order is updated, or allowed and reported to both of us. Use above the agreed capacity is charged from the date it began, pro rata, at the prices in your Order.

Reducing it

You can increase quantities at any time. You can reduce them at renewal, or during the term down to the minimum the Order states.

Seats are for named people

An administrator seat belongs to one named person. It can be reassigned when that person leaves, but not shared.

What you pay

The fees are those in your Order: recurring subscription fees, each charged per Site, per Endpoint, per administrator seat, per person trained or as a flat fee, and one-time fees for onboarding, delivery and engagements.

Currency and taxes

Prices are in euro and exclude VAT and other taxes, which are added at the applicable rate. For customers in other EU member states with a valid VAT number, the reverse charge applies.

Invoicing

Recurring fees are invoiced monthly in advance, unless the Order sets another period. One-time fees, such as onboarding and delivery, are invoiced on signature of the Order. Engagements are invoiced on completion, or in the stages their statement of work sets. Invoices are sent electronically.

Payment

Invoices are payable within 14 days of their date, by bank transfer to the account shown on the invoice. Your own bank's charges are yours.

Late payment

If an invoice is not paid on time, statutory interest under Bulgarian law runs from the due date, together with the fixed compensation for recovery costs that applies between businesses. We send a reminder before taking any further step.

Disputed invoices

If you dispute part of an invoice, tell us within 14 days with your reasons and pay the undisputed part. We resolve the disputed part with you in good faith, and it is not treated as late while we do.

Price changes

The prices in your Order are fixed for its initial term. For a renewal we may change them by giving at least 60 days' written notice before the renewal date; if you do not accept the change, you may end the contract on that date.

Discounts

Discounts are those stated in the Order, applied in the order the quote shows: product promotions, campaign promotions, the breadth discount for taking more of the platform, and any negotiated discount. A discount given in return for a minimum term may be recovered if the contract ends early through your ending for convenience or our ending for your breach.

Work outside the scope, and travel

Work outside the agreed scope is quoted and agreed before it is done. Travel to sites, vessels and ports, where the Order does not include it, is charged at cost with your prior approval.

No deductions

Payments are made without set-off or deduction, except for credits we have issued and except where the law does not allow this to be excluded.

Router Subscriptions

A Router Subscription is paid by bank transfer against a proforma invoice: first the prepaid months described under Router Subscriptions ordered online, before dispatch, and after them monthly in advance. Its prices stay fixed for as long as it runs, so Price changes does not apply to it, and nothing is invoiced on signature, because there is no signed Order.

Term

Each product runs for the term in the Order, starting on its service start date. The term is never shorter than the product's minimum term, which is 12 months unless the Order says otherwise.

Renewal

At the end of its term, the contract renews automatically for a further period of the same length as its initial term, unless either of us gives written notice at least 90 days before the end of the current period.

Ending early for convenience

You may end the contract before the end of its current term by giving two months' written notice. If you do, the subscription fees for the rest of the current term become payable at once, reduced only by the costs we actually save, and a discount given in return for that term may be recovered.

Ending for a breach

Either of us may end the contract by written notice if the other materially breaches it and does not put the breach right within 30 days of being told about it in writing, or immediately if the breach cannot be put right.

Insolvency

Either of us may end the contract by written notice if the other becomes insolvent, enters bankruptcy or liquidation, or stops trading, as far as the law allows.

Persistent service failure

You may end an affected product without penalty if we miss its availability target in three months out of any six.

A vessel sold, a site closed

If you sell or stop operating a vessel, or close a Site, you may remove that Site at its next renewal date, or earlier by paying the remaining fees for that Site's current term. The vessel's new owner or manager can take the Site over under an Order of its own.

Ending part of an Order

Ending one product or one Site does not end the rest of the Order, unless what remains cannot work without it.

Router Subscriptions

A Router Subscription has no minimum term and does not renew for a fixed period: it runs from month to month until you stop it with 30 days' notice, with the refund described under Router Subscriptions ordered online. Term, Renewal and Ending early for convenience do not apply to it; Ending for a breach and Insolvency do.

When we may suspend

We may suspend all or part of the Services if:

• an invoice is unpaid more than 30 days after its due date and 10 days after a written reminder;
• an account or device is being used for an attack, or poses a serious risk to the Platform or other customers;
• a court or authority requires it;
• you breach Acceptable use.

