Version 2.1 · Effective: 7 September 2026 · replaces the August 2019 version

Preamble and notes on structure

These General Terms and Conditions (hereinafter "GTC") are divided into a general part and specific terms for the individual types of service:

• Part A – General Terms. Applies to all contracts between the Contractor and the Client.
• Part B – Software development and other works services.
• Part C – Consulting, project management and other services.
• Part D – Managed services and operations.
• Part E – Provision of third-party software, licences and cloud services.

In the event of conflicts between the general part and the specific terms, the specific terms of the affected type of service prevail.

Part A – General Terms

A1 Scope and conclusion of contract

A1.1 These GTC apply to all offers, contracts, deliveries and services of HAGEN+TRIEBSCH GmbH, Schloßstraße 8d, 22041 Hamburg (hereinafter "Contractor") to the contracting party (hereinafter "Client").

A1.2 These GTC apply exclusively to businesses within the meaning of § 14 of the German Civil Code (BGB), to legal persons under public law and to special funds under public law. Contracts with consumers within the meaning of § 13 BGB are not concluded on the basis of these GTC.

A1.3 The Client's general terms and conditions do not become part of the contract. This also applies where the Contractor performs services with knowledge of such terms or refers to letters from the Client that reference them. Deviating terms apply only where the Contractor has expressly agreed to them in text form.

A1.4 The Contractor's offers are non-binding unless expressly designated as binding. A contract is concluded when the Client accepts an offer of the Contractor in text form within the binding period, or when the Contractor confirms an order of the Client in text form. The date of contract conclusion is the day on which the declaration of acceptance is received by the other contracting party.

A1.5 These GTC are provided to the Client with the first offer in the version applicable at that time. The Contractor archives all versions with version number and date and provides them to the Client on request.

A1.6 The Contractor may amend these GTC in continuing obligations with effect for the future insofar as the amendment

• is necessary to adapt to a change in the legal situation, a decision of a supreme court, or a binding order of an authority or supervisory body,
• serves to close a gap in the terms that has arisen after conclusion of the contract due to an unforeseeable change of circumstances, and performance of the contract would be materially impaired without such closure, or
• is limited to wording, structure, cross-references or editorial details without changing the substantive content,

and the amendment does not unreasonably disadvantage the Client, taking into account the Contractor's interests.

A1.7 Not subject to change under A1.6 are the nature and scope of the main performance obligations, the remuneration and price adjustment, the term and termination rules, liability and limitation. Changes to these provisions require an agreement in text form.

A1.8 The Contractor notifies the amendment in text form at least six weeks before its intended effective date, contrasts the amended and previous terms, and separately points out the right to object, the objection period and the legal consequence of silence. If the Client does not object in text form within four weeks after receipt of the notice, the amended terms are deemed accepted. If the Client objects, the previous terms continue to apply; in that case either party may terminate the continuing obligation with three months' notice to the end of the month, without the Client incurring any early-termination charge or damages.

A2 Order of precedence of contract components

Mandatory statutory provisions prevail over all subsequent contract components. For data protection matters, the data processing agreement including its annexes prevails over all other contract components. Otherwise, unless the parties agree otherwise, the following order of precedence applies:

• individual agreements in text form, in particular framework or individual contracts and amendment agreements,
• the annexes to the contract in the order of their designation, in particular the statement of work, price list and service level agreement,
• the Contractor's offer accepted by the Client,
• the specific terms of Parts B to E of these GTC,
• the general Part A of these GTC,
• the otherwise applicable statutory provisions.

A3 Definitions

For the purposes of these GTC, the following terms mean:

• "Work results" means all results produced by the Contractor under the contract, in particular custom software, source code, scripts, configurations, concepts, documentation, drawings, analyses and reports;
• "Third-party services" means software, cloud services, licences, hardware and other services of third parties that the Contractor procures, arranges or resells;
• "Service portal" means the ticket system provided by the Contractor for reporting, processing and documenting requests and incidents;
• "Service hours" means the period specified in the statement of work or the service level agreement during which the Contractor provides services;
• "Text form" means text form within the meaning of § 126b BGB; email suffices.

A4 Subject matter and changes to services

A4.1 The nature, scope, quality and delivery dates of the services are determined exclusively by the contract and its annexes. Public statements, advertising, third-party product descriptions and manufacturer service descriptions do not give rise to any obligations of the Contractor beyond the contract.

A4.2 The Contractor performs the services in accordance with the state of the art recognised at the time of performance. The parties agree that, according to the state of the art, software cannot be produced entirely free of defects and that defects cannot be excluded under all operating conditions.

A4.3 Each party may request a change to the agreed scope of services in text form. The recipient examines the request and states within ten business days whether and on what terms the change can be carried out. If the review requires more than four person-hours, the Contractor may charge for it at the agreed rates; it will point this out before starting the review.

A4.4 Changes to the scope of services, delivery dates or remuneration are recorded in an amendment agreement in text form. Until an amendment agreement takes effect, the Contractor continues to provide the services on the previous basis.

A4.5 The Contractor is entitled to change or develop services further insofar as the change is necessary due to changes at manufacturers, for reasons of information security, or to comply with statutory or supervisory requirements, does not impair the agreed main functions, agreed interfaces and agreed service levels, and is reasonable for the Client, taking into account the Contractor's interests. An impairment within the meaning of sentence 1 exists in particular where the Client would have to adapt its operational processes or bear expenditure for training, migration or additional licensing. The Contractor informs the Client in text form at least four weeks before implementation, stating the reason, content and impact of the change; for changes that cannot be deferred in order to counter a significant threat to information security, it informs the Client without undue delay after implementation. If, contrary to sentence 1, a change impairs the agreed main functions or service levels, the Client may terminate the affected part of the services within four weeks of receiving the notice, with effect as of the time of the change.

A5 Client's cooperation obligations

A5.1 The Client provides the cooperation required for performance of the services free of charge, in a timely manner and to the extent required. This includes in particular:

• naming a contact person with technical and organisational decision-making authority together with a deputy,
• timely provision of complete and accurate information, data, documents and test data,
• provision of required access, permissions, system capacity, premises, network and remote access,
• cooperation in tests and acceptance procedures and provision of suitable test environments,
• obtaining necessary third-party approvals, in particular from licensors, works councils and supervisory authorities,
• backing up its data in accordance with the state of the art, unless data backup is expressly agreed as a service of the Contractor.

A5.2 The cooperation obligations under A5.1 are enforceable contractual obligations of the Client, not mere incumbencies.

A5.3 If the Client fails to fulfil its cooperation obligations at all, in time or in full and this causes delays or additional effort, the following applies:

• The agreed dates shift by the period of the delay plus a reasonable restart time.
• The Contractor may charge the demonstrated additional effort at the agreed rates.
• If the Contractor cannot otherwise deploy the personnel capacity it has made available as a result of the delay, it may claim compensation of 60 per cent of the agreed rates for the capacity held in reserve for the waiting time, for no more than ten business days per delay event. The Client remains entitled to prove that other use was possible or that the effort was smaller; the Contractor remains entitled to prove a greater loss.
• If the Client fails to fulfil a cooperation obligation despite a request in text form and the setting of a period of 15 business days, the Contractor may terminate the affected part of the services or the contract for cause; § 648 BGB and further statutory rights of the Contractor remain unaffected.

