We, "SD Worx",

• SD Worx People Solutions NV, Brouwersvliet 2, 2000 Antwerp, Belgium – VAT BE 0422.211.801 – registered in Antwerp
• SD Worx Social Secretariat ASBL/VZW, Brouwersvliet 2, 2000 Antwerp, Belgium – VAT BE 0407.139.583 – registered in Antwerp
• and the affiliated companies within the meaning of art. 1.14 of the Companies Code

want to engage with you as "Security Researcher" to test the security measures of our platforms as part of our responsible disclosure program.

SD Worx processes large quantities of personal data of our customers and users and must comply with data protection regulations, including EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“General Data Protection Regulation” or “GDPR”). As a Security Researcher, by accepting these terms and conditions, you will act as a data processor for SD Worx. This means that you may only process any personal data during your investigation in accordance with SD Worx' explicit instructions, as described below and in the program details for the bounty program (such as the specific rules of engagement, in scope, out of scope element on each bounty program).

As a Security Researcher, you

• do not work or have worked for SD Worx during the past 24 months (not as an employee, nor on any external basis as a contingent worker or consultant)
• disclose your findings exclusively via the Intigriti platform, and comply with the “Binding Ethical Hacking Researcher Guidelines” provided by Intigriti. You explicitly declare that these "Binding Ethical Hacking Researcher Guidelines" will directly apply to your relationship with SD Worx, which you enter into by subscribing to these terms and conditions.
• report your findings to SD Worx as soon as possible
• process any data or information that you discover in line with the below requirements and the data protection regulations including the GDPR
  • treat all data as confidential
  • do not download or copy more data than necessary to demonstrate the vulnerability
  • do not use data for any purpose other than discovering and reporting vulnerabilities
  • take appropriate measures to adequately secure the discovered data during the moment from discovery until it is removed after reporting the vulnerability
  • permanently delete all (copies of) data after having reported the vulnerability
  • do not use third parties or other processors to carry out these tasks on your behalf
• always work in good faith with us to resolve any vulnerabilities you may have found or to provide further information
• are responsible for paying any taxes associated with rewards

As the bounty program manager, SD Worx

• will respond to any reports you provide within a reasonable time frame
• will keep you informed on the progress of resolving the vulnerability
• approves the associated reward for reporting an unknown, confirmed and validated vulnerability from a certain degree of severity. We determine the size of the reward on the basis of the severity of the vulnerability as defined in the program. Reports from individuals who we are prohibited by law from paying are ineligible for rewards.
• withholds the right to disclose the vulnerability and the reported problem at any time, even without your approval. In that report we will not mention your name as the discoverer of the problem. If you do wish to be mentioned, you must inform us and we will take this into consideration, but we will not be obliged to mention your name.
• may modify the terms of this program or terminate this program at any time. We won’t apply any changes we make to these program terms retroactively.

In order to encourage the adoption of bug bounty programs and promote uniform security best practices across the industry, SD Worx reserves no rights in these bug bounty terms & conditions and considers these as free to copy and modify by others for their own purposes.