How we suspend

We tell you beforehand unless the risk is immediate. A suspension may cover all of the Services, including protection, management and the traffic passing through Appliances, so a suspended Site can lose its connection. We restore the Services promptly once the reason is gone. We are not liable for the consequences of a suspension made in line with this section.

Fees during suspension

Fees continue during a suspension caused by you.

Router Subscriptions

For a Router Subscription, an unpaid invoice does not lead to the suspension described above. It leads only to the narrower steps under If a payment is missed in Router Subscriptions ordered online: the cloud features are suspended while the router keeps routing and internet access, and the subscription ends if the invoice stays unpaid. The other grounds for suspension above still apply to it in full.

Taking your data with you

When the contract ends, for whatever reason, you have 30 days to export your data from the portal. On request, we export your registers, evidence, reports and records for you in structured, commonly used, machine-readable formats. Exporting your data and switching to another provider are free of charge, in line with the EU Data Act (Regulation (EU) 2023/2854).

Help with switching

If you ask for it in your notice, we assist you during a transition period of up to 30 days, extendable where the Data Act requires it, with the switching assistance that Act requires. Further work, such as configuring a successor's systems, is quoted and charged separately.

Deletion

After the export period, we delete your data from the Platform within 30 days, and from backups as they cycle out within a further 90 days, except for what the law requires us to keep, such as invoices and contract records, which we keep only for that purpose. We confirm deletion in writing on request.

Devices

Appliances and Agents stop receiving updates, intelligence and management, and we give no assurance that an Appliance keeps protecting or passing traffic after the end date. Agents can be removed from the portal before the end date, or by your administrators afterwards. Appliances are returned as described under Network appliances. Arranging replacement equipment in time is your responsibility.

What remains payable

Fees for the period up to the end, and anything due under Ending early for convenience, remain payable.

What survives

The sections on confidentiality, liability, intellectual property, deletion of data, fees owed, and governing law and disputes continue to apply after the contract ends.

What this section covers

This section applies to every Router Subscription, whether it is taken by an organisation or by a Consumer. Where it differs from another section of these terms, this section prevails for the Router Subscription; in everything it does not change, the rest of these terms apply. The clauses that name a Consumer apply only to a Consumer.

Ordering

Before you order, the order form shows the routers and the per-router features you chose, the monthly price of each from our published price list on that day, the delivery charge, the number of months to prepay and the amount, and asks whether you order as a business or as a private person. A private person ordering must be at least 18 years old.

Sending the order is your offer to take a Router Subscription on these terms. The contract is made when we accept the order by email to the address you gave, and the version of these terms in force on that day applies to it. We may decline an order, for example where we cannot deliver to the address or sanctions apply. The prices of an accepted order are frozen for as long as that Router Subscription runs. We confirm the accepted order by email, with these terms and, for a Consumer, the model withdrawal form.

The routers are rented

The routers are included in the subscription and remain our property: they are rented to you, never sold. A router that fails in normal use is replaced at no cost, as described under Network appliances.

Prepayment before dispatch

Before we dispatch, you prepay the smallest whole number of months of the subscription whose value covers the value of the routers, EUR 280 per router, plus delivery, EUR 50 per order within the EU. The order form and the proforma invoice show the exact number of months and the amount. This is a prepayment of subscription fees, not a price for the routers, which stay ours.

The subscription is activated on the day the first router of the order reports to the Platform, and at the latest 30 days after delivery. The next payment falls due that many months after activation; after that, the subscription is invoiced monthly in advance.

Payment and VAT

Payments are made by bank transfer against a proforma invoice. Prices exclude VAT, which is added at the applicable rate and shown as its own line on the order form and the invoices, so the total you pay, VAT included, is shown before you order. For a business in another EU member state with a valid VAT number, the reverse charge applies.

Delivery

Within the EU, we deliver by DHL for a flat EUR 50 per order, which the prepaid months cover, and you can follow the tracking in the client portal. Outside the EU, we quote delivery, customs duties and import taxes before we accept the order. Risk of loss passes to you on delivery.

Your account

Once the prepayment has reached us, we set up your account in the client portal and email one-time sign-in credentials to the address in the order. At first sign-in you must choose your own password and set up two-factor authentication.

Consumers: the right of withdrawal

A Consumer may withdraw from the Router Subscription, without giving any reason and at no cost, within 14 days from the day the contract is made, which is the day we accept the order. To withdraw, send us a clear statement of the decision by email to the contact address published on this website and given in the order confirmation, or use the form in Annex: Model withdrawal form. It is enough to send it before the 14 days have passed.