The Contractor shall notify delays, additional effort and waiting times without undue delay in text form and document them.

A5.4 The Client is itself responsible for the organisational integration of the services into its operational processes and for compliance with the regulatory and supervisory obligations that apply to it.

A6 Deployment of personnel and subcontractors

A6.1 The Contractor uses its own suitably qualified personnel to perform the services. The selection, supervision, direction, control and remuneration of its own personnel are the responsibility of each party for its own staff.

A6.2 The services are not provided by way of temporary employee leasing. The Contractor's personnel is not subject to any right of instruction by the Client; technical coordination to specify the subject matter of the services remains permissible. The Client will not integrate the Contractor's personnel into its work organisation and will not give them employment-law instructions.

A6.3 The Contractor is entitled to use subcontractors. The use of subcontractors for services involving access to the Client's systems or data requires the prior consent of the Client in text form; consent may only be refused for cause. For sub-processors within the meaning of Art. 28 GDPR, the provisions of the data processing agreement apply exclusively, in derogation from this clause. The Contractor obliges subcontractors to comply with the obligations agreed in these GTC and the contract, in particular regarding confidentiality, data protection and information security, and remains responsible to the Client for their performance.

A6.4 On request, the Contractor provides the Client with a current overview of the subcontractors it uses, including the subject matter of the services and the place of processing.

A7 Remuneration and payment terms

A7.1 Services are invoiced at the agreed fixed price or on a time-and-material basis at the agreed rates. In the absence of an agreement, the Contractor's prices valid at the time of contract conclusion apply.

A7.2 For time-and-material invoicing, the actual working times are recorded and evidenced in units of 15 minutes. Travel time is remunerated at 50 per cent of the agreed hourly rate; travel and accommodation costs are reimbursed at actual cost against evidence. Consumables and procured third-party services are charged additionally.

A7.3 Efforts designated as estimates in the offer are non-binding. If the Contractor recognises that an estimated effort will be exceeded by more than 10 per cent, it notifies the Client without undue delay in text form. Until the Client's consent in text form, the Contractor does not exceed the estimated effort.

A7.4 All prices are net, plus the applicable statutory VAT. If the VAT rate changes during the contract term, the periods with the respective rates are deemed to have been agreed separately.

A7.5 The Contractor issues invoices as electronic invoices within the meaning of § 14 of the German VAT Act (UStG) in a format that complies with EN 16931. The Client provides a suitable receiving address for electronic invoices and notifies changes without undue delay. The invoice is deemed received at the point in time when it reaches the receiving address named by the Client. If the Client has not named a receiving address, if the named address is not reachable, or if the invoice is rejected there, the invoice is deemed received upon dispatch to the Client's last known address; the Contractor may charge for the effort of re-issuing or re-transmitting at the agreed rates. If the Client is not established in Germany, or if there is no obligation to issue an e-invoice for the transaction in question, the Contractor may also issue the invoice in another format; the Client already now consents to transmission as a PDF file by email for this purpose.

A7.6 Invoices are due for payment without deduction within 14 days of receipt. In case of late payment, the Client owes default interest at the statutory rate; the assertion of further damages caused by default remains unaffected.

A7.7 For continuing obligations and for time-and-material services, the Contractor is entitled to adjust the agreed prices for the first time twelve months after the start of the contract and thereafter at most once per calendar year, using the following formula:

Adjustment rate = 0.70 × change in personnel costs + 0.20 × change in costs for third-party services and licences + 0.10 × change in general consumer prices.

The reference values are:

• for personnel costs, the change in the index of collectively agreed monthly earnings in the economic sector "Information and communication" (WZ 2008 section J) of the German Federal Statistical Office,
• for the costs of third-party services and licences, the change – to be evidenced by the Contractor – in the fees charged to it by its suppliers for the third-party services and licences used to perform the services,
• for general consumer prices, the change in the Consumer Price Index for Germany of the German Federal Statistical Office,

each referring to the twelve-month period ending three months before the notice under A7.7a, compared with the corresponding prior-year period, using the month of contract start as the initial reference value. If an index is replaced, the successor index designated by the Federal Statistical Office takes its place.

A7.7a If the formula yields a negative adjustment rate, the Contractor is obliged to reduce prices accordingly. No profit margin is added. The increase per adjustment is at most five per cent of the previous remuneration. The Contractor notifies the adjustment in text form at least three months before it takes effect, discloses the calculation with the index values and evidence used, and points out the right of termination under sentence 5. The Client may terminate the continuing obligation within four weeks of receipt of the notice, with effect as of the time the adjustment takes effect; in case of termination, no early-termination charges arise for the Client and no damages claims arise for the Contractor.

A7.8 The Client may only set off counterclaims that are undisputed or have been established by final court decision. This does not apply to counterclaims based on a defect or non-performance of the invoiced service or to counterclaims that stand in a reciprocal relationship with the remuneration claim; the Client may set off such counterclaims without restriction. The Client's rights under §§ 320, 641(3) BGB remain unaffected. Otherwise, the Client may only exercise a right of retention on the basis of counterclaims arising from the same contractual relationship.

A7.9 If the Client is in default on due remuneration of more than EUR 5,000.00 or more than 20 per cent of the contract value for longer than 14 days, the Contractor may, after prior notice in text form with five business days' notice, suspend its services until the arrears are cleared. Excluded are services to counter a significant threat to information security, to prevent imminent data loss and to fulfil obligations under the data processing agreement. The agreed dates shift by the duration of the suspension plus a reasonable restart time; the remuneration for the agreed availability services remains unaffected. D7.4 remains unaffected.

A7.10 For works services with a contract value above EUR 25,000.00 or a term of more than three months, the Contractor may claim interim payments based on the value of the services evidenced and performed in conformity with the contract, generally on a monthly basis. For an initial engagement, it may require an advance payment of up to 30 per cent of the contract value if this is stated in the offer.

A8 Deadlines, default and force majeure

A8.1 Deadlines are binding only if expressly designated as such in the contract. If the Client fails to fulfil a cooperation obligation under A5 at all, in time or in full, a binding deadline shifts by the period of the delay plus a reasonable restart time, insofar as the delay is causal for the failure to meet the deadline. The Contractor notifies the delay and its impact on the deadline without undue delay in text form.

A8.2 Events of force majeure that make performance materially more difficult or impossible for the Contractor release it from its performance obligation for the duration of the disruption. Force majeure includes in particular natural disasters, epidemics and pandemics, armed conflicts, official orders, industrial action at third parties, large-scale outages of telecommunications networks or energy supply, and cyber attacks on third parties whose services are required for performance. The Contractor informs the Client without undue delay of the occurrence and expected duration.

