These General Terms and Conditions (hereinafter: “GTC”) apply to all contracts between OXORY AS.DS GmbH (hereinafter: “OXORY”) and its customers (hereinafter: “Customer”) concerning consulting and other services, software development and projects, the provision of software (purchase, rental, subscription), software maintenance, support and helpdesk services, cloud and managed services, AI and automation solutions as well as training courses. They also apply to all future contracts of this kind without OXORY having to refer to them again in each individual case.

These GTC apply exclusively to entrepreneurs within the meaning of Section 14 of the German Civil Code (BGB), legal entities under public law and special funds under public law. OXORY does not conclude contracts with consumers (Section 13 BGB) on the basis of these GTC.

Deviating, conflicting or supplementary terms and conditions of the Customer shall not become part of the contract, even if OXORY does not expressly object to their validity, refers to a letter of the Customer containing such terms, or performs services without reservation in the knowledge of such terms. They shall only apply if OXORY has expressly agreed to their validity in text form.

These GTC consist of Part A (General Provisions), which applies to all services, and Part B (Special Provisions) with supplementary rules for individual types of services. For software, SaaS applications, cloud services and AI, automation and agent solutions of which OXORY is the manufacturer or provider, the End User License Agreement of OXORY AS.DS GmbH (hereinafter: "EULA") and the product-specific terms (hereinafter: "Product Terms") in the version agreed in each case apply in addition. In the event of contradictions, the following order of precedence applies: (1) individual agreements, in particular the individual contract, the offer or order confirmation and the licence certificate, (2) a separate data processing agreement for matters of data protection, (3) the Product Terms, (4) the service specification, (5) the Service Level Agreement (SLA) or the service schedule, (6) the EULA, (7) the Special Provisions in Part B, (8) the General Provisions in Part A, (9) supplementarily the statutory provisions. The EULA primarily governs licence and usage rights; in all other respects, in particular for remuneration, claims for defects, liability, confidentiality, data protection, term and termination, these GTC apply. Mandatory statutory provisions and Clause 11.1 shall remain unaffected in any case.

Insofar as OXORY brokers or resells software or services of third parties (e.g. software manufacturers, cloud providers), the respective licence and usage terms of such third parties, which OXORY makes available to the Customer before conclusion of the contract in accordance with Clause B.3.6, shall apply supplementarily and with priority.

Offers made by OXORY are subject to change and non-binding unless they are expressly designated as binding or contain a specific period for acceptance. Unless otherwise stated, binding offers are valid for 30 calendar days from the date of the offer.

A contract is concluded by (a) the signing of an offer, individual contract or service specification by both parties, (b) the Customer's acceptance of a binding offer from OXORY in text form, (c) an order confirmation from OXORY in text form, or (d) the commencement of performance by OXORY. The Customer may place orders by e-mail, via a ticket system or via an online form; such orders become binding upon confirmation by OXORY or commencement of performance.

The type, scope and characteristics of the services, the number and designation of items to be delivered, deadlines, the remuneration and other agreements result from the respective offer, individual contract, service specification and/or order confirmation. Information in product descriptions, presentations, brochures or on OXORY's website does not constitute an agreement on quality or a guarantee unless it has been expressly made part of the contract.

OXORY assumes guarantees in the legal sense only if they are expressly designated as a “guarantee” in text form.

OXORY performs the contractual services by qualified personnel in accordance with the state of the art at the time the contract is concluded. OXORY determines the manner of performance and the selection of the employees deployed at its own discretion, taking into account the legitimate interests of the Customer. The Customer is only entitled to the deployment of specific employees if this has been expressly agreed.

OXORY is entitled to replace employees provided that their qualifications are equivalent and the interests of the Customer are appropriately taken into account.

OXORY is entitled to engage subcontractors and freelancers for the performance of services. OXORY remains responsible to the Customer for the proper performance of the services.

The parties do not intend any temporary agency work (Arbeitnehmerüberlassung) within the meaning of the German Temporary Employment Act (AÜG). The employees deployed by OXORY remain integrated into OXORY's work organisation and are subject exclusively to OXORY's right to issue instructions and directions, in particular with regard to working hours, place of work, the manner in which tasks are performed and holiday and substitution arrangements. The parties shall perform the contract accordingly: the Customer shall not issue instructions under employment law to OXORY's employees and shall not integrate them into its operational organisation like its own employees (e.g. duty or shift rosters, holiday planning, disciplinary management). The Customer shall direct project-related requirements and requests exclusively to the contact person or project manager designated by OXORY; technical coordination within the scope of the agreed service specification remains unaffected. If a party determines that the actual performance deviates from this, it shall inform the other party without undue delay; the parties shall then jointly ensure performance in accordance with the contract.

Insofar as services are performed on the Customer's premises, the Customer shall provide the necessary workplaces, access and work equipment free of charge and shall instruct OXORY's employees in the applicable safety regulations and house rules.

Performance and delivery dates are only binding if they have been expressly agreed as binding in text form. They are extended appropriately for as long as the Customer fails to provide its cooperation services, or fails to provide them on time or in full, or requests changes to the scope of services.

The Customer shall support OXORY in performing the contractual services. In particular, the Customer shall provide all necessary information, documents, data, test data and test environments in good time and free of charge, grant access to its IT infrastructure to the extent required (on site and/or remotely), set up the necessary authorisations and designate competent contact persons with decision-making authority.

The Customer shall inform OXORY of particularly sensitive or critical data, systems and processes, of special security requirements and of any risks known to it.

Unless OXORY has expressly undertaken to perform data backups, the Customer is responsible for regularly backing up its data and systems in accordance with the state of the art at intervals appropriate to the application, but at least before each intervention by OXORY, so that the data can be restored with reasonable effort.

The Customer shall take appropriate precautions in the event that software or systems do not function properly in whole or in part (e.g. fault diagnosis, regular review of results, contingency planning).

The cooperation services are material contractual obligations of the Customer. If the Customer fails to provide them, or fails to provide them on time or in full, it shall bear the resulting disadvantages, delays and additional costs; OXORY is entitled to invoice any additional effort at the applicable rates. Further rights of OXORY remain unaffected.

Where OXORY implements interfaces, integrations, automations or AI connections to systems of the Customer or third parties (e.g. to SAP systems), the Customer is responsible for holding the licences and usage rights of the respective manufacturer required for this. This includes in particular licences for indirect access to systems via third-party applications, interfaces or automated processes (e.g. SAP Digital Access or indirect use) as well as usage restrictions for programming interfaces. OXORY informs the Customer of licensing implications of the commissioned solution that are recognisable to OXORY; OXORY owes a licensing review only if separately commissioned. Claims of the manufacturer due to missing licences of the Customer are borne by the Customer unless they are based on a design of the solution by OXORY in breach of contract.

The Customer shall pay the contractually agreed remuneration. Unless otherwise agreed, OXORY's price lists valid at the time the contract is concluded apply.

All prices are in euros plus the applicable statutory value added tax.

Time-and-materials services are invoiced on the basis of the time actually spent according to the activity report in 15-minute increments. A consultant day comprises eight hours. Activity reports are prepared by OXORY and sent to the Customer in text form (e.g. by e-mail or via an online portal). If the Customer does not raise substantiated objections in text form within ten working days of receipt, the activity report shall be deemed accepted.

