This End User License Agreement (hereinafter: “EULA”) governs the use of all software products, SaaS applications, cloud services, AI solutions, automation platforms, agent systems, interfaces (APIs), connectors, workflows, extensions and digital services of which OXORY AS.DS GmbH (hereinafter: “OXORY”) is the manufacturer or provider, including updates, upgrades and user documentation (hereinafter collectively: “Software”), by its contractual partners (hereinafter: “the Customer”). This includes, in particular, the software AI IDOCMON.

The Software may be provided in the following forms of deployment; the form of deployment agreed in each case is set out in the licence certificate or the Product Terms:

• as a SaaS or cloud service operated by or on behalf of OXORY and made available to the Customer for use via the internet (Clause 4);
• for installation and operation in the Customer’s system environment, including its Microsoft 365, Azure or Power Platform tenant and its SAP systems (hereinafter: “Customer Environment”), either for an unlimited period (purchase) or for a limited period (rental, subscription) (Clause 5).

This EULA applies exclusively to entrepreneurs within the meaning of Section 14 German Civil Code (BGB), legal entities under public law and special funds under public law. It governs exclusively the grant and scope of licence and usage rights and the obligations associated therewith. Remuneration, claims for defects, liability, confidentiality, data protection, and term and termination are governed by the General Terms and Conditions of OXORY AS.DS GmbH in the version agreed in each case (hereinafter: “GTC”), unless expressly provided otherwise in this EULA.

In the event of contradictions, the following order of precedence applies:

• (1) individual agreements, in particular the individual contract, offer and licence certificate;
• (2) a data processing agreement pursuant to Art. 28 GDPR, insofar as the processing of personal data is concerned;
• (3) the product-specific terms (hereinafter: “Product Terms”);
• (4) the service specification;
• (5) the Service Level Agreement (SLA) or the service schedule;
• (6) this EULA;
• (7) the Special Provisions of the GTC (Part B) and thereafter the General Provisions of the GTC (Part A);
• (8) supplementarily, the statutory provisions.

Provisions of the GTC that safeguard mandatory statutory liability (in particular Clause 11.1 of the GTC) shall always take precedence over deviating provisions in ranks (3) to (6).

If the Customer acquires the Software through a sales partner authorised by OXORY, this EULA is agreed directly between OXORY and the Customer. Remuneration, delivery and claims for defects are then governed by the contract with the sales partner. In the relationship between OXORY and the Customer, Clauses 7 (Performance Reservations, Export Control, Force Majeure), 10 (Third-Party Intellectual Property Rights), 11 (Liability), 12 (Confidentiality), 13 (Data Protection and Information Security) and 17 (Final Provisions) of the GTC apply mutatis mutandis; OXORY makes the GTC available at oxory.net or upon request. Sales partners are not entitled to grant usage rights exceeding those under this EULA.

Deviating, conflicting or supplementary terms and conditions of the Customer do not become part of the contract, not even through silence, reference, acceptance of an offer or performance of services, unless OXORY expressly agrees to their validity in text form.

This EULA does not apply to software and services of third-party manufacturers that OXORY merely distributes or brokers (e.g. Microsoft licences and subscriptions); in this respect, Clauses B.3.6 and B.7 of the GTC apply.

“Licence certificate” means the document (e.g. offer, order confirmation, order of a subscription) in which the product, form of deployment, licence model, licence metric, licence quantity and term are specified.

“Product Terms” means the product-specific terms for each product or platform, in particular regarding usage and API limits, fair-use rules, data storage, retention periods, third-party services, knowledge bases, Agent Actions and multi-tenancy (sample: Annex 1).

“Licence metric” means the reference unit for the permitted scope of use, e.g. named user, client, organisational unit, connected system, data volume, number of messages processed (e.g. IDocs), API calls, agents, workflows or executions.

“Customer Data” means all data and content that the Customer or its users introduce into the Software or connect via connectors, including inputs (prompts), documents and knowledge bases, as well as the AI Outputs generated for the Customer.

“AI Outputs” means results generated with the aid of AI functions, e.g. texts, classifications, analyses, recommendations, code or proposed actions.

“Agent Actions” means actions that the Software triggers automatically or through AI agents using the Customer’s authorisations in the Customer’s systems or in third-party systems (e.g. creating, changing, reprocessing, cancelling or sending data, messages or documents).

“Affiliated companies” means companies affiliated with the Customer within the meaning of Sections 15 et seq. German Stock Corporation Act (AktG).