A8.3 For the duration of a force majeure event, the Contractor is not in default; the Client has no damages claims for non-performance of the affected services. Remuneration for the parts of the services still provided remains owed; remuneration for the parts not provided lapses on a pro-rata basis. If, during the disruption, the Contractor at the Client's request keeps capacity available for resumption, the evidenced standby costs shall be reimbursed. Both parties take the measures reasonable to them to limit the impact and coordinate on resumption. § 313 BGB remains unaffected.

A8.4 If the disruption lasts longer than three months, either party may terminate the affected part of the services in text form. Services already rendered shall be remunerated.

A9 Rights in work results

A9.1 Upon full payment of the remuneration owed, the Contractor grants the Client a non-exclusive, unlimited (in time and territory) and irrevocable right to use, reproduce, modify and put into operation the work results produced in conformity with the contract for its own business purposes. Until full payment, the Client receives a non-exclusive, non-transferable right of use of the same scope, subject to a resolutive condition: it ends if the Client is in default of payment for more than 30 days and the Contractor has unsuccessfully sent a reminder setting a period of ten business days. Use by undertakings affiliated with the Client at the time of contract conclusion within the meaning of §§ 15 et seq. of the German Stock Corporation Act is included; the inclusion of affiliated undertakings that join later shall be notified by the Client to the Contractor in text form and the parties shall agree separately on the additional remuneration owed. Further rights, in particular exclusive rights of use or the right to pass work results on to third parties for the Client's own economic purposes, require a separate agreement.

A9.2 The Contractor remains entitled to continue to use, without restriction, and to use for third parties, general know-how, methods, concepts, tools, libraries and reusable program components that were created before or independently of the performance of the contract or are of a general nature.

A9.3 If the Contractor uses open-source components, it informs the Client before handover of the applicable licence terms and provides an overview of the components used with version and licence. Rights of use in open-source components are governed exclusively by the respective licence terms. Components under a licence with copyleft effect, in particular under the GNU General Public License or the GNU Affero General Public License, are used by the Contractor only with the prior consent of the Client in text form; it points out the legal consequences of the respective licence for distribution and provision of the work results.

A9.4 The Client shall not remove or alter copyright, origin and other proprietary notices in the work results.

A9.5 Inventions made by staff of one party during performance belong to that party. Joint inventions are jointly owned by both parties; the details of exploitation shall be agreed separately.

A10 Confidentiality and trade secrets

A10.1 The parties treat all information of the other party that becomes accessible to them in the course of cooperation and that is designated as confidential or whose confidentiality follows from the circumstances as strictly confidential. They take the confidentiality measures appropriate for the protection of trade secrets within the meaning of the German Trade Secrets Act (GeschGehG).

A10.2 Confidential information may only be used for the purposes of the contract and only be made accessible to persons who need it for performance of the contract and who are bound to confidentiality to at least the same extent.

A10.3 The obligations under A10.1 do not apply to information that is generally known, becomes known without breach of these obligations, was already known to the recipient before disclosure, was disclosed to it by an authorised third party, or whose disclosure is required by law or by an official or judicial order. In the case of a disclosure obligation, the recipient informs the other party in advance to the extent permitted.

A10.4 The confidentiality obligations apply for the duration of the contract and for three years thereafter. For information that the disclosing party has designated as a trade secret in text form at or immediately after disclosure, in particular source code, design and security documentation, price and calculation bases and customer and supplier data, the obligations continue to apply without time limit until the information has become generally known without a breach of this agreement. The parties agree that the continued application under sentence 2 itself constitutes an appropriate confidentiality measure within the meaning of § 2 no. 1 letter b GeschGehG.

A10.5 After termination of the contract, each party returns or deletes on request the confidential documents provided, unless statutory retention obligations preclude this. Each party confirms the return or deletion in text form without prompting.

A11 Data protection

A11.1 The parties comply with the data protection provisions applicable to them, in particular Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and the German Federal Data Protection Act (BDSG).

A11.2 If, in the course of performance, the Contractor processes personal data on behalf of the Client, the parties conclude a data processing agreement under Art. 28 GDPR before the start of processing. The technical and organisational measures under Art. 32 GDPR taken by the Contractor form part of this agreement. As long as the data processing agreement has not been concluded, the Contractor is entitled and obliged to defer performance of the services insofar as they require processing of personal data on behalf; the Contractor does not fall into default in this respect and the agreed dates shift accordingly. The Contractor submits the agreement to the Client no later than with the offer. If the agreement is not concluded within 20 business days after conclusion of the contract, either party may terminate the affected part of the services; services already provided shall be remunerated.

A11.3 The Contractor generally processes personal data of the Client within the European Union and the European Economic Area. Access from third countries by the sub-processors named in the data processing agreement is possible; it takes place exclusively on the basis of an adequacy decision of the European Commission under Art. 45 GDPR or appropriate safeguards under Art. 46 GDPR together with supplementary measures. The details, in particular the approved sub-processors, the places of processing and the transfer bases, are set out in the data processing agreement and its annexes; these prevail over A11.3.

A11.4 If the Client collects, processes or uses personal data of third parties in the systems managed by the Contractor, it is responsible for the lawfulness of that processing and for fulfilling information and data subject rights.

A11.5 The Contractor processes contact data of the Client's representatives for the performance of the contract and for communication regarding the business relationship on the basis of Art. 6(1)(b) and (f) GDPR. Details are set out in the Contractor's privacy policy.

A12 Information security and supply chain

A12.1 The Contractor operates an information security management system aligned with ISO/IEC 27001. It informs the Client on request about the status of any certification under the VdS 10000 guideline; this does not constitute a commitment to obtain or maintain a certification. It appoints an information security officer and a data protection officer and notifies the Client of the contact persons on request.

A12.2 The Contractor implements state-of-the-art measures to protect the confidentiality, integrity and availability of the information it processes. The measures are described in the document "Technical and organisational measures pursuant to Art. 32 GDPR", which is made available to the Client on request in the version applicable at that time.

A12.3 The Contractor informs the Client without undue delay, and at the latest within 24 hours after its management or its information security officer becomes aware, of security incidents that materially affect the Client's systems or data, and provides the information required to fulfil the Client's own reporting obligations. If not all information is available, an initial notification is provided with a follow-up notification without further request. The reporting obligation under Art. 33 GDPR in conjunction with the data processing agreement remains unaffected.

A12.4 If the Client is subject to special statutory supply-chain security requirements, in particular under the German Act on the Federal Office for Information Security (BSIG) as amended by the implementing act for Directive (EU) 2022/2555, the parties agree the additional requirements needed for this in a separate annex. At the Client's request, the Contractor cooperates in the Client's risk analysis and provides the necessary evidence.

A12.5 If the Client is subject to supervisory outsourcing requirements, in particular under § 25b of the German Banking Act (KWG), the Minimum Requirements for Risk Management (MaRisk) or Regulation (EU) 2022/2554 (Digital Operational Resilience Act, DORA), the necessary information, audit, instruction and termination rights and the exit strategy shall be agreed in a separate annex.