Unless otherwise agreed, travel time, travel costs and expenses are invoiced separately. Travel costs are calculated from OXORY's registered office or from the place of residence of the deployed employee, whichever distance is shorter. OXORY's rates valid at the time the contract is concluded apply.

Unless otherwise agreed, recurring fees (e.g. software maintenance, rental, subscription, support and helpdesk flat fees) are payable annually in advance at the beginning of each contract year. One-off fees for the provision of software are invoiced upon delivery, and time-and-materials services are invoiced monthly in arrears. For fixed-price projects, OXORY is entitled to request instalment payments in line with the progress of the work or an agreed payment schedule.

Invoices are due for payment without deduction within 14 calendar days of the invoice date. Invoices are issued electronically (e.g. as a PDF or in a structured electronic invoice format in accordance with statutory requirements). Where applicable, the Customer shall notify OXORY of a separate billing address for this purpose.

In the event of default in payment, the statutory provisions apply, in particular default interest of nine percentage points above the base interest rate and the lump-sum default fee pursuant to Section 288 (5) BGB. The right to claim further damages for default is reserved. If the Customer is more than 30 days in arrears with a payment, OXORY is entitled, after prior notice in text form, to withhold further services until the outstanding claims have been settled.

In the case of continuing obligations (e.g. software maintenance, rental, subscription, support and helpdesk flat fees as well as framework agreements with agreed hourly or daily rates), OXORY is entitled to adjust the agreed recurring remuneration or the agreed hourly and daily rates to cost changes that have actually occurred after conclusion of the contract, in accordance with Clauses 5.9 and 5.10. An adjustment is permissible no earlier than twelve months after the start of the contract and thereafter no more than once per contract year.

Only changes in the following cost types relevant to the respective service are taken into account: (a) personnel costs, (b) licence, subscription and maintenance costs of third-party manufacturers, (c) costs for cloud, hosting, data centre and telecommunications services of third parties, and (d) costs resulting from new or amended statutory charges or official requirements. The benchmark for changes in personnel costs is the change in the nominal wage index published by the German Federal Statistical Office (Statistisches Bundesamt) for economic section J “Information and Communication” (or any index replacing it) since the last price determination; the benchmark for the other cost types is the actual change in OXORY's purchase prices. Each cost type is only taken into account in proportion to its share in the calculation of the remuneration concerned. Cost increases in one cost type are only taken into account to the extent that they are not offset by cost reductions in other cost types. An adjustment may not lead to an increase in OXORY's profit margin. If the relevant costs decrease overall, OXORY is obliged to reduce the remuneration in accordance with the same principles.

OXORY shall notify an adjustment in text form at least three months before it takes effect, setting out in a comprehensible manner the cost types taken into account, the extent of their change and the calculation of the adjustment. If the increase exceeds 5% of the previous remuneration, the Customer is entitled to terminate the affected contract or part of the contract with one month's notice effective as of the date on which the increase takes effect; OXORY shall point out this right in the notification. OXORY passes on price changes by third-party manufacturers for third-party software distributed by OXORY (rental, subscription and maintenance) exclusively in accordance with Clause B.4.7.

The Customer may only set off counterclaims that are undisputed, have been legally established or are ready for decision. This does not apply to counterclaims of the Customer arising from defects or partial non-performance under the same contractual relationship.

The Customer may only assert a right of retention on the basis of counterclaims arising from the same contractual relationship.

OXORY is not obliged to perform insofar as performance is prevented by obstacles arising from national or international foreign trade regulations, embargoes or other sanctions. The Customer is responsible for compliance with the export and import regulations applicable to it, in particular in the event of a resale or export of software, and shall inform OXORY in advance in text form of any such intention.

Events of force majeure that make performance significantly more difficult or temporarily impossible for OXORY entitle OXORY to postpone performance for the duration of the impediment plus a reasonable start-up period. The following are equivalent to force majeure: natural disasters, pandemics and epidemics, war, terrorism, strikes and lockouts, official measures, large-scale failures of energy or telecommunications networks, cyberattacks despite appropriate protective measures, and supply failures of upstream suppliers and manufacturers for which OXORY is not responsible. If the impediment lasts longer than three months, both parties are entitled to withdraw from or terminate the contract with respect to the affected part of the services.

With respect to work results that OXORY creates individually and exclusively for the Customer within the framework of a contract (e.g. concepts, reports, configurations, custom software), OXORY grants the Customer, upon full payment of the remuneration attributable thereto, a non-exclusive, non-transferable right of use unlimited in time and territory for the Customer's own business purposes, unless otherwise agreed in the individual contract (e.g. an exclusive right of use). Until full payment, use is permitted on a revocable basis.

Work results do not include pre-existing methods, know-how, software libraries, frameworks, tools, templates, samples, scripts, procedures and other instruments, or those generally used by OXORY, including their further developments (hereinafter: “Tools”). All rights therein remain with OXORY. Insofar as Tools become part of the work results and the Customer necessarily requires them to use the work results, the Customer receives a simple, irrevocable right of use therein to the extent required for the contractual use of the work results.

When open-source components are used, their respective licence terms take precedence. Upon request, OXORY shall inform the Customer of the open-source components used and their licence terms.

OXORY is entitled to freely use the general know-how acquired in the course of performing the services, provided that it does not contain any confidential information of the Customer.

Claims for defects are governed by the statutory provisions unless otherwise provided in these GTC. There are no claims for defects with respect to services (consulting, support, helpdesk, training) that OXORY provides on the basis of a service contract (Dienstvertrag); liability is governed by Clause 11.

Insofar as Section 377 of the German Commercial Code (HGB) applies, the duties to inspect and give notice of defects stipulated therein apply; notices of defects must be given in text form. Otherwise, the Customer should notify OXORY of identified defects without undue delay in text form with a comprehensible description of the symptoms (e.g. error messages, steps to reproduce, affected system environment) in order to enable prompt remedy. The statutory consequences of a late notice of defects, in particular under Section 254 BGB, remain unaffected. For work performances (Werkleistungen), the acceptance provisions of Clauses B.2.4 and B.2.5 apply in addition.

In the event of defects, OXORY shall, at its own discretion, provide subsequent performance by remedying the defect, by delivering defect-free software or a new program version (update, patch), or by showing a reasonable way to avoid the effects of the defect (workaround), provided that functionality, runtime or response-time behaviour is not significantly impaired as a result.

If subsequent performance fails after a reasonable grace period, the Customer is entitled in accordance with the statutory provisions to reduce the remuneration or to withdraw from the contract or – in the case of continuing obligations – to terminate the contract for cause. The Customer may claim damages and reimbursement of futile expenses only in accordance with Clause 11.

Claims for defects do not exist insofar as the defect is due to the Customer or third parties having made changes to the software or the work results without OXORY's consent, the software having been used in a non-approved system environment or contrary to the documentation, or the defect being due to operating errors, unless the Customer proves that this was not the cause of the defect and does not make analysis and remedy significantly more difficult.

If OXORY performs services to locate or remedy errors without a defect existing, or if the defect is attributable to the Customer, OXORY may charge for the effort incurred at the applicable rates, provided that the Customer could have recognised this by exercising due care.

The Customer shall support OXORY in error analysis and the remedy of defects, provide logs, error messages, screenshots and other information upon request and grant access – including remote access – to the affected systems.

