General Terms and Conditions (Terms)

Effective: 17 April 2026 — for use of the SaaS applications of Consiliari Software GmbH

§ 1 Scope, B2B-only

(1) These General Terms and Conditions (hereinafter "Terms") govern the use of the Software-as-a-Service applications provided by Consiliari Software GmbH (in particular "Temporalis EMS", "Kontrakte.AI" and "DOT"; hereinafter, individually and collectively, the "Service") between

Consiliari Software GmbH, Brauerstraße 12, 76135 Karlsruhe, Local Court Mannheim, HRB 753583, represented by its managing director Raphael J. N. Hettich

(hereinafter "Provider") and the contracting party (hereinafter "Customer").

(2) The offer is directed exclusively at entrepreneurs within the meaning of § 14 BGB (German Civil Code), legal entities under public law and special funds under public law. By concluding the contract, the Customer confirms that it acts in the exercise of its commercial or self-employed professional activity. The Provider does not provide services to consumers (§ 13 BGB).

(3) Differing, conflicting or supplementary general terms and conditions of the Customer do not become part of the contract unless their validity is expressly agreed in writing. Conflicting Customer terms and conditions are also not accepted if the Provider, knowing of such conditions, performs the service without reservation.

§ 2 Description of services

(1) The Provider makes cloud-based software applications available to the Customer over the internet. The specific feature scope of each Service is set out in the service/feature description on the relevant product website at https://www.consiliari-software.de in the version applicable at the time the contract is concluded.

(2) The Service is provided exclusively over the internet as Software as a Service. There is no right to delivery of the software copy for installation on the Customer's systems.

(3) The Provider is entitled to continuously develop the Service further. This may lead to changes in the feature scope, provided that the core scope and core functionality are preserved. The Provider will give at least 30 days' notice of material restrictions. Further development is carried out by the affiliated Consiliari GmbH (Local Court Mannheim, HRB 727046).

§ 3 Conclusion of contract, 14-day trial

(1) The Customer registers for a free 14-day trial (hereinafter "Trial") online. The Provider confirms registration by email.

(2) The Trial is available without entering payment data and ends automatically after 14 calendar days without separate notice. There is no automatic conversion into a paid subscription.

(3) During the Trial period the Customer may test the Service in full or in a clearly marked, reduced feature scope (depending on the chosen plan). Trial accounts are subject to additional restrictions (e.g. user-count limit, email quota).

(4) The paid contract is concluded when the Customer selects a plan within the application, enters its payment data via our payment service provider Stripe (cf. § 7) and confirms the order. The Provider confirms conclusion of the contract by email. The auto-renewal terms (§ 9 (2)) are separately disclosed to the Customer in the checkout flow.

(5) If no paid subscription is concluded within the Trial period, the account is deactivated; data entered by the Customer is automatically and permanently deleted 30 days after deactivation. The Customer is informed by email before this deadline expires and receives an export link.

§ 3a Special rules for the trial

This section conclusively governs the rights and obligations of the parties during a free trial under § 3 (1) to (3) ("Trial"). The other provisions of these Terms apply to paid subscriptions; § 3a applies there only insofar as its content is expressly referenced.

(1) No entitlement. The Provider voluntarily provides the Trial as a non-binding introductory offer. There is no legal entitlement to the establishment, continuation, extension or renewed grant of a Trial. The Provider is entitled to reject, restrict or withdraw Trial requests without giving reasons.

(2) No service-level commitments, no support. During a Trial neither the SLA provisions under § 5 (availability, service credits, maintenance windows) nor response, processing or recovery times apply. The Provider owes no support, no bug fixes, no consulting, no data recovery and no availability during the Trial. Any assistance provided is given exclusively voluntarily, at the Provider's free discretion, and creates no entitlement for the future.

(3) Provided "as is" / "as available". During the Trial, the Service is provided "as is" and "as available". The Provider gives no warranty regarding suitability, feature scope, freedom from defects, data integrity, performance or interoperability with the Customer's systems. The Customer acknowledges that Trial environments are in active development and test mode and may experience temporary or permanent outages at any time.

(4) Exclusion of warranty and limitation of liability in the Trial. § 12 (Warranty) does not apply to the Trial. In the Trial relationship, the Provider's liability is limited to intent and gross negligence of its legal representatives, executive employees and other vicarious agents, as well as to the cases of § 13 (1) (life/body/health, guarantees, Product Liability Act); liability for ordinary negligence under § 13 (2) to (4) is excluded in the Trial. Mandatory claims under Art. 82 GDPR and mandatory statutory liability rules remain unaffected.