A12.6 The Client is entitled to verify compliance with the agreed security requirements once per calendar year, with 20 business days' notice, during usual business hours, either itself or through a third party bound to confidentiality and not in competition with the Contractor. The Contractor may replace the audit by presenting suitable certificates, audit reports or assessment reports insofar as they cover the audit subject matter. This does not apply to audits concerning the processing of personal data; for these, the provisions of the data processing agreement apply exclusively, under which the right to an audit at the business premises cannot be replaced by evidence. Ad-hoc audits on justified suspicion remain permissible without limitation on frequency.

A13 Defect claims and limitation

A13.1 The Client's rights in case of defects are governed by the statutory provisions and the supplementary rules of Parts B to E of these GTC.

A13.2 The Client's claims based on defects are time-barred after twelve months from the statutory commencement of limitation.

A13.3 The reduction under A13.2 does not apply to:

• claims for damages arising from injury to life, body or health,
• claims for intentional or grossly negligent conduct of the Contractor, its legal representatives or vicarious agents,
• claims for defects fraudulently concealed,
• claims arising from a guarantee given by the Contractor or from the assumption of a procurement risk,
• claims under the German Product Liability Act,
• recourse claims under §§ 445a, 445b, 478 BGB,
• claims based on a defect in title consisting in a real right of a third party on the basis of which surrender of the item may be demanded, or in another right entered in the land register (§ 438(1)(1) BGB),
• defect claims regarding buildings and regarding works services whose success consists in the provision of planning or supervision services for a building.

In these cases, the statutory limitation periods apply.

A13.4 A reduction of the limitation period for claims based on intentional breach of duty is excluded under § 202(1) BGB.

A13.5 Other claims of the Client against the Contractor that are not defect claims, in particular claims for damages arising from breach of obligations under a service contract or ancillary obligations, are time-barred after twelve months from the statutory commencement of limitation. A13.3 and A13.4 apply accordingly.

A14 Liability

A14.1 The Contractor is liable without limitation

• for intent and gross negligence,
• for injury to life, body or health,
• for assumption of a guarantee or a procurement risk,
• for fraudulent concealment of a defect,
• under the German Product Liability Act,
• insofar as liability cannot be limited under mandatory statutory provisions.

A14.1a The Contractor's liability to data subjects under Art. 82 GDPR remains unlimited and cannot be restricted by agreement. For the compensation between the parties, in particular for recourse claims under Art. 82(5) GDPR and for the allocation of administrative fines, insofar as such allocation is legally permissible, the limits under A14.2 to A14.4a apply; A14.1 remains unaffected. Recourse claims under Art. 82(5) GDPR are not deemed third-party claims within the meaning of A14.4a.

A14.2 For the slightly negligent breach of a material contractual obligation, the Contractor is liable for compensation of the typical, foreseeable damage. Material contractual obligations are those obligations whose fulfilment makes the achievement of the contract's purpose possible in the first place, on whose observance the Client may rely, and whose breach jeopardises the purpose of the contract.

A14.3 Liability under A14.2 is capped per damage event at the higher of the following two amounts:

• the remuneration owed for the affected service in the contract year concerned, or, for contracts covering one-off services, the total remuneration owed for the affected service, or
• EUR 250,000.00.

The cap per damage event shall in no case exceed EUR 1,000,000.00. For all damage events in a contract year taken together, the cap is EUR 2,000,000.00; this amount applies jointly to property damage and financial loss. Several damage events based on the same cause are deemed to be one damage event.

A14.3a The Contractor's indemnification and reimbursement obligations under A15.2 are subject to the caps under A14.3, unless a case under A14.1 is present.

A14.3b The caps under A14.3 do not apply in the cases of A14.1.

A14.4 Otherwise, the Contractor's liability is excluded; in particular, it is not liable for the slightly negligent breach of obligations that are not material contractual obligations within the meaning of A14.2.

A14.4a Loss of profit, missed savings, reputational damage and other indirect losses are only compensated insofar as they were foreseeable at the time of contract conclusion as a typical consequence of the breach of the obligation concerned. The caps under A14.3 remain unaffected. A case under A14.1 remains unaffected by sentences 1 and 2.

A14.5 Without prejudice to A14.1, the following applies to loss or damage to data: In the case of simple negligence, the compensation claim is limited to the effort that would have been necessary to restore the data from backups made properly and at appropriate intervals. If the Client has breached its data backup duties under A5.1 and the loss is co-attributable to this, the claim is reduced pursuant to § 254 BGB in accordance with the share of contributory causation. If data backup was agreed as a service of the Contractor, sentences 1 and 2 apply with the proviso that reference is made to the backups owed under the statement of work.

A14.6 The above liability rules also apply to the personal liability of the Contractor's legal representatives, staff and vicarious agents and to the benefit of its subcontractors.

A14.7 The above provisions do not entail a change of the burden of proof to the Client's disadvantage.

A14.8 Descriptions of services, information on procedures, standards, certifications and measures, and commitments regarding deadlines in these GTC and the annexes are service descriptions. A guarantee within the meaning of § 443 BGB or the assumption of a procurement risk exists only insofar as the Contractor has expressly designated it in the contract or an annex as a "guarantee" or as the "assumption of a procurement risk".

A15 Third-party rights and indemnification

A15.1 The Contractor examines with the diligence customary in trade and, applying this diligence, ensures that the work results it produces, when used in conformity with the contract, are free from third-party rights that stand in the way of the agreed use. This does not constitute a guarantee or the assumption of a procurement risk within the meaning of A14.1.

A15.2 If claims are made against the Client based on the infringement of third-party rights through work results used in conformity with the contract, the Contractor defends the Client at its own expense against such claims and reimburses the Client for costs and damages finally awarded or settled with the Contractor's consent. The Client informs the Contractor without undue delay in text form of the claims asserted, leaves the conduct of the defence and settlement negotiations to it, does not make any acknowledgements without the Contractor's consent, and supports the Contractor in the defence to the extent required. If the Client breaches these obligations, the claims under sentence 1 lapse only to the extent that the Contractor's defence has thereby been impaired or additional effort or increased damage has arisen.

A15.3 In such case, the Contractor is entitled to modify or replace the work results at its own expense or to obtain a right of use. If this is not possible with reasonable effort, either party may terminate the affected part of the services; the Contractor in that case refunds the remuneration paid for the affected work results less a reasonable amount for the use to date.

A15.4 The Contractor's liability is excluded insofar as the infringement is based on the fact that

• the Client contributed components, data, specifications or instructions,
• the Client modified the work results or used them in a way different from the agreed conditions of use,
• the work results were combined with products, data or processes not supplied by the Contractor, or
• the infringement is exclusively attributable to third-party services, or
• the infringement is exclusively based on the fact that the Client failed to comply with the licence terms of an open-source component disclosed pursuant to A9.3.