The limitation period for claims for defects is one year from delivery or – in the case of work performances – from acceptance. In the case of electronic provision of software, the period begins at the time the software is made available to the Customer for download. This reduction does not apply to claims under Clause 11.1 or in cases where the law mandatorily prescribes longer periods.

OXORY warrants that the contractual use of the services provided by OXORY within the Contract Territory does not infringe any intellectual property rights of third parties. The Contract Territory is the Federal Republic of Germany and any other country expressly agreed as a country of use in the individual contract, offer or service specification (e.g. Austria and Switzerland). OXORY assumes no responsibility under this Clause 10 for use outside the Contract Territory. If the Customer intends to use the services outside Germany, it shall notify OXORY before conclusion of the contract so that the countries concerned can be included in the Contract Territory. If a third party asserts against the Customer that the contractual use of the services infringes intellectual property rights, the Customer shall inform OXORY without undue delay, comprehensively and in text form.

At its own discretion and expense, OXORY shall defend against the claims – in coordination with the Customer in accordance with Clause 10.3 –, procure for the Customer the right to continue using the services, or modify or replace the services so that they no longer infringe intellectual property rights without significantly impairing the agreed functionality. If this is not possible with reasonable effort, both parties are entitled to the statutory rights of withdrawal or termination.

The Customer shall not acknowledge or settle third-party claims without prior coordination with OXORY. It shall give OXORY the opportunity to participate in the defence against the claims and – insofar as the Customer agrees – to conduct the defence itself at its own expense. The parties shall coordinate the further course of action, in particular the defence strategy, settlement negotiations and the engagement of lawyers. The Customer shall support OXORY to a reasonable extent and provide the necessary information and documents. If the Customer ceases to use the service for reasons of mitigating damage or for other important reasons, it shall inform the third party that such cessation does not constitute an acknowledgement of an infringement of intellectual property rights.

If the Customer has fulfilled its obligations under Clauses 10.1 and 10.3, OXORY shall indemnify the Customer against third-party claims and against the reasonable costs of legal defence, insofar as these are not based on circumstances for which the Customer is responsible (e.g. unauthorised modifications, use contrary to the contract, combination with components not supplied or approved by OXORY). Liability for damages is otherwise governed by Clause 11.

For software and services of third-party manufacturers, their rules on infringements of intellectual property rights take precedence; upon request, OXORY shall assign any claims of its own against the manufacturer to the Customer.

OXORY is liable without limitation in accordance with the statutory provisions

• in the event of intent and gross negligence, including that of OXORY's legal representatives and vicarious agents;
• for damage resulting from injury to life, body or health;
• for damage resulting from breach of a guarantee assumed by OXORY;
• in the event of fraudulent concealment of a defect;
• under the German Product Liability Act and in other cases of mandatory statutory liability.

In the event of simple (slight) negligence, OXORY is liable only for breach of a material contractual obligation, and then limited to the foreseeable damage typical for the contract at the time the contract was concluded. Material contractual obligations are those whose fulfilment makes the proper performance of the contract possible in the first place and on whose compliance the Customer regularly relies and may rely. Liability for simple negligence is limited to a maximum of EUR 100,000 per case of damage.

Otherwise, OXORY's liability for simple negligence is excluded.

Insofar as data backup is the Customer's responsibility under Clause 4.3, OXORY is liable for the loss of data – except in the cases of Clause 11.1 – only in the amount of the effort that would have been required to restore the data if the Customer had performed proper data backups in accordance with the state of the art. If OXORY has assumed data backup in whole or in part under the individual contract or service specification (e.g. as part of backup, hosting or operating services under Clause B.7.5), sentence 1 does not apply in this respect; OXORY is then liable for the loss of the data covered by the agreed data backup in accordance with Clauses 11.1 to 11.3. The Customer's contributory responsibility for data not covered by the agreed data backup remains unaffected.

The defence of contributory negligence remains unaffected.

The above limitations of liability apply to all contractual and non-contractual claims for damages, irrespective of their legal basis, as well as to claims for reimbursement of futile expenses. They also apply in favour of OXORY's corporate bodies, employees, subcontractors and other vicarious agents.

Claims of the Customer for damages and for reimbursement of futile expenses become time-barred within one year. For claims based on defects, the period begins at the time specified in Clause 9.8; otherwise, it begins with the statutory start of the limitation period (Section 199 BGB). This reduction does not apply in the cases of Clause 11.1, to claims for indemnification under Clause 10.4, or where the law mandatorily prescribes longer periods; in these cases the statutory limitation periods apply. In the case of recurring services (e.g. software maintenance, support, cloud and managed services), the period begins separately for each claim.

The parties undertake to treat as strictly confidential all confidential information of the other party that becomes known to them in connection with the contract – in particular trade and business secrets within the meaning of the German Trade Secrets Act (GeschGehG), source code, calculations, customer and project data –, to use it exclusively for the performance of the contract and not to make it accessible to third parties. In doing so, the parties shall apply at least the same care with which they protect their own comparable information.

Employees, subcontractors and other vicarious agents engaged for the performance of the contract who have previously been bound to confidentiality in a comparable manner, as well as advisers bound to professional secrecy (e.g. lawyers, tax advisers, auditors), are not considered third parties.

The confidentiality obligation does not apply to information that (a) is generally known or becomes generally known without breach of this obligation, (b) was demonstrably already known to the recipient at the time of disclosure, (c) was lawfully made available to the recipient by a third party without any confidentiality obligation, (d) was demonstrably developed independently by the recipient, or (e) must be disclosed due to statutory provisions or an official or court order; in the latter case, the recipient shall inform the other party in advance, insofar as legally permissible. The burden of proof for the existence of an exception lies with the recipient.

The confidentiality obligation continues for a period of five years after the end of the contract; for trade secrets, it applies for as long as they remain secret.

OXORY is entitled to name the Customer as a reference customer, stating its name and logo (e.g. on the website, in presentations and offers), provided that the Customer has given its prior consent in text form. The consent may be revoked at any time with effect for the future in text form; OXORY shall then remove the reference from its digital media within a reasonable period. The publication of project details, case studies or quotations always requires the separate prior consent of the Customer.

The parties shall comply with the applicable data protection provisions, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). They shall bind the persons involved in the processing of personal data to confidentiality.

Insofar as OXORY processes personal data on behalf of the Customer in the course of performing the services (e.g. in support, helpdesk, remote maintenance, software maintenance or operations) or access to such data cannot be ruled out, the parties shall conclude a data processing agreement pursuant to Art. 28 GDPR before processing begins. OXORY provides a template agreement for this purpose. Until such agreement has been concluded, OXORY is entitled to postpone services that require access to personal data.

The Customer shall ensure that it is entitled to transfer personal data to OXORY and that the processing by OXORY to the agreed extent is lawful.

The parties shall take appropriate technical and organisational measures to protect the information exchanged and system access. Access credentials provided to the other contracting party shall be treated confidentially and deleted or deactivated upon completion of the service.

The Customer is obliged to implement security updates and patches as well as security measures recommended by OXORY or the respective manufacturer for the systems and applications operated within its area of responsibility within a reasonable period; in the case of critical security vulnerabilities, this must be done without undue delay. If the Customer fails to do so despite notice from OXORY in text form, OXORY is not liable for damage resulting from the failure to implement the measure, unless OXORY caused the damage intentionally or through gross negligence or another case under Clause 11.1 applies. This does not apply insofar as OXORY has itself contractually undertaken to implement the measures concerned (e.g. as part of software maintenance, managed services or operating services under Clause B.4 or B.7).