(5) No data-retention obligation. The Customer shall not enter real productive, business-critical or sensitive personal data during the Trial. The Provider assumes no responsibility for data entered during the Trial and is not obliged to retain, back up, export or restore it. The export and deletion deadlines under § 10 apply to paid subscriptions; in the Trial, the Provider only provides the export option set out in § 3 (5) before deactivation.

(6) Immediate termination. The Provider is entitled to suspend or terminate a Trial at any time, without notice and without giving reasons. Cause exists in particular, but is not limited to:

• (a) recognisable or reasonably suspected misuse, in particular spam, abuse, scraping, load- or penetration tests without prior written approval;
• (b) multiple registrations by the same natural or legal person or its affiliates, in particular under varying email addresses, names or identities;
• (c) use of the Trial recognisably for purposes of market observation, reverse-engineering of the Service, or to develop, market or improve a competing product;
• (d) use of disposable, role-based or obviously incomplete email addresses or incomplete registration data;
• (e) indications of violations of applicable law, in particular sanctions or export-control law (§ 14a);
• (f) measures to protect system integrity, customers or third parties or to prevent impairment of paid operations;
• (g) unclear geographic attribution of the applicant, in particular when using anonymisation services (VPN, proxy, Tor), conflicting registration, billing or access regions, or where no jurisdiction can be identified in which the Service may lawfully be offered (cf. § 14a).

(7) No remuneration or damages claims. A rejection, restriction, suspension or early termination of a Trial gives rise to no claims by the Customer for reimbursement of expenses, damages, loss of use, lost profit or other consequential damages. § 13 (1) remains unaffected.

(8) No-circumvention rule. The Customer is prohibited from applying for or using a renewed Trial after regular expiry, rejection or early termination of a Trial — in particular under another email address, organisation or person name, via affiliates, or using technical means to obscure identity (e.g. proxies, VPN services, falsified information). A renewed Trial requires the Provider's prior written approval.

(9) Acceptable use. The use prohibitions and customer-cooperation duties under § 4 (2) to (5) and § 8 (3) apply to the Trial without restriction. Violations entitle the Provider to immediate suspension under § 4a and to termination of the Trial under (6).

(10) Data protection in the Trial. During the Trial as well, the Provider is a processor under Art. 28 GDPR (Annex 1). The Customer remains controller within the meaning of the GDPR and is responsible for the lawfulness of the data it enters (§ 4 (3)).

§ 3b Beta, early-access and experimental features

(1) Labelling. The Provider may offer individual features within the Service labelled as "Beta", "Preview", "Early Access", "experimental" or with comparable labelling (hereinafter "Beta features"). Labelling is provided as a notice in the application, in the release log or in the service description.

(2) Voluntary use. Use of Beta features is voluntary. The Customer activates and uses them at its own risk. Beta features are not part of the contractual scope owed under the paid subscription and are not separately remunerated.

(3) No SLA, no support. The SLA commitments under § 5 and the response provisions in § 5 (4) do not apply to Beta features. The Provider owes no support, no bug fixes, no documentation, no migration paths and no backwards compatibility for Beta features.

(4) Provided "as is". Beta features are provided "as is" and "as available". § 12 (Warranty) does not apply to Beta features.

(5) Liability. The Provider's liability for damages from the use of Beta features is limited to intent and gross negligence and to the cases of § 13 (1); liability for ordinary negligence under § 13 (2) to (4) is excluded. Mandatory claims under Art. 82 GDPR and mandatory statutory liability rules remain unaffected.

(6) Change/termination at any time. The Provider is entitled to change, restrict, relocate, transfer to the productive offering, or discontinue Beta features at any time without notice and without giving reasons. § 2 (3) (30-day notice for material restrictions) does not apply to Beta features. The Customer may not derive any claims (in particular for reduction, termination of the paid main contract, damages) from a change to or discontinuation of a Beta feature.

(7) Customer data in Beta features. The Provider recommends not using Beta features for business-critical purposes and not relying on Beta features as the sole data store. The Customer shall maintain parallel productive backups (§ 4 (4)). The Provider is not liable for the loss of data stored exclusively in Beta features.

