Terms and Conditions (AGB)

(1)These General Terms and Conditions (“Terms”) of Hashfox GmbH (“Hashfox”) apply to all contracts for services provided by Hashfox. These include in particular:

1. a)the provision and operation of hosting, server, cloud, GPU, e-mail and AI infrastructure;
2. b)managed services, support and maintenance;
3. c)the registration and administration of domains;
4. d)the development of custom software, interfaces and plugins, as well as e-commerce services;
5. e)the design, development and operation of AI solutions;
6. f)the delivery and installation of hardware;
7. g)online marketing services.

(2)Hashfox concludes contracts exclusively with entrepreneurs within the meaning of Section 14 BGB, with legal entities under public law and with special funds under public law (“Customer”). Hashfox does not conclude contracts with consumers within the meaning of Section 13 BGB. When placing an order, the Customer confirms that it is acting in the exercise of its commercial or independent professional activity. Upon request, it shall provide evidence of this, in particular by stating its company name, address, register number and VAT identification number. Hashfox may reject an order if there are doubts as to the Customer's status as an entrepreneur. If the Customer has provided incorrect information about its status as an entrepreneur, Hashfox may terminate the contract for good cause without notice.

(3)The version of these Terms referred to in the Offer or the order applies. The versions are available, with date and version number, at www.hashfox.com/agb. These Terms also apply to future contracts with the Customer. The version referred to in the Offer or the order confirmation of the future contract is authoritative; if there is no such reference, the version published at www.hashfox.com/agb at the time the future contract is concluded applies.

(4)The Customer's general terms and conditions do not form part of the contract. This also applies if Hashfox does not expressly object to them, if the Customer refers to them in an order, order confirmation or other documents, or if Hashfox performs services without reservation in the knowledge of such terms. An exception applies only if Hashfox expressly agrees to their application in text form.

(5)Parts A, C, D, J and K apply to all services. Parts B and E to I supplement Part A for the respective service areas. If a contract covers several types of service, the relevant Parts apply to each service.

In these Terms:

1. 1.“Individual Contract”: any contract for a service provided by Hashfox. If an Offer contains several services, each service shown separately in the Offer constitutes a separate Individual Contract, unless the Offer expressly provides otherwise.
2. 2.“Offer”: the offer accepted by the Customer, the order confirmation issued by Hashfox or the order placed via the customer portal, in each case including the Service Description.
3. 3.“Service Description”: the description of the service contained in the Offer or referred to in it, including a responsibility matrix.
4. 4.“Recurring Services”: services that Hashfox provides on an ongoing basis, in particular Infrastructure Services, managed services, operation, support, maintenance and care services, the operation of AI solutions and ongoing marketing support. Domain contracts are not Recurring Services.
5. 5.“Infrastructure Services”: the provision of web space, storage space, servers, virtual machines, GPU resources, data centre capacity, e-mail services and platforms for operating applications or AI systems, in each case including the network connection agreed for this purpose.
6. 6.“Project Services”: one-off services such as analysis, conception, design, development, customisation, set-up, migration, proof of concept, workshops and training.
7. 7.“Billing Period”: the period of one, three, six or twelve months agreed in the Offer for which fixed fees for a Recurring Service are charged.
8. 8.“Monthly Fee”: the fixed, non-usage-based remuneration agreed for one month under an Individual Contract for Recurring Services, including VAT. Where the Billing Period exceeds one month, it is the portion attributable to one month. If no fixed remuneration has been agreed for an Individual Contract, the Monthly Fee is deemed to be the average of the fees invoiced for the last three full calendar months, including VAT, or, in the case of a shorter term, the average of the calendar months invoiced to date.
9. 9.“Customer Data”: all data, content, programs, models and configurations that the Customer or a third party engaged by it stores on Hashfox systems or has processed there.
10. 10.“text form”: text form within the meaning of Section 126b BGB, in particular e-mail, a message via the customer portal or the Hashfox ticket system.
11. 11.“Working Days”: Monday to Friday, excluding statutory public holidays in North Rhine-Westphalia as well as 24 and 31 December.
12. 12.“Business Hours”: 9:00 to 17:00 (German time) on Working Days, unless the Service Description provides otherwise.
13. 13.“Data Act”: Regulation (EU) 2023/2854 (Data Act).
14. 14.“Upstream Suppliers”: data centre operators, providers of server, network and cloud capacity, registrars and registries, manufacturers and licensors, providers of AI models and other third parties whose services Hashfox procures in order to provide its services. Where these Terms name individual Upstream Suppliers separately, this is for clarification only.

(1)Offers made by Hashfox that have not yet been accepted are non-binding unless they are expressly designated as binding or contain an acceptance period. Content on the website, in presentations, brochures or product overviews does not constitute an offer.

(2)An Individual Contract is concluded in one of the following ways:

1. a)The Customer accepts an Offer from Hashfox in text form, by electronic signature or via the customer portal.
2. b)Hashfox confirms an order from the Customer in text form.
3. c)Following an order in text form, Hashfox begins performing the service or makes the service available.

(3)Legally relevant declarations and notifications require text form, unless a stricter form is prescribed by law. These are in particular notices of termination, notices of defects, refusals of acceptance, the setting of deadlines, change requests and objections. Acceptance by conclusive conduct and under Section 48(3) remains unaffected.

(4)Hashfox's performance dates and performance deadlines are binding only if they are expressly designated as binding in text form.

(5)The Customer shall designate a contact person to Hashfox and provide one current e-mail address each for contractual, invoicing, security and abuse notifications. It shall keep this information up to date and ensure that notifications reach it there. The Customer bears any disadvantages resulting from a failure to notify changes.

(6)The contract language is German.

(1)In the event of conflicts, the contractual components apply in the following order of precedence:

1. a)individual agreements and the Offer, including the Service Description;
2. b)an agreed service level agreement or an agreed support contract;
3. c)the Data Processing Agreement (Annex 1), which takes precedence over the components under letters b and d in matters concerning the processing of personal data;
4. d)these Terms;
5. e)the statutory provisions.

Third-party terms apply additionally in accordance with Section 28 and Section 41.

(2)The type, scope and characteristics of the services are determined exclusively by the components under paragraph 1 letters a and b. Hashfox owes the following services only if and to the extent that they are expressly agreed there:

1. a)data backups and restorations;
2. b)monitoring;
3. c)updates and security services;
4. d)a specific availability;
5. e)specific response or processing times;
6. f)specific locations;
7. g)the provision of source code;
8. h)documentation and training.

(3)General descriptions by Hashfox, in particular on the website, in presentations or in product overviews, describe the range of services. They become part of the contract only if the Offer or the Service Description refers to them. Individual agreements remain unaffected.

(4)Hashfox assumes guarantees in the legal sense only if a commitment is expressly designated as a “guarantee” and agreed in text form.

(5)Hashfox may discontinue at any time any free services that it provides without an agreement. There is no entitlement to their continuation.

(1)The Customer shall provide the cooperation required for the performance of the services in good time, in full and free of charge for Hashfox. This includes in particular:

1. a)the provision of information, content, test data and access;
2. b)functional decisions within a reasonable period;
3. c)the designation of a contact person with decision-making authority;
4. d)the provision of the system environment required for the service.

(2)The Customer shall keep access credentials, keys and certificates secret and protect them in accordance with the state of the art. If there is a suspicion that unauthorised persons have obtained knowledge of them, it shall change the access credentials without undue delay and inform Hashfox. The Customer is responsible for use of the services by third parties with its access credentials to the extent that it is answerable for such use.

(3)The Customer alone is responsible for the lawfulness of its content, data, websites, online shops, applications and advertising measures. This includes in particular:

1. a)legal notice (Impressum), privacy notices, consent management, terms and conditions and cancellation policies;
2. b)price information and product descriptions;
3. c)accessibility requirements;
4. d)the rights of third parties in materials provided by it.

Hashfox does not provide legal advice and does not review the Customer's content for lawfulness.

(4)If the Customer fails to provide cooperation, or fails to provide it in good time or properly, agreed deadlines are extended by the duration of the delay plus a reasonable start-up period. Hashfox may demand remuneration for the resulting additional effort at the agreed rates or, if nothing has been agreed, at the customary rates. Further rights of Hashfox, in particular under Sections 642 and 643 BGB, remain unaffected.

(5)The Customer grants Hashfox the rights in the content provided by it that are necessary for the performance of the services, in particular for storage, reproduction, editing and making available to the public. These rights are limited to the purpose of performing the services. They exist for the term of the contract and for the duration of the wind-down under Sections 31 and 32, of retention in data backups and of any preservation of evidence under Section 35(5).

(1)Hashfox may use subcontractors, freelancers and Upstream Suppliers to perform the services. Hashfox remains responsible to the Customer for the performance of the services in accordance with the contract. Hashfox is answerable, in accordance with Section 14, for any fault of third parties used to the extent that they are its vicarious agents within the meaning of Section 278 BGB. The use of Sub-processors is governed by Section 61 and Annex 1.

(2)If a location or location area is agreed in the Service Description, Hashfox provides Infrastructure Services there. Otherwise, Hashfox provides them in data centres in the European Union or the European Economic Area. Any processing outside this area is governed by Section 61.

(3)Hashfox provides services that can be performed remotely from locations of its choice. Hashfox owes on-site assignments only if they have been agreed. Travel time and travel expenses are remunerated as agreed; if nothing has been agreed, on a time and materials basis.

(1)The remuneration agreed in the Offer applies, plus statutory VAT.

(2)Hashfox charges usage-based fees and third-party costs in accordance with the Offer. These include in particular data traffic, additional storage, API and token costs of AI providers, and licence, registry and advertising costs. Unless the Offer provides otherwise, the Customer bears third-party costs incurred at its instigation in the amount evidenced.

(3)Fixed fees for Recurring Services are payable in advance for the respective Billing Period. They fall due at the start of the Billing Period, but no earlier than seven calendar days after receipt of the invoice. Hashfox invoices usage-based fees monthly in arrears.