Consumers: dispatch after the withdrawal period

For a Consumer, we dispatch the router only after the 14-day withdrawal period has passed, even if the prepayment reaches us sooner. Delivery to a Consumer can therefore take more than 14 days from the order.

Consumers: refund after withdrawal

If a Consumer withdraws within the period, we refund everything paid under the order within 14 days of receiving the withdrawal, by the same means of payment that was used unless the Consumer expressly agrees otherwise, and at no cost to the Consumer. Nothing has been shipped, so nothing has to be returned, and any portal account already set up for the order is closed.

Stopping the subscription

You may stop a Router Subscription at any time with 30 days' notice, given in the client portal or in writing. There is no minimum term and no renewal for a fixed period.

If the end date falls within the prepaid period, we refund the prepaid months not used by the end date, less EUR 50 for delivery and EUR 50 for the return of the routers. If you stop after the prepaid period, monthly invoicing stops at the end date and the return costs you nothing. In either case we send you a prepaid DHL return label.

Returning the routers

Return each router with its power supply within 30 days of the end date. A router that is not returned is invoiced at its replacement price of EUR 280.

If a payment is missed

After the prepaid period, if a monthly invoice is not paid, we send a reminder on its due date. If it is still unpaid 14 days after the due date, we suspend the cloud features, while the router keeps providing basic routing and internet access. If it is still unpaid 30 days after that, the Router Subscription ends, the routers must be returned as described under Returning the routers, and the amounts outstanding remain payable.

Consumers: the legal guarantee of conformity

A Consumer has the legal guarantee of conformity under Bulgarian law, including the Consumer Protection Act and the Act on the Supply of Digital Content and Digital Services and the Sale of Goods, which transposes Directives (EU) 2019/770 and 2019/771, as far as those rules apply to the Router Subscription. Exercising it costs the Consumer nothing, and our commitment to replace a router that fails in normal use is given in addition to these rights, not instead of them.

Consumers: rights the law protects

Nothing in these terms takes away a right that a Consumer has under the mandatory consumer protection law of the country where the Consumer lives. Every limitation or exclusion of liability in these terms, including those under Liability, Automatic protection and response and What we promise, and what we do not, applies to a Consumer only as far as that law allows.

Consumers: courts and dispute resolution

A Consumer may bring proceedings in the courts of the place where the Consumer lives, as well as in Varna, and we may bring proceedings against a Consumer only in the courts the law allows. The choice of English law and arbitration under Governing law and disputes is not available to a Consumer. A Consumer may also take a dispute to alternative dispute resolution: in Bulgaria, the conciliation committees of the Commission for Consumer Protection (www.kzp.bg).

Statements of work

Each engagement, such as an Organisation Evaluation, a re-evaluation, a training programme, a penetration test or a threat intelligence report, has a statement of work or Order line setting its scope, deliverables, schedule and price.

Organisation Evaluation

We assess your organisation against the obligations that apply to it, such as NIS2 and the maritime cyber rules, and deliver a report with a gap list and priorities. The report describes the position on the day it was written. It is an assessment, not a certification, and it does not decide your legal status for you.

Training

Training is priced per person. Course content is licensed for your internal use. We keep training records and results for you as evidence. A certificate of completion confirms attendance and results; it does not certify competence for a regulated role.

Virtual CISO

On plans that include one, a named virtual CISO advises your management, prepares management reporting, and attends reviews and audits with you. The virtual CISO does not become an officer or employee of yours and does not take on your management body's legal duties. If the named person changes, we tell you in advance and arrange a handover.

Security Operations Centre

Where included, our Security Operations Centre watches your alerts 24 hours a day, 365 days a year, triages them, takes the response actions your settings allow, and escalates to your named contacts by the route agreed at onboarding.

Incidents and regulatory notification

Where your plan includes incident handling, we run the incident with you and prepare the notifications your law requires, under NIS2 an early warning within 24 hours, a notification within 72 hours and a final report within one month, ready for submission inside each deadline. You, or the person you authorise, submit them, unless the Order says we submit them on your behalf. We cannot meet a deadline if we learn of the incident too late or your approval does not arrive in time.

Audits and inspections

Where included, we attend audits and inspections with you, remotely unless agreed otherwise, and provide the evidence the Platform holds.