(8) Confidentiality. Beta features made available to the Customer in advance or within a closed user group are deemed confidential information within the meaning of § 14 until general release. Public promotion, disclosure to third parties or comparative reporting requires the Provider's prior approval.

§ 4 Provision and customer cooperation duties

(1) The Provider makes the Service available to the Customer for use over the internet. Provision ends at the contractually agreed handover point (router exit of the data centre). The Customer is responsible for the connection from the handover point to the Customer (internet connection, end devices).

(2) The Customer ensures that its users use the Service only as agreed, keep their access credentials confidential, and use strong passwords. Multi-person use of a single account is not permitted (exception: team accounts expressly provided for in the contract). The Customer must enable the multi-factor authentication offered in the application for privileged accounts (administrators).

(3) The Customer is solely responsible for the data entered into the Service and for its compliance with law (in particular copyright, data-protection, employment law). The Customer ensures that it is entitled to collect, process and transfer such data to the Provider, has met its information obligations to data subjects under the GDPR, and — where applicable — has observed works-council co-determination rights (§ 87 (1) no. 6 BetrVG). In particular when using the time-tracking and attendance features it is the Customer's sole responsibility to meet, on its own initiative within its own organisation, the organisational, co-determination and documentation requirements arising from the German Federal Labour Court ruling of 13 September 2022 (file no. 1 ABR 22/21) and from § 3 (2) no. 1 ArbSchG — including involvement of any works council or staff council and the design of any works agreements. The Provider provides only the technical platform; it owes neither employment-law advice nor lawful design of the specific roll-out and use at the Customer.

(4) The Customer is obliged to make its own regular data backups. The Service offers suitable export functions for this purpose. This obligation applies in addition to the Provider's backup services and serves the Customer's own protection.

(5) The Customer reports detected security incidents (e.g. compromised credentials, suspicious activity) without undue delay, at the latest within 48 hours, to security@consiliari-software.de and cooperates reasonably in investigation and remediation.

§ 4a Temporary account suspension (Suspension)

(1) The Provider is entitled to temporarily suspend the Customer's access to the Service if

• (a) the Customer is in default of payment for more than 14 days despite a reminder,
• (b) there is reasonable suspicion of a serious breach of contract or a threat to system integrity (e.g. abuse, massive load, compromise),
• (c) sovereign orders so require.

(2) The Customer is informed in text form without undue delay, at the latest upon suspension, and is given the opportunity to comment. The suspension is lifted as soon as the cause has ceased.

(3) Fees continue to accrue during the suspension to the extent that the Customer is responsible for it. If the Provider has caused the suspension without legitimate reason, the fee is refunded pro rata.

§ 5 Availability (SLA)

(1) The Provider owes a Service availability of 99.5 % per calendar month. Availability is calculated as the ratio of actual availability time to the total time of the calendar month, less planned maintenance windows and times of force majeure.

(2) Planned maintenance windows are generally held on weekdays between 22:00 and 06:00 (CET/CEST) and are announced at least 48 hours in advance by email or in-app notice. Maintenance windows do not count as unavailability.

(3) The following also do not count as unavailability:

• disruptions outside the Provider's control (e.g. internet-backbone failures, attacks, force majeure within the meaning of § 12a);
• interruptions to defend against acute security threats;
• restrictions due to unlawful use by the Customer or third-party integrations triggered by the Customer.

(4) The Customer reports disruptions without undue delay to support@consiliari-software.de with a comprehensible description. The Provider handles reported disruptions exclusively within its business hours (Monday to Friday, 10:00–16:00 (CET/CEST), excluding statutory holidays at the Provider's seat) prioritised by severity. No guaranteed response or recovery time is owed beyond the SLA availability set out in § 5 (1). Reports received outside business hours are deemed received at the start of business on the next business day.

(5) Service credits for SLA breach. If actual availability in a calendar month falls below the rate committed in (1), the Provider grants the Customer, on its written request within 30 days of month-end, a credit on the next invoice on the following scale:

(6) The grant of service credits under (5) is the Customer's exclusive remedy for pure SLA breaches. Claims under § 13 (1) (intent, gross negligence, guarantees, protection of life/body/health, product liability) remain unaffected. The right to rent reduction under § 536 BGB is hereby limited to the service credits; recourse to §§ 536a, 536b BGB remains unaffected to the extent mandatory.