OXORY grants the Customer a simple, non-exclusive and non-sublicensable right to use the Software to the agreed extent. The right of use is non-transferable unless Clause 5.5 (transfer of purchased software) provides otherwise.

The right of use covers exclusively use in accordance with the contract for the Customer’s own business purposes by its authorised users. Use by affiliated companies is only permitted insofar as agreed in the licence certificate. The Customer may have the Software operated or supported by an IT service provider commissioned by it, provided that this is done exclusively for the Customer’s purposes, the Customer names the service provider to OXORY in advance in text form and obliges it to comply with this EULA. The Customer is responsible for compliance with this EULA by affiliated companies, service providers and users.

The type and scope of the licence are determined by

• the offer or individual contract,
• the licence certificate or the subscription booked,
• the Product Terms and
• the service specification.

If use is restricted according to a licence metric, the agreed limits must not be exceeded. Any use beyond this requires additional licences or an extension of the subscription. Technical limitations that OXORY employs to ensure compliance with the licence metric do not constitute a defect.

Unless otherwise agreed, the grant of the right of use is subject to the condition precedent of full payment of the remuneration attributable to it; until then, use is permitted on a revocable basis. In the case of acquisition through a sales partner, full payment to the sales partner is sufficient.

If OXORY provides the Software for evaluation, test or pilot purposes (e.g. proof of concept), the Customer may use it only for these purposes and for the period notified, or, in the absence of notification, for 30 calendar days. Productive use, in particular the release of Agent Actions in production systems, is not permitted without a separate agreement.

Updates, upgrades, new functions and extensions received by the Customer are also subject to this EULA.

In the case of SaaS and cloud offerings, the Software is provided exclusively as an online service. The Customer receives the right to access the functions of the Software via the internet for the term of the contract; no copies of the program are provided, and the Customer does not acquire ownership of the Software.

Availability, service hours, maintenance windows, data backup and recovery are governed by the SLA or service schedule; otherwise, Clauses B.7.4 and B.7.5 of the GTC apply mutatis mutandis. The Customer is responsible for its internet connection and end devices.

OXORY is entitled to further develop the Software and, in particular, to

• adapt or extend functions,
• change user interfaces,
• replace or update integrations and AI models used, and
• change technical platforms and operating environments (sub-processors in accordance with the data processing agreement),

OXORY may discontinue individual functions, provided that this does not materially impair the core purpose of the contract. If a change or discontinuation has a materially adverse effect on the Customer’s use, OXORY shall announce it in text form at least six weeks before it takes effect. In this case, the Customer may terminate the affected contract or part of the contract for cause until the change takes effect; remuneration paid in advance will be refunded pro rata. OXORY shall draw attention to this right in the announcement. OXORY may make changes that are necessary for mandatory legal reasons or to avert acute security risks without prior notice; OXORY shall inform the Customer without undue delay.

The Customer shall not store or distribute unlawful content via the Software, introduce malware, carry out load or penetration tests without the prior consent of OXORY, or use the Software in a manner that impairs its stability, security or use by other customers.

After the end of the contract, OXORY shall make the Customer’s Customer Data available to it in accordance with Clause B.7.10 of the GTC.

In the case of purchase, the Customer receives the right of use pursuant to Clause 3 for an unlimited period; in the case of rental or subscription, it is limited to the term of the contract.

If the Software is deployed in the Customer Environment (e.g. as a Copilot agent, Power Automate flow, Azure resource, Microsoft Teams app or as an add-on or connector for SAP systems), the Customer shall provide, at its own expense, the licences, subscriptions and consumption quotas of the respective manufacturers required for this purpose (e.g. Microsoft 365, Microsoft 365 Copilot, Azure consumption, SAP usage rights), unless OXORY supplies them under the licence certificate. The prerequisites are set out in the Product Terms or the system requirements.

The Customer may reproduce the Software only insofar as this is necessary for use in accordance with the contract (e.g. installation, deployment in the tenant, loading into main memory, system copies and virtualisation within the permitted scope of use). It may make the backup copies required for secure operation, which may be used exclusively for archiving and recovery purposes. Any further reproduction, including printing out the program code, is not permitted.

Unless the Product Terms provide otherwise, the Customer may, without additional remuneration, also use the Software in the development, test and quality assurance systems assigned to a licensed production system, exclusively for these purposes.

The Customer may sell or give away purchased Software to a third party only in its entirety and permanently, if

• it notifies OXORY of the transfer in advance in text form, specifying the Software and the acquirer,
• it completely and finally ceases its own use no later than upon the transfer and hands over or deletes all copies, and
• the acquirer undertakes to OXORY in text form to comply with this EULA.