Moving a scheduled day

If you cancel or move a scheduled engagement day, such as a training session, a visit or a test window, with less than 5 business days' notice, we may charge the costs we cannot recover, such as travel already booked.

Written authorisation

We test only the systems you authorise in writing, within the scope, dates, times and source addresses set out in the rules of engagement. You confirm you have the right to authorise testing of everything in scope; for systems hosted or operated by others, such as cloud, satellite or managed service providers, you obtain their permission where their terms require it.

The risk of testing

Testing can disrupt systems even when done carefully. We agree exclusions and safeguards with you beforehand, stop at once if you ask, and tell you immediately if we find something critical. Within the agreed scope and rules, disruption caused by the testing itself is not a breach of contract, unless we were negligent.

Phishing and social engineering

Simulations target only the people and addresses you approve. Their results are for training, not for disciplinary use, unless you have told your staff otherwise and your law permits it.

Findings

Findings are confidential and belong to you. We keep a test's working data only as long as needed to write and support the report, and no longer than 12 months.

Retesting

One retest of the findings within three months of the report is included, unless the statement of work says otherwise.

Connectivity at sea

Vessels and remote sites rely on satellite and cellular links that are slow, costly and sometimes absent. The Platform is designed for that: it queues reporting and updates, and protection runs on board without the cloud. Delays in reporting caused by the link are not failures of the service.

Airtime

Data used by the Platform over your links is charged to you by your link provider. You can cap and schedule the Platform's traffic in the portal, and we help you set limits that fit your airtime plan.

Installation on board

Installation on a vessel is done in port, or by the crew following our instructions with remote assistance. Attendance on board, travel and port access are quoted separately unless the Order includes them. You arrange port passes and the master's permission.

Ship's systems and class

An Appliance is connected to ship's operational technology, such as navigation, engine or cargo systems, only to the extent the Order describes and in line with the vessel's safety management system. We do not alter safety-critical systems. Where class rules for cyber resilience apply, such as IACS UR E26 and E27, we provide the documentation the Platform holds to support your surveys; obtaining class approval remains yours.

What we promise

• the Services are provided with reasonable skill and care, by qualified people, in line with good industry practice;
• the Platform works materially as its documentation describes;
• we do not knowingly introduce malicious code;
• we have the right to grant the licences in these terms;
• on plans that include it, the controls in scope are deployed, operating and evidenced continuously, your regulatory notifications are drafted and ready inside the deadline, and your registers and evidence will stand up to an assessor.

What we own, we fix

A defect or gap in our own equipment or our own software, meaning the Appliance and the Platform we run for you, is fixed at no cost to you. A gap anywhere else in your estate is written up with a recommendation, a priority and, if you want us to do the work, a quote.

What nobody can promise

No security service can guarantee that you will never be breached, that every threat will be detected, or that a regulator, insurer or customer will reach a particular conclusion. We do not make those promises, and nothing on our website, in our brochures or in conversation should be read as making them. What we mean by guaranteed compliance is that when the regulator does come, the work will have been done and the evidence will be there.

Information we provide

Vulnerability, threat intelligence and compliance information comes from sources we consider reliable and from our own analysis, but it can be incomplete or wrong. It informs your decisions; it does not replace them, and it is not legal advice.

If we fall short

If the Services do not meet these promises, tell us promptly. We put it right at our cost, or, if we cannot within a reasonable time, you may end the affected product and receive a refund of the fees paid for the period after the failure.

Nothing else implied

Apart from what these terms say, and as far as the law allows, we give no other warranties, express or implied.

Where there is no limit

Nothing in these terms limits or excludes liability for intent or gross negligence, which Bulgarian law does not allow to be limited in advance, for death or personal injury, for fraud, or any other liability the law does not allow to be limited.

The cap

Otherwise, each party's total liability arising from or in connection with a contract, in each contract year, is limited to the fees paid and payable under that contract in the 12 months before the event giving rise to the claim.

A higher cap for data

For breaches of the Data Processing Agreement or of Confidentiality, the cap is twice that amount.

Losses neither of us covers

Neither of us is liable for loss of profit, revenue, business, goodwill or anticipated savings, or for indirect or consequential loss, except where there is no limit as described above.

Fines

Fines imposed on you by a regulator remain your responsibility, except to the extent they result directly from our breach of contract and the law allows them to be recovered.

Lost data

Where data is lost because of our breach, our first duty is to restore it from the most recent backup the Services hold, and we cover the reasonable cost of recreating what cannot be restored, within the cap.