In these cases, the Client indemnifies the Contractor and its subcontractors against third-party claims, including reasonable costs of legal defence, unless it is not responsible for the infringement. Insofar as the Contractor is guilty of intent or gross negligence, no indemnification obligation of the Client applies. The Contractor informs the Client without undue delay of the claims asserted and coordinates the defence with it.

A15.5 The Client ensures that the content, data and domain names provided by it do not infringe third-party rights and do not violate statutory prohibitions. It indemnifies the Contractor against third-party claims based thereon, including reasonable costs of legal defence, unless it is not responsible for the infringement. A15.4 sentences 2 and 3 apply accordingly.

A16 Term and termination

A16.1 Contracts for one-off services end upon full performance of the service.

A16.2 Continuing obligations are concluded for the term agreed in the contract. In the absence of an agreement, the contractual relationship may be terminated with three months' notice to the end of the month.

A16.3 The right of termination for cause remains unaffected. Cause exists for the Contractor in particular if the Client

• is in default for more than 30 days with a non-trivial portion of the remuneration and does not make payment despite reminder with a set deadline,
• fails to fulfil a cooperation obligation under A5 despite a period being set under A5.3 number 4,
• materially exceeds the rights of use granted despite a warning,
• fails to conclude the data processing agreement within the period under A11.2,
• materially breaches A18.1 or A18.2 or is itself or through a person controlling it captured by sanctions regulations of the European Union, the Federal Republic of Germany or the United Nations, or
• issues instructions or requires a use whose implementation would compel the Contractor to breach mandatory law, and maintains the instruction or requirement after being pointed to this in writing.

A16.4 Every termination requires text form.

A16.5 After termination of the contract, the Contractor supports the Client on request, against remuneration on a time-and-material basis, in transferring the services to the Client or a third party. Details are governed by Part D of these GTC or a separate annex. For data processing services within the meaning of Regulation (EU) 2023/2854, E5.2a takes precedence.

A16.6 Contractual provisions that by their nature are intended to continue to apply beyond the end of the contract, in particular on confidentiality, data protection, rights in work results and liability, remain unaffected by termination.

A17 References and no-poaching

A17.1 The Contractor may name the Client, stating company name and word mark, as a reference customer if the Client has consented to this in text form. Consent may be withdrawn at any time for the future. The mentioning of project-specific details requires separate consent. Following a withdrawal, the Contractor removes the reference without undue delay from its digital appearances, and, for already produced print materials and for ongoing procurement and tender procedures, at the latest within six months after receipt of the withdrawal. The use of the reference in offer documents already submitted remains permitted until conclusion of the respective procedure.

A17.2 To protect the special relationship of trust arising from the privileged access of the deployed persons to systems, trade secrets and know-how of the other party, the parties will not, during the term of the contract and for twelve months thereafter, actively poach – exploiting such access – the staff of the other party directly involved in performance. Public job postings, applications on the applicant's own initiative and the hiring of persons no longer employed by the other party remain permissible.

A17.3 For each breach of A17.2, the breaching party promises a contractual penalty in the amount of three gross monthly salaries of the poached person, capped at EUR 25,000.00 per case. The contractual penalty is credited against any further damages claim; each party remains free to prove a higher or lower loss.

A18 Compliance, export control and sanctions

A18.1 The parties comply with the statutory provisions applicable to them, in particular the rules on combating corruption, money laundering and restraints of competition, and the rules on occupational safety and minimum wage.

A18.2 The Client is itself responsible for compliance with foreign trade law, in particular the rules on the export, transit and re-export of goods, software and technology and the applicable sanctions regulations, insofar as it uses the Contractor's services outside the Federal Republic of Germany or makes them accessible to third parties.

A18.2a The Client assures that it, its shareholders with an interest of at least ten per cent and the recipients of the services named by it are not on a sanctions list of the European Union, the Federal Republic of Germany, the United Nations or the United States of America, and that the services are not, directly or indirectly, used for a purpose or recipient prohibited under those regulations. It notifies changes without undue delay and provides the Contractor with the information required for sanctions list screening.

A18.2b The Contractor is entitled, without prior notice, to defer performance of the services and to terminate the contract for cause insofar as performance would breach foreign trade or sanctions regulations or there is sufficient suspicion of such a breach. The Client has no claims arising from the suspension or termination. The Client indemnifies the Contractor against claims and sanctions based on a breach of A18.2 or A18.2a, unless it is not responsible for the breach.

A18.3 If the Contractor uses artificial intelligence systems or provides such systems to the Client, the parties observe Regulation (EU) 2024/1689 (AI Act). The allocation of the roles of provider and deployer and the resulting obligations shall be laid down in the contract or an annex. The Contractor ensures the measures for promoting sufficient AI competence of its staff under Art. 4 of the AI Act.

A19 Final provisions

A19.1 The assignment of rights and obligations under the contract to third parties requires the prior consent of the other party in text form. Assignment to an affiliated undertaking or to a legal successor by way of universal succession is permitted without consent; it shall be notified to the other party without undue delay. The assignment of monetary claims remains effective under § 354a HGB; it does not require consent. The Contractor is entitled to assign its remuneration claims for financing purposes to credit institutions or factoring companies; it notifies the Client of this in text form.

A19.2 The use of trademarks, trade names and other identifiers of the other party requires, unless otherwise provided for in these GTC, the prior consent of the rights holder in text form.

A19.3 Declarations, notices and communications from and in connection with the contract shall be made in text form unless a stricter form is required by law. A stricter form than text form is not required for declarations of the Client.

A19.3a Individual agreements between the parties take precedence over these GTC (§ 305b BGB). The form requirements under A19.3 and A1.3 do not affect the validity of individual agreements made orally or in another form. The parties shall confirm such agreements in text form without undue delay for evidentiary purposes; the failure to confirm does not affect their validity.

A19.4 Before a party brings an action based on non-fulfilment of a contractual obligation, it gives the other party the opportunity to fulfil the obligation within a reasonable period. This does not apply to proceedings for interim relief and preservation of evidence, to the court dunning procedure and the assertion of payment claims, to measures for the suspension or interruption of limitation, to termination for cause and to cases in which the setting of a period is not necessary under statutory provisions. Sentence 1 is not a procedural prerequisite.

A19.5 German law applies, excluding the United Nations Convention on Contracts for the International Sale of Goods.

A19.6 The exclusive place of jurisdiction for all disputes arising from and in connection with the contractual relationship is Hamburg. The Contractor remains entitled also to bring an action at the Client's general place of jurisdiction, provided that this is located in a Member State of the European Union or in a contracting state of the Lugano Convention of 30 October 2007. Exclusive statutory places of jurisdiction remain unaffected.

A19.7 If a provision of these GTC is or becomes wholly or partly invalid, the validity of the remaining provisions remains unaffected. In place of the invalid provision, the statutory provisions apply (§ 306(2) BGB). The parties remain free to agree an effective replacement rule in a separate agreement in text form.

Part B – Software development and other works services

B1 Scope and scope of services

B1.1 Part B applies to services aimed at achieving a specific result, in particular the creation of custom software, interfaces, web applications, extensions of existing systems, analyses and migrations.

