Terms and Conditions

1) Scope

1.1 These General Terms and Conditions ("GTC") of CIRO GmbH ("we") apply to all contracts for the provision of Software-as-a-Service ("SaaS") that you, as a consumer or entrepreneur ("Customer"), conclude with us regarding the services described on our website. The subject of the contract is the paid provision of software ("Software") in digital form via the internet for the duration of the contract, as well as the provision of storage space on our servers. We hereby object to the inclusion of your own terms and conditions, unless we have agreed otherwise with you.

1.2 You are a consumer within the meaning of these GTC if you enter into a legal transaction for purposes that are predominantly outside your trade, business, or profession.

1.3 You are an entrepreneur within the meaning of these GTC if, when entering into a legal transaction, you act in the exercise of your trade, business, or profession (as a natural or legal person or as a partnership with legal capacity).

1.4 Our software may contain links to third-party services. These GTC do not apply to such third-party services. This also applies if those services are free of charge and/or require registration with us. The third party's terms and applicable law govern the relationship between you and that third party. We merely provide technical access to such services.

2) Provider Services

2.1 We provide you with software in digital form via the internet for the duration of the agreed contract term. We grant you access to the software, which remains on our server. The functional scope and technical specifications are described in the service description on our website. We owe only the provision of the software with the functionalities defined in the service description. In particular, we do not owe the establishment or maintenance of the data connection between your IT system and our server.

2.2 We update our software at irregular intervals. You receive a usage right in the software in its current version. You have no claim to a particular version or state of the software.

2.3 We provide limited storage space on our servers. The amount is described in the service description on our website.

2.4 We provide the above services with overall availability of 99.5%.

Availability is calculated based on the contract period for the respective calendar month, less maintenance windows. Where possible, we will perform maintenance during low-usage hours.

2.5 We take state-of-the-art measures for data security. However, we have no custodial duty. You are responsible for adequate data backups.

2.6 We provide you with electronic operating instructions.

2.7 We offer additional support services. The content and scope are described on our website.

3) Service Modifications

3.1 We reserve the right to modify our services or offer alternative services, unless this is unreasonable for you.

3.2 We further reserve the right to modify our services or offer alternative services,

• where required by a change in law;
• to comply with a court judgment or official decision against us;
• where the change is necessary to close existing security gaps;
• where the change is solely beneficial to you; or
• where the change is purely technical or procedural without material impact on you.

3.3 Changes with only insignificant impact on our services do not constitute service modifications under this clause. This applies in particular to purely graphical changes and the mere rearrangement of functions.

4) Conclusion of Contract

4.1 The services described on our website are not binding offers. They serve as an invitation for you to make a binding offer.

4.2 You may submit your offer via the online order form on our website. By entering your personal data and clicking the order button, you submit a legally binding contractual offer for the selected services.

4.3 We may accept your offer within five days,

• by sending you a written or text-form order confirmation (fax or email), with receipt by you being decisive, or
• by requesting payment from you after submission of your order.

If multiple alternatives apply, the contract is concluded at the earliest occurrence. The acceptance period begins on the day after you submit the offer and ends at the close of the fifth day thereafter. If we do not accept within this period, your offer is deemed rejected and you are no longer bound.

4.4 If you select a payment method offered by PayPal, payment is processed via PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg ("PayPal") under PayPal's terms of use. If you pay via a PayPal-offered method during checkout, we already declare acceptance of your offer at the moment you click the order button.

4.5 When you submit an offer via our online order form, we store the contract text after conclusion and send it to you in text form (e.g., email). We do not provide further access beyond this. If you have created a user account before placing your order, your order data is archived in your password-protected account and can be retrieved free of charge.

4.6 Before binding submission of your order, you can identify input errors by carefully reading the information displayed on screen. You may use your browser's zoom function to enlarge the display. You may correct entries via standard keyboard and mouse functions until you click the order button.

4.7 The German language is available for the conclusion of the contract.

4.8 Order processing and contact usually take place by email and automated processing. You must ensure that the email address you provide is correct and that emails from us can be received (in particular, configure SPAM filters to allow our emails).

5) Right of Withdrawal

Consumers generally have a right of withdrawal. Further information is provided in our withdrawal policy.

6) Grant of Usage Rights by the Provider

We hold all usage rights necessary for providing the software. Unless otherwise stated in the service description, we grant you a non-exclusive, non-transferable right, limited to the term of the contract, to use the software for private and business purposes within the scope of these GTC. Any further use is not permitted.

