Engineering Audit Agreement

Provider: V.DEV d.o.o., Dobriše Cesarića 5, 31000 Osijek, Croatia, OIB 87371467628, VAT HR87371467628 ("V.DEV").

Client: [Company name], [Registered address], [Country], represented by [Name], [Role] ("Client").

V.DEV performs an engineering audit of the online store at [store URL]: code and module review, platform version and missing security patches, performance on key page types, integrations, and a prioritised roadmap with effort estimates and a proposed fixed monthly price.

Deliverables: a written report and a 30-minute walkthrough call. Delivery within 5 working days after the access listed in section 6 is in place.

The fee is €290 excluding VAT, paid in advance. EU business clients with a valid VAT number: reverse charge. The fee is credited in full against the first monthly invoice if the Client starts a V.DEV plan within 60 days of delivery. If the Client finds the audit not useful, V.DEV refunds the fee in full on request within 14 days of delivery.

Each party keeps the other's confidential information (including source code, credentials, business data, customer data and this audit) confidential, uses it only to perform or receive the service, and shares it only with people who need it and are bound by the same duty. This obligation survives termination for 5 years; for source code and credentials, indefinitely. It does not cover information that is public, already known lawfully, or independently developed.

To the extent V.DEV processes personal data on the Client's behalf, V.DEV acts as processor and the Client as controller. V.DEV processes personal data only on documented instructions, ensures confidentiality of people with access, applies appropriate technical and organisational measures (named accounts, least-privilege access, encrypted credential storage, 2FA), assists with data subject requests and breach notifications (notice without undue delay, at most 48 hours after becoming aware), and deletes or returns personal data at the end of the service.

The audit does not require a production database. If a database is needed, an anonymised copy is used. Sub-processors: Resend, Inc. (transactional email); Hetzner Online GmbH (workflow automation, servers in Finland, EU); AI tools under commercial terms that do not train on client data; and, only if the Client chooses to use the V.DEV client portal, Supabase, Inc. (database, EU region, Ireland) for hosting it. Where the Client prefers its own tools (for example Jira, Asana, Trello, Slack or Microsoft Teams), requests, files and communication stay in those tools under the Client's own agreements with their providers, and V.DEV does not copy their content to other systems.

The Client grants read-only access to the code repository (or provides a copy), and where needed a restricted admin user on a staging environment. V.DEV does not change production systems under this agreement. Access is personal, never shared, stored only in an encrypted password manager, and the Client may revoke it at any time. V.DEV confirms in writing that all access and local copies of code are deleted within 5 working days of delivery.

Where V.DEV is given an account in the Client's project management, chat or documentation tools, it is a personal named account subject to the Client's security policies (including SSO and 2FA), used only for this service, and the Client may remove it at any time.

The Client's code, data and materials remain the Client's property. The Client receives a perpetual licence to use the audit report internally. V.DEV keeps its general know-how, tools and methods.

Each party's total liability under this agreement is limited to the fee paid, except for breach of confidentiality, data protection obligations, wilful misconduct or gross negligence. Neither party is liable for indirect or consequential loss.

Croatian law applies. Disputes go to the competent court in Osijek, Croatia. This agreement is concluded electronically; an electronic signature has the same effect as a handwritten one under Regulation (EU) No 910/2014 (eIDAS).