General Terms and Conditions

Status: 23.11.2022

These terms and conditions are the machine translation of the German version, named "Allgemeine Geschäftsbedingungen". Only the original document in the German language is legally binding.

I. Scope of application

(1) konfidal GmbH, Hauptstr. 28, 15806 Zossen (hereinafter "konfidal") operates a whistleblower software-as-a-service platform called konfidal, which enables business customers and public institutions to comply with, among other things, the Whistleblower Directive (EU) 2019/1937.

(2) It is a "Software as a Service" (SaaS) operated through a web-based interface that allows legal persons and their employees to communicate with other employees or business partners through the solution without using any software other than an internet browser.

(3) The "General Terms and Conditions" (hereinafter referred to as "GTC") regulate the contractual conditions for the use of the konfidal whistleblower software platform for all licensees, regardless of whether a free or paid version of the software is used.

(4) These GTC apply exclusively. Deviating, conflicting or supplementary general terms and conditions of the licensee shall not apply and shall only become part of the contract if konfidal has expressly agreed to their validity in writing. This requirement of consent shall also apply if konfidal commences with the performance of services without reservation in the knowledge of the general terms and conditions of another party.

II. Definitions

"User" means the entirety of natural persons who act as employees or otherwise qualified persons at privately organised, legal entities, partnerships or public bodies as those persons who operate the konfidal Whistleblower Software Platform.

"Licensee" means the legal entity under private or public law that acts as a contractual partner to konfidal for the use of the konfidal Whistleblower Software Platform.

"Terms" means the terms and conditions contained in this document. "Settings" means the section in the konfidal portal in which User can provide details of the Licensee, in particular their current number of employees and their contact details.

"Update" means improvements and functional enhancements and updates are installed as software updates.

"User Backend" means the area of the Solution where Users can view or edit notices and, if necessary, customise the Solution according to the specific requirements of their organisations. Whether customisability is possible depends on whether it is a free use or a paid subscription.

"Licence Fee" means that fee paid by the licensee for the right to use the Solution within a Licence Period.

"Licence Period" means the period of time for which the licensee receives the right of use against payment of the Licence Fee.

"Licence Types" means the entirety of the variants of the Software, i.e. one free of charge and one or more payable collections of functions, to which the licensee may establish a right of use.

"konfidal portal" or "solution" means the konfidal application developed by konfidal GmbH and to which licensee is granted solution usage rights under these terms and conditions.

"Right of Use" means the right of licensee to use the Solution in accordance with the Terms.

"Use Agreement" means the agreement between konfidal and licensee for the use of konfidal.

"Party" or "Parties" means the parties to the User Agreement, i.e. licensee and konfidal, who are subject to these Terms and the rights and obligations described below.

"Package" or "Variant" means a collection of features of the Solution. Packages vary in their scope of services. "Trial Period" means a period of time beginning upon initial registration with the konfidal portal and limited in duration.

"Company Settings", "Company Profile" or "Company Profile" means the section in the Solution where licensees can view their currently valid Package, modify the Package, book Additional Services, download invoices and maintain contact and billing information, etc.

"Services" means the services that konfidal provides to licensee through the provision of Solution Usage Rights.

"Service Description" defines the scope of individual sub-aspects of the Software, which differ depending on the package selected. A current overview of the scope of the respective packages and the respective associated prices can be found at konfidal.eu/plans.

"Contract Termination" means the date on which a written notice of termination given by either party becomes effective, subject to the termination rights and any associated time limits set out in more detail in this document.

"Additional Services" means the services provided by konfidal to licensees in addition to the Packages in return for payment with the booking.

"Confidential information" is all information that konfidal or the client protect against unrestricted disclosure to third parties or that is to be considered confidential according to the circumstances of the disclosure or its content. In any case, the following information shall be considered confidential information of konfidal: All software, programs, tools, prices, data or other materials that konfidal makes available to the User or licensee pre-contractually or on the basis of the Agreement.

"End-to-end encryption" is a technology integrated in the solution that encrypts the communication between user, licensee and notifier in such a way that only sender and receiver of a message can decrypt it and thus read it in plain text. konfidal is at no time able to read or decrypt the contents of the communication through this technology.