§ 6 Prices and payment terms

(1) The prices in force at the conclusion of the contract apply, as set out in the price overview on the relevant product website at https://www.consiliari-software.de plus statutory VAT. All prices are net prices.

(2) Billing models:

• monthly, payable in advance per calendar month;
• annually, payable in advance for 12 months, with a discount disclosed by the Provider (see price overview).

(3) Billing is processed via the payment service provider Stripe (§ 7). Permitted payment methods: credit/debit card, SEPA direct debit, or other methods provided by Stripe.

(4) Payment is due immediately upon issuance of the invoice. In the event of default, statutory provisions apply (§§ 286 et seq., 288 BGB), in particular the default lump sum under § 288 (5) BGB (EUR 40) and default interest of nine percentage points above the base interest rate for receivables.

(5) An automatic renewal for the chosen billing period takes place (cf. § 9) unless terminated in time. Before annual renewals, the Provider informs the Customer at least 30 days in advance by email, clearly indicating the option to terminate.

(6) Price adjustments. The Provider may adjust prices once per year to the extent that its prime costs (in particular personnel, hosting, licences, energy, statutory charges) have changed since the last price setting, but at most in line with the change in the consumer price index (CPI, base year 2020) published by the German Federal Statistical Office. Reductions in the relevant cost elements are passed on to the Customer accordingly. The Provider notifies the Customer of adjustments at least 60 days before they take effect, in text form. The Customer has a special right of termination effective on the new prices' effective date; if it does not terminate, the new prices are deemed agreed. The Provider expressly draws attention to this legal consequence and the calculation basis in the notification.

(7) Set-off by the Customer is permitted only with undisputed or legally established counterclaims. The Customer may exercise a right of retention only based on the same contractual relationship.

(8) Reverse charge for EU B2B customers. For customers with a valid VAT identification number from other EU Member States, the supply is performed under the reverse-charge procedure under § 3a (2) UStG. The Customer is obliged to provide its VAT-ID in the account and to keep it up to date; the Provider verifies it before first invoicing under § 18e UStG. If the VAT-ID is incorrect or invalid, the Provider invoices with German VAT.

§ 7 Payment processing via Stripe

(1) All payments are processed via Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

(2) By entering its payment data at checkout, the Customer grants Stripe a mandate for the chosen payment method. Payment data is transmitted directly to Stripe; the Provider stores no full credit-card or bank data.

(3) Invoices are sent to the Customer electronically in PDF format or made available in the customer account.

§ 8 Usage rights, licences and insolvency continuity

(1) The intellectual property rights in the SaaS applications distributed by the Provider — including source code, design, documentation and associated trademarks — are held by Consiliari GmbH (Local Court Mannheim, HRB 727046). Pursuant to an intra-group licence and distribution agreement, Consiliari Software GmbH is authorised to market, distribute and sub-license the Service to customers. The customer contract, liability and all rights vis-à-vis the Customer rest exclusively with Consiliari Software GmbH as the Provider.

(2) The Provider grants the Customer, for the term of the contract, a simple, non-exclusive, non-transferable and non-sublicensable right to use the Service as intended.

(3) The following uses are not permitted:

• editing, decompiling, reverse engineering (beyond §§ 69d, e UrhG);
• duplication or distribution of the software;
• use beyond the agreed scope (e.g. exceeding licensed users);
• passing on credentials or making the Service available to third parties;
• automated extraction of data (scraping), unless via the provided APIs;
• use to develop a competing service;
• use for purposes that violate export-control or sanctions law (§ 14a).

(4) Customer-entered data ("Customer Data") gives rise to no rights of the Provider; the Customer remains exclusively entitled.

(5) The Customer grants the Provider the right to process the Customer Data to the extent necessary to perform the Service. In addition, the Provider is entitled to process technical usage and telemetry data (e.g. error logs without personal content, performance metrics, aggregated usage statistics without tenant attribution) for purposes of product improvement and quality assurance, and to forward such data to Consiliari GmbH. Processing of such data takes place on the basis of the data processing agreement (Annex 1); personal Customer Data is not used to train AI systems.