B1.2 The specification agreed in the contract is decisive for the scope of services. It describes the functions, performance features, interfaces, volume structures and the intended operating environment. In the absence of a specification, the scope of services is determined by the scope described in the offer.

B1.3 The Contractor does not owe adjustment of the work results to changes in the operating environment, in particular to new versions of operating systems, databases, browsers or cloud services, unless this is separately agreed as a maintenance service.

B2 Acceptance

B2.1 The Contractor makes the work results available to the Client for acceptance on the agreed date and demonstrates the fulfilment of the performance features in an acceptance test. The Client provides suitable test data and test scenarios for this purpose.

B2.2 The Client examines the work results within 15 business days of provision and declares acceptance in text form. Non-material defects do not, pursuant to § 640(1) sentence 2 BGB, entitle the Client to refuse acceptance.

B2.3 Defects are classified into the following defect classes:

The classification follows § 640(1) sentence 2 BGB: only defects of defect class 1 are material defects that prevent acceptance.

B2.3a The parties strive for a consensual classification. If no agreement is reached within five business days, the Contractor makes a preliminary, plausibly reasoned classification and notifies it in text form; the acceptance test is continued on this basis. The preliminary classification does not affect the Client's rights or the allocation of the burden of proof. At the request of either party, an independent expert jointly appointed by both parties decides on the final classification; the costs are borne by the party whose classification differs from the expert's determination.

B2.4 A protocol on acceptance is prepared in text form, to which a list of the identified defects with their defect classes is attached. The protocol serves as evidence; its preparation is not a prerequisite for acceptance or the effects of acceptance under B2.5 to B2.5b.

B2.5 With the provision under B2.1, the Contractor sets the Client a period of 15 business days for acceptance. If the Client does not declare acceptance within this period and does not refuse it by stating at least one defect in text form, the work results are deemed accepted upon expiry of the period. The Contractor points out this legal consequence when setting the period in text form.

B2.5a If the Client refuses acceptance solely by stating defects of defect classes 2 or 3, the refusal is unjustified (§ 640(1) sentence 2 BGB). The Client falls into default of acceptance upon expiry of the period under B2.5. The effects of acceptance, in particular the maturity of the remuneration, the transfer of the risk of performance, the reversal of the burden of proof for defectiveness and the commencement of limitation of defect claims, take effect at that point in time.

B2.5b After all defects of defect class 1 have been remedied, the Contractor makes the work results available for acceptance again; B2.5 and B2.5a apply again with a period of ten business days. Remaining defects of defect classes 2 and 3 are remedied under a jointly agreed schedule as part of defect removal.

B2.6 If, after expiry of the period under B2.5, the Client uses the work results or delimitable partial results in productive operation for longer than 20 business days without notifying a defect of defect class 1 in text form, it is presumed that the work results were made available ready for acceptance and have been accepted. The Client remains free to prove that a defect of defect class 1 existed or that use notwithstanding such a defect was merely for damage mitigation; in the latter case, it must notify the Contractor of this without undue delay in text form.

B2.7 The acceptance test is not extended and acceptance is not refused due to defects in third-party devices and programs that are not the subject of the contract, or due to operating errors for which the Contractor is not responsible.

B3 Rights of use and source code

B3.1 A9 applies to rights of use in custom software. The delivery of the source code is agreed separately; without a specific agreement, the Contractor does not owe delivery of the source code.

B3.2 If delivery of the source code is agreed, the Contractor delivers with the source code the information necessary to build a runnable program, in particular information on the development environment, dependencies and the build process, as well as an overview of the third-party and open-source components used.

B4 Defect claims

B4.1 The Contractor warrants that the work results correspond, upon acceptance, to the agreed performance features.

B4.2 In case of defects, the Contractor cures at its choice by rectification or new production. For defects of defect class 3, it may also remedy the defect provisionally by providing a reasonable workaround and definitively with the next program version.

B4.3 If the Client unsuccessfully sets the Contractor a reasonable period for cure, or if cure has failed, is impossible, is refused or further waiting is unreasonable for the Client, the Client may, in accordance with statutory provisions, reduce the remuneration, withdraw from the contract, claim damages in lieu of performance or reimbursement of futile expenses. When assessing the reasonableness of the period, it shall be taken into account that removing software defects regularly requires several analysis and remediation steps. A14 remains unaffected.

B4.4 No defect claims exist insofar as the defect is due to the Client having modified or intervened in the work results. If the Client has modified or intervened in the work results, it shall, at the Contractor's request, fully disclose the changes made, their timing and the tools used, and provide the logs and version states required for review. If the Client fails to meet this disclosure and cooperation duty, the Contractor may charge the effort of its root-cause investigation at the agreed rates. The burden of proof otherwise remains unchanged.

B4.5 The Contractor may claim remuneration for its effort at the agreed rates insofar as it has acted on the basis of a defect report, no defect for which it is responsible existed and the Client could have recognised this using the diligence customary in trade, in particular because the cause lay within its area of responsibility or the check steps provided for in the statement of work were not performed before the report. The Contractor points out to the Client the likely cost obligation as soon as indications arise that no defect exists.

B4.6 A13 applies to the limitation of defect claims.

B5 Agile approach

B5.1 If the parties agree an agile approach, in particular Scrum or Kanban, the following applies: the Client names a product owner with decision-making authority, maintains and prioritises the backlog and participates in the agreed coordination meetings.

B5.2 In an agile approach, the Contractor owes the professional execution of the agreed development cycles and the delivery of the respective cycle results, not a specific scope of functionality by a specific date, unless the parties agree otherwise. Invoicing is on a time-and-material basis.

B5.3 The parties may agree partial acceptance under B2 for individual cycles or releases.

B6 Client's free right of termination

The Client's right to terminate the works contract until completion of the work under § 648 BGB remains unaffected. In case of termination, the Contractor retains the claim to the agreed remuneration less saved expenditure and other earnings. For the part of the service not rendered, it is presumed that the Contractor is entitled to five per cent of the remuneration attributable to that part; each party remains free to prove a higher or lower claim.

B6a Termination for cause and determination of performance status

Either party may terminate the contract for cause under § 648a BGB. After termination, either party may request that the performance status be jointly determined. If a party refuses to cooperate in the determination or fails to appear at a scheduled meeting, that party bears the burden of proof for the performance status; § 648a(4) BGB remains unaffected. The Contractor may demand the agreed remuneration for the services rendered; for services not rendered, B6 sentences 2 and 3 apply accordingly insofar as the Client is responsible for the termination.

B7 Use of artificial intelligence systems in development

B7.1 The Contractor is entitled to use, in the creation of the work results, tools based on artificial intelligence systems, in particular for code generation, code analysis and documentation. Through suitable procedures, in particular four-eyes review and automated analyses, it ensures that the work results correspond to the agreed performance features and do not infringe third-party rights.