III. general conditions

A. Registration, conclusion of the contract of use

(1) The contract of use comes into effect as soon as konfidal receives the signed contract offer from the licensee, unless the contract is concluded on the basis of the following paragraph (2).

(2) By registering on the website konfidal.eu or app.konfidal.eu with his/her name, email and company, the licensee makes an offer to conclude this user contract. konfidal checks the corresponding registration. The user will then receive a confirmation e-mail with his access data. The contract is deemed to have been concluded upon receipt of the confirmation e-mail.

B. Type and scope of service

(1) konfidal provides the licensee:with the use of the "konfidal" software at the router exit of the respective data centre of konfidal ("transfer point").

(2) The scope of services of the software at the time of the conclusion of the contract results from the service description.

(3) The scope of services can be changed for the future according to the following conditions: 1. at any time, insofar as a change to a higher-value package with a greater scope of performance is to take place, 2. at the end of the licence period if a downgrading of the scope of services is to take place. Excluded from this are any (free) test periods offered directly after registration. Within the scope of these, the licensee may use the functional scope of a generally chargeable package free of charge for a limited period of time.

(4) There is no physical transfer of the software. The software shall remain on konfidal's server at all times. konfidal is not responsible for guaranteeing the data connection between the transition point and the IT systems of the licensee. It is the responsibility of the licensee to create the technical prerequisites for receiving the software at the transfer point and its use.

(5) konfidal shall always offer and provide the software in the current version; in this respect konfidal shall be entitled to carry out corresponding updates of the software ("update" and/or "patches"). konfidal shall not be obliged to provide the software during an ongoing update process. Insofar as the required update involves a restriction of use, it shall be carried out after prior announcement in the period between 8:00 p.m. and 6:00 a.m. and only if it is reasonable for the licensee.

(6) Insofar as the software runs exclusively on the servers of konfidal or a service provider commissioned by konfidal, the licensee shall not require any copyright usage rights to the software, nor shall konfidal grant any such rights. However, konfidal grants the licensee the non-exclusive, non-transferable right, limited in time to the duration of the license agreement, to load the user interface of the software for display on the screen into the main memory of the end devices used for this purpose in accordance with the agreement and to make the resulting reproductions of the user interface.

(7) konfidal shall not be responsible for establishing and maintaining the data connection between the IT systems of the licensee and the described transfer point.

C. Test periods

(1) konfidal intends to offer campaigns in which functions are made available to the licensee free of charge for a certain test period, which are to be partially or completely assigned to a higher-value package. The length of the trial period will be indicated to the licensee during the first registration. There is no entitlement to this period as such or to a certain scope of functions within the duration of the test period. konfidal is entitled at any time to partially or completely withdraw the functions made available during this period. After the end of the trial period the licensee must decide whether he/she wishes to retain the scope of functions for a fee, otherwise the contractually agreed scope of services shall remain. A detailed description of the scope of services is defined in the service description, which can be found at konfidal.eu/plans. If the licensee decides in favour of a chargeable function or service extension, the contractual amendment shall take effect at the end of the calendar month in which the licensee declares the service extension to konfidal, and the first licence period shall commence on the 1st of the following month.

(2) Apart from the aforementioned, konfidal shall also be entitled to extend the contractual scope of services temporarily and free of charge at its own discretion for test purposes. The licensee shall be informed of a possible extension as well as of its discontinuation. The licensee shall not be entitled to the (free) extension of services; however, it shall be possible to continue to use the extension of services within the framework of a contract extension for a fee.

D. Support

(1) konfidal shall provide the licensee with free user support in accordance with the service description for the elimination of technical faults and the rectification of errors that arise in the course of using the software.

(2) The processing times differ in each case according to product variant and can be viewed in the service description, accessible at konfidal.eu/plans.

E. Contract term / termination

(1) The contract is concluded for a period of 12 months. It shall be automatically renewed for a further 12 months, unless one of the parties expressly objects in writing to an extension no later than 6 weeks before the expiry of the licence period, or the licensee has given notice of termination or the licensee has been offered and accepted a discounted period with a different term by konfidal. The first licence period shall commence on the day the contract is concluded.

(2) If the licence fee due is not paid within 14 days, konfidal is entitled to pause the service until payment is received. During this time, notices from outside may be received, but the licensee shall not have access to these receipts. After a further 2 weeks, konfidal is entitled to block the use and the service as a whole.