Limiting losses

Each of us takes reasonable steps to limit its losses. We are not liable to the extent a loss results from your not following our written recommendation, not applying an update we provided, or not approving a response action we proposed and explained.

Fees are not capped

The cap does not apply to your obligation to pay the fees.

Consumers

This section applies to a Consumer only as far as the law allows, as described under Router Subscriptions ordered online.

Claims that our products infringe

If a third party claims that the Services infringe its intellectual property, we defend you and pay the damages and costs awarded, provided you tell us promptly, let us control the defence and cooperate. We may instead change the Services so that they no longer infringe, obtain a licence, or, if neither is reasonable, end the affected product and refund the fees paid in advance for it. This does not apply where the claim arises from your modifications, your data, or a combination with things we did not supply.

Claims about what you put in scope

You defend us, on the same conditions, against claims by third parties, including your staff, crew and guests and the owners of systems you brought into scope, arising from monitoring, scanning or testing you authorised without the right to, or from your data or your unlawful use of the Services.

Ours

We and our licensors own the Platform, the software in the Appliances and Agents, our detection content and threat intelligence, our methods, templates and training content, and improvements to them, including improvements prompted by your feedback.

Yours

You own your data and the deliverables produced specifically for you: your evaluation report, your registers, your policies and plans, your test reports and your evidence. Where a deliverable contains our standard templates, methods or content, you have a perpetual right to use that content as part of the deliverable for your own purposes, also after the contract ends.

Feedback

If you give us suggestions, we may use them freely and without obligation to you.

Your name and logo

We do not name you as a customer or use your logo without your written permission.

What we each keep confidential

Each of us keeps confidential the other's non-public information received under the contract, including your network designs, vulnerabilities and findings, and our pricing, methods and product internals. Each of us uses it only for the contract and shares it only with people who need it and are bound by similar duties.

For how long

This duty lasts for the contract and five years after it, and for as long as the information stays sensitive where it concerns security, such as credentials, vulnerabilities and network designs.

Exceptions

The duty does not cover information that is or becomes public through no fault of the receiver, that the receiver already knew or developed independently, or that the law or an authority requires to be disclosed, in which case the receiver tells the other first where it is allowed to.

Sanctions

We do not supply the Services to persons, entities or vessels subject to sanctions of the European Union or the United Nations, or of other jurisdictions where they apply to us, or for use in sanctioned territories. You confirm that neither you, your owners or managers, nor any vessel or Site in scope is subject to such sanctions, and you tell us at once if that changes. We may suspend or end the contract immediately if it does.

Export controls

Our products contain encryption and security technology that may be subject to export controls, including Regulation (EU) 2021/821 on dual-use items. You do not export or move them in breach of those controls, including by carrying an Appliance on board to a destination where its use is restricted.

Your regulatory status

Working out which laws apply to you, for example whether you are an essential or important entity under NIS2, and registering with an authority where required, is your responsibility. Our evaluation helps you with it.

Anti-corruption

Each of us complies with anti-corruption laws and neither offers nor accepts bribes or improper payments in connection with the contract.

Buying through a partner

If you buy SeaDirect Protect through an authorised partner, your commercial terms (price, invoicing, payment and first-line support) are with the partner. These terms still govern the use of the Services, our handling of your data and our responsibilities to you.

A partner operating for you

A partner you appoint may be given operator access to your environment. You decide what it can see and do, and you can withdraw its access at any time. We are not responsible for what a partner does as your operator.

Services under a partner's brand

An authorised partner may offer the Services under its own brand, under a separate partner agreement with us. If you buy such a service, the partner is your provider and answers to you for it; we deliver the underlying Services to the partner, and our handling of your data follows the Data Processing Agreement the partner makes available to you.

Force majeure

Neither of us is liable for a delay or failure caused by events beyond its reasonable control, such as natural disasters, war, terrorism, piracy, acts of authorities, new sanctions, widespread failures of internet, satellite or power networks, or attacks on shared infrastructure of a scale our measures under How we secure the service could not reasonably prevent, provided it tells the other promptly and does what it reasonably can to limit the effect. Fees for Services actually delivered remain payable. If such an event prevents performance for more than 60 days, either of us may end the affected part of the contract.

Updating the terms

We may update these terms, for example to reflect new products, new laws or changes to the Services. The version and date at the top change with each update, and earlier versions are available on request.