(4)The following payment rules apply to Project Services:

1. a)The payment schedule agreed in the Offer applies.
2. b)If remuneration on a time and materials basis has been agreed, Hashfox invoices monthly on the basis of activity records. Time is recorded to the minute for each activity; for each Working Day, the total is rounded up to the next full quarter of an hour.
3. c)Hashfox may demand instalment payments for self-contained partial services; Section 632a BGB remains unaffected.
4. d)Budgets, estimates and effort forecasts are non-binding unless they are expressly designated as a fixed price. In the case of contracts for work, Section 649 BGB remains unaffected.
5. e)Invoices for Project Services are payable without deduction within 14 calendar days of receipt, unless the payment schedule provides otherwise.

(5)Other invoices are payable without deduction within 14 calendar days of receipt of the invoice.

(6)The method of payment is set out in the Offer. If a SEPA business-to-business direct debit has been agreed, the following applies:

1. a)The Customer grants a SEPA B2B direct debit mandate and confirms it to its bank before the first debit.
2. b)The Customer ensures sufficient funds on the due date.
3. c)The period for pre-notification of the direct debit is five calendar days.
4. d)If a direct debit is not honoured or is returned for a reason for which the Customer is responsible, the Customer shall reimburse the bank charges actually incurred by Hashfox as a result.

(7)The Customer consents to the transmission of invoices in electronic form, including electronic invoices in a structured format. The Customer shall raise any objections to an invoice in text form within eight weeks of receipt. If it fails to do so, the invoice is deemed approved; Hashfox shall draw attention to the period and this consequence in the invoice. Approval does not preclude later objections if the Customer proves that the invoice is incorrect and that it could not have recognised the incorrectness within the period even upon reasonable examination.

(8)Payment terms, cash discount deductions and review periods under the Customer's purchasing conditions do not apply.

(9)If an Individual Contract for Recurring Services ends before the end of a Billing Period for which the Customer has paid fixed fees in advance, Hashfox shall refund the portion of the fees attributable pro rata to the period after the end of the contract, after set-off against claims against the Customer that are due. This applies in particular to terminations under Section 9(4), Section 10(1) sentence 4 and (3), Section 11(4), Section 12(3), Section 28(4) and Section 61(2) to (4). By way of derogation, Section 30(3) and (4), Section 32(7) and Section 36(3) apply; for domains, Section 43(3) applies. Further claims of the Customer on account of the termination exist only if Hashfox is responsible for the termination.

(1)The Customer is in default without a reminder if it fails to pay on the due date under Section 7(3) or within the payment period under Section 7(4) or (5).

(2)In the event of default, the statutory provisions apply, in particular those on default interest (Section 288(2) BGB) and on the lump sum under Section 288(5) BGB. The right to claim further damage caused by default, in particular the costs of legal action, is reserved.

(3)If the Customer is in default with payments, the following applies:

1. a)Hashfox may withhold further services under the affected Individual Contract until the amounts due have been paid.
2. b)Hashfox may make the performance of other Individual Contracts that have not yet commenced, as well as the acceptance of new orders, conditional upon advance payment.

Letter a does not apply to Recurring Services, domains and rights of use in work results; in this respect, Section 29, Section 44 and Section 51(5) apply exclusively.

(4)If, after conclusion of the contract, circumstances become apparent which indicate that Hashfox's claim to payment is jeopardised by the Customer's lack of ability to perform, Hashfox has the rights under Section 321 BGB. Such circumstances are in particular direct debits that are not honoured, attachments or significant payment arrears under other contracts.

(1)The Customer may only set off claims that are undisputed, have been finally established by a court or are ready for decision. This does not apply to claims arising from the same Individual Contract or from Individual Contracts which, according to the Offer, are legally or economically connected, to the extent that they are in a reciprocal relationship with Hashfox's claim, in particular claims for reimbursement of the costs of remedying defects or of completion.

(2)The Customer may only assert a right of retention on the basis of counterclaims arising from the same Individual Contract or from Individual Contracts which, according to the Offer, are legally or economically connected. On account of defects, the Customer may only withhold a portion of the remuneration that is reasonable in relation to the defect. Section 24 applies to the reduction of remuneration for Infrastructure Services.

(3)The Customer may only transfer rights and claims under the contract to third parties with the prior consent of Hashfox in text form. Hashfox shall not unreasonably withhold consent. Section 354a HGB remains unaffected.

(4)Hashfox may assign claims against the Customer to third parties. Hashfox may also transfer Individual Contracts with the Customer to a company affiliated with Hashfox within the meaning of Sections 15 et seq. AktG that has its registered office in the European Union and assumes the obligations under the contract, including Annex 1 and Section 17(4). The transfer becomes effective if Hashfox has notified the Customer of it in text form, naming the transferee, at least four weeks in advance. The Customer may terminate the affected Individual Contract up to the date of the transfer with effect from that date. Remuneration paid in advance for the period thereafter is refunded; no further claims exist, and Section 30(3) and Section 32(7) do not apply. Hashfox shall draw attention to this in the notification.

(1)Change for the renewal period. Hashfox may change the fees for Recurring Services with effect from the start of a renewal period. Hashfox shall notify the Customer of the change in text form no later than two weeks before the last day on which the Customer can terminate the contract under Section 20(3) with effect from the end of the current term. In doing so, Hashfox shall specifically point out that the Customer may terminate and that, without termination, the contract will be renewed at the changed fees. If the notification is received later, the Customer may, notwithstanding Section 20(3), terminate the contract up to the start of the renewal period with effect from that start. If it is received only after the start of the renewal period, the change takes effect only from the start of the following renewal period.

(2)Passing on cost changes during the term. Hashfox may also adjust the fees during a term to the extent that, after conclusion of the contract, costs have changed that are directly incurred in providing the respective service and that Hashfox cannot influence. These are:

1. a)charges of Upstream Suppliers for data centre space, rented servers, cloud resources, network connectivity and IP addresses;
2. b)energy costs of data centre operation;
3. c)licence fees for third-party software;
4. d)charges of providers of AI models and application programming interfaces;
5. e)statutory levies.

The adjustment is limited to the amount by which these costs have changed in the portion attributable to the respective service; any increase in Hashfox's margin is excluded. If these costs decrease, Hashfox shall reduce the fees to the corresponding extent. Cost increases and cost decreases are offset against each other. Hashfox shall give notice of an adjustment in text form at least six weeks before it takes effect and, upon request, shall set out the underlying change in costs in an appropriate form.

(3)Special right of termination. If an increase under paragraph 2, alone or together with previous increases under paragraph 2 within the last twelve months, exceeds five percent of the fee applicable before the first of these increases, the Customer may terminate the affected Individual Contract. Termination must be declared in text form within four weeks of receipt of the notification, with effect from the date on which the increase takes effect. Hashfox shall draw attention to this right in the notification.

(4)Usage-based third-party costs. If it is agreed in the Offer that usage-based third-party costs are passed on at the respective purchase price plus a mark-up, paragraphs 1 to 3 do not apply to them.

(5)Section 43(4) applies to fees for domains.

(1)Hashfox may change the services in the following cases, provided that the agreed essential service features are retained at least to an equivalent standard and the change is reasonable for the Customer, taking into account the interests of Hashfox:

1. a)discontinuation of support for software versions, in particular of programming languages, databases, operating systems, control panels, frameworks and AI models, if the manufacturer or the developer community no longer provides security updates or discontinues the version, as well as migration to a supported version;
2. b)replacement or modernisation of hardware and virtualisation environments;
3. c)changes to IP addresses, host names and network configurations, unless fixed addresses have been expressly agreed;
4. d)relocation of service provision to another data centre within the agreed location area or, if none has been agreed, within the European Union or the European Economic Area;
5. e)use or change of subcontractors and Upstream Suppliers with at least an equivalent level of security and data protection;
6. f)changes to implement statutory, regulatory or judicial requirements or to eliminate security vulnerabilities.

(2)Hashfox shall announce changes in text form, namely changes under paragraph 1 letters a, b, c and e at least four weeks, and changes under letter d at least six weeks, before they are implemented. Hashfox may implement a change without observing these periods if it is necessary to avert an acute security threat, because of a short-notice discontinuation by manufacturers or Upstream Suppliers, or under paragraph 1 letter f. In these cases, Hashfox shall inform the Customer without undue delay. Information and objection rights under Annex 1 remain unaffected.

(3)Adapting applications, content and configurations for which the Customer is responsible to changed software versions or environments is the Customer's responsibility. If Hashfox supports the Customer in doing so, such support shall be remunerated separately unless it is included in the Service Description.

(4)If a change under paragraph 1 results in a more than insignificant impairment of the contractual use, the Customer may terminate the affected Individual Contract extraordinarily. Termination must be declared within four weeks of receipt of the announcement or of implementation of the change, with effect from the date on which the change takes effect. If Hashfox has complied with the requirements of paragraphs 1 and 2, the change does not constitute a breach of duty and does not give rise to any claims for reduction or damages; liability under Section 14(1) remains unaffected.

(5)Hashfox may make changes that operate exclusively in the Customer's favour or do not affect the agreed service features at any time without prior notice.

(1)Hashfox may amend these Terms and the Service Descriptions with effect for existing contracts to the extent that the amendment is necessary in order to

1. a)implement changes in the legal situation, in the case law of the highest courts or in regulatory requirements,
2. b)close gaps in the provisions that have arisen after conclusion of the contract,
3. c)reflect technical developments, changed security requirements or changes at Upstream Suppliers, or
4. d)govern new, additional services or service features,

and the amendment does not shift the contractual balance to the detriment of the Customer.

The following may not be amended under this Section: the type and scope of the agreed main services, individually agreed content of the Service Description, the fees, the term and the termination provisions, the liability provisions, the choice of law and place of jurisdiction, an agreed location of data processing, and Annex 1. The updating of Annexes 1a and 1b is governed by clause 12.2 of Annex 1. Sections 10, 11 and 20 or a separate agreement apply to these matters.