At the Customer's request, OXORY supports the Customer in the technical and organisational implementation of regulatory requirements, for example under Directive (EU) 2022/2555 (NIS2) and the German BSI Act (BSIG) as amended to implement it, the GDPR or Regulation (EU) 2022/2554 (DORA). The type, scope and remuneration of such support result from the respective individual contract; unless otherwise agreed, it is provided as a service under Clause B.1. Responsibility for compliance with the statutory and regulatory requirements applicable to the Customer, in particular for determining whether it is in scope, for its risk management and its reporting obligations to authorities, remains with the Customer. OXORY does not provide legal advice; the legal assessment is the responsibility of the Customer or its legal advisers.

During the term of the respective contract and for a period of twelve months after its termination, the Customer undertakes not to actively solicit employees of OXORY who were deployed in the performance of the contract, i.e. not to approach them in a targeted manner – directly or via third parties (e.g. recruiters or other service providers) – in order to induce them to terminate their contractual relationship with OXORY and to work for the Customer. This applies accordingly to freelancers and subcontractors deployed by OXORY within the scope of the contract.

General job advertisements as well as applications and contacts made without prior targeted approach by the Customer do not constitute a breach. The freedom of occupation of the employees concerned remains unaffected; Section 75f HGB remains unaffected.

Delivered items (e.g. data carriers, hardware, documentation) remain the property of OXORY until full payment of all claims of OXORY under the respective contract. The granting of rights of use in software and work results is subject to the condition precedent of full payment of the remuneration attributable thereto (Clauses 8.1 and B.3.2).

In the event of default in payment, OXORY is entitled, after an unsuccessful deadline has been set, to withdraw from the contract and to demand the return of the reserved goods or the deletion of the software provided.

In the event of third-party access to the reserved goods (e.g. seizure), the Customer shall point out OXORY's ownership and notify OXORY without undue delay in text form.

The term of contracts results from the respective individual contract or the Special Provisions in Part B. Unless otherwise agreed, contracts for continuing obligations (e.g. software maintenance, rental, subscription, support and helpdesk contracts) have a minimum term of twelve months and are automatically extended by a further twelve months in each case unless terminated by either party with three months' notice to the end of the respective term.

The right of each party to terminate for cause remains unaffected. Cause exists for OXORY in particular if the Customer is in default with payment of a not insignificant part of the remuneration for more than two months, infringes intellectual property rights of OXORY or third parties, or uses the software in breach of contract despite a warning.

Notices of termination must be given in text form.

Upon termination of a contract, each party shall return to the other the documents and data received from it or delete them, unless statutory retention obligations or legitimate interests preclude this.

The Customer may only transfer rights and obligations under contracts with OXORY to third parties with OXORY's prior consent in text form. Section 354a HGB remains unaffected. OXORY is entitled to transfer rights and obligations to a company affiliated with it within the meaning of Sections 15 et seq. of the German Stock Corporation Act (AktG); OXORY shall notify the Customer of this in advance in text form.

Amendments and supplements to contracts as well as contract-related declarations by the Customer (e.g. notices of defects, setting of deadlines, declarations of withdrawal, reduction and termination) require at least text form (Section 126b BGB), in particular e-mail. Individual agreements always take precedence (Section 305b BGB).

Amendments to these GTC become effective for existing contracts only if the parties expressly agree to them, at least in text form. OXORY shall offer the Customer intended amendments for ongoing continuing obligations in text form at least six weeks before they are scheduled to take effect, identifying the amended provisions. Silence on the part of the Customer shall not be deemed consent. If the Customer does not consent, the previous GTC continue to apply unchanged. Price adjustments are governed exclusively by Clauses 5.8 to 5.10 and B.4.7; Clauses 17.4 and 17.5 do not apply to them.

If performance of a continuing obligation under the previous conditions becomes legally impossible or unreasonable for a party due to a mandatory statutory provision that came into force after conclusion of the contract or a change in supreme court case law after conclusion of the contract, that party shall inform the other party without undue delay in text form, stating the provision concerned. The parties shall endeavour to adapt the contract to take account of the changed legal situation. If no agreement is reached within four weeks of receipt of the notification, the affected party may terminate the contract or the part of the contract affected by the change in law with three months' notice to the end of a month.

If, after conclusion of the contract, a third-party manufacturer changes its distribution, licence or usage terms binding on OXORY for third-party software or a cloud or AI service specifically obtained by the Customer through OXORY (e.g. discontinuation of the distribution or partner programme, discontinuation of the agreed licence model, mandatory change to end-customer terms), and OXORY can therefore no longer provide the service concerned or can only provide it on significantly changed terms, OXORY shall inform the Customer without undue delay after becoming aware of it, in text form, stating the change, and shall offer an equivalent alternative where possible. If no agreement is reached within four weeks, both parties may terminate only the part of the contract relating to the affected third-party software or service, with three months' notice to the end of a month or, if the manufacturer's change takes effect earlier, as of the date on which it takes effect. The remaining services remain unaffected. OXORY's right under Clause B.4.6 (end of life) remains unaffected.

In the event of termination under Clause 17.4 or 17.5, fees paid in advance for the period after the termination takes effect shall be refunded pro rata. No further claims arise from such termination insofar as the terminating party is not responsible for the underlying change.

The law of the Federal Republic of Germany applies exclusively, to the exclusion of the UN Convention on Contracts for the International Sale of Goods (CISG) and the conflict-of-law rules of private international law.

Unless otherwise agreed, the place of performance for all services and payments is OXORY's registered office.

The exclusive place of jurisdiction for all disputes arising from or in connection with contracts based on these GTC is Cologne, Germany, provided that the Customer is a merchant, a legal entity under public law or a special fund under public law, or has no general place of jurisdiction in Germany. OXORY is also entitled to sue the Customer at its general place of jurisdiction.

Should individual provisions of these GTC or of the contract be or become invalid or unenforceable in whole or in part, the validity of the remaining provisions shall remain unaffected. The invalid or unenforceable provision shall be replaced by the statutory provisions (Section 306 (2) BGB).

Consulting and other services comprise in particular IT and management consulting, project support, project management, requirements analysis, conceptual design and accompanying and supporting advice on the introduction, integration and operation of the Customer's software and IT systems. The services may be provided on site at the Customer's premises or remotely. The scope of services and remuneration result from the respective offer, service specification and/or order confirmation.

Consulting and other services are provided as services within the meaning of Sections 611 et seq. BGB (service contract). OXORY owes the professional performance of the agreed activities, but not a specific economic or technical result, unless such a result has been expressly agreed as a work performance (see Clause B.2). Project responsibility and the decision on implementing recommendations remain with the Customer.

Orders are generally placed in the form of consultant days or hourly contingents. A consultant day comprises eight hours. Contingents not called off within the agreed service period expire unless otherwise agreed.

At the Customer's request, OXORY prepares effort estimates based on the information received from the Customer. They serve as guidance and are non-binding; the actual effort may be higher or lower. OXORY shall inform the Customer as soon as it becomes apparent that the estimate will be exceeded by more than 15%. The effort for preparing an estimate may be invoiced on a time-and-materials basis if this has been agreed in advance.

