1. Definitions

"Confidential Information" includes all non-public information disclosed by either party (the "Disclosing Party") to the other (the "Receiving Party") in connection with any engagement, including but not limited to: business and technical information, system details, source code, credentials shared for testing, vulnerability findings, reports, customer data, pricing and any information submitted through the LuDuan platform.

"Nominated consultants" means individuals engaged by LuDuan on a project basis who have been assigned to perform the specific services ordered by you. All nominated consultants are subject to background checks (where applicable) and have signed confidentiality agreements with LuDuan no less protective than these terms.

2. Obligations

• The Receiving Party shall keep Confidential Information strictly confidential and use it solely for the purpose of performing the engagement.
• The Receiving Party shall not disclose Confidential Information to any third party without prior written consent, except to its employees and nominated consultants bound by confidentiality obligations no less protective than these terms.
• The Receiving Party shall protect Confidential Information using at least the same degree of care it uses for its own confidential information and no less than reasonable care.

3. Exceptions

Confidential Information does not include information that: (a) is or becomes publicly available through no fault of the Receiving Party; (b) was lawfully in the Receiving Party's possession before disclosure; (c) is independently developed without use of the Confidential Information; or (d) is required to be disclosed by law or regulatory authority, provided the Receiving Party gives prompt notice where permitted.

4. Data Breach Notification

In the event of any actual or suspected unauthorized access, disclosure or loss of Confidential Information, the Receiving Party shall notify the Disclosing Party within 48 hours of becoming aware of such incident and shall provide reasonable cooperation in investigating and remediating the incident.

5. Term

This NDA survives the completion or termination of any engagement. Confidentiality obligations apply for a period of three (3) years from the date of disclosure; however, trade secrets and vulnerability findings shall be protected as confidential information for as long as they remain confidential and the underlying vulnerabilities remain unpatched or undisclosed to the public.

6. Return or Destruction

Upon written request, the Receiving Party shall return or securely destroy all Confidential Information (including copies) within 30 days, except where retention is required by law or professional standards.

7. Breach & Remedies

In the event of a breach of this NDA, the Receiving Party shall be liable for all damages suffered by the Disclosing Party as a result of such breach. The Disclosing Party shall be entitled to seek injunctive relief and/or specific performance in addition to any other remedies available at law or in equity.

Relationship with Other Documents

This document forms part of the LuDuan legal framework together with the Non-Disclosure Agreement, Data Sharing Consent, Disclaimer, Penetration Test Authorization, Service Terms and Refund Policy. Where there is any conflict, the order of precedence is: Penetration Test Authorization, NDA, Data Sharing Consent, Disclaimer, Service Terms, Refund Policy, unless expressly agreed otherwise in writing. All documents acknowledged at order placement together constitute the agreement governing your engagement with LuDuan.