7) Grant of Usage Rights by the Customer

We are entitled to use the content and information you provide as required to perform the service. You grant us, free of charge, on a non-exclusive basis and for the term of the contract, the necessary usage rights, in particular the right of permanent storage, reproduction, and modification, and you warrant that you are entitled to grant such rights.

8) Customer Obligations

8.1 You are responsible for ensuring that your hardware and software (including computers, routers, and data communication equipment) meet the technical minimum requirements for using our current software version.

8.2 You must protect your access credentials against access by third parties using state-of-the-art measures. You must ensure use only within the agreed scope. Unauthorized third-party access must be reported to us immediately.

8.3 You may not store data on the storage space provided by us whose use violates applicable law, official orders, third-party rights, or agreements with third parties.

8.4 Content stored on your storage space may be subject to data protection law. You are responsible for ensuring that your use of personal data complies with applicable data protection requirements.

8.5 You are responsible for performing regular and adequate data backups.

8.6 You must check your data and information for viruses or other harmful components before input and use state-of-the-art measures (e.g., anti-virus software).

8.7 You must ensure that programs, scripts, or similar items installed by you do not endanger the operation of our server, our communications network, or the security and integrity of other data on our servers.

8.8 If programs, scripts, or similar items installed by you endanger or impair the operation of our server, our network, or the security or integrity of other data on our servers, we may deactivate or uninstall them. If necessary to remedy the threat, we may also disconnect the affected content from the internet. We will inform you of such measures without undue delay.

9) Content Moderation and Restrictions

9.1 We are generally not obliged to proactively review the content you submit for legality, third-party rights, or compliance with these GTC. However, we reserve the right to review your content at our own initiative on a case-by-case basis and to take measures upon detection of violations.

9.2 You may report potentially unlawful content to us using the contact details in our imprint (e.g., by email). We may forward the content of your report to the person who posted the content. The reporter's identity is only disclosed if absolutely necessary.

9.3 In the event of reports and any reviews initiated by us, content review is generally performed by humans. Automated technical review procedures may be used additionally in individual cases.

9.4 If, following a report or upon our own review, content you have published is found to be unlawful, we may, at our reasonable discretion and without prior notice, take one or more of the following measures:

• warning to you as the publishing customer,
• temporary suspension or permanent deletion of the affected content,
• temporary or permanent suspension of contractual obligations,
• termination of the contractual relationship (ordinary or extraordinary for cause).

9.5 In choosing the measure, we will respect proportionality and weigh your interests as the affected customer against our interests in the unimpeded, undisturbed, and integrity-preserving conduct of our business. Criteria considered include:

• the meaning and significance of the specific content and its violation or risk potential,
• the frequency of unlawful content publication by you,
• the proportion of unlawful content to your other use of services,
• your apparent intentions in publishing such content,
• the existence and degree of fault on your part, where discernible.

9.6 If you frequently submit obviously unfounded reports or complaints, we may suspend processing of your reports and complaints for a reasonable period after prior warning.

10) Compensation and Payment Terms

10.1 Unless otherwise stated in our service description, the prices stated are total prices including statutory VAT.

10.2 Payment options and modalities are communicated on our website.

10.3 Compensation is billed at the agreed intervals and collected by direct debit (SEPA) from your bank account. You grant us a SEPA mandate that may be revoked at any time. If a direct debit is not honored due to insufficient funds or incorrect bank details, or if you wrongfully object to the debit, you must bear the chargeback fees of the credit institution where this is your responsibility.

10.4 If you select a payment method offered via Stripe, payment is processed by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland ("Stripe"). The individual payment methods offered via Stripe are communicated on our website. Stripe may use additional payment services with their own terms, of which you may be separately notified. Further information about Stripe is available at https://stripe.com.

11) Contract Term and Termination

11.1 Our contract is concluded for an indefinite term, but at least for the minimum term shown in the service description on our website. You may terminate the contract during the minimum term to the end of that minimum term, and after the minimum term has expired, at any time with a notice period of 14 days.

11.2 The right to extraordinary termination for good cause remains unaffected. Good cause exists if, considering all circumstances and weighing both parties' interests, continuation of the contract until the agreed termination date or until expiry of a notice period cannot reasonably be expected.

11.3 Terminations may be made in writing, in text form (e.g., by email), or electronically via the cancellation button provided on our website.

11.4 Upon termination, you lose access to your user account. Our obligation to store your data also ends upon termination.

12) Provider Switching

If you wish to switch to another provider or to ICT infrastructure on your own premises, the rules in the Annex on Provider Switching, attached to these GTC, apply.