Splitting licences, temporary or partial transfer and the transfer of software that has been rented, provided under a subscription or provided for evaluation are not permitted.

There is no entitlement to the surrender of the source code. Escrow may be regulated in a separate agreement; Clause B.2.6 of the GTC applies mutatis mutandis.

Access credentials, API keys, client secrets and certificates must be treated confidentially, stored securely and must not be disclosed. Named user licences are personal; shared use of a user account by several persons is not permitted. Reassignment is permitted in the event of a permanent change of the person.

The Customer shall take appropriate technical and organisational measures against unauthorised access, manage the authorisations of its users in accordance with the principle of least privilege and revoke the access of departed users without undue delay. Insofar as log-in takes place via the Customer’s identity service (e.g. Microsoft Entra ID, single sign-on), the Customer is responsible for its secure configuration.

OXORY may require the use of multi-factor authentication insofar as this corresponds to the state of the art.

The Customer is responsible for all activities that take place under its user accounts or API access, insofar as it is responsible for them. It shall inform OXORY without undue delay if there are indications of misuse of access credentials or a security incident.

Unless otherwise permitted in this EULA or in the licence certificate, the Customer is in particular prohibited from

• making the Software accessible to third parties; authorised users, affiliated companies and service providers pursuant to Clause 3.2 are not deemed third parties;
• renting, leasing, lending or sublicensing the Software;
• operating the Software commercially for third parties, in particular as application service providing, software as a service, hosting or managed service;
• circumventing technical protection measures, licence verification mechanisms, usage or API limits or deactivating security mechanisms;
• modifying or decompiling the Software, carrying out reverse engineering or extracting source code;
• deliberately circumventing content filters and protection mechanisms of AI functions (e.g. through prompt injection or jailbreaking) or extracting system instructions, models, model parameters or configurations of OXORY;
• publishing or making accessible to third parties benchmarking or competitive analyses without the prior consent of OXORY in text form;
• using the Software or knowledge gained from it to develop a product with substantially the same functions;
• using the Software for practices prohibited under Regulation (EU) 2024/1689 (AI Act) or, without a separate agreement, in high-risk areas of application;
• removing or altering copyright notices, trade marks, licence notices or other markings.

Mandatory statutory rights of use, in particular under Sections 69d and 69e German Copyright Act (UrhG), remain unaffected. Before the Customer obtains information to achieve interoperability pursuant to Section 69e UrhG, it shall request such information from OXORY in text form; OXORY shall make it available within a reasonable period.

OXORY may provide APIs, connectors and integrations. Their use is governed by this EULA, the Product Terms and the respective API documentation.

API limits, fair-use limits and other technical restrictions must not be circumvented. The Customer shall use APIs only for the documented purposes and only with the access assigned to it.

OXORY is entitled to block or throttle API access temporarily and to the extent necessary in the event of misuse, significant exceeding of limits or specific security risks. OXORY shall inform the Customer without undue delay and lift the measure as soon as the reason for it has ceased to exist.

The Software may be connected to third-party systems and services, in particular Microsoft 365, Microsoft Azure, Microsoft Copilot, Azure OpenAI, OpenAI, SAP and Salesforce. Changes to these systems and their interfaces are beyond OXORY’s control. OXORY shall carry out any adaptations required as a result within the framework of an agreed maintenance or operating contract or otherwise upon request against remuneration on a time-and-materials basis; Clause 14 applies supplementarily.

The Software may contain artificial intelligence functions, in particular generative AI, machine learning, retrieval systems (retrieval augmented generation, RAG), agent systems and automated decision support. Clauses B.8.2 to B.8.9 of the GTC apply supplementarily.

The Customer acknowledges that AI systems are based on statistical probability models. AI Outputs may be incorrect, incomplete, misleading, outdated or contradictory and may differ even with identical inputs.

OXORY owes the technical functionality of the agreed solution in accordance with the service specification, but not the factual accuracy of individual AI Outputs, unless specific quality criteria (e.g. detection rates based on agreed test data sets) have been expressly agreed as a characteristic.

The Customer shall review AI Outputs to an appropriate extent from a subject-matter perspective before using them and shall ensure appropriate human oversight. In particular, AI Outputs must not be used without review for

• legal assessments,
• personnel decisions,
• medical decisions,
• safety-relevant decisions,
• financial decisions and
• regulatory assessments and reports.

The Customer bears responsibility for decisions based on AI Outputs, including the permissibility of automated individual decisions under Art. 22 GDPR and the deployer obligations under the AI Act (e.g. AI literacy, transparency and labelling). Where OXORY is the provider of an AI system within the meaning of the AI Act, OXORY shall fulfil the obligations incumbent upon it.