(6) Insolvency continuity. The parties intend that the usage rights granted to the Customer continue to exist even in the event of an economic crisis of the Provider or of Consiliari GmbH. To this end, the following applies:

• (a) In the event that insolvency proceedings are opened over the Provider's assets, Consiliari GmbH grants the Customer, by way of a contract for the benefit of third parties (§ 328 BGB), the right to continue the usage rights already acquired during the contract term for at least 90 days for the purpose of data backup and an orderly transition to an alternative provider. Consiliari GmbH confirms this grant by separate consent to these Terms.
• (b) In the event that insolvency proceedings are opened over Consiliari GmbH's assets, the intra-group usage and distribution right granted to the Provider continues to exist as an insolvency-proof, free-of-charge usage position; the Provider remains entitled to grant sub-licences to customers from it. To the extent legally permissible, the intra-group usage right has been structured as an unconditional full-rights transfer or irrevocable usage position.
• (c) For Enterprise customers, a source-code escrow agreement with a recognised escrow agent (e.g. NCC Group, Deposix) may additionally be concluded. Details are governed by individual contract.

(7) Feedback licence. If the Customer voluntarily submits feedback, suggestions, improvement ideas, feature requests, bug reports or other input on the Service to the Provider (hereinafter "Feedback"), the Customer grants the Provider a royalty-free, time- and territory-unrestricted, transferable and sub-licensable right to use, exploit, modify and incorporate such Feedback into the Service or other products of the Provider and its affiliates as it sees fit. The Customer derives no claims from the use of Feedback (in particular no remuneration, joint-authorship, attribution or revocation claims). The Customer warrants that its Feedback does not infringe third-party rights and contains no third-party confidential information or its own trade secrets that it does not wish to disclose. The Provider is not obliged to implement Feedback.

(8) Reference use with opt-out. The Provider is entitled to use the Customer's company name and logo for reference purposes on its website, in pitches, presentations, sales materials and press releases during the contract term, without separate remuneration. Such use is in a form appropriate to the Customer's standing; disclosure of confidential information, usage figures or individual conditions takes place only with separate written consent. The Customer may object to reference use at any time in text form (software@consiliari.de) with effect for the future; the Provider then removes the relevant references within 30 days from all channels under its control. Removal of physical print materials already distributed is not owed.

(9) Acceptable use policy. In addition to (3), the Provider's Acceptable Use Policy (AUP) applies in the version then in force. The AUP specifies prohibited uses and is an integral part of this contract. The Provider may amend the AUP under § 15; material tightenings require the Customer's consent, while subordinate clarifications fall under the deemed-acceptance rule.

§ 9 Term and termination

(1) The contract begins upon conclusion under § 3 (4). The minimum term corresponds to the chosen billing period (monthly or annually).

(2) Ordinary termination:

• For monthly billing: at any time with effect to the end of the current billing month.
• For annual billing: with 30 days' notice to the end of the term; otherwise the contract automatically extends by another 12 months. After an automatic renewal the Customer may terminate at any time with 30 days' notice to the end of the month. This easier right of termination is expressly mentioned in the renewal confirmation email.

(3) Termination may be declared by the Customer directly from within the application ("Cancel" function in the administrator area) or in text form by email to support@consiliari-software.de. The in-app function meets the text-form requirement. Terminations are logged with date and timestamp.

(4) Extraordinary termination for cause remains unaffected for both parties. Cause exists in particular for:

• the Customer's payment default despite a 14-day reminder with notice of termination;
• serious breach of these Terms or applicable law by the Customer;
• failure to make an urgently required sub-processor change despite § 8 (2) DPA (Customer's objection);
• sustained failure by the Provider to meet the SLA availability despite a grace period;
• violation of export-control / sanctions law (§ 14a);
• opening of insolvency proceedings over a party's assets (subject to § 8 (6)).

(5) Each termination requires text form (email is sufficient).

§ 10 Data export and deletion after contract end

(1) After the contract ends, the Provider gives the Customer 30 days to export Customer Data in a structured, common and machine-readable format (e.g. JSON/CSV, plus file attachments). The export meets the data-portability requirements of Art. 25 of the EU Data Act (Regulation 2023/2854). On request, a complete export is additionally provided by the Provider; an appropriate service fee may be charged depending on the effort involved (until 12 January 2027 under Art. 29 of the EU Data Act, free thereafter).

(2) After the export period expires, all Customer Data is permanently deleted within a further 60 days. Statutory retention obligations remain unaffected. Details are set out in the Data Processing Agreement (DPA / Annex 1, in particular § 11 DPA).

(3) Details of the termination of processing are set out in the Data Processing Agreement (DPA) (Annex 1 to these Terms).