13) Liability for Defects

If you are a consumer, statutory provisions on liability for defects apply.

If you are an entrepreneur, statutory provisions on liability for defects apply with the following limitations.

13.1 You must notify us of any defects, disruptions, or damage without undue delay.

13.2 We exclude warranty for only insignificant impairment of the suitability of the service.

13.3 Our strict liability under § 536a (1) BGB for defects existing at the time of contract conclusion is excluded.

13.4 Termination by you for non-provision of contractual use is permissible only after we have had sufficient opportunity to remedy the defect and have failed. Failure is assumed only if remedy is impossible, refused or unreasonably delayed by us, where there are reasonable doubts as to success, or where remedy is otherwise unreasonable for you.

14) Liability

14.1 We are liable to you on all contractual, quasi-contractual, and statutory (including tort) claims for damages and reimbursement of expenses as follows:

14.2 We are liable without limitation on any legal basis

• for intent or gross negligence,
• for intentional or negligent injury to life, body, or health,
• based on a guarantee, unless otherwise regulated,
• based on mandatory liability such as under the Product Liability Act.

14.3 Where we negligently breach a material contractual obligation, our liability is limited to foreseeable damage typical of the contract, unless we are liable without limitation under the preceding clause. Material contractual obligations are obligations the contract imposes on us in line with its purpose, whose fulfillment enables the proper performance of the contract and on whose observance you may regularly rely.

14.4 In all other respects, our liability is excluded.

14.5 The above liability rules also apply to our liability for our agents and legal representatives.

15) Indemnification

You indemnify us against all claims that other customers or third parties assert against us for infringement of their rights based on content you have posted or other use of the service. You bear the necessary legal defense costs, including statutory court and lawyer fees. This does not apply if you are not responsible for the infringement. You must promptly, truthfully, and completely provide us with all information necessary for review and defense in the event of a third-party claim.

16) Confidentiality

We undertake to maintain confidentiality regarding all confidential information obtained in connection with this contract and its performance, and not to disclose such information to third parties. Confidential information is information marked as confidential or whose confidentiality follows from the circumstances, regardless of whether communicated in written, electronic, embodied, or oral form. The confidentiality obligation does not apply where we are required by law or by a final administrative or court decision to disclose the information.

17) Amendment of GTC

17.1 We reserve the right to amend these GTC at any time, subject to your consent.

17.2 We further reserve the right to amend these GTC without your consent,

• where required by a change in law;
• to comply with a court judgment or official decision against us;
• where we introduce additional, entirely new services or service elements requiring description in the GTC, unless this adversely changes the existing usage relationship;
• where the change is solely beneficial to you; or
• where the change is purely technical or procedural, unless it has material impact on you.

17.3 We will inform you of material amendments to these GTC in good time and in suitable form. Material changes are those that would significantly shift the contractual relationship to your disadvantage or amount to the conclusion of an entirely new contract. These include rules on the type and scope of the service or contract term and termination modalities.

17.4 Your right of termination remains unaffected.

18) Applicable Law, Jurisdiction

18.1 The law of the Federal Republic of Germany applies to all legal relations between us. If you are a consumer, this choice of law applies only to the extent that the protection granted by mandatory provisions of the law of the state in which you have your habitual residence is not withdrawn from you.

18.2 If you are a merchant, legal entity under public law, or special public-law fund based in Germany, our place of business is the exclusive jurisdiction for all disputes arising from this contract. If you are based outside Germany, our place of business is the exclusive jurisdiction for disputes arising from this contract where the contract or claims are attributable to your professional or commercial activity. In the foregoing cases, we are nonetheless entitled to bring proceedings at your place of business.

19) Alternative Dispute Resolution

We are neither obliged nor willing to participate in dispute resolution proceedings before a consumer arbitration board.

1) Scope

The following provisions apply if you wish to switch to another provider or to ICT infrastructure on your own premises.

2) Definitions

2.1 "Data processing service" within these GTC means a digital service provided to you that enables on-demand and ubiquitous network access to a shared pool of configurable, scalable, and elastic computing resources of a centralised, distributed, or highly distributed nature, that can be rapidly provisioned and released with minimal management effort or interaction by us.

2.2 "Digital assets" within these GTC means elements in digital form — including applications — for which you have a usage right, regardless of the contractual relationship with the data processing service you wish to switch.

2.3 "On-premises ICT infrastructure" within these GTC means ICT infrastructure and computing resources owned, rented, or leased by you, located in your data center, and operated by you or a third party.