(3) The licensee may terminate the contract at any time without stating reasons with a notice period of 6 weeks to the end of a licence period by logging off in the section "Company Settings" or "Company Profile" on the konfidal portal.

(4) Both parties reserve the right to extraordinary termination for good cause if the legal requirements are met. Good cause shall be deemed to exist in particular if konfidal does not fulfil its due obligation to provide the software within 14 working days even after a written request by the licensee. the licensee is more than 6 weeks in arrears with the payment of a due licence fee despite a written payment reminder the software is not used in accordance with the contract the Software is used for criminal purposes (e.g. drug trafficking, distribution of pornography, etc.) or the use otherwise violates applicable laws.

(5) If the licensee is responsible for the extraordinary reason for termination, he shall be obliged to pay konfidal the agreed license fee less any expenses saved by konfidal until the date on which the contract would have ended at the earliest in case of an ordinary termination.

F. Licence fee

(1) The licensee shall pay konfidal a fee for the transfer of the subject matter of the contract and for the granting of the rights of use in accordance with the contractual licence type.

(2) The amount of the licence fee results from the service description.

(3) konfidal is entitled to change the prices at its own discretion, but always in accordance with what is customary in the market and business. The licensee is to be informed of a price change. Price changes shall take effect at the beginning of the respective following licence period. In the event of an increase in the licence fee, licensee shall have a special right of termination at the end of the current licence period subject to a notice period of 2 weeks. With regard to the fee-free variant, however, konfidal shall be entitled to demand a fee at any time. A price change or price introduction of this kind shall become effective 2 weeks after notification to the licensee. Electronic information such as an e-mail shall suffice for the notification. The introduction of a fee for previously free variants shall open up a special right of termination with a notice period of 2 weeks.

(4) Payments shall be made online using a major credit card, SEPA direct debit, services such as PayPal, or similar, unless a different method of payment is specified in the service description. Payments can also be processed via a payment service provider. If this is the case, the transfer of data to and from this payment service provider can be found in the privacy policy, which can be viewed at konfidal.eu/privacy. The licensee accepts that the payment will be created as a recurring payment with the payment providers CHARGEBEE INC. and Mollie B.V..

(5) Payment obligations of the licensee are due with the conclusion of the User Agreement or with the coming into effect of an amendment to the Agreement and are payable within 2 weeks from the date of the invoice.

(6) If the agreed payment date is exceeded, konfidal is entitled to interest on arrears in the amount of 8 percentage points above the respective base interest rate without further reminder.

(7) The licence fees shall be invoiced plus the applicable statutory value added tax.

G. Access authorisation

The licensee shall receive an access authorisation for each of the workstations agreed in the specification of services, consisting of a user ID and a password. The licensee may only disclose the user ID and password to authorised persons and is otherwise obliged to maintain secrecy. Moreover, licensee is not permitted to assign or transfer the contractually granted right of use to third parties or to grant sublicenses.

H. Ownership of rights

(1) The licensee shall receive the right of use agreed in this licence agreement. The acquisition of further rights to the software is excluded.

(2) konfidal remains the full owner of the rights within the meaning of copyright law. konfidal reserves in particular all publication, reproduction, processing and exploitation rights to the software.

I. Rights to data processing, data backup

(1) konfidal complies with the statutory data protection regulations.

(2) The licensee grants konfidal the right to reproduce the data created by the licensee during the use of the software to the extent necessary for the fulfilment of the contractual obligations. The same applies to files loaded by the licensee into the cloud storage. konfidal is also entitled to keep the data in a failover system or separate failover computer centre. In the event of failures, konfidal is entitled to make necessary changes to the format or structuring of the data.

(3) konfidal regularly backs up the data of the licensee on the server for which konfidal is responsible on an external backup server. The licensee can, as far as technically possible, excerpt this data at any time for backup purposes and is obliged to do so at regular customary intervals. If this is not possible, konfidal shall provide the licensee with the data as a backup once a month.

(4) If and insofar as the licensee processes personal data of third parties on IT systems for which konfidal is technically responsible, a commissioned processing agreement pursuant to Art. 28 (3) DSGVO shall be concluded as a rule.