(2)Hashfox shall notify the Customer of the amendments in text form at least six weeks before they take effect, setting out the amended provisions alongside the previous ones. The amendments are deemed approved if the Customer does not object to them in text form by the stated effective date. In the notification, Hashfox shall specifically point out the right to object, the objection period and the significance of a failure to object.

(3)If the Customer objects, the previous terms continue to apply. In this case, Hashfox and the Customer may terminate an affected Individual Contract for Recurring Services with the notice period under Section 20(3) and a domain contract with the notice period under Section 43(1), at the earliest with effect from the intended effective date of the amendment. For Project Services, the previous terms continue to apply until the contract has been performed. Section 30(3) and Section 32(7) do not apply to such a termination.

(4)The possibility of agreeing amendments with the Customer's express consent remains unaffected.

(1)Force majeure is an external event that is not connected with business operations and could not be averted even by exercising the utmost care that can reasonably be expected. Examples include natural disasters, epidemics, war, terrorism, sabotage, sovereign measures including sanctions and embargoes, general disruptions of the energy supply or of public communications networks, and strikes and lockouts at third-party businesses.

(2)Hashfox is released from its obligation to perform for as long as and to the extent that it is prevented by force majeure or by other circumstances for which neither Hashfox nor its vicarious agents are responsible. Such circumstances also include cyberattacks that could not be averted despite appropriate protective measures. Agreed deadlines are extended by the duration of the obstacle plus a reasonable start-up period. This also applies if an Upstream Supplier is unable to perform because of such an event. Hashfox shall inform the Customer without undue delay.

(3)If an obstacle under paragraph 2 lasts longer than six weeks, either party may terminate the affected Individual Contract extraordinarily with regard to the affected services. For the period of release from performance, no remuneration is payable for the services not performed.

(4)The following applies to the delivery of hardware and the procurement of third-party licences: Hashfox is entitled to withdraw from the contract if its supplier fails to deliver to it, through no fault of Hashfox, despite a corresponding covering transaction having been concluded in good time. Hashfox shall inform the Customer without undue delay and refund any consideration already received.

(1)Hashfox has unlimited liability

1. a)in the event of intent and gross negligence,
2. b)for damage resulting from injury to life, body or health,
3. c)under the Product Liability Act (Produkthaftungsgesetz) and other mandatory provisions on liability for defective products,
4. d)to the extent of a guarantee expressly assumed by Hashfox, and
5. e)in the event of fraudulent concealment of a defect.

(2)In the event of a slightly negligent breach of material contractual obligations, Hashfox is liable only for the damage typical of the contract and foreseeable at the time the contract was concluded. Material contractual obligations are obligations whose fulfilment makes the proper performance of the contract possible in the first place and on whose fulfilment the Customer may regularly rely. These include in particular:

1. a)the provision of the agreed Infrastructure Services to the agreed extent;
2. b)the performance of expressly agreed data backups;
3. c)maintaining the confidentiality of Customer Data within Hashfox's area of responsibility;
4. d)the defect-free production of commissioned works.

(3)In the cases under paragraph 2, liability per event giving rise to damage is additionally limited to the higher of the following two amounts:

1. a)three times the net remuneration owed under the affected Individual Contract, namely, for Recurring Services, the fixed remuneration for the twelve months before the event giving rise to the damage or, where the term to date is shorter, the fixed monthly net remuneration extrapolated to twelve months, and, for Project Services, the agreed total remuneration;
2. b)EUR 50,000.

Several instances of damage based on the same cause are deemed to be one event giving rise to damage. For all events giving rise to damage in a calendar year arising from the same Individual Contract, liability is limited to twice the amount under sentence 1. Higher amounts may be agreed in the Offer. The limitation does not apply in the cases of paragraph 1.

(4)Otherwise, Hashfox's liability for slightly negligent breaches of duty is excluded.

(5)In the event of slight negligence, Hashfox is liable for the loss of or damage to data only in the amount of the effort that would have been required for restoration had the Customer backed up its data properly and in a manner appropriate to the risk. This does not apply to the extent that data backup is a service owed by Hashfox.

(6)Paragraphs 2 to 5 also apply to claims by the Customer for compensation or indemnification on account of third-party claims, including claims by data subjects under Art. 82 GDPR. Liability towards data subjects remains unaffected. Each party against which fines are imposed bears them itself. Reimbursement by Hashfox is possible only to the extent that it is legally permissible and the fine is based on an intentional breach of duty by Hashfox.

(7)Hashfox's no-fault liability for defects existing at the time the contract is concluded (Section 536a(1) first alternative BGB) is excluded.

(8)The limitations of liability in paragraphs 2 to 7 also apply, to the same extent, in favour of Hashfox's legal representatives, employees and vicarious agents. They do not apply in the cases under paragraph 1.

(9)These provisions do not alter the burden of proof to the detriment of the Customer.

(1)Claims by the Customer on account of material defects and defects of title in work services become time-barred twelve months after acceptance. Claims by the Customer on account of material defects and defects of title in deliveries become time-barred twelve months after delivery. For Recurring Services, paragraph 2 applies to claims by the Customer for damages and for reimbursement of futile expenses on account of a defect; the claim to remedy of a defect that exists during the term of the contract does not become time-barred before the end of the term of the contract.

(2)Other claims by the Customer for damages and for reimbursement of futile expenses become time-barred after twelve months. The period begins at the end of the year in which the claim arose and the Customer became aware, or should have become aware without gross negligence, of the circumstances giving rise to the claim.

(3)Paragraphs 1 and 2 do not apply to:

1. a)claims based on intent or fraudulent intent;
2. b)claims under a guarantee;
3. c)claims for damages for injury to life, body or health;
4. d)claims for damages for a grossly negligent breach of duty by Hashfox, its legal representatives or vicarious agents;
5. e)claims under the Product Liability Act;
6. f)the cases under Section 438(1) no. 2 and Section 634a(1) no. 2 BGB.

In these cases, the statutory periods apply.

(1)The Customer shall indemnify Hashfox, its legal representatives, employees and vicarious agents against third-party claims asserted against Hashfox on account of a breach, for which the Customer is responsible, of statutory provisions or of obligations under these Terms. Third parties in this sense also include authorities, Upstream Suppliers, registrars, registries and licensors. This covers in particular breaches of Section 5(3), Parts C, D and E, Section 55, Section 59 and the Customer's obligations as controller under data protection law. A breach by a third party to whom the Customer has made the services available is equivalent to a breach by the Customer; the Customer is responsible for such a breach if it could have prevented it by reasonable measures or stopped it without undue delay after becoming aware of it.

(2)The indemnification covers:

1. a)the necessary costs of legal defence;
2. b)the costs of official proceedings as well as of preservation of evidence and investigation;
3. c)charges, contractual penalties and other amounts that Hashfox actually owes to Upstream Suppliers, registrars, registries or licensors on account of the breach;
4. d)fines, to the extent that their reimbursement is legally permissible and they are based on an intentional or grossly negligent breach by the Customer.

(3)Hashfox shall inform the Customer of the claim without undue delay, to the extent legally permissible. Hashfox should not make any acknowledgement without prior consultation with the Customer to the extent that consultation is reasonable, in particular not in cases of urgency or of an official order. Hashfox shall enable the Customer, to the extent legally possible and reasonable for Hashfox, to conduct or support the defence at its own expense. The Customer shall support Hashfox with the information available to it.

(4)Further claims of Hashfox, in particular for damages, remain unaffected.

(1)The parties shall treat confidential information of the other party as confidential and use it only for the performance of the contract. Confidential information is all information that is designated as confidential or whose confidentiality is apparent from the circumstances, in particular trade secrets, access credentials and Customer Data. The obligation does not apply to information that

1. a)was already publicly known at the time of receipt or subsequently becomes known without breach of this obligation,
2. b)was already lawfully known to the receiving party,
3. c)was independently developed by the receiving party, or
4. d)must be disclosed on the basis of a statutory obligation or an official or court order; to the extent legally permissible, the disclosing party shall inform the other party in advance.

(2)The parties may make confidential information available to their employees, advisers, subcontractors and Upstream Suppliers to the extent that these need it for the performance of the contract and are bound to confidentiality. The confidentiality obligation continues after the end of the contract: for trade secrets, for as long as they remain trade secrets, and otherwise for three years.

(3)Hashfox may also use general knowledge, experience, methods and know-how gained in the course of providing the services for other customers, provided that no confidential information of the Customer is disclosed in doing so.

(4)Holders of professional secrets. If the Customer has notified Hashfox in text form under Section 60(5) that it is a holder of professional secrets within the meaning of Section 203(1) or (2) StGB, the following applies in addition:

1. a)Hashfox acts as a contributing person within the meaning of Section 203(3) sentence 2 StGB.
2. b)Hashfox undertakes to maintain secrecy regarding third-party secrets that become known to it in the course of or on the occasion of providing the services; this obligation continues after the end of the contract.
3. c)Hashfox obtains knowledge of third-party secrets only to the extent necessary for the performance of the contract.
4. d)The Customer hereby informs Hashfox that the unauthorised disclosure of such secrets is a criminal offence under Section 203(4) StGB; Hashfox takes note of this information.
5. e)Hashfox only involves employees and subcontractors who have been bound to secrecy in text form and informed of the criminal consequences, and confirms this in text form upon request.
6. f)Hashfox indicates in Annex 1b which Sub-processors provide services abroad. The Customer shall verify whether their use is permissible under the professional rules applicable to the Customer; it shall obtain any required consents from its clients, patients or principals.
7. g)This provision constitutes an agreement in text form within the meaning of Section 43e(3) BRAO, Section 62a(3) StBerG and comparable provisions.

(1)After completion or commissioning of a service, Hashfox may name the Customer as a reference in its own advertising materials and on its own website. The Customer's company name and logo as well as a general description of the project without confidential information may be named.

(2)The Customer may object to this use in text form at any time with effect for the future. Hashfox may use up materials that have already been printed. The reference is omitted from the outset if the Customer has notified Hashfox under Section 60(5) that it is a holder of professional secrets, or if confidentiality regarding the existence of the business relationship has been agreed.