OXORY owes documentation of the services only if this has been expressly agreed. The Customer shall inform OXORY in advance of the desired documentation and its type and scope; its preparation is remunerated on a time-and-materials basis unless otherwise agreed.

Confirmed assignment dates may be postponed or cancelled by the Customer free of charge up to 14 calendar days before the date. In the event of later postponement or cancellation, OXORY charges 50%, and in the event of cancellation less than three working days before the date 100%, of the remuneration agreed for the date, unless OXORY is able to deploy the scheduled employees elsewhere. The Customer remains entitled to prove that OXORY has incurred no loss or a lower loss. Travel costs already incurred that cannot be cancelled shall be borne by the Customer.

The contractual relationship ends upon expiry of the period for which it was entered into or upon use of the agreed contingent. Unless otherwise agreed, service contracts of indefinite duration may be terminated by either party with one month's notice to the end of a month.

This covers the creation, adaptation (customising), implementation, integration and migration of software as well as other project services whose result OXORY expressly owes (work performances within the meaning of Sections 631 et seq. BGB). If a specific work result has not been expressly agreed, OXORY provides software development services as services under Clause B.1. This applies in particular to services under agile methods (e.g. Scrum) in which requirements are continuously prioritised by the Customer.

The work performance is based on a service description agreed between the parties (e.g. requirements specification, functional specification, specification). The Customer is responsible for the completeness and correctness of the functional requirements. If the preparation of the specification itself is the subject of the order, it is performed as a service unless otherwise agreed.

The Customer shall notify OXORY of change requests in text form. OXORY shall assess the impact on effort, deadlines and remuneration and submit a corresponding offer to the Customer. Until the change has been agreed, the service is continued on the basis of the existing agreement. The effort for assessing extensive change requests may be invoiced on a time-and-materials basis. Agreed deadlines are postponed appropriately by the duration of the assessment and implementation.

OXORY shall notify the Customer in text form of the completion of the work performance or of partial performances capable of acceptance. The Customer shall inspect the performance within 14 calendar days of receipt of the notice of completion (acceptance period) and declare acceptance in text form if the performance essentially corresponds to the agreed service description. The parties may agree on acceptance criteria, test cases and an acceptance procedure in the individual contract; the Customer shall provide the necessary test data and test environments for this purpose. Acceptance may not be refused on account of insignificant defects; these shall be remedied within the scope of liability for defects.

The performance is deemed accepted in accordance with Section 640 (2) BGB if OXORY has set the Customer a reasonable period for acceptance after completion – the acceptance period under Clause B.2.4 is deemed to be such a period – and the Customer has not refused acceptance within this period stating at least one defect. Self-contained partial performances may be accepted separately; partial acceptances remain unaffected by later acceptances.

OXORY owes source code only if this has been expressly agreed. Escrow of source code may be regulated in a separate agreement; the costs are borne by the Customer unless otherwise agreed.

The rights of use in the work results are governed by Clause 8.

This covers the provision of standard software that OXORY itself produces or distributes as a reseller or distributor of third-party manufacturers, either for an unlimited period (purchase) or for a limited period (rental, subscription), together with the associated user documentation in electronic form. The type, number and scope of the licences (e.g. named user, concurrent user, server, core, instance) result from the offer or order confirmation and the product-related licence metric. For software of which OXORY is the manufacturer, the EULA and the Product Terms pursuant to Clause 1.4 apply in addition.

In the case of purchase, the Customer receives, upon full payment of the remuneration, a non-exclusive, perpetual right to use the software to the agreed extent for its own business purposes. In the case of rental or subscription, the Customer receives a non-exclusive, non-transferable right of use limited to the term of the contract; upon expiry of the contract, the right of use lapses and the Customer shall delete the software including all copies and confirm the deletion in text form upon request. Use by companies affiliated with the Customer within the meaning of Sections 15 et seq. AktG requires a separate agreement.

Unless otherwise agreed, delivery is made by making the software available for download or by transmitting the licence keys or access credentials. The risk passes to the Customer upon provision. If product activation or registration is required, the Customer shall carry it out. Installation, configuration and instruction are only owed if they have been agreed separately.

The Customer may only reproduce the software insofar as this is necessary for its contractual use; this includes installation, loading into the working memory and the creation of the backup copies required for secure operation, which may be used exclusively for archiving purposes. Modification, decompilation or reverse engineering is only permitted within the scope of the mandatory provisions of Sections 69d and 69e of the German Copyright Act (UrhG). Copyright notices, serial numbers and other features serving identification may not be removed or altered. The removal of copy protection is only permitted insofar as it impairs trouble-free use; the Customer bears the burden of proof in this respect.

Use of the software for operation on behalf of third parties, in particular within the framework of data centre, outsourcing, hosting, application service providing or software-as-a-service models, as well as rental or other temporary provision to third parties require a separate agreement. A permanent transfer of purchased software to third parties is only permitted in its entirety and only if the Customer completely and finally ceases its own use, deletes all copies, notifies OXORY of the transfer in advance in text form, stating the acquirer, and the acquirer undertakes to comply with the terms of use. Overriding terms of third-party manufacturers remain unaffected.

If OXORY is not the manufacturer of the software, the scope and conditions of the right of use are primarily governed by the manufacturer's licence and usage terms (e.g. End User License Agreement – EULA, product terms) in the version valid at the time the contract is concluded. OXORY makes these terms available to the Customer before conclusion of the contract by naming them in the offer and either attaching them to the offer or identifying them with a specific reference (e.g. the manufacturer's web address) in such a way that the Customer can reasonably take note of them. OXORY shall separately point out in the offer any material usage restrictions that go beyond these GTC (e.g. licence metric, territorial restrictions, restrictions on group or third-party use, audit rights of the manufacturer, term and termination rules). The terms made available in this way also become part of the contract between OXORY and the Customer. If, upon delivery, installation or activation, the manufacturer presents terms that deviate materially to the Customer's detriment from the terms made available before conclusion of the contract, the Customer is entitled, within 14 calendar days of becoming aware of them, to withdraw from the contract or terminate it with respect to the affected third-party software, provided that it does not accept the deviating terms; remuneration already paid for the affected third-party software shall be refunded against deletion of the software. Changes to the manufacturer's terms during the term of the contract are governed by Clause 17.5. If OXORY supplies third-party products together with its own products as a unified solution, the components may, in case of doubt, only be used together.

The Customer shall protect the software, the documentation and licence keys and access credentials against unauthorised access by third parties by means of suitable measures and shall instruct its employees to comply with the terms of use and copyright law. When extracting data from third-party systems, the Customer alone is responsible for complying with their licence terms.

Upon request, but no more than once per calendar year, the Customer shall inform OXORY of the actual extent of use of the software (licence reconciliation). If overuse is found, the Customer is obliged to acquire the missing licences at the applicable list prices. The licence reconciliation takes place after prior notice in text form with a reasonable notice period and may not unreasonably impair the Customer's business operations. Further audit rights of third-party manufacturers under their licence terms remain unaffected.

For products with digital elements of which OXORY is the manufacturer and which OXORY places on the market in the EU, OXORY fulfils the obligations incumbent upon it as manufacturer under Regulation (EU) 2024/2847 (Cyber Resilience Act) in accordance with its temporal scope of application. In particular, during the support period specified in the Product Terms or the product documentation, OXORY provides security updates insofar as these are necessary to remedy vulnerabilities, and maintains a point of contact for reporting vulnerabilities. The Customer shall report vulnerabilities that come to its attention to OXORY without undue delay and install security updates provided in accordance with Clause 13.5. For software of third-party manufacturers, their rules apply.