§ 11 Data protection and processing on behalf

(1) The Provider processes personal data within the scope of using the Service as a processor within the meaning of Art. 28 GDPR. The basis is the Data Processing Agreement (DPA), which is included as Annex 1 to these Terms and is automatically concluded with the contract.

(2) Details of the processing of personal data on the website and during contract initiation are set out in the privacy notice at https://www.consiliari-software.de/datenschutz.

§ 12 Warranty

(1) The Provider warrants that the Service substantially exhibits the functions promised in the service description. For defects of the Service, §§ 535 et seq. BGB (German tenancy law) apply with the modifications of these Terms, in particular § 5 (5)/(6) (service credits).

(2) A defect does not exist where:

• the deviation is only insignificant;
• the Customer uses the Service improperly;
• third-party software or infrastructure is outside the Service.

(3) Liability under § 536a (1) Alt. 1 BGB for initial defects is excluded to the extent that it is independent of fault; § 13 remains unaffected.

§ 12a Force majeure

(1) Neither party is liable for non-performance or delay in performance of its contractual obligations to the extent that this is due to force majeure. Force majeure includes in particular: natural disasters, pandemics and government measures relating thereto, war, riots, terrorist attacks, strikes and lock-outs (not initiated by the affected party), large-scale failures of energy or telecommunications infrastructure, cyberattacks on backbone or cloud infrastructure outside the affected party's control, government measures, and export or import restrictions.

(2) The affected party shall inform the other party without undue delay of the occurrence, expected duration and effects of force majeure and take all reasonable measures to minimise the consequences.

(3) If the force-majeure event lasts longer than 60 calendar days, both parties have a right to extraordinary termination. Pro rata advance payments are refunded to the extent they relate to the period of non-performance.

§ 13 Liability

(1) The Provider is liable without limitation

• for intent and gross negligence of its legal representatives, executive employees and other vicarious agents — including vicarious agents of affiliated companies within the meaning of §§ 15 et seq. AktG (in particular Consiliari GmbH);
• for damages from injury to life, body or health;
• where a guarantee has been assumed;
• and under the German Product Liability Act.

(2) For ordinary negligence, the Provider is liable only for breach of a material contractual obligation (cardinal duty). Material obligations are those whose performance is essential to the proper performance of the contract and on whose observance the Customer regularly relies.

(3) In the cases of (2), liability is capped at the foreseeable, contract-typical damage at the time the contract is concluded, but at most at the net fee actually paid by the Customer to the Provider in the year in which the damage was caused, or — for monthly billing — at the twelvefold last monthly net amount.

(4) GDPR special cap. For damages claims arising from the Provider's culpable breach of data-protection obligations (including those of its vicarious agents), in the cases of (2) a minimum liability cap of EUR 50,000 per damage event additionally applies; the higher of the amount under (3) or this paragraph applies as the ceiling. Claims under Art. 82 GDPR remain unaffected; liability towards data subjects is governed by statutory provisions.

(5) Otherwise the Provider's liability is excluded.

(6) The Provider is not liable for the loss of data to the extent that the damage is due to the Customer's failure to perform regular data backups (§ 4 (4)). In any event, the Provider is liable only for the cost that would have been incurred for restoration with proper data backups.

(7) The provisions of this § 13 also apply for the benefit of the Provider's employees, representatives, vicarious agents and affiliates — in particular for the benefit of Consiliari GmbH as development partner.

§ 13a IP indemnity

(1) Indemnity by the Provider. The Provider shall indemnify the Customer against meritorious third-party claims based on the assertion that the intended use of the Service in its contractual version infringes industrial property rights (patents, utility models, trademarks) or copyrights in Germany. Indemnification is conditional on the Customer notifying the Provider in text form without undue delay of the claim, leaving sole defence and settlement to the Provider, and not making any acknowledgement without prior coordination.

(2) Defensive measures. The Provider is entitled, at its own expense, to (a) modify the Service so that it no longer infringes IP rights without materially impairing the contractually owed functionality, (b) obtain a usage right for the Customer, or (c) terminate the contract extraordinarily with immediate effect if the foregoing measures are unreasonable. In the event of termination, the Customer receives a pro rata refund of advance payments.

(3) Exclusion. The indemnity does not apply to the extent that the alleged infringement is based on (a) content provided by the Customer, (b) modification of the Service by the Customer, or (c) non-contractual use. The monetary liability caps under § 13 apply mutatis mutandis.