(3)A reference to Hashfox on the Customer's websites or in its applications, such as a link “Implementation: Hashfox”, is only made with the Customer's consent. The Customer may remove such a reference at any time.

(1)This Part applies to Recurring Services. Part H applies additionally to the operation of AI solutions, and Part I applies additionally to ongoing marketing support. Domain contracts are not Recurring Services within the meaning of this Part; Part E and Parts A, C, D, J and K apply to them.

(2)Contracts for Recurring Services are independent of contracts for Project Services. This also applies where both are combined in one Offer, for example the creation of a website, an online shop or software and its hosting or operation. Termination, defects and performance disruptions under one Individual Contract shall not affect the other, unless the Offer expressly provides otherwise.

(3)The Customer is entitled to specific hardware, a specific virtualisation environment or a specific host only if this is agreed in the Service Description.

(1)Recurring Services are subject to the minimum term of one, three, six or twelve months agreed in the Offer. If no minimum term is agreed, it shall be one month.

(2)The minimum term and the first Billing Period begin upon provision of the service. If provision is delayed for reasons for which the Customer is responsible, they begin no later than 30 calendar days after conclusion of the contract. Provision means the transmission of the access credentials or the notification of operational readiness.

(3)The contract shall renew in each case for a period equal to the agreed minimum term unless either party terminates it in due time with effect from the end of the respective term. The notice period is:

1. a)14 calendar days for a term of one month,
2. b)one month for a term of three months,
3. c)two months for a term of six or twelve months.

(4)Notice of termination must be given in text form. It may be given in particular via the customer portal or by e-mail to the other party's contact address named in the contract. The Customer may terminate individual Individual Contracts without affecting other Individual Contracts.

(5)Ordinary termination takes effect at the end of the current minimum term or renewal period. The fees for this term remain owed even if the Customer no longer uses the services before it ends.

(6)Hashfox may notify the Customer of the upcoming renewal before the notice period expires. Failure to give such notice shall not affect the renewal.

(7)The right to extraordinary termination for good cause and the Customer's rights under Section 32 remain unaffected.

(1)Hashfox owes a specific level of availability only to the extent that it is specified in the Service Description or a service level agreement. In the absence of such a specification, Hashfox shall provide the services with customary care. Uninterrupted availability is not owed.

(2)If availability is agreed, the following applies unless otherwise provided therein: availability is determined for the agreed measurement period at the transfer point from the network operated or commissioned by Hashfox to the internet. Periods during which the service cannot be used for the following reasons shall not be taken into account:

1. a)maintenance work under paragraph 3;
2. b)circumstances beyond the sphere of influence of Hashfox and its vicarious agents, in particular force majeure under Section 13 and disruptions of networks not operated by Hashfox or on its behalf;
3. c)attacks on the infrastructure, to the extent that they exceed the protective measures agreed or to be expected according to the state of the art;
4. d)causes for which the Customer is responsible or which originate from its area of responsibility under Section 22, in particular software deployed by it, configurations, overloads or breaches of Part C;
5. e)justified measures under Sections 29, 35 and 40.

(3)Hashfox may carry out maintenance work. Hashfox shall announce plannable maintenance work in text form with reasonable advance notice. Where possible, such work shall be carried out within the maintenance windows specified in the Service Description or, if none are specified there, at times of low usage. Hashfox may carry out non-plannable maintenance work to avert a significant threat to the security or stability of the systems, in particular to close critical security vulnerabilities, without prior notice; in this case, Hashfox shall inform the Customer without undue delay.

(4)Liability for non-availability is governed by Sections 14 and 24. Paragraph 2 does not limit liability beyond Section 14.

(1)The Service Description specifies which operating model applies:

1. a)provision without operational services (unmanaged);
2. b)operation by the Customer with Hashfox on standby;
3. c)joint operation;
4. d)full operation by Hashfox.

The tasks Hashfox assumes are set out in the Service Description and the responsibility matrix attached to it. This concerns in particular updates, hardening, firewall configuration, monitoring, data backup and restoration.

(2)Tasks not expressly assigned to Hashfox are incumbent on the Customer. In the case of provision without operational services, the Customer is solely responsible for the installation, configuration, updating and securing of the operating system and applications, for the access credentials and for data backup. In this case, Hashfox is not obliged to monitor the Customer's systems.

(3)If the Customer retains administrative access in joint operation or full operation, it shall coordinate changes with Hashfox in advance. To the extent that the Customer or third parties commissioned by it exercise administrative rights, Hashfox's monitoring obligations and agreed service levels shall cease to apply for the affected systems and components. Hashfox is not responsible for disruptions, security incidents and additional work resulting from uncoordinated changes. The Customer shall pay for the additional work at the agreed rates or, if none are agreed, at the customary remuneration.

(4)If Hashfox provides updates or security notices whose implementation is incumbent on the Customer, the Customer shall implement them without undue delay or commission Hashfox to do so against remuneration.

(1)Hashfox owes data backups only if and to the extent that they are agreed in the Service Description. The Service Description specifies in particular the subject matter, frequency, retention period and storage location of the backup. Restoration from a backup owed by Hashfox takes place at the Customer's request. Unless otherwise agreed, it is subject to separate remuneration, unless the data loss is due to a cause for which Hashfox is responsible.

(2)To the extent that no data backup by Hashfox is agreed, it is incumbent on the Customer to back up its data itself to its own systems or systems of third parties and to verify that they can be restored. The Customer shall back up at intervals appropriate to the application, but at least before every change initiated by it and before announced maintenance work. Hashfox shall provide the Customer with the access or export options provided for in the Service Description for this purpose. If none are provided for, Hashfox shall, upon request in text form and within a reasonable period, provide free of charge once per calendar quarter a copy of the stored Customer Data in the format in which they are held at Hashfox; Hashfox shall produce further copies against remuneration on a time and materials basis.

(3)If Hashfox performs data backups, the Customer's obligation to additionally back up business-critical data itself remains unaffected, to the extent that this is possible and reasonable for the Customer under paragraph 2 sentences 3 and 4.

(4)Liability for data loss is governed by Section 14, in particular Section 14(5).

(1)The Customer shall report defects and disruptions without undue delay via the agreed channels in text form and describe them in a comprehensible manner.

(2)If a service level agreement provides for service credits where agreed values are not met, these shall be offset against the next invoice. The Customer may demand payment of service credits only at the end of the contract. Service credits shall be credited against any reduction of remuneration and against claims for damages arising from the same event.

(3)The Customer may not assert a reduction of remuneration by deducting it from the invoice amount, unless the claim to reduction of remuneration is undisputed or has been established with final and binding effect. The Customer's right to reclaim overpaid remuneration under the provisions on unjust enrichment remains unaffected.

(4)The Customer may terminate on account of failure to grant contractual use only after Hashfox has allowed a reasonable period for remedy set by the Customer in text form to expire, unless setting a period is dispensable under Section 543(3) sentence 2 BGB.

(5)Liability is governed by Section 14. No-fault liability for defects existing at the time of conclusion of the contract is excluded under Section 14(7).

(1)Hashfox owes support services, response times and standby services only to the extent that they are agreed in the Service Description or a support contract. The Customer shall direct requests to Hashfox via the channels named therein.

(2)An agreed response time means the period between receipt of a comprehensible report via an agreed channel and the start of processing by Hashfox, including feedback to the Customer. It is not a commitment to a solution within this period. Unless otherwise agreed, response times run only during Business Hours.

(3)The Customer shall pay for services outside the agreed scope of services on a time and materials basis. These also include services outside the agreed service hours and the remedying of disruptions whose cause lies within the Customer's area of responsibility.

(1)Hashfox shall take appropriate technical and organisational security measures for the systems within its area of responsibility under Section 22. Hashfox owes specific security services, evidence and certifications only to the extent that they are agreed in the Service Description or in Annex 1.

(2)If the Customer is subject to special statutory requirements regarding information security, it shall notify Hashfox of this before conclusion of the contract and name a contact point for security matters. This concerns in particular particularly important or important entities under the BSI Act (BSIG), operators of critical facilities and undertakings subject to Regulation (EU) 2022/2554 (DORA). Hashfox owes requirements on Hashfox arising therefrom only in accordance with a separate agreement and against the remuneration agreed therein. Such requirements are in particular notification and information deadlines, evidence, audits, inspection and information rights, and exit support.

(3)If Hashfox becomes aware of a security incident within its area of responsibility that significantly impairs the Customer's services or data, Hashfox shall inform the Customer without culpable delay, unless statutory or official requirements preclude this. The information may be provided in stages as soon as reliable findings are available, and shall be sent to the address for security notifications designated under Section 3(5). It does not constitute an acknowledgement of a breach of duty. Obligations under Annex 1 remain unaffected.

(4)The Customer shall inform Hashfox without undue delay of security incidents within its area of responsibility that may have an impact on Hashfox's infrastructure or on other customers, and shall cooperate in investigating and remedying them.

(5)Statutory obligations of Hashfox. Hashfox provides e-mail services as publicly available telecommunications services and is, to that extent, subject in particular to the Telecommunications Act (TKG), the Telecommunications Digital Services Data Protection Act (TDDDG) and the BSI Act (BSIG). Statutory obligations of Hashfox remain unaffected by these Terms, in particular obligations to report security incidents and personal data breaches to authorities, to inform users and to implement official orders. Their fulfilment does not constitute a breach of duty towards the Customer.

(6)Informing customers and users. If Hashfox is obliged by law or by official order to inform customers or users about security incidents, significant cyber threats or possible protective and remedial measures, Hashfox shall inform the Customer via the address under Section 3(5) or in the customer portal. To the extent that it is necessary to inform the users of e-mail mailboxes, Hashfox may also inform them directly, in particular by a message to the affected mailbox or upon login. The Customer shall forward communications addressed to users without undue delay and recommend that they implement the measures communicated.