B7.2 The Contractor transmits confidential information and personal data of the Client only to tools for which the use of the inputs for model training is contractually excluded. Tools that process personal data of the Client in doing so are sub-processors; their engagement is governed exclusively by § 7 of the data processing agreement and they are listed in its annex 3.

B7.3 If the work results themselves are artificial intelligence systems or parts of such systems, the parties agree the role allocation and the obligations under the AI Act, as well as the necessary documentation and information obligations, in an annex to the contract.

B7.4 The Contractor grants rights of use in the work results in accordance with A9.1 to the extent that such rights are available to it. The parties agree that parts of the work results that have been generated by artificial intelligence systems without a decisive human creative contribution may not be protected by copyright and that no exclusive rights exist in them. The Contractor is not liable for the ability to establish exclusive rights in such parts or to prohibit their use by third parties. The Client's use of the work results in conformity with the contract is not affected thereby; A15 remains unaffected.

Part C – Consulting, project management and other services

C1 Scope and performance obligation

C1.1 Part C applies to services not aimed at a specific result, in particular consulting, analysis, project leadership, interim management, agile roles, training and support of the Client.

C1.2 The Contractor owes the professional performance of the agreed activities in accordance with the recognised rules of technology and the principles of proper professional practice. It does not owe the achievement of a specific economic, technical or legal result.

C1.3 For activities owed under C1.1 and C1.2 no acceptance takes place; defect claims under works contract law do not apply. If, according to the statement of work, the Contractor in the individual case owes a specific result, the rules of Part B apply to that part of the services; the parties document this in the statement of work. The statutory allocation of the burden of pleading and proof remains unchanged in every case.

C1.4 The Contractor does not provide legal, tax or auditing advice. Insofar as the Contractor's services touch on legal or tax matters, it points this out; obtaining corresponding advice is the Client's responsibility.

C2 Invoicing and documentation

C2.1 Services under service contracts are invoiced on a time-and-material basis unless otherwise agreed. A7 applies accordingly.

C2.2 The Contractor documents the services rendered by activity, date and effort and provides the documentation to the Client with the invoice.

C2.3 The Client asserts objections to the service documentation within 14 days of receipt in text form. When transmitting the documentation, the Contractor separately points out in text form that after expiry of this period the presumption under sentence 3 takes effect. After expiry of the period, it is presumed that the documented services were rendered to the documented extent. The Client remains free to prove the contrary; the assertion of objections that only become recognisable later remains unaffected.

C3 Termination

Service contracts with a fixed term end upon expiry of that term. Service contracts without a fixed term may be terminated with one month's notice to the end of the month; after a term of six months, with two months' notice to the end of the month. A16 otherwise remains unaffected.

Part D – Managed services and operations

D1 Scope and scope of services

D1.1 Part D applies to continuous operations, administration, support and monitoring services, in particular for the operation of Microsoft 365 and Azure environments, for application operation and application hosting, and for first- to third-level support.

D1.2 The scope of services, service hours, response and recovery times, and the agreed metrics follow from the statement of work and the service level agreement.

D1.3 Services not included in the scope of services are provided by the Contractor after prior coordination against remuneration on a time-and-material basis.

D2 Incident reporting and handling

D2.1 The Client reports incidents and requests via the Contractor's service portal. Reports received through other channels are recorded by the Contractor in the service portal; the response time starts on recording.

D2.2 The Client names the persons authorised to submit reports and keeps this information up to date.

D2.3 A report is classified into a priority level according to the criteria set out in the service level agreement. In case of differing assessments, the parties coordinate the classification without undue delay.

D2.4 Response and recovery times run only within the agreed service hours. Times during which handling is paused for reasons for which the Client is responsible, in particular due to missing information or missing cooperation, are not counted.

D3 Change, patch and maintenance management

D3.1 The Contractor carries out changes to the managed systems in accordance with a documented change process. Changes with material impact on operations require the Client's consent in text form.

D3.2 The Contractor may apply security-relevant updates without prior consent if delay would lead to a significant threat to information security. It informs the Client without undue delay.

D3.3 Plannable work is carried out by the Contractor within the agreed maintenance windows and announced at least five business days in advance. Time within announced maintenance windows does not count as downtime insofar as it does not exceed eight hours per calendar month in total and lies outside the agreed service hours. Maintenance windows beyond this or falling within service hours require the Client's consent in text form; without consent they count as downtime.

D3.4 If manufacturers change the services, interfaces or licensing models they provide, the Contractor is entitled to adjust performance accordingly, provided that the adjustment is necessary, does not impair the agreed main functions and service levels, and is reasonable for the Client taking into account the Contractor's interests. The Contractor informs the Client at least four weeks before implementation in text form, or, in cases where the manufacturer sets a shorter lead time, without undue delay after gaining knowledge. If the change leads to a material change in the scope of services or costs, the parties coordinate the adjustment under A4.3; if no agreement is reached within four weeks, either party may terminate the affected part of the services with one month's notice to the end of the month.

D4 Access and privileged permissions

D4.1 The Client provides the Contractor with the access and permissions required for performance, limited to what is necessary.

D4.2 The Contractor manages privileged access according to the principle of least privilege, documents its granting and withdrawal, secures it with multi-factor authentication and reviews it at least semi-annually.

D4.3 The Contractor withdraws access without undue delay when the authorisation ceases, in particular when staff leave, and confirms this to the Client on request.

D5 Data backup and restore

D5.1 The scope, frequency, retention period and recovery targets of data backup follow from the statement of work. Without an express agreement, the Contractor does not owe data backup.

D5.2 If data backup is agreed, the Contractor verifies restorability at least once per calendar half-year and documents the result.

D5.3 The Client is responsible for informing the Contractor of the data stocks to be backed up and the applicable retention and erasure periods.

D6 Availability

D6.1 Agreed availability levels relate exclusively to the components of the services for which the Contractor is responsible, within the agreed service hours.

D6.2 Downtime does not include times attributable to maintenance under D3.3, to force majeure under A8.2, or to circumstances for which the Client is responsible. Disruptions at third parties do not count as downtime only if the third party is not a subcontractor or other vicarious agent of the Contractor, or if it was specified by the Client. Disruptions at subcontractors and other vicarious agents of the Contractor do not count as downtime only insofar as they in turn are attributable to force majeure within the meaning of A8.2.

D6.3 The Contractor does not owe availability for third-party services. For third-party services, the commitments of the respective manufacturer apply; the Contractor supports the Client in asserting claims against the manufacturer.

D7 Term, termination and handover

D7.1 Managed services contracts are concluded for a minimum term of twelve months, unless otherwise agreed, and are extended by twelve months at a time unless terminated with three months' notice to the end of the respective term. If the Contractor provides the service in whole or in part as a data processing service within the meaning of Art. 2 no. 8 of Regulation (EU) 2023/2854, the notice period for the affected part of the services shall, in derogation from sentence 1, be no more than two months; the minimum term and extension do not preclude the exercise of the switching right under E5 and do not give rise to any payment obligation for the affected part of the services beyond the switching date.