When an update applies to you

For an existing Order, a new version applies from its next renewal, and we tell you about material changes at least 60 days before they apply to you. Changes the law requires, or that only benefit you, may apply sooner.

Changing an Order

An Order is changed in writing, including by a new or updated quote you accept.

Notices

Notices under the contract are given in writing to the addresses in the Order, and email counts as writing. A notice of breach, termination or a claim is also sent by registered post or a qualified electronic delivery service.

Electronic signatures

Orders and other contract documents may be signed electronically, including with an advanced electronic signature, and each of us accepts electronically signed documents as originals.

Language

These terms are written in English and made available in Bulgarian. If the English and the Bulgarian version, or any other translation, differ, the English version prevails.

Transferring the contract

Neither of us may transfer the contract without the other's consent, which is not to be unreasonably withheld, except to a successor to the whole of the relevant business that takes over all the obligations.

The whole agreement

The contract documents are the whole agreement between us about their subject and replace earlier proposals and discussions. Neither of us relies on a statement not written in them, but this does not limit liability for fraud.

If a clause fails

If a clause is found invalid, the rest of the contract stands, and the invalid clause is replaced by a valid one closest to its purpose.

No waiver

Not enforcing a right straight away does not mean giving it up.

Independent parties

We are independent contractors. Nothing in the contract makes either of us the other's partner, agent or employee.

Governing law

The contract, and any dispute about it, is governed by the law of the Republic of Bulgaria, unless your Order chooses the law of England and Wales. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Talking first

We first try to resolve any dispute by talking. Each of us names a senior person, and they meet, in person or online, within 15 business days of a written request.

Courts

If talking has not resolved the dispute within 30 days, it is decided by the competent court in Varna, Bulgaria. Where your Order chooses English law, it is instead finally resolved by arbitration in London under the terms of the London Maritime Arbitrators Association current when the arbitration starts, in English. Either of us may still ask a competent court for urgent interim measures at any time.

Consumers

For a Consumer, the courts and the dispute resolution described under Router Subscriptions ordered online apply, and the mandatory consumer protections of the country where the Consumer lives are unaffected by the choice of Bulgarian law.

Who this section applies to

This section applies to everyone who visits protect.seadirect.net or uses its free tools, whether or not they are a customer.

The free tools

The free tools (the IP address scan, vulnerability lookup, malware fingerprint lookup, file scan, User-Agent lookup and regulatory clock) are free of charge and provided as they are, for information. Each network address may make a limited number of lookups a day. Results can be incomplete or wrong, and a clean result is not a guarantee of safety.

Fair use

When using the site and the tools, you must not:

• query them automatically or in bulk, or work around the daily limits;
• upload files you have no right to share, or files containing other people's personal data;
• use the results to attack, harass or profile anyone;
• interfere with the site or try to gain access to anything not offered to you.

Pages made from lookups

When a vulnerability lookup finds known vulnerabilities, the product and version may become a public page on this site, so that others can find the answer. Nothing about who asked is stored with it.

The content of the site

The content of this site belongs to us or is used under licence. You may read, print and share pages for your own information, naming the source; anything more needs our permission. Vulnerability data comes from public sources under their own licences, credited on the pages that show it.

Liability for the free tools

As far as the law allows, we are not liable for loss arising from using this site or the free tools, which are free of charge. This does not limit liability for intent or gross negligence.

Privacy

How this site handles personal data is described in the privacy notice.

Contact

NBS Maritime OOD, 1 Primorski Blvd., 9000 Varna, Bulgaria. UIC 127595228, VAT number BG127595228.

• about a contract or these terms: the contact address published on this website, or your account contact;
• about personal data: our data protection officer, at the address in the privacy notice;
• to report a vulnerability in our products: the security contact published on this website;
• to report a security event: the report form on this website, or your support channel if you are a customer.

Model withdrawal form

Complete and return this form only if you wish to withdraw from the contract.

• To: NBS Maritime OOD, 1 Primorski Blvd., 9000 Varna, Bulgaria, by email to the contact address published on this website and given in the order confirmation.
• I/We (*) hereby give notice that I/We (*) withdraw from my/our (*) contract for the provision of the following service: Router Subscription, order reference:
• Ordered on (*) / accepted on (*):
• Name of consumer(s):
• Address of consumer(s):
• Signature of consumer(s) (only if this form is sent on paper):
• Date:
• (*) Delete as appropriate.