(7)Cooperation in incidents. The Customer shall support Hashfox to a reasonable extent in investigating and managing security incidents that Hashfox is required by law to report, in particular by providing information without undue delay on affected accounts, systems, points in time and measures already taken. Upon request, Hashfox shall confirm to the Customer in text form its registration with the Federal Office for Information Security (BSI) and provide a summary description of its security measures. Further evidence, audits or information rights exist only under paragraph 2 sentence 3.

(1)Hashfox's e-mail services are publicly available number-independent interpersonal telecommunications services within the meaning of the TKG. Hashfox, its employees and the service providers involved in the provision of the services shall observe the secrecy of telecommunications under Section 3 TDDDG. Hashfox processes subscriber data and traffic data in accordance with the provisions of the TKG and the TDDDG; Annex 1 applies additionally to message contents and other mailbox data.

(2)To protect its systems and the users, Hashfox may use filters against unsolicited messages and malware in accordance with the respective state of the art. Hashfox may reject messages upon submission, so that the sender receives an error message, flag them or move them to a quarantine accessible to the Customer. Hashfox shall delete messages containing detected malware without notification only to the extent that the Customer has selected this in the configuration. Details and any setting options are set out in the Service Description. Hashfox does not owe the delivery of any particular messages. Measures under this paragraph are limited to what is necessary for the provision of the services and for the protection of the technical systems and the users.

(3)Hashfox may limit sending volume and storage space to the agreed level. If the Customer exceeds the agreed storage space, Hashfox may refuse to accept further messages; the sender then receives a non-delivery notification.

(4)Unless this is necessary for the provision or protection of the services, Hashfox shall access mailbox contents only on the Customer's instruction in text form. The Customer warrants that it is entitled to give this instruction vis-à-vis the users of the mailboxes and their communication partners. Hashfox may refuse to carry out the instruction if there are reasonable doubts as to the entitlement. The Customer shall indemnify Hashfox against claims of third parties based on an unauthorised instruction for whose lack of authorisation the Customer is responsible; Section 16(2) to (4) apply accordingly.

(5)Regulating the private use of the services by the Customer's employees is incumbent on the Customer.

(6)Subscriber data. Before e-mail services are activated, the Customer shall notify Hashfox completely and correctly of its name or company name and its address and, if it is a natural person, also of its date of birth; it shall notify changes without undue delay. Hashfox shall store this information together with the identifiers assigned and the date of commencement of the contract to the extent required by the TKG, even if it is not required for operational purposes, and shall delete it after expiry of the statutory periods. As long as the information is missing, Hashfox may refuse activation.

(7)Requests from authorities. Hashfox shall provide information to authorised bodies and implement orders for the interception of telecommunications, for the preservation or disclosure of data and comparable measures, to the extent that Hashfox is legally obliged to do so. Hashfox shall check requests for formal correctness. To the extent permitted by law, Hashfox shall inform the Customer; if Hashfox is subject to a statutory or ordered duty of confidentiality, no information shall be given. The fulfilment of such obligations does not constitute a breach of duty towards the Customer.

(8)Liability for e-mail services. The limitation of liability under Section 70 TKG applies to claims of the Customer for damages for financial loss or for payment of compensation arising from the provision of e-mail services. Section 14 applies to these claims in addition; where Section 14 and Section 70 TKG specify different maximum amounts, the lower amount applies. To the extent that Section 71(1) TKG does not permit a limitation under Section 14, statutory liability with the limitation under Section 70 TKG applies. Otherwise, in particular for damage to property and for damage arising from other services, Section 14 remains unaffected.

(1)If Hashfox arranges or procures services of third parties, the terms and conditions of these third parties named in the Offer or in the Service Description, as amended from time to time, shall additionally apply. Such services are in particular SSL/TLS certificates, software licences (for example for operating systems, databases, control panels or GPU software) and cloud services of manufacturers. Hashfox shall make these terms and conditions available on request. Part E applies to domains.

(2)If a third party requires the conclusion of a direct contract with the Customer or the Customer's consent to its terms and conditions, such consent is a prerequisite for the provision of the services. The Customer shall comply with the terms and conditions of the third parties. To the extent that they establish obligations of the Customer or provide for measures which the third party, or Hashfox as its contractual partner, is obliged to take, they take precedence over these Terms.

(3)With regard to services of third parties, Hashfox does not owe any characteristics beyond those set out in their terms and conditions. Hashfox is not liable for decisions of the third party, in particular the rejection, blocking or revocation of certificates or licences, unless Hashfox is responsible for that decision.

(4)If a third party changes its terms and conditions or services in such a way that Hashfox's contractual services change materially to the Customer's detriment, the Customer may terminate the affected Individual Contract with regard to the affected service by giving one month's notice.

(5)IP addresses that Hashfox assigns to the Customer remain with Hashfox or its Upstream Suppliers. The assignment applies only for the term of the respective Individual Contract and only as long as the conditions of the original assignment are met. After the end of the contract, Hashfox may assign the addresses to others. The Customer is entitled to a specific IP address or its transfer only if this is expressly agreed.

(6)If a third party demands measures because the Customer breaches its terms and conditions, Section 35(2) letter e and Section 16 apply accordingly.

(1)If the Customer is in default with payments amounting to at least one Monthly Fee, but at least 100 euros, Hashfox may suspend the services under the affected Individual Contract in whole or in part. Hashfox shall first give warning of the suspension in text form, setting a payment deadline of at least seven calendar days. The warning may be combined with a payment reminder.

(2)The suspension takes place in two stages:

1. a)First, Hashfox shall suspend administrative access while retaining read access, and shall discontinue changes, new orders, support services with the exception of the acceptance of fault reports, and other additional services. Hashfox shall continue agreed data backups; restorations take place after the suspension has been lifted.
2. b)If the arrears persist seven calendar days after the start of the suspension under letter a, Hashfox may also suspend the publicly accessible services.

If a partial suspension is technically not possible in an individual case, Hashfox may suspend completely immediately after expiry of the period under paragraph 1.

(3)Hashfox shall not suspend on account of amounts which the Customer has disputed in text form, stating comprehensible reasons, before expiry of the period under paragraph 1. Suspension on account of the remaining amounts remains permissible.

(4)The suspension serves exclusively to secure the payment claims. For the duration of the suspension, the following applies:

1. a)The Customer Data and the existing data backups are retained; Hashfox shall not modify or delete them on account of the suspension.
2. b)Publicly accessible services display a neutral notice page without reference to the payment default.
3. c)In the case of e-mail services, the suspension is limited to access to mailboxes and the sending of messages; Hashfox shall continue to accept incoming messages and store them within the agreed storage space.
4. d)In the case of systems located at the Customer's premises, the suspension is limited to the discontinuation of Hashfox's services. Hashfox shall not interfere with the operation of these systems.

(5)The Customer's obligation to pay the agreed remuneration continues during a justified suspension. Hashfox is not liable for disadvantages incurred by the Customer as a result of a justified suspension.

(6)After full settlement of the amounts due, Hashfox shall lift the suspension without undue delay, as a rule within one Working Day.

(7)Hashfox's rights under Sections 273 and 320 BGB and the right to extraordinary termination remain unaffected.

(1)The right of both parties to terminate for good cause remains unaffected.

(2)Good cause for Hashfox exists in particular if

1. a)the Customer is in default with the payment of an amount of at least two Monthly Fees, but at least EUR 200, and Hashfox has previously requested payment from it in text form with reference to the right of termination, whereby the request may be combined with the warning of suspension under Section 29(1), or
2. b)the Customer has been in default with the payment of an amount of at least one Monthly Fee, but at least EUR 100, for more than 30 calendar days and Hashfox has previously given warning of the termination in text form, setting a payment deadline of at least 14 calendar days.

Termination is excluded if the Customer settles the entire arrears before receipt of the notice of termination. Termination must be given in text form. Hashfox may limit it to individual Individual Contracts or extend it to all Individual Contracts for Recurring Services under which the Customer is in default. Further good causes arise in particular from Section 1(2), Section 36 and Section 40.

(3)Liquidated damages for Infrastructure Services. If Hashfox terminates an Individual Contract for Infrastructure Services for good cause for which the Customer is responsible, Hashfox may claim, as compensation for the damage resulting from the premature termination of the contract, a lump sum of 90 percent of the fixed net remuneration, unless the Service Description specifies a lower percentage for the affected service. The Service Description specifies a lower percentage to the extent that the service is based on resources that are allocated exclusively to the Customer and whose costs Hashfox can save if the contract ends early, before the end of the current term. If the lump sum is subject to value added tax, the Customer additionally owes the statutory value added tax. The relevant remuneration is that which would have accrued for the period from the termination taking effect until the end of the current minimum term or renewal period. In detail, the following applies:

1. a)Usage-based fees are disregarded.
2. b)Amounts already paid by the Customer for this period shall be credited; any excess amount shall be refunded after set-off against claims of Hashfox against the Customer that are due.
3. c)Fees for this period that are due but not yet paid are not owed in addition to the lump sum.
4. d)The Customer remains entitled to prove that Hashfox has suffered no damage or significantly less damage.
5. e)Hashfox reserves the right to prove greater damage; the lump sum shall be credited against any further claim for damages.

(4)Other Recurring Services. If Hashfox terminates an Individual Contract for other Recurring Services for good cause for which the Customer is responsible, the Customer owes compensation for the damage resulting from the premature termination of the contract in accordance with the statutory provisions. This damage comprises the remuneration agreed until the end of the current minimum term or renewal period, less saved expenses and earnings from other use.

(5)Remuneration for periods up to the termination taking effect remains unaffected.

(1)Hashfox shall not delete any Customer Data on account of a payment default or a suspension of services.

(2)After termination of an Individual Contract for Infrastructure Services, Hashfox shall make the exportable Customer Data stored at the end of the contract available to the Customer for retrieval for 30 calendar days (data retrieval period). This applies irrespective of the reason for termination. Hashfox chooses the form of provision: read-only access or a data package in the format in which the data are held at Hashfox. If the Customer has initiated a switch under Section 32, the transitional and retrieval periods specified there apply to the extent that they are longer. If the Customer requests early deletion in text form, Hashfox shall delete the Customer Data before expiry of the data retrieval period.