Unless otherwise agreed, software maintenance for the software specified in the maintenance contract or offer comprises: (a) the provision of new releases, updates, patches and service releases, insofar as the manufacturer makes them generally available, and (b) the receipt and processing of error reports (support) for the current version and – for a transitional period of six months after the release of a new major release – the previous version. Whether, when and in what form new releases or updates are published is at the discretion of the manufacturer.

A prerequisite for maintenance services is that the Customer has lawfully acquired the software, uses it in a system environment supported by the manufacturer and that maintenance has been agreed for all licences of the respective software (no partial maintenance).

Software maintenance does not include, in particular: the installation of updates and releases, consulting, training and on-site service, customising and adaptations to changed hardware or software environments, user advice in the event of operating errors, and services in connection with changes made to the software by the Customer or third parties. OXORY provides such services upon separate order as services under Clause B.1 against remuneration on a time-and-materials basis.

The annual maintenance fee results from the offer or price list; for OXORY's own software, unless otherwise agreed, it is calculated as a percentage of the respective list price of the maintained licences. In the case of rental and subscription, maintenance is included in the fee and ends automatically upon expiry of the rental or subscription contract.

The maintenance contract has a minimum term of twelve months from the start of the contract and is extended by a further twelve months in each case unless terminated in text form with three months' notice to the end of the respective contract year. If additional licences are acquired, they are included pro rata in the existing maintenance contract (co-termination).

If the manufacturer discontinues maintenance for a product or version altogether (end of life), OXORY's maintenance obligation for the affected product ends at that time. OXORY shall inform the Customer of this as soon as OXORY becomes aware of it and shall endeavour to offer a suitable successor or replacement product. Maintenance fees already paid for the period after discontinuation shall be refunded pro rata.

Insofar as a third party is the manufacturer of the software, the scope and conditions of maintenance are additionally governed by its maintenance or support terms, and OXORY can only provide maintenance services for as long as the manufacturer is obliged to do so vis-à-vis OXORY. OXORY is entitled to pass on price increases by the manufacturer to the Customer to the extent that OXORY's purchase price actually increases; OXORY passes on price reductions by the manufacturer in the same way. Upon request, OXORY shall provide evidence of the manufacturer's price change. OXORY shall notify the Customer of a price increase in text form no later than three months before the end of the respective maintenance period; the increase then takes effect at the beginning of the following maintenance period. If the manufacturer announces the price increase at such short notice that OXORY cannot meet this deadline, OXORY shall notify the Customer of the increase in text form no later than ten working days after becoming aware of it; in this case, the increase takes effect no earlier than one month after receipt of the notification. If OXORY fails to meet the applicable notice period, the effective date of the increase is postponed accordingly. If the increase exceeds 5% compared with the previous year's maintenance fee, the Customer may terminate maintenance for the affected product with one month's notice effective as of the date on which the increase takes effect; OXORY shall point out this right in the notification. Different periods may be agreed in the offer for the respective software insofar as the manufacturer prescribes shorter periods.

If the Customer has terminated maintenance or maintenance has ended for other reasons, it may only be resumed later (reactivation) against back payment of the maintenance fees for the entire period without maintenance plus a reactivation fee amounting to 20% of this back payment, unless otherwise agreed or the manufacturer prescribes different terms. After maintenance has ended, there is no entitlement to maintenance services.

Support and helpdesk services (e.g. service desk, user and software helpdesk, 1st/2nd/3rd-level support, application management, remote maintenance) comprise the receipt, recording, classification and processing of incidents, errors, requests and service orders (hereinafter: “Tickets”) within the agreed scope of services. The details, in particular supported systems and applications, number of authorised contact persons, service hours, priorities and response and, where applicable, restoration times, result from the respective service specification or Service Level Agreement (SLA).

Support and helpdesk services are provided as services within the meaning of Sections 611 et seq. BGB. OXORY owes the professional processing of Tickets, but not the successful resolution of every incident within a specific time, unless a restoration or resolution time has been expressly agreed as binding.

Unless otherwise agreed, the following service hours apply: Monday to Friday from 08:00 to 17:00 (CET/CEST), excluding nationwide public holidays, public holidays in North Rhine-Westphalia and 24 and 31 December. Tickets received outside service hours are deemed to have been received at the beginning of the next service period. Services outside service hours (e.g. on-call service, 24/7 support) require a separate agreement and are remunerated with the agreed surcharges.

Tickets must be reported exclusively by the Customer's designated contact persons via the channels provided by OXORY (e.g. ticket system, service e-mail address, service hotline). The Customer shall describe incidents as precisely and reproducibly as possible and provide all information relevant for processing.

Unless otherwise provided in the SLA, Tickets are classified according to the following priorities:

• Priority 1 (critical): use of the system as a whole or of business-critical functions is impossible and no workaround exists;
• Priority 2 (high): essential functions are significantly restricted, but business operations can be continued – if necessary with a workaround;
• Priority 3 (normal): individual functions are impaired without significantly hindering business operations;
• Priority 4 (low): requests, notes, change requests and minor impairments.

OXORY makes the final classification at its reasonable discretion, taking into account the Customer's information. The response time is the period within service hours between receipt of a complete Ticket and the start of qualified processing by OXORY, which is communicated to the Customer. Response times are not resolution times.

Where necessary, the Customer shall provide OXORY with secure remote access to the affected systems with the necessary authorisations. If remote access is not possible and an on-site assignment therefore becomes necessary, it is invoiced separately on a time-and-materials basis plus travel costs.

Depending on the agreement, support and helpdesk services are remunerated as a monthly or annual flat fee, as a prepaid hourly contingent or on a time-and-materials basis. Contingents not used within the agreed billing period expire unless otherwise agreed. Services that go beyond the agreed scope of services or are due to causes within the Customer's area of responsibility (e.g. operating errors, unauthorised changes, unsupported environments) are invoiced on a time-and-materials basis at the applicable rates.

Insofar as an SLA provides for service credits or other legal consequences in the event of non-compliance with service levels, these are exhaustive to the extent permitted by law; Clause 11.1 remains unaffected.

Clause 16.1 applies to the term and termination unless otherwise agreed in the service specification.

This covers standard and individual training courses, workshops and trainings held at OXORY's premises or training rooms rented by OXORY, on site at the Customer's premises or as online training (live or as e-learning). The content, duration, maximum number of participants and remuneration result from the respective course description, the offer or the registration or booking confirmation.

Registrations are made in text form, in particular via a registration form or by e-mail. The contract is concluded upon OXORY's registration or booking confirmation. For standard training courses, registrations are considered in the order in which they are received.

Unless otherwise stated, training courses take place between 09:00 and 17:00. For training courses at OXORY's premises, training materials, refreshments and, where applicable, catering according to the course description are included in the training fee. For training courses at the Customer's premises, the Customer shall provide training rooms and technical equipment (e.g. presentation equipment, workstations, network and system access) unless otherwise agreed.

For online training, the Customer is responsible for ensuring that the technical requirements are met (e.g. internet connection, approval of the conferencing or remote tools used by the Customer's IT security policies). Access credentials are personalised and may not be passed on to third parties.