J. Warranty

(1) konfidal warrants the agreed quality of the software or that the software is suitable for the contractually stipulated use and that the licensee can use the contractual software without infringing the rights of third parties. Functional impairments resulting from the hardware and software environment provided by the licensee, operating errors, external defective data, computer network malfunctions or other reasons originating from the licensee's sphere of risk do not constitute a defect. Insignificant deviations do not constitute a defect. konfidal expressly points out that the software only functions using the specified operating systems (Microsoft Windows >= 10, Mac OS X >= 10.13, current Linux versions) and browsers (Google Chrome, Mozilla Firefox). Apart from that, konfidal does not give any assurances or guarantees with regard to the provision of the service.

(2) The application of § 536a para. 2 (Lessee's right of self-remedy) is excluded. The application of Section 536a (1) of the German Civil Code (Lessor's liability for damages) is also excluded insofar as the standard provides for strict liability.

(3) The licensee is obliged to notify the Provider of functional failures, malfunctions or impairments of the Software immediately, at the latest, however, two weeks after discovery, and as precisely as possible. If the licensee fails to do so, § 536c BGB shall apply accordingly.

(4) In the event of defective performance, konfidal shall be entitled to subsequent performance, at its discretion by means of rectification of defects or replacement delivery, within a reasonable period of time, unless this is unreasonable in the individual case or special circumstances exist which justify a termination of the order by the licensee, taking into account the interests of both parties. Subsequent performance can be effected in particular by providing a new programme version or by konfidal showing possibilities to avoid the effects of the defect. A new program version must also be accepted by the licensee if this leads to an acceptable adaptation effort for him. konfidal shall have the right to two attempts at supplementary performance; only after the second unsuccessful attempt at supplementary performance shall the supplementary performance be deemed to have failed. If the supplementary performance fails, the licensee shall have the right to reduce the price or to withdraw from the contract at his discretion.

(5) Claims for damages shall only exist in accordance with these contractual conditions. Claims for damages shall not exist if the deviation from the quality owed is only insignificant.

K. Availability

(1) konfidal points out to the licensee that it cannot guarantee 100% availability of the software if restrictions or impairments arise that are beyond konfidal's sphere of influence. konfidal may also interrupt the provision of services for a certain period of time outside of the time periods specified in § 2 Paragraph 4 with the consent of the licensee in order to carry out maintenance work and shall be released from its obligation to perform in this respect. The availability percentage can be viewed in the service description at konfidal.eu/plans. This is calculated per calendar quarter.

(2) The licensee is obliged to inform konfidal immediately in writing (by letter or e-mail) as soon as the software is not available.

L. Liability

(1) konfidal shall be liable for damages of the licensee caused intentionally or by gross negligence, which are the result of the non-existence of a guaranteed quality, which are based on a culpable violation of essential contractual obligations (so-called cardinal obligations), which are the result of culpable injury to health, body or life, or for which liability is provided for under the Product Liability Act, in accordance with the statutory provisions. Cardinal obligations are those contractual obligations whose fulfilment makes the proper performance of the contract possible in the first place and on whose compliance the contractual partner may regularly rely, and whose breach on the other side jeopardises the achievement of the purpose of the contract.

(2) In the event of a breach of a cardinal obligation, liability - insofar as the damage is only due to slight negligence - shall be limited to such damage as may typically be expected to occur when using the contractual software. Liability is limited for each individual case of damage and for all cases of damage together arising from or in connection with the contractual relationship to five times the total amount of the licensee's remuneration for the respective service in the respective calendar year.

(3) konfidal is also liable for damages of its vicarious agents according to the aforementioned provisions.

(4) In all other respects liability is excluded. In particular, konfidal is not liable for damages resulting from the use of this software or the inability to use this software.

(5) If damages to the licensee result from the loss of data, konfidal shall not be liable for this, insofar as the damages would have been avoided by a regular and complete backup of all relevant data by the licensee. The licensee shall carry out regular and complete data backups himself or have them carried out by a third party and shall be solely responsible for this.

(6) Claims for damages against konfidal shall become time-barred within one year, claims for reimbursement of expenses within 6 months.

M. Client data and indemnification against third-party claims

(1) As a technical service provider, konfidal stores content and data for the licensee, which the latter enters and stores when using the software and makes available for retrieval. The licensee undertakes vis-à-vis konfidal not to enter any content and data that is punishable by law or otherwise illegal in absolute terms or in relation to individual third parties and not to use any programs containing viruses or other malware in connection with the software. The licensee remains the responsible party with regard to personal data and must therefore always check whether the processing of such data via the use of the Software is covered by the relevant permissions.