(3)Provision under paragraph 2 is not conditional on the settlement of outstanding claims. Hashfox shall provide further support services only on the basis of a separate agreement and, to the extent permitted by law, against separate remuneration, which Hashfox may demand in advance. Such services are in particular format conversions, migrations and the transfer to systems of third parties.

(4)After expiry of the data retrieval period, Hashfox shall delete all Customer Data including personal data, unless there is a statutory obligation to retain them or Hashfox has secured the data for the preservation of evidence under Section 35(5). Customer Data contained in backups shall be deleted upon expiry of the respective backup cycle, but no later than 90 calendar days after expiry of the data retrieval period. Hashfox shall confirm the deletion in text form upon request. There is no obligation to retain Customer Data beyond the data retrieval period; the Customer shall fulfil its own retention obligations itself.

(5)For services that are not Infrastructure Services, Hashfox shall, at the request of the Customer, which must be made by the end of the contract, hand over the Customer Data stored at Hashfox in a common format available at Hashfox. Otherwise, Hashfox shall delete them 30 calendar days after the end of the contract. Paragraph 3 sentence 2 and paragraph 4 sentences 2 to 4 apply accordingly, with the proviso that the expiry of the data retrieval period is replaced by the time of deletion under sentence 2. If the service is a data processing service within the meaning of Section 32(1), paragraphs 2 to 4 apply instead.

(6)Hashfox shall not hand over Customer Data whose handover is prohibited by law. This concerns in particular content whose possession or disclosure is a criminal offence, for example content under Section 33(1) letter a and Section 34(2) letters a and b, and data whose handover is precluded by foreign trade and payments regulations. In the case of such data, Hashfox may secure evidence under Section 35(5).

(7)In the event of conflicts, the provisions of Annex 1 take precedence.

(1)Scope. This Section applies only to services that are data processing services within the meaning of Article 2(8) of the Data Act, and only to the extent that Articles 23 to 31 of the Data Act are mandatorily applicable. For each service, Hashfox states in the Service Description whether, in Hashfox's assessment, it is a data processing service and whether the special rule of Article 31 of the Data Act applies. Services for which the majority of main features are tailored to the needs of the individual customer, or all of whose components have been developed for the individual customer, and which are not offered at broad commercial scale via Hashfox's service catalogue, are exempt under Article 31(1) of the Data Act from the obligations under Article 23, point (d), Article 29 and Article 30(1) and (3). The Customer is informed of this by these Terms and in the Service Description before conclusion of the contract. Test and evaluation versions which are provided for a limited period and not as a full version are not subject to this Section.

(2)Switching request and notice period. The Customer may at any time, including during a minimum term, request in text form to switch to another provider of data processing services or to an on-premises ICT infrastructure, or to have its exportable data and digital assets deleted (switching request). The notice period for initiating the switch is two months from receipt of the switching request. No later than upon expiry of this period, the Customer shall state whether it is switching to another provider (providing the necessary details of that provider), whether it is switching to its own infrastructure or whether it requests deletion.

(3)Transitional period. The notice period is followed by a transitional period of no more than 30 calendar days, during which Hashfox enables the switch without undue delay and makes the exportable data and digital assets available for transfer. During this period, the following applies:

1. a)Hashfox shall provide reasonable assistance to the Customer and to third parties authorised by the Customer in completing the switch.
2. b)Hashfox shall act with due care to maintain business continuity and shall continue to provide the contractual services.
3. c)Hashfox shall provide clear information about known risks to the continuity of service provision that are attributable to Hashfox.
4. d)Hashfox shall ensure a high level of security, in particular of the data during their transfer and during the retrieval period.
5. e)Hashfox shall support the Customer's exit strategy relevant to the contractual services by providing the relevant information for this purpose.

If the transitional period is technically unfeasible, Hashfox shall notify the Customer of this, stating reasons, within 14 Working Days of the switching request and shall indicate an alternative transitional period of no more than seven months. The Customer may extend the transitional period once by a period determined by the Customer. During the transitional period, including any extension, the contract continues and the agreed fees are payable until its end.

(4)Scope of transfer. The categories of data and digital assets exhaustively listed in the Service Description are transferable, but in any event all exportable data within the meaning of Article 2(38) of the Data Act. Hashfox shall provide them in the structured, commonly used and machine-readable formats specified there, and virtual machines as an image in a common format. The following are excluded from transfer:

1. a)the data categories exhaustively listed in the Service Description which are specific to the internal functioning of Hashfox's services and whose disclosure would endanger trade secrets of Hashfox, to the extent that their exclusion does not impede or delay the switch;
2. b)data and assets of Hashfox or of third parties which are protected by intellectual property rights or constitute trade secrets.

Hashfox is not obliged to rebuild services in the environment of the new provider, to develop new technologies or to compromise the security and integrity of its systems.

(5)End of contract, retrieval and deletion. The contract for the affected data processing service ends upon successful completion of the switch. If the Customer chooses deletion, the contract ends upon expiry of the notice period under paragraph 2; Hashfox shall then delete the exportable data and digital assets after expiry of a retrieval period of 30 calendar days or, at the Customer's request, immediately. Hashfox shall inform the Customer of the termination. After expiry of the transitional period, the Customer may retrieve its data during a data retrieval period of 30 calendar days. After expiry of the data retrieval period, Hashfox shall completely delete all exportable data and digital assets generated directly by the Customer or relating directly to the Customer, provided that the switch has been successfully completed. Statutory retention obligations remain unaffected.

(6)Switching charges and additional services. For switching services provided and invoiced before 12 January 2027, Hashfox may charge reduced switching charges which do not exceed the costs incurred by Hashfox that are directly linked to the switch; their amount is set out in the Service Description. From 12 January 2027, Hashfox shall not levy any switching charges for completing a switch. This does not apply to services to which Article 29 of the Data Act does not apply pursuant to Article 31(1) of the Data Act; the charges set out in the Service Description apply to such services. Hashfox shall provide services going beyond the statutory switching obligations only at the Customer's request and after prior agreement on the price. Such services are in particular migration, setup or configuration in the target environment, data conversion at the Customer's request and on-site assignments.

(7)Early termination fee. If a contract with an agreed minimum term ends under this Section before expiry of the current minimum term or renewal period, the Customer shall pay an early termination amount as an early termination fee within the meaning of Article 29(4) of the Data Act. It amounts to 90 percent of the fixed, non-usage-based net fees that would have accrued for the period from the end of the contract until the end of the current term, unless the Service Description specifies a lower percentage for the affected service; Section 30(3) sentence 2 applies accordingly. If the service is not an Infrastructure Service, the early termination amount is the stated net fees less saved expenses and earnings from other use. The Customer additionally owes the statutory value added tax. This applies irrespective of whether the Customer switches or chooses deletion. In detail, the following applies:

1. a)Fees paid in advance for this period shall be credited.
2. b)The Customer remains entitled to prove that, as a result of the early termination, Hashfox has saved greater expenses or has earned more through other use of the resources.
3. c)Hashfox remains entitled to prove that the saved expenses are lower.
4. d)Future renewal periods are disregarded.
5. e)The early termination amount is not a switching charge; the fees for the period until the end of the contract under paragraph 5 remain unaffected.

Hashfox draws attention to the early termination amount before conclusion of the contract in the Offer and in these Terms.

(8)Parallel use. If the Customer uses services of Hashfox in parallel with services of other providers, Hashfox may charge data egress charges up to the amount of the costs incurred as a result.

(9)Information. Hashfox provides information on its website, together with these Terms, at www.hashfox.com/agb on:

1. a)switching procedures, available methods and formats, and known restrictions;
2. b)the online register of data structures and data formats;
3. c)the jurisdiction to which the ICT infrastructure used is subject, and the measures to protect against unlawful governmental access;
4. d)switching charges and data egress charges.

(1)The Customer shall not use Hashfox's services unlawfully. Nor shall it use them in a manner that infringes the rights of third parties or endangers the security, integrity or availability of the infrastructure of Hashfox, its Upstream Suppliers, other customers or third parties. The following in particular are not permitted:

1. a)storing, disseminating or making available illegal content, in particular content that is criminal, harmful to minors, incites hatred, glorifies violence or infringes personality rights;
2. b)sending unsolicited bulk e-mail (spam) and operating websites that are advertised by means of spam;
3. c)disseminating or operating malware, phishing sites, botnets or their command and control servers;
4. d)overload attacks (DDoS) as well as unauthorised port scans, penetration tests and other attacks on third-party systems;
5. e)falsifying sender or IP addresses;
6. f)operating open mail relays, open proxies or Tor exit nodes;
7. g)mining crypto assets;
8. h)offering content that infringes copyright, in particular via file sharing;
9. i)circumventing security, access or usage restrictions;
10. j)use contrary to Part D (Export Control and Sanctions).

Letters f and g do not apply to the extent that the use is expressly permitted in the Service Description.

(2)If the use exceeds the agreed resources and thereby impairs other customers or the infrastructure, Hashfox may limit the resources to the agreed level.

(3)The Customer shall protect its systems, access credentials and applications against misuse by third parties within its area of responsibility under Section 22. Uses by third parties to whom the Customer makes the services available shall be attributed to the Customer as its own uses. The Customer shall oblige such third parties to comply with Part C and Part D.

(4)Hashfox is not obliged to monitor the content stored or transmitted by the Customer or to actively seek facts or circumstances indicating illegal activity.

(1)This Section applies in addition to Section 33 to the provision of GPU servers, GPU instances, compute clusters, model and inference platforms, and to AI assistants and AI agents of Hashfox (AI Infrastructure).