2.4 "Switch" within these GTC means a process involving us, you as the customer, and possibly a receiving provider of data processing services. You move from using our data processing service to using another data processing service of the same kind, another service offered by another provider, or on-premises ICT infrastructure, including by extracting, transforming, and uploading data.

2.5 "Exportable data" within these GTC means input and output data, including metadata, generated directly or indirectly through your use of the data processing service or jointly with us, excluding assets or data of ours or third parties protected by intellectual property rights or constituting a trade secret.

3) Pre-contractual Information

3.1 Before ordering the data processing services, we provide you with clear information on the following:

• our standard fees and any penalties for early termination;
• switching fees;
• services requiring a highly complex or costly switch, or where switching is not possible without significant impact on data, digital assets, or service architecture, where relevant;
• specific services for which switching and termination obligations do not apply, where applicable;
• a complete list of categories of data and digital assets that can be transferred, including at minimum all exportable data;
• a complete list of categories of data specific to the internal functioning of our service that are exempt from the data export obligation if their export would risk breaching our trade secrets;
• clear information on known risks to the continuity of providing our functions or services.

3.2 Our online register of data structures and formats, relevant standards, and open interoperability specifications for data is available on our website.

4) Switching and Exit Plan

4.1 We agree on a switching and exit plan (the "Plan") with you, which includes in particular:

• details on switching and exit assistance, including porting methods and formats, and the steps required for the switching process;
• the contacts designated by you and us to implement the Plan;
• an estimate of the time required to export and transfer your data and digital assets from the original provider's environment;
• limitations and technical restrictions, including those arising from data being stored outside the EU;
• a description of the sequence of operations we propose;
• a description of the testing methodology proposed by us, if testing is performed.

4.2 At your request, we must provide your designated personnel (or other authorized third parties) with information explaining the relevant procedures.

4.3 At your request, we undertake to either organise a test or support you with your tests to verify whether the Plan works in practice for exportable data and digital assets. Where issues arise during testing, we will jointly analyse causes in good faith and work toward solutions.

4.4 We and you undertake to update the Plan as required and, at minimum upon your request, to assess whether changes are necessary.

5) Initiation of the Switching Process

5.1 You must give us notice with a 2-month notice period indicating that you are initiating the switch. If you only wish to transfer specific services, data, or digital assets, you must specify this.

5.2 In the switching notice, you must inform us whether you intend to:

• switch to another provider of data processing services. In this case, you should provide the necessary details on the target provider;
• switch to your own on-premises ICT infrastructure; or
• not switch but only delete your exportable data and digital assets.

5.3 We will confirm receipt of the switching notice within 3 working days at the latest, using the same communication channel you used.

6) Transition Period

6.1 The transition period is 30 calendar days and begins upon expiry of the notice period for initiation of the switching process.

6.2 If we cannot meet the agreed transition period for technical reasons, we undertake to:

• notify you in writing or text form within 14 working days of receiving your termination notice;
• specify an alternative transition period not exceeding seven (7) months from the date of your termination notice; and
• provide a reasoned justification for the technical impossibility.

You must confirm receipt of this extension notice within 3 working days in writing or text form.

6.3 You may extend the transition period once by a period you consider reasonable for your purposes, but no longer than 3 months. For complex migrations, we may agree on a longer period by mutual consent, up to a maximum of 12 months. You must inform us in writing or text form of your intention by the end of the original transition period and specify the alternative transition period. We will confirm receipt of such extension notice within 3 working days in writing or text form.

7) Provider Obligations During the Switching Process

We undertake to reasonably support you and any third parties you authorize from the start and throughout the switching process so that you can switch within the agreed transition period. To this end, we must in particular:

• provide capabilities, adequate information (including documentation needed for the switch), and technical support. Where issues are identified, we and you will analyse causes in good faith and work toward solutions;
• exercise due care to maintain business continuity and continue to provide the contractual functions or services;
• maintain a high level of security throughout the switching process, in particular for the security of data during transmission.

8) Customer Obligations

8.1 You undertake to take all reasonable measures to achieve an effective switch. You are responsible for the import and implementation of data and digital assets into your own systems or those of the target provider.

8.2 You and any third parties you authorize, including the target provider, undertake to respect intellectual property rights and trade secrets in materials we provide during the switching process. You further undertake to grant access to such materials to third parties or the target provider, and where applicable to grant sublicenses for their use, only insofar as necessary for the switching process up to the end of the agreed transition period (including the alternative transition period), respecting confidentiality obligations and the intellectual property rights granted by us.