Insofar as the Software is capable of executing Agent Actions, the Customer decides on their activation, scope and authorisations. The Product Terms may provide for approval levels (e.g. proposal only, execution after individual approval by a user, automatic execution).

The Customer shall test all automations and Agent Actions before releasing them for productive use, where possible in a non-production system, and shall expressly approve them. It shall provide technical users and agents only with the authorisations required for the respective purpose, use the logging and shut-down functions provided by the Software and monitor productive automations at appropriate intervals.

The Customer shall ensure that automations and Agent Actions do not violate statutory, regulatory or contractual obligations, in particular retention, bookkeeping, data protection and approval requirements (e.g. four-eyes principle).

OXORY is not responsible for the consequences of Agent Actions that are based on rules, prompts, workflows, authorisations or approvals defined or approved by the Customer. This does not apply insofar as the consequences are based on a defect in the Software or a breach of duty by OXORY, for instance if the Software executes actions outside the configured rules or authorisations. Clause B.8.4 and Clause 11 of the GTC, in particular Clause 11.1, remain unaffected.

All rights to the Customer Data remain with the Customer. OXORY does not acquire any rights to Customer Data unless expressly provided otherwise in this EULA.

For the term of the contract, the Customer grants OXORY the simple right to store, process and reproduce Customer Data insofar as this is necessary for the provision of the contractual services, data backup, troubleshooting and ensuring security. Personal data is processed in accordance with Clause 13 of the GTC and the data processing agreement.

OXORY may evaluate technical operating and usage data (e.g. number of calls, utilisation, error logs, use according to licence metric) for the provision, invoicing, security and improvement of the Software, provided that such data does not contain any content of the Customer Data and does not permit any conclusions to be drawn about the Customer or natural persons, or insofar as this is necessary for invoicing and licence verification.

The Customer warrants that

• it is entitled to process the Customer Data with the Software and the processing is lawful,
• the Customer Data and its processing do not infringe any third-party rights, and
• any necessary consents, information and approvals have been obtained.

OXORY does not use Customer Data, in particular inputs, documents, content and AI Outputs, to train or improve general AI models or AI models used for other customers. Use for training purposes takes place exclusively with the Customer’s express prior consent in text form. Clause B.8.6 of the GTC applies supplementarily.

Customer-specific adaptations (e.g. knowledge bases, vector indices, fine-tuning, prompt libraries) are used exclusively for the Customer and are deleted or handed over after the end of the contract in accordance with the Product Terms.

Where services are provided on the basis of third-party AI services (e.g. Azure OpenAI), their terms apply supplementarily. Where available, OXORY selects configurations in which inputs and outputs are not used to train the manufacturer’s models. The Customer acknowledges that manufacturers may temporarily store data in accordance with their terms for the purpose of abuse detection; details are set out in the Product Terms.

The Software may contain open source components. These components are subject to the respective open source licences, which take precedence over this EULA insofar as they are mandatory.

OXORY shall provide the Customer with an overview of the open source components contained and their licences together with the Software, in the documentation or upon request. The Customer’s rights under this EULA are not restricted by open source licences.

If the Software contains or requires third-party components or services, the terms of the respective manufacturers apply supplementarily, insofar as these form part of the solution. This applies in particular to

• Microsoft 365 and Microsoft Teams,
• Microsoft Azure and the Microsoft Power Platform,
• Microsoft Copilot and Copilot Studio,
• Azure OpenAI and OpenAI, and
• other cloud, AI and enterprise software services (e.g. SAP).

OXORY shall specify the services concerned and the relevant manufacturer terms in the Product Terms or in the offer (Clause B.3.6 of the GTC). Insofar as the Customer procures these services itself, it shall conclude the contracts required for this directly with the manufacturer or its licensing partner.

Changes, restrictions or discontinuations of such services by the manufacturer do not constitute a breach of duty by OXORY, insofar as OXORY is not responsible for them. OXORY shall inform the Customer of material changes that have come to its knowledge; Clauses B.7.3, B.8.7 and 17.5 of the GTC apply mutatis mutandis.

The Customer acknowledges that AI assistance functions such as Microsoft 365 Copilot and agents based on them can in principle access all content to which the respective user or technical user is authorised. The Customer bears responsibility for an appropriate authorisation and classification concept.

The Software is protected by copyright law and international treaties. All rights to the Software, including further developments, remain with OXORY or its licensors, unless expressly granted to the Customer under this EULA. Use of the Software does not result in any transfer of ownership or rights.