(2)The Customer shall not use the AI Infrastructure, either itself or through third parties, for

1. a)the generation, processing, storage or dissemination of depictions of the sexual abuse of children or adolescents, including in artificially generated or altered form;
2. b)the generation or alteration of realistic intimate or sexual depictions of an identifiable person without that person's express consent, and the generation of other content infringing personality rights, in particular deceptive deepfakes;
3. c)practices prohibited under Article 5 of Regulation (EU) 2024/1689 (AI Act) as amended from time to time;
4. d)the development, generation or dissemination of malware, exploits for attacking third-party systems, phishing content or botnet command and control, or for attacks on the systems of third parties;
5. e)spam, fraudulent campaigns, fake reviews or interactions, and unlawful influence on elections or on the formation of public opinion, or influence that is deceptive as to its origin;
6. f)supporting the development, production or use of chemical, biological, radiological or nuclear weapons or other weapons, or for military purposes, unless this has been expressly agreed and is permissible by law and under the applicable licence terms;
7. g)the infringement of copyrights, related rights, trade mark rights or other rights of third parties, including training with content in disregard of an effective reservation of use under Section 44b(3) UrhG;
8. h)the unauthorised extraction, replication or distillation of models, weights, system instructions or data of Hashfox, other customers or third parties;
9. i)the circumvention, deactivation or defeat of Hashfox's security, filtering, tenant separation or usage limitation mechanisms, including jailbreak and prompt injection attacks on Hashfox's services;
10. j)uses in breach of the licence or usage terms of the third-party software, models or application programming interfaces used, in particular in breach of usage restrictions, user thresholds, labelling obligations and territorial restrictions;
11. k)modifications of firmware, BIOS or BMC, exceeding approved performance, power or temperature limits, circumventing the isolation of virtualised or partitioned graphics processors, and side-channel attacks.

(3)The following are permitted only with Hashfox's prior consent in text form:

1. a)mining crypto assets and comparable compute workloads;
2. b)cracking passwords, hash values or encryption; consent requires proof of authorisation;
3. c)security research, penetration tests and the generation of attack tools for testing or research purposes;
4. d)providing computing capacity or access to third parties, whether for consideration or free of charge, including resale; the Customer shall impose the obligations under Part C and Part D on the third party and shall disclose that third party's identity to Hashfox on request;
5. e)operating publicly accessible inference or chat services for an indefinite number of users.

Hashfox decides on consent at its free discretion; Hashfox may revoke consent once granted for good cause.

(4)The Customer alone is responsible for the models, training and input data and outputs it uses or creates, and for decisions based on them. This also applies to the acquisition of and compliance with the necessary rights and licences, to the obligations incumbent on the Customer as a provider, deployer, importer or distributor under the AI Act, and to compliance with data protection law. Where Hashfox provides computing capacity on which the Customer operates its own or third-party models, Hashfox is not a provider, deployer or distributor of those AI systems or models. The Customer shall notify Hashfox in text form before commencement if it

1. a)intends to operate or develop a high-risk AI system on the AI Infrastructure or
2. b)intends to train or modify a general-purpose AI model that may meet the conditions for systemic risk.

(5)Software, drivers, containers, models and services of third parties provided by Hashfox (for example from graphics processor manufacturers or model providers) are additionally subject to their licence and usage terms, to which Hashfox refers in the Service Description. Hashfox may block, replace or discontinue the provision of such components if

1. a)the licensor terminates the licence or prohibits the use or
2. b)the Customer's use breaches those terms.

In the case of letter a, Hashfox shall, where reasonable, offer an equivalent alternative and shall refund on a pro rata basis any remuneration already paid for components that can no longer be used.

(6)Hashfox processes operating data and metadata as controller for operational security, capacity planning, billing, the detection and prevention of abuse and compliance with Foreign Trade Regulations. These are in particular:

1. a)utilisation, memory usage, power consumption and temperature of the graphics processors;
2. b)process and container identifiers recognisable at host level;
3. c)connection data of network traffic;
4. d)usage data of application programming interfaces;
5. e)access and origin data.

No general review of the Customer's content, models, inputs or outputs takes place. Hashfox takes note of content only

1. a)where there are specific indications of a breach and this is necessary for clarification,
2. b)where the Customer consents,
3. c)where there is a statutory obligation or an order by a public authority or court or
4. d)in the case of Hashfox's own AI services, for abuse filtering in accordance with the Service Description.

(1)Request for remedy. If Hashfox has specific indications of a breach of Part C, in particular on the basis of a notice under Section 37, Hashfox shall request the Customer in text form to cease the breach or to dispel the indications. The deadline shall be reasonable and correspondingly short in view of the seriousness of the breach, as a rule three Working Days. If the Customer does not cease the breach in time and does not dispel the indications, Hashfox may block or shut down the affected services in whole or in part.

(2)Immediate measures. Without prior request and without setting a deadline, Hashfox may block or shut down the affected services in whole or in part, halt compute jobs and instances, disconnect network connections, deactivate access credentials and keys, or block models and endpoints if

1. a)a breach of Section 33(1) or Section 34(2) is obvious or there are specific factual indications of a breach of Section 34(2) letters a to f;
2. b)on the basis of specific facts there is a well-founded suspicion that the Customer's systems pose a present danger to the infrastructure of Hashfox or its Upstream Suppliers, to other customers or to third parties, for example through attacks, overload, exceeding power or temperature limits, or the actual inclusion, or the inclusion that is imminent on the basis of specific facts, of Hashfox's IP addresses, network ranges or domains in widely used blocklists against spam or malware, for example following an advance warning from the list operator or a detected sending of unsolicited messages;
3. c)on the basis of specific facts there is a well-founded suspicion that the Customer's systems, accounts or access credentials have been compromised;
4. d)a use requiring consent under Section 34(3) takes place without consent;
5. e)an Upstream Supplier, data centre operator, licensor, registrar or registry of Hashfox demands measures because of an event attributable to the Customer; or
6. f)a public authority or court orders or demands the measure.

(3)Proportionality and information. Hashfox shall limit measures under paragraphs 1 and 2 to the extent necessary to eliminate the breach or the danger. Where possible, Hashfox shall limit itself to individual content, services, ports, IP addresses or systems. If Hashfox is technically able to block only entire systems or services, in particular in the case of services without operational services, it may block the affected system. No later than at the start of the measure, Hashfox shall inform the Customer in text form of:

1. a)the nature, scope, territorial reach and expected duration of the measure,
2. b)the underlying facts and circumstances, including whether the measure is based on a notice under Section 37(2) or on Hashfox's own findings,
3. c)whether automated means were used for detection or decision-making,
4. d)the contractual or statutory basis, with an explanation of why the content or the use is impermissible on that basis, and
5. e)the options for review under Section 37(5) and for recourse to the courts.

Such information shall not be provided to the extent that a statutory prohibition or an order by a public authority or court precludes it; Hashfox shall provide it subsequently as soon as the impediment has ceased to exist. Hashfox shall lift the measure as soon as the reason for it has ceased to exist and the Customer has, where necessary, demonstrated this.

(4)Well-founded suspicion. A measure under paragraph 2 letter a second alternative and letters b, c and e is justified even if the suspicion later proves to be unfounded, provided that Hashfox assessed the indications available at the time of the decision with due care. For the duration of such a measure, the Customer owes no remuneration for the blocked services unless the indications originate from its area of responsibility. In all other respects, Section 14 applies.

(5)Preservation of evidence and reporting. To the extent legally permissible, Hashfox may create and retain logs and snapshots of the affected systems for the preservation of evidence and transmit them to the competent authorities. Hashfox may report criminal offences and breaches of Foreign Trade Regulations to the competent authorities.

(1)Hashfox may terminate the affected Individual Contract or all Individual Contracts with the Customer for good cause without notice, in particular if the Customer

1. a)intentionally or with gross negligence breaches Section 33(1) or Section 34(2), in particular through criminal content or attacks on third-party systems,
2. b)breaches Section 34(2) letters a to c,
3. c)fails to cease a breach within the deadline set despite a request under Section 35(1) or
4. d)repeatedly breaches Part C.

In the cases of letters a and b, no prior warning is required.

(2)If the Customer is responsible for the cause of a justified measure under Section 35 or of a termination under paragraph 1, or if the cause is based on circumstances within its area of responsibility under Section 22, the Customer remains obliged to pay the agreed remuneration for the duration of the measure. Hashfox must credit any expenses saved.

(3)If the Customer is responsible for the cause, the following also applies:

1. a)The Customer shall remunerate Hashfox's necessary effort in investigating and remedying the breach and its consequences at the agreed rates and, if none have been agreed, at the customary remuneration. This includes in particular clean-up, restoration and removal from blocklists, but not the receipt and initial assessment of notices. The Customer remains entitled to prove that no effort or a lower effort was incurred.
2. b)In the event of a termination under paragraph 1, Section 30(3) to (5) applies accordingly.

(4)Hashfox is not liable for disadvantages incurred by the Customer as a result of a justified measure under Section 35 or a justified termination under paragraph 1. The Customer's obligation to indemnify is governed by Section 16.

(5)After a termination under paragraph 1, Hashfox shall give the Customer the opportunity to retrieve its data in accordance with Section 31, to the extent this is legally permissible and possible without danger to third parties. Section 31(6) remains unaffected.

(1)Points of contact. Hashfox's single point of contact under Articles 11 and 12 of Regulation (EU) 2022/2065 (Digital Services Act) for authorities of the Member States, the European Commission, the European Board for Digital Services, and for customers and other users is: abuse@hashfox.com. Communication is possible in German and English. Enquiries are not handled solely by automated means.

(2)Notice of illegal content. Any individual or entity may notify Hashfox electronically via the point of contact under paragraph 1 of content stored in Hashfox's services that it considers to be illegal. The notice should contain:

1. a)a sufficiently substantiated explanation of why the content is alleged to be illegal;
2. b)the exact electronic location, in particular the URL, and, where necessary, further information enabling identification;
3. c)the name and e-mail address of the notifying person, except for notices concerning offences referred to in Articles 3 to 7 of Directive 2011/93/EU;
4. d)a statement confirming the notifying person's bona fide belief that the information is accurate and complete.

Hashfox shall confirm receipt of a notice without undue delay, provided that electronic contact details have been given.