D7.2 After termination of the contract, the Contractor supports the Client in the orderly transfer of the services to the Client or a third party. The scope of support, remuneration and time frame are governed by the statement of work or a separate annex; without a deviating agreement, the Contractor provides support for up to three months after the end of the contract against remuneration on a time-and-material basis. For data processing services within the meaning of Regulation (EU) 2023/2854, E5.2a takes precedence.

D7.3 The Contractor hands over to the Client the operational documents, configuration data and documentation required for continued operation in a common, machine-readable format, and keeps the Client's data available for retrieval for a period of at least 30 days after the end of the contract. After expiry of this period, it deletes the data unless statutory retention obligations preclude this, and confirms the deletion in text form without prompting, stating date, scope and systems concerned.

D7.4 The Contractor does not retain Client data, access data or configuration and operational documents strictly required for continued operation of the systems in order to enforce payment claims. For handover-support services under D7.2 that go beyond the provision under D7.3, in particular for the creation of additional documentation, training and project support, the Contractor may make performance conditional on payment of due, undisputed remuneration. E5.2a remains unaffected.

D8 Special requirements for regulated clients

If the Client is subject to special supervisory requirements, the rules agreed in a separate annex on information, audit and instruction rights, sub-outsourcing, incident reporting, cooperation in operational resilience tests and the exit strategy apply in addition. A12.5 applies accordingly.

Part E – Provision of third-party software, licences and cloud services

E1 Scope and role of the Contractor

E1.1 Part E applies to the procurement, brokerage and resale of third-party software, licences, subscriptions, cloud services and hardware.

E1.2 When procuring third-party services, the Contractor acts as reseller or as broker. The role in the individual case follows from the offer. If the Contractor acts as broker, the contract regarding the third-party service is concluded directly between the Client and the manufacturer or provider.

E2 Applicability of manufacturer terms

E2.1 The licence, use and service terms of the respective manufacturer or provider in the version attached to the offer or referenced therein by citation and version date apply additionally to the use of the third-party service. The Contractor makes these terms available to the Client before conclusion of the contract. Subsequent changes to these terms are subject to the contract only in accordance with E2.3 to E2.3b. The Client's rights and obligations vis-à-vis the Contractor are governed by these GTC and the contract; in case of conflict, these GTC and the contract prevail over the manufacturer terms in the relationship between the Client and the Contractor.

E2.2 If the Contractor acts as reseller, its liability for defects is governed by statutory provisions. The contractually agreed condition of the third-party service follows from the product and service description of the manufacturer or provider valid at the time in the version attached to the offer; the Contractor does not owe any condition, availability or further development beyond that. Cure is provided through procurement of the fix, update or replacement delivery made available by the manufacturer; A14 applies to damages claims. Additionally, upon request, the Contractor assigns its claims against the manufacturer to the Client insofar as this is permissible; the assignment does not affect the Client's statutory claims against the Contractor.

E2.2a If the Contractor acts as broker, the contract regarding the third-party service under E1.2 is concluded directly between the Client and the manufacturer; the Contractor in this respect owes only the brokering activity.

E2.3 If the Contractor acts as broker, changes by the manufacturer take effect directly in the relationship between the Client and the manufacturer; the Contractor informs the Client without undue delay after gaining knowledge.

E2.3a If the Contractor acts as reseller, it is entitled to pass on increases in the fees charged to it by the manufacturer to the Client on a one-to-one basis and without a mark-up. It notifies the increase at least four weeks before it takes effect in text form, evidences the increase by submitting the manufacturer's price list or a corresponding notice from the manufacturer, and passes on reductions in manufacturer fees in the same way. The Client may terminate the affected part of the services within four weeks of receipt of the notice with effect as of the time the increase takes effect; remuneration already paid for periods after termination is refunded.

E2.3b The Contractor passes on changes to the content of services or to the terms of the manufacturer insofar as they are reasonable for the Client taking into account the Contractor's interests. If a change materially impairs the agreed main functions of the third-party service, the Client may terminate the affected part of the services within four weeks of receipt of the notice.

E3 Licence management and evidence

E3.1 The Client is responsible for the use of third-party services in conformity with the contract, in particular for compliance with licence metrics and user numbers.

E3.2 The Client informs the Contractor without undue delay of changes in user numbers and usage volumes that lead to an adjustment of the licensing. Subsequent licensing takes effect at the point in time when use commences and is invoiced accordingly.

E3.3 If a manufacturer requires an audit of licence use, the Contractor supports the Client on a time-and-material basis. The Client is liable for additional claims, contractual penalties, fines and costs that a manufacturer asserts on the basis of use exceeding the scope procured. If the manufacturer holds the Contractor liable, the Client indemnifies it from this, including reasonable costs of legal defence, unless the Contractor is responsible for the excess use. The Contractor informs the Client without undue delay and coordinates the defence with it.

E4 Term and termination

E4.1 The term, extension and notice periods of subscriptions and cloud services are governed by the manufacturer's terms. The Contractor points out the applicable deadlines to the Client.

E4.2 The Client's terminations must reach the Contractor so that it can comply with the notice period vis-à-vis the manufacturer; a lead time of ten business days before expiry of the manufacturer's deadline is required for this. If the termination is received later, the subscription is extended in accordance with the manufacturer terms; the Client bears the resulting remuneration.

E5 Switching data processing services

E5.1 If the Contractor itself provides a data processing service within the meaning of Regulation (EU) 2023/2854 (Data Act), the provisions of Art. 23 to 31 of the Data Act apply to switching to another provider or to the Client's own infrastructure. The Client may request the switch with a notice period of no more than two months.

E5.2 The Contractor supports the switch within a transition period of no more than 30 calendar days from expiry of the notice period. If the transition cannot technically be carried out within this period, the Contractor communicates this within 14 working days after the switching request, stating the reasons, and names an alternative transition period not exceeding seven months in total.

E5.2a If the Contractor provides the service as a data processing service within the meaning of Regulation (EU) 2023/2854, it does not charge a fee for the switch and transfer of data and digital assets from 12 January 2027. For switching processes initiated before 12 January 2027, it charges at most the costs directly caused to it by the switch and evidences these on request. The remuneration rules in A16.5 and D7.2 do not apply in this respect. For services that are not data processing services, in particular for the creation of additional documentation, training of the receiving service provider and project support beyond data export, A16.5 and D7.2 remain applicable.

E5.2b The Client may extend the transition period under E5.2 once by a period it considers more appropriate for its purposes. It notifies the extension before expiry of the current transition period in text form; no justification is required. For the duration of the extension, the Client owes the agreed ongoing remuneration for the services still used; no additional fee is charged for the switch itself.

E5.3 The Contractor provides the Client with the exportable data and digital assets in a structured, commonly used and machine-readable format, and keeps them available for retrieval for at least 30 calendar days from expiry of the transition period. It provides an overview of the exportable data categories on request.

E5.4 For third-party services, switching modalities are governed by the terms of the respective provider. The Contractor supports the Client in exercising its rights vis-à-vis the provider.