9) Data Recovery and Deletion

9.1 You may retrieve or delete your data within the agreed data retrieval period. The data retrieval period is 30 calendar days and begins upon expiry of the agreed transition period. We may jointly agree on a longer period if appropriate considering both parties' interests.

9.2 After expiry of the agreed retrieval period and upon successful completion of the switching process, we undertake to delete all exportable data and digital assets generated by you or directly related to you, and to confirm to you that we have done so. This does not apply to exportable data we are required to retain under mandatory EU or member-state law, provided we inform you which exportable data we retain, for how long, and on what grounds.

10) Switching Fees and Exit Charges

We do not charge any additional fees for the switching process.

11) Termination of the Switching Process

11.1 Once you notify us that the switching process has been successfully completed, we will promptly inform you of the termination of the contract. If you fail to notify us of successful or unsuccessful switching, but we have legitimate grounds to assume that you have successfully completed the switch, we may request your confirmation of successful completion. If you do not confirm within 30 working days of such request, we will assume the switch was unsuccessful, and the contract will not be terminated but will continue under existing conditions.

11.2 If you do not wish to switch but to delete your exportable data and digital assets, we undertake to inform you of the termination of the contract at the end of the agreed notice period.

12) Termination of the Contract

12.1 The contract is deemed terminated upon full occurrence of one of the following events:

• the successful completion of the switching process;
• expiry of the notice period if you do not wish to switch but to delete your exportable data and digital assets upon termination of the service.

12.2 If our contract or GTC contain clauses on termination based on statutory provisions or related cases, such as the following:

• a contracting party requests a payment moratorium or suspension of payments, or has been declared insolvent;
• a party still fails to timely meet a material or other contractual obligation that (contractually or by law) leads or may lead to termination;
• you become aware of a change of ownership or authority that contractually or by law leads or may lead to termination;
• the agreement is declared null and void due to a violation or change of applicable mandatory law;
• similar or identical situations or other situations that contractually or by law lead or may lead to termination,

the agreement and the agreed services and functions will not be terminated or expire before one of the events under the preceding clause has clearly occurred. This does not affect any other rights or remedies we or you may have against the other party.

You may agree with us on success criteria and milestones for the switch and report progress during the switching process. In any event, you must inform us of successful completion.

12.3 If the switching process cannot be successfully completed, we and you must cooperate in good faith to improve the process and achieve successful completion, enable timely data transfer, and maintain service continuity. At your request, we will help identify the reasons for unsuccessful switching and inform you how the identified obstacles can be removed or circumvented.

• You will, at your own discretion, engage the target provider on your behalf.
• Without prejudice to other remedies under applicable law, the agreement will not be terminated or expire before the successful completion of the switching process or before a corresponding decision by a competent court or a forum chosen and agreed by us and you.
• In case of conflicts or inconsistencies between these clauses and other agreements on termination between us and you, these clauses prevail.

12.4 The switching process is considered successfully completed when:

• the agreed notice period has expired,
• the transition period has begun upon expiry of the notice period,
• the data retrieval period has begun upon expiry of the transition period, and
• data deletion has been successfully completed upon expiry of the data retrieval period or upon expiry of an alternatively agreed period after successful completion of the switching process.

12.5 If at the end of the transition period you decide not to delete all your exportable data and digital assets at the end of the agreed retrieval period and wish to ensure their availability for a specific additional period with reduced functionality, or if you have agreed with us to maintain the contract without certain services, this may, unless you expressly direct otherwise, only occur after:

• the agreed notice period has expired,
• the transition period has expired, and
• an alternative period for data retrieval and other terms for the service with reduced functionality or maintenance of the contract have been agreed between you and us (in particular, permission for us to delete data after the alternative retrieval period and/or compensation for this additional period).

If the alternative retrieval period and other terms are proposed by us during this time, the contract may not be terminated or expire until you, at your discretion, accept deletion and unequivocally confirm that the contract is terminated.

12.6 Our mutual right to terminate an indefinite contract by ordinary termination remains unaffected, provided the reason for termination is not a provider switch or — on your side — an intention to delete data.

12.7 If the contract was expressly concluded for a definite term and the expiry date is reached before the switching process is completed, and you have not requested deletion of your exportable data and digital assets,

• the transition period begins on the expiry date of the contract and we provide reasonable support for the switch;
• the above rules on successful or unsuccessful completion of the switching process apply accordingly.