Clause 8 of the GTC applies to work results that OXORY creates individually for the Customer (e.g. customer-specific agents, prompts, workflows, configurations). Configurations, rules and content that the Customer creates itself belong to the Customer.

OXORY may use feedback, suggestions for improvement and feature requests from the Customer free of charge for the further development of its products, provided that they do not contain any confidential information or Customer Data of the Customer. There is no obligation to implement them.

The Customer may use company names, trade marks and product names of OXORY only in order to indicate, in the customary manner, that the Software originates from OXORY.

OXORY is entitled to verify use in accordance with the contract no more than once per calendar year. The verification is carried out primarily by means of a self-declaration by the Customer in text form within 30 calendar days of the request and – in the case of SaaS offerings – by evaluating the usage data pursuant to Clause 11.3.

If there are reasonable indications of overuse, OXORY may, after giving notice in text form at least 14 calendar days in advance, carry out a more extensive audit itself during normal business hours or have it carried out by an expert bound to confidentiality. The audit must not unreasonably impair the Customer’s business operations.

Any additional use identified must be licensed retrospectively without undue delay at the list prices applicable at the time of identification; recurring remuneration must be paid retroactively from the beginning of the additional use. OXORY bears the costs of the audit, unless the additional use exceeds 5 % of the licensed scope; in that case, the Customer bears the reasonable costs of the audit.

In the event of security incidents or specific, significant security risks, OXORY is entitled, temporarily and to the extent necessary, to

• block user accounts or API access,
• restrict access,
• take systems offline,
• deactivate functions, in particular Agent Actions.

OXORY shall choose the least intrusive suitable means, inform the Customer without undue delay unless statutory or security-related reasons prevent this, and lift the measure as soon as the reason for it has ceased to exist. If the reason is not based on a circumstance for which the Customer is responsible, the Customer’s rights under the SLA remain unaffected.

In the case of SaaS offerings, rental and subscription, the right of use exists for the duration of the respective contract and ends automatically upon its termination. Term and ordinary termination are governed by the licence certificate and otherwise by Clause 16 of the GTC. The right of use to purchased Software exists for an unlimited period.

OXORY may temporarily block rights of use or terminate them for cause, in particular in the event of

• serious licence infringements, in particular of Clauses 3, 5 and 7, which the Customer fails to remedy despite a warning in text form within a reasonable period of at least 14 calendar days;
• a significant threat to security emanating from the Customer’s use (blocking pursuant to Clause 17);
• misuse of the Software, in particular for unlawful purposes or in breach of Clause 4.5;
• default in payment, but exclusively subject to the conditions of Clauses B.7.9 and 16.2 of the GTC.

A warning is not required if it holds no prospect of success or if OXORY cannot reasonably be expected to continue the contract (Section 314 (2) German Civil Code (BGB)).

Upon termination of the right of use, the Customer shall cease use, remove the Software from the Customer Environment, delete all copies unless statutory retention obligations prevent this, and confirm this in text form upon request. Clause 4.6 applies to the return of Customer Data.

The GTC of OXORY AS.DS GmbH in the version agreed in each case apply to liability, claims for defects, third-party intellectual property rights, data protection, confidentiality and remuneration, and, in the case of acquisition through a sales partner, in accordance with Clause 1.6.

Amendments and supplements to this EULA and declarations by the Customer to OXORY require at least text form (Section 126b German Civil Code (BGB)). Individual agreements always take precedence (Section 305b BGB). Amendments to this EULA become effective for existing contracts only in accordance with Clause 17.3 of the GTC; Clauses 4.3 and 4.4 remain unaffected.

The Customer is responsible for compliance with the export and import regulations, embargoes and sanctions applicable to it; Clause 7.1 of the GTC applies supplementarily.

The law of the Federal Republic of Germany applies exclusively, to the exclusion of the UN Convention on Contracts for the International Sale of Goods (CISG) and the conflict-of-law rules of private international law.

The exclusive place of jurisdiction for all disputes arising from or in connection with this EULA is Cologne, Germany, provided that the Customer is a merchant, a legal entity under public law or a special fund under public law, or has no general place of jurisdiction in Germany. OXORY is also entitled to sue the Customer at its general place of jurisdiction.

If this EULA is also available in another language, the German version shall prevail in the event of discrepancies.

Should individual provisions of this EULA be or become invalid or unenforceable in whole or in part, the validity of the remaining provisions shall remain unaffected. The invalid or unenforceable provision shall be replaced by the statutory provisions (Section 306 (2) German Civil Code (BGB)).