(2) The licensee shall be solely responsible for all content used and data processed as well as any legal positions required for this. konfidal shall not take any notice of the licensee's content and shall not check the content used by the licensee with the software as a matter of principle.

(3) In this context, the licensee undertakes to indemnify konfidal against any liability and any costs, including possible and actual costs of legal proceedings, if a claim is made against konfidal by third parties, including employees of the licensee personally, as a result of alleged acts or omissions by the licensee. konfidal shall inform the licensee of the claim and, insofar as this is legally possible, give it the opportunity to defend the asserted claim. At the same time, the licensee shall immediately provide konfidal with all information available to it concerning the facts which are the subject of the claim.

(4) Any further claims for damages on the part of konfidal shall remain unaffected.

N. Surrender and deletion of data

(1) After termination of the contract, konfidal shall make the data created by the licensee available to the licensee for downloading in full within 1 week without request. The data shall be made available in a CSV file [or another suitable format] for a maximum of 6 months.

(2) Within 1 week after the licensee has downloaded the data, but no later than 6 months after the end of the contract, konfidal shall completely delete all data stored by the licensee on its servers, unless there is an explicit legal regulation that provides for longer storage.

(3) Against payment of a fee, the licensee may also request konfidal to transfer the data in a suitable format to a third party company of the licensee's choice.

O. Confidentiality

(1) The parties undertake to protect all confidential information of the other party obtained prior to and in the course of the performance of the contract for an unlimited period of time, in the same way as they protect their own comparable confidential information, but at least to treat it confidentially with reasonable care. konfidal may use the data collected during the term which falls under confidential information in aggregated, anonymised form, provided that this data is collected by more than one user, client or licensee and does not identify the employees of the respective companies or institutions.

(2) The information is not confidential information if it can be has been independently developed by the recipient without recourse to the disclosing party's Confidential Information, has become generally available to the public without breach of contract by the recipient or has been lawfully obtained from a third party without a duty of confidentiality, was known to the recipient without restriction at the time of disclosure, have been exempted from the rule referred to in subsection 1 after written consent by the disclosing party, are required by a competent court or authority as well as a mandatory regulation.

(3) konfidal is entitled to publish, e.g. in a reference list, as a presentation on the konfidal website or in newsletters, that users and their organisations belong to konfidal's client portfolio. (4) The obligation from paragraph 1 shall survive the end of this agreement.

P. Assignment of rights and obligations

The rights and obligations arising from this agreement may only be assigned with the prior written consent of konfidal. konfidal is entitled to entrust third parties with the fulfilment of the obligations arising from this agreement.

Q. Final provisions

(1) konfidal is entitled to make changes to the service description or the GTC and other terms and conditions and will inform the users, clients and licensees by e-mail to the e-mail address provided by the users, clients and licensees in the "Services" section of the administrator portal. konfidal will only make changes for valid reasons, in particular due to new technical developments, changes in jurisdiction or other equivalent reasons. If the change significantly disturbs the contractual balance between the parties, the change shall not be made. Amendments with effect from the following term period shall be exempt from the aforementioned restriction subject to 6 weeks' notice. Otherwise, amendments require the consent of the licensee. The updated or current GTC can be downloaded at any time at konfidal.eu/terms.

(2) The data processing conditions of konfidal can be downloaded at konfidal.eu/privacy.

(3) This contract is subject to the laws of the Federal Republic of Germany.

(4) The exclusive place of jurisdiction for all disputes arising directly or indirectly from the contractual relationship is, as far as legally permissible, konfidal's registered office.

(5) Should individual provisions of this contract be or become invalid or should a loophole requiring regulation become apparent, this shall not affect the validity of the remaining provisions. In place of the ineffective provision or to fill the gap, a provision shall apply without further ado which - as far as legally possible - comes as close as possible in economic terms to what the parties intended with the ineffective provision or - in the case of the gap - would have intended according to the sense and purpose of the entire contractual work if they had considered the point requiring regulation.

(6) Amendments and supplements to this licence agreement must be made in writing unless another form is prescribed by law. This shall also apply to amendments to this written form clause itself.