Training materials are protected by copyright. Participants receive a simple, non-transferable right to use the materials for their own purposes. Reproduction, disclosure to third parties, publication or use for their own training events is prohibited without OXORY's prior consent in text form. Video and audio recordings of training courses are only permitted with OXORY's consent.

Cancellations and rebookings by the Customer must be made in text form. The following applies to open and standard training courses: cancellation is free of charge up to 14 calendar days before the start of the course; in the event of cancellation between 13 and 7 calendar days before the start of the course, 50% of the training fee is charged, and in the event of later cancellation or no-show, 100%. A substitute participant may be named free of charge up to the start of the course.

The following applies to training courses on site at the Customer's premises as well as to individual and online training courses: postponement or cancellation is free of charge up to 14 calendar days before the date; in the event of later postponement or cancellation, 50% of the agreed remuneration is charged, and in the event of cancellation less than three working days before the date, 100%. Travel costs already incurred that cannot be cancelled shall be borne by the Customer.

In the cases of Clauses B.6.6 and B.6.7, the Customer remains entitled to prove that OXORY has incurred no loss or a significantly lower loss.

OXORY is entitled to cancel or postpone training courses if the minimum number of participants is not reached up to 7 calendar days before the start, or at short notice for an important reason for which OXORY is not responsible (e.g. sudden illness of the trainer, force majeure). In these cases, training fees already paid are refunded or – at the Customer's option – credited towards an alternative date. If OXORY cancels or postpones a training course less than 7 calendar days before the start for other reasons within its area of responsibility (e.g. planning or capacity reasons, or cancellation due to failure to reach the minimum number of participants after expiry of the aforementioned period), OXORY shall additionally reimburse the proven, reasonable and non-cancellable travel and accommodation costs of the registered participants, in total up to a maximum of the net training fee agreed for the affected course. Further claims exist only in accordance with Clause 11; Clause 11.1 remains unaffected.

Insofar as certification examinations are offered, the provisions of this Clause B.6 apply accordingly; content, duration and requirements result from the respective examination description.

Cloud and managed services comprise the provision, set-up, administration, monitoring and support of cloud services and IT systems of the Customer, in particular based on Microsoft 365 and Microsoft Azure, as well as the brokering or resale of third-party cloud subscriptions (e.g. under the Microsoft Cloud Solution Provider programme). The type and scope of services, supported systems, service hours and, where applicable, availability and restoration times result from the respective service specification or Service Level Agreement (SLA). Clauses B.4 and B.5 apply in addition.

Insofar as cloud services are operated by third parties (e.g. Microsoft), OXORY does not owe the operation of these services itself, but exclusively its own contractually agreed services (e.g. provision of subscriptions, set-up, configuration, administration and support). The functionality, availability, security and data processing of the manufacturer's services are primarily governed by the manufacturer's applicable terms (e.g. customer agreement, product terms, data protection addendum and service level agreements of the manufacturer), which OXORY makes available to the Customer before conclusion of the contract in accordance with Clause B.3.6 and which the Customer accepts when placing the order. OXORY passes on service credits from the manufacturer to the Customer insofar as OXORY receives them for the Customer's services.

The Customer acknowledges that manufacturers may change functions, licence models, prices, data centre locations and terms of their services or discontinue services (manufacturer dependency). OXORY shall inform the Customer of material changes that come to its attention and affect the agreed services and, upon request, shall support necessary adjustments against remuneration on a time-and-materials basis. OXORY is not liable for changes to or discontinuation of manufacturer services for which it is not responsible; Clause 11.1 remains unaffected. Clause B.4.7 applies accordingly to price changes.

For operating services provided by OXORY itself, the availability agreed in the service specification applies. If no availability has been agreed, OXORY does not owe any specific availability. Unless otherwise agreed, availability is measured over the calendar year (annual average). The following do not count as downtime: announced maintenance windows (announced at least five working days in advance, or as early as possible for urgent security updates), disruptions to manufacturer services, the internet or telecommunications networks outside OXORY's area of responsibility, disruptions within the Customer's area of responsibility (e.g. its own hardware and software, networks, operating errors) and cases of force majeure (Clause 7.2).

OXORY owes data backups only insofar as this has been expressly agreed in the service specification. In this case, the scope, interval, retention period and storage location of the backups as well as the restoration times result from the service specification; OXORY checks restorability by random sampling at reasonable intervals. Restorations at the Customer's request are remunerated on a time-and-materials basis unless agreed as a flat-rate service. Integrated functions of the manufacturer's services (e.g. recycle bin, version history, retention policies) do not constitute data backup within the meaning of this clause. If no data backup by OXORY has been agreed, the Customer remains responsible for data backup in accordance with Clause 4.3.

Insofar as technically possible and unless otherwise agreed, OXORY sets up cloud services in such a way that customer data is stored in data centres within the European Union or the European Economic Area. The Customer acknowledges that, under their terms, manufacturers may also process certain data (e.g. for support, security, telemetry or individual functions) outside the EU/EEA; such transfers take place only on the basis of Art. 44 et seq. GDPR, in particular an adequacy decision of the EU Commission (e.g. the EU-U.S. Data Privacy Framework for correspondingly certified providers) or EU Standard Contractual Clauses, and in accordance with the manufacturer's data protection terms. Upon request, OXORY shall inform the Customer of the data locations known to it. Clause 13 applies in addition.

The Customer is responsible for the content and data it stores or processes in the cloud services, for lawful and licence-compliant use by its users, for compliance with the manufacturers' usage policies and for the secure safekeeping of its access credentials. It shall use multi-factor authentication where available and inform OXORY without undue delay if there are indications of misuse or a security incident.

The term, termination and increase or reduction in the number of cloud subscriptions brokered or resold by OXORY are governed primarily by the manufacturer's terms, taking precedence over Clause 16.1. In particular, subscriptions with a fixed term (e.g. annual subscriptions) generally cannot be terminated or reduced in number during their term; increases are possible at any time. Consumption-based services (e.g. Microsoft Azure) are invoiced monthly according to actual usage on the basis of the prices applicable at the time; monitoring consumption is the Customer's responsibility. Upon request, OXORY sets up budget limits and cost alerts. For data processing services provided by OXORY itself, Clause B.7.11 applies in addition.

OXORY is entitled to temporarily suspend access to the cloud services in whole or in part if (a) the Customer is more than 30 days in arrears with payment for these services and the suspension has previously been announced in text form with a notice period of at least ten days, (b) there is a significant threat to the security or integrity of the systems of OXORY, the Customer or third parties, or (c) the manufacturer requires it. The suspension shall be limited to the extent necessary; OXORY's claim to remuneration remains in place insofar as the Customer is responsible for the suspension.

After the end of the contract, OXORY shall, upon request, make the Customer's data available to the Customer within 30 days in a common format, insofar as OXORY has access to it, or support the transfer of the subscriptions to the Customer or a service provider designated by it. Migration support services are remunerated on a time-and-materials basis. After this period has expired, OXORY is entitled to delete the data unless statutory retention obligations preclude this; the manufacturers' deletion periods remain unaffected. Insofar as Clause B.7.11 is applicable, it takes precedence over this Clause.