(4) Indemnity by the Customer. The Customer shall indemnify the Provider against third-party claims attributable to Customer Data it has introduced, third-party software it has integrated, or non-contractual use.

§ 14 Confidentiality

(1) Definition. Confidential information means all information of the other party obtained during contract initiation and performance that is marked as confidential or whose confidentiality is apparent from the circumstances. This includes in particular technical concepts, trade secrets within the meaning of the GeschGehG, pricing and contract information, personnel data and customer data.

(2) Obligations. The parties undertake to use confidential information

• exclusively for the purpose of performing the contract;
• to protect it adequately against unauthorised access (§ 2 no. 1 GeschGehG);
• to disclose it only to employees and vicarious agents who need the information to perform the contract and who are under a comparable confidentiality obligation.

(3) Exceptions. The confidentiality obligation does not apply to information which

• is already publicly known or generally accessible;
• was demonstrably already known to the receiving party before disclosure;
• was lawfully obtained from third parties without a confidentiality obligation;
• was independently developed without recourse to confidential information;
• must be disclosed pursuant to a statutory duty or governmental or judicial order, in which case the obliged party shall — to the extent legally permissible — inform the other party prior to disclosure.

(4) Duration. The confidentiality obligation applies during the contract term and for a period of three (3) years after the contract ends. For trade secrets within the meaning of the GeschGehG, statutory protection continues to apply as long as the requirements of § 2 no. 1 GeschGehG are met.

(5) Return / destruction. After the contract ends, each party returns or destroys confidential information at the other party's request; § 10 (data export/deletion) remains unaffected.

§ 14a Export controls and sanctions

(1) The Customer represents that neither it nor its beneficial owners are listed on relevant sanctions lists of the EU (in particular Regulation (EU) 2014/833, Regulation (EU) 2014/269), the United Nations or the United States (OFAC SDN), and that it does not use the Service from an embargoed state or for end uses prohibited under EU/German law (in particular military, nuclear or dual-use purposes without authorisation).

(2) The Customer is obliged to inform the Provider without undue delay if any of these conditions change.

(3) A breach of this section constitutes cause for extraordinary termination (§ 9 (4)) and entitles the Provider to immediate suspension under § 4a.

§ 15 Changes to the Terms

(1) The Provider reserves the right to amend these Terms with effect for the future. Changes are notified to the Customer in text form (email) at least 60 days before they take effect. The notification clearly highlights the changes, the right to object and its legal consequences.

(2) Limited deemed-acceptance rule. If the Customer does not object to the changes in text form within 60 days of receipt of the notification, the amended Terms are deemed approved. Excluded from the deemed-acceptance rule are changes affecting the main contractual obligations (scope of services, fees, contract term, liability); such changes require the Customer's express consent. The deemed-acceptance rule applies in particular to adjustments required by mandatory statutory provisions, supreme-court case law, adjustments to changes in relevant third-party services, or to clarify/refine regulatory gaps without disadvantage to the Customer.

(3) If the Customer objects in time, or if the change affects the main contractual obligations and the Customer does not consent, the Provider has the right to terminate the contract extraordinarily as of the planned effective date; fees already paid are refunded pro rata.

§ 16 Final provisions

(1) The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods.

(2) The exclusive place of jurisdiction for all disputes arising out of or in connection with this contract is Karlsruhe, provided the Customer is a merchant, a legal entity under public law or a special fund under public law.

(3) Place of performance is the Provider's seat (Karlsruhe).

(4) Transfer to affiliates. The Provider may transfer rights and obligations under this contract — preserving the Customer's interests (in particular data-protection and service levels) — to an affiliated company within the meaning of §§ 15 et seq. AktG, in particular to Consiliari GmbH. The Customer is informed in text form at least 60 days before the transfer takes effect and has the right to terminate the contract extraordinarily without notice as of the transfer date; advance payments are refunded pro rata. A transfer by the Customer requires the Provider's prior written consent.

(5) Amendments and supplements require text form; this also applies to the amendment of this text-form clause.

(6) Severability. Should individual provisions of this contract be or become invalid or unenforceable, the validity of the remaining provisions shall not be affected. The invalid provision shall be replaced by the statutory rule (§ 306 (2) BGB).

Annexes

• Annex 1: Data Processing Agreement (DPA) under Art. 28 GDPR
• Annex 2: Service / feature description (in the version then in force online)
• Annex 3: Price overview (in the version then in force online)