Insofar as OXORY itself provides data processing services within the meaning of Regulation (EU) 2023/2854 (Data Act) (e.g. its own hosting, operating or SaaS services) and the switching provisions of the Data Act are applicable according to their scope, the following applies in addition to a switch by the Customer to another provider or to its own IT infrastructure: (a) The Customer may request the switch with a notice period of no more than two months; to that extent, the contract ends upon successful completion of the switch, and Clause 16.1 does not apply in this respect. (b) The notice period is followed by a transitional period of 30 calendar days during which OXORY continues the service and reasonably supports the switch; if this is technically unfeasible, OXORY shall notify the Customer with reasons within 14 working days and set an alternative transitional period of no more than seven months. The Customer may extend the transitional period once. (c) OXORY makes the Customer's exportable data and digital assets available in a structured, commonly used and machine-readable format, informs the Customer in advance of procedures, formats and known limitations, and keeps the data available for retrieval for at least 30 calendar days after the end of the transitional period. (d) For the switch, OXORY charges at most the costs directly incurred by it until 11 January 2027 and no switching charges from 12 January 2027. Charges for early termination of fixed terms remain unaffected insofar as legally permissible. For third-party services that OXORY merely brokers or resells (Clause B.7.8), the switching rules of the respective provider apply.

This covers consulting, conceptual design, development, implementation, operation and support of solutions based on artificial intelligence (AI) and of automation solutions (e.g. assistants, chatbots and AI agents, AI-supported document and data processing, AI-supported monitoring of interfaces and processes, process automation), including the introduction and configuration of third-party AI services such as Microsoft Copilot or Azure OpenAI. The Special Provisions for the respective type of service apply in addition (in particular Clauses B.1, B.2, B.3, B.5 and B.7).

The Customer acknowledges that AI systems are based on statistical methods. Their outputs (e.g. texts, summaries, classifications, recommendations, code or images) may be incorrect, incomplete, outdated or inappropriate and may differ for identical inputs. OXORY owes the agreed functionality of the solution (e.g. integration, configuration, connection of data sources), but not the correctness, completeness or suitability for a particular purpose of individual AI outputs, unless specific quality criteria (e.g. hit rates based on agreed test data sets) have been expressly agreed as a quality characteristic.

The Customer is obliged to have AI outputs reviewed to an appropriate extent by competent persons before using them, in particular before making legal, financial, security-related or personnel-related decisions on their basis or publishing them. It shall ensure appropriate human oversight of the use of the AI solution. The Customer bears responsibility for decisions based on AI outputs, including the permissibility of automated individual decisions under Art. 22 GDPR. The Customer shall test automations that trigger actions in its systems with the Customer's authorisations before productive use and expressly approve them.

OXORY is not liable for damage resulting from the Customer using AI outputs without appropriate review contrary to Clause B.8.3 or using non-approved automations productively, unless OXORY caused the damage intentionally or through gross negligence or another case under Clause 11.1 applies. Otherwise, Clause 11 applies.

The Customer is responsible for ensuring that it is entitled to use the content entered or connected by it or its users (e.g. inputs/prompts, documents, databases) and that the processing of such content by the AI solution complies with applicable law, in particular data protection and copyright law. The Customer shall only process special categories of personal data (Art. 9 GDPR) and trade secrets of third parties insofar as this is permissible and agreed with OXORY.

OXORY does not use the Customer's data, inputs and outputs to train or improve AI models that OXORY uses for other customers or generally, unless the Customer has expressly consented to this in text form. If models are adapted with the Customer's data at the Customer's request (e.g. fine-tuning, building knowledge bases), these adaptations may only be used for the Customer. For third-party AI services, OXORY selects, where available, configurations under which inputs and outputs are not used to train the manufacturer's models according to the manufacturer's terms; the manufacturer's applicable terms are decisive in this respect.

Third-party AI services (e.g. Microsoft Copilot, Azure OpenAI) are primarily governed by the terms and usage policies of the respective manufacturer, including any content filters; Clauses B.7.2 and B.7.3 apply accordingly. Manufacturers may change or discontinue models and model versions, which may change the behaviour of the solution; OXORY provides any resulting adjustments upon request against remuneration on a time-and-materials basis, unless agreed within the scope of an operating or maintenance contract. The Customer acknowledges that assistant functions such as Microsoft 365 Copilot can generally access all content to which the respective user has access; the Customer is responsible for an appropriate authorisation and classification concept. OXORY supports its review and implementation (e.g. readiness check) upon separate order. For AI services of providers based outside the EU/EEA (e.g. in the USA), OXORY chooses, where available, processing in data centres within the EU/EEA (e.g. EU Data Boundary); transfers of personal data to third countries take place only in accordance with Clause B.7.6 (Art. 44 et seq. GDPR).

The Customer acknowledges that, under applicable law, no copyright may arise in purely AI-generated outputs and that AI outputs may contain content subject to third-party rights. OXORY gives no warranty as to the protectability of AI outputs or their freedom from third-party rights; Clause 10 does not apply to AI outputs unless they were created or edited by OXORY itself. Insofar as OXORY holds rights in AI outputs or in components of the solution created by OXORY (e.g. prompts, configurations, workflows), Clause 8 applies. Any indemnity commitments of manufacturers apply in accordance with their terms in the relationship between the manufacturer and the Customer. Before publication or commercial exploitation, the Customer shall check AI outputs for possible third-party rights and label them as AI-generated where required by law.

Unless otherwise provided in the individual contract, the following applies to the roles under Regulation (EU) 2024/1689 (AI Act): (a) OXORY is the provider of AI systems that OXORY develops and places on the market or puts into service under its own name or trademark (e.g. its own AI products and SaaS solutions) and fulfils the obligations incumbent upon it in this respect; (b) if OXORY develops an AI solution on behalf of the Customer which the Customer puts into service or makes available to third parties under its own name or trademark, the Customer is the provider; OXORY supports the Customer in fulfilling the provider obligations under a separate agreement; (c) the Customer is the deployer insofar as it uses AI systems under its own responsibility and is responsible for the deployer obligations, in particular for sufficient AI literacy of its employees (Art. 4 AI Act); (d) if the Customer makes substantial modifications to an AI system or changes its intended purpose, it may itself become the provider pursuant to Art. 25 AI Act. The obligations of the providers of third-party AI models and AI services (e.g. Microsoft, OpenAI) remain unaffected.

Insofar as AI systems are intended to interact directly with natural persons (e.g. chatbots, voice assistants), the respective provider designs them in such a way that the persons concerned are informed that they are interacting with an AI system, unless this is obvious to a reasonably well-informed person (Art. 50 AI Act). As deployer, the Customer ensures that this notice is not removed or concealed in its context of use (e.g. website, customer portal, internal applications) and fulfils the transparency obligations incumbent upon it, for example when publishing AI-generated or AI-manipulated content.

Use of OXORY solutions in areas that are or may be classified as high-risk AI systems within the meaning of Art. 6 AI Act (e.g. recruitment and personnel decisions, creditworthiness assessment, control of critical infrastructure) is only permitted after a prior separate agreement in text form which sets out the roles, the respective obligations (in particular risk management, documentation and human oversight) and the remuneration. Use for practices prohibited under Art. 5 AI Act is excluded. The Customer shall inform OXORY in advance of any intended use within the meaning of sentence 1; as long as no agreement pursuant to sentence 1 exists, OXORY is entitled to refuse the service concerned.