(3)Processing. Hashfox processes notices in a timely, diligent, non-arbitrary and objective manner. In doing so, Hashfox does not carry out a detailed legal examination. If the illegality is not obvious, Hashfox will as a rule give the Customer the opportunity to comment and will otherwise proceed in accordance with Section 35. Disputed legal questions between the notifying person and the Customer must be resolved by them, unless there is an obvious infringement or an order by a public authority or court is issued. Hashfox shall inform the notifying person of its decision and of the available means of redress. Hashfox uses automated tools, if at all, only to record and allocate notices; the decision is taken by a member of staff.

(4)Content moderation and restrictions. Hashfox does not generally monitor content and does not search customer systems without cause. Hashfox takes measures against content or uses on the following bases:

1. a)notices under paragraph 2;
2. b)orders or decisions of public authorities or courts;
3. c)demands of Upstream Suppliers, registrars or registries;
4. d)its own findings in the course of operations, for example through automated detection of attack patterns, malware, spam or resource abuse to protect the technical systems; in the case of e-mail services, Hashfox takes note of the content and the detailed circumstances of messages only in accordance with Section 27(2) and (4) and the secrecy of telecommunications.

Possible restrictions are the blocking or removal of individual content, the blocking of individual services, ports, IP addresses, domains or systems, the limitation of resources, temporary suspension, as well as suspension under Sections 35 and 40 and termination under Sections 36, 40 and 45. In the case of services without operational services, Hashfox has no access to individual content and can as a rule only block entire systems or IP addresses. Decisions on restrictions are taken by a member of Hashfox's staff. Automated measures for the immediate prevention of danger are reviewed by a member of staff without undue delay. Hashfox applies these rules diligently, objectively and proportionately, taking into account the legitimate interests and fundamental rights of all parties involved.

(5)Statement of reasons and review. If Hashfox restricts the Customer's services or content, the Customer receives a statement of reasons in accordance with Section 35(3). Via the point of contact under paragraph 1, the Customer may request a review of the decision; Hashfox shall then re-examine the decision, taking into account the Customer's submissions. Recourse to the state courts remains unaffected.

(6)Criminal offences. If Hashfox becomes aware of information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of persons has taken place, is taking place or is likely to take place, Hashfox shall inform the competent law enforcement or judicial authorities in accordance with Article 18 of Regulation (EU) 2022/2065.

(7)Contacts for authorities and security matters. Authorised bodies shall address requests for information and orders of law enforcement, security and supervisory authorities to behoerden@hashfox.com. Hashfox receives security-relevant notices, in particular regarding vulnerabilities and security incidents, at security@hashfox.com. These points of contact do not serve for notices of illegal content under paragraph 2.

(1)"Foreign Trade Regulations" within the meaning of these Terms are the applicable provisions of foreign trade, export control and sanctions law

1. a)of the European Union, in particular Regulation (EU) 2021/821, Regulation (EU) No 833/2014, Regulation (EC) No 765/2006 and the regulations concerning restrictive measures against persons and entities,
2. b)of the Federal Republic of Germany, in particular the Foreign Trade and Payments Act (AWG) and the Foreign Trade and Payments Ordinance (AWV),
3. c)of the United Nations, to the extent they apply in the European Union, and
4. d)of the United States of America on export control, in particular the Export Administration Regulations, to the extent they are applicable to the services, the goods used or the parties.

Other foreign provisions need only be observed to the extent that their observance is permissible under the law applicable to Hashfox, in particular under Regulation (EC) No 2271/96.

(2)"Embargoed Countries" are Russia, Belarus, Iran and North Korea, Crimea, the city of Sevastopol and the areas of the Donetsk, Luhansk, Kherson and Zaporizhzhia oblasts not controlled by the government of Ukraine. Embargoed Countries also include all countries and territories for which a legal act of the European Union prohibits the provision of services of the kind that are the subject of the contract to persons resident or established there, as well as the countries and territories that the Service Description, at the time the contract is concluded, designates as Embargoed Countries for Hashfox's business reasons.

(3)Hashfox is not obliged to perform to the extent that and for as long as Foreign Trade Regulations preclude performance, in particular if performance is prohibited or a required licence has not been granted. Agreed deadlines are extended by the duration of the impediment. Hashfox is only required to apply for licences if this has been expressly agreed; the Customer shall cooperate in licensing procedures. If a licence is refused or not granted within a reasonable time, or if the impediment is not merely temporary, either party may terminate the affected Individual Contract or withdraw from an affected purchase contract. The Customer has no claims on account of the impediment to the extent that Hashfox is not responsible for it.

(1)The Customer represents, and shall ensure for the entire contract term, that

1. a)neither the Customer itself nor its legal representatives nor any person directly or indirectly controlling it is listed on a list of sanctioned or restricted persons maintained under the Foreign Trade Regulations within the meaning of Section 38(1) sentence 1 (sanctions list), in particular in the annexes to the regulations of the European Union referred to there and in the Entity List of the Export Administration Regulations; Section 38(1) sentence 2 remains unaffected;
2. b)it has neither its registered office nor a branch in an Embargoed Country and does not act on behalf of or at the direction of a government, body or legal person established there;
3. c)it does not, directly or indirectly, provide the services to, make them available to or use them for the benefit of persons under letter a or b, in particular computing capacity, models, software, access credentials and work results;
4. d)it does not permit access to the services from an Embargoed Country and does not disguise such access by technical means such as VPN;
5. e)it does not use or allow the services to be used in connection with chemical, biological or nuclear weapons or their delivery systems, for a military end use in a country subject to an arms embargo, for internal repression or serious human rights violations, or for any other end use requiring a licence under Foreign Trade Regulations;
6. f)without Hashfox's prior consent in text form, no company whose headquarters or ultimate parent company is located in the People's Republic of China including Hong Kong, in Macau or in any other country in Country Group D:5 under Supplement No. 1 to Part 740 of the Export Administration Regulations receives or uses hardware with computing or graphics accelerators falling under Export Control Classification Numbers 3A090 or 4A090 of the Export Administration Regulations, or access to such hardware; Hashfox indicates in the Service Description which services include such hardware;
7. g)it does not participate in any activities whose purpose or effect is the circumvention of Foreign Trade Regulations;
8. h)in its own exports, transfers or onward disclosures of hardware, software, technology or models that it receives from Hashfox or creates using Hashfox's services, it complies with Foreign Trade Regulations and itself obtains any required licences.

(2)On request, the Customer shall provide Hashfox without undue delay with the information and evidence that Hashfox requires in order to comply with Foreign Trade Regulations and with the foreign trade related conditions of its Upstream Suppliers and licensors. This includes in particular information on identity, shareholding and control structures and beneficial owners, on end use, end users and places of use, and an end-use certificate in the form prescribed by Hashfox, a public authority or an Upstream Supplier.

(3)The Customer shall notify Hashfox in text form without undue delay if a representation under paragraph 1 becomes or threatens to become inaccurate. This applies in particular in the event of inclusion on a sanctions list, a change of control or a relocation of the registered office or place of use. The Customer shall likewise give notice if it intends to take hardware supplied by Hashfox to a country outside the European Union or to pass it on to third parties.

(4)In order to comply with Foreign Trade Regulations, Hashfox may screen customer and contract data against sanctions lists, technically verify the origin of access, and prevent access from Embargoed Countries.

(5)If the Customer passes on hardware supplied by Hashfox, it shall oblige the acquirer in text form in accordance with paragraphs 1 to 3, including this obligation to pass on. Re-export to Russia and Belarus, and use there, are prohibited for the Customer. This also applies to parts and associated technology.

(1)Hashfox may refuse or suspend services in whole or in part, or block access, immediately and without prior notice if

1. a)the service is prohibited under Foreign Trade Regulations or a required licence is missing,
2. b)there are specific factual indications that a representation under Section 39(1) is inaccurate or that Section 39 is being breached,
3. c)the Customer fails to comply with a justified request under Section 39(2) within a reasonable period or
4. d)a public authority demands it, or an Upstream Supplier or licensor demands discontinuation on account of a circumstance attributable to the Customer.

Hashfox shall limit the measure to what is necessary and shall lift it as soon as the reason for it has ceased to exist. Unless precluded by a statutory obligation or an order by a public authority, Hashfox shall inform the Customer without undue delay, stating the reasons. For as long as the release of data or other assets is impermissible under Foreign Trade Regulations, Hashfox may refuse to release them.

(2)Hashfox may terminate all or individual Individual Contracts with the Customer for good cause without notice and without prior warning if

1. a)the conditions of paragraph 1 letter a are not merely temporarily met,
2. b)the Customer or a person controlling it is included on a sanctions list under Section 39(1) letter a,
3. c)a representation under Section 39(1) was inaccurate when it was made,
4. d)the Customer breaches Section 39(1) or (5) or
5. e)the Customer fails to comply with a request under Section 39(2) despite being requested to do so with a reasonable deadline.

(3)Claims of the Customer on account of measures under paragraph 1 or 2 are excluded if the conditions for those measures were met or if Hashfox carefully assessed the indications available at the time of the measure. Liability for intent and gross negligence remains unaffected. For the duration of a measure whose conditions were not met, no remuneration is payable.

(4)If the Customer is responsible for the reason for the measure, it remains obliged to pay the remuneration for the duration of the measure. If Hashfox terminates under paragraph 2 for a reason for which the Customer is responsible, Section 30(3) to (5) applies accordingly; otherwise, paragraph 5 applies.

(5)If the impediment is based on circumstances within the Customer's sphere for which the Customer is not responsible, the Customer shall reimburse Hashfox for the proven expenses that Hashfox incurred for the Customer in reliance on the contract and cannot otherwise utilise. Such circumstances are in particular inclusion on a sanctions list, a change of control or a relocation of the registered office.

(6)Statutory exclusions of claims, in particular under Article 11 of Regulation (EU) No 833/2014, remain unaffected.

(1)Hashfox arranges the registration of domains with the competent registry via registrars and Upstream Suppliers selected by Hashfox and manages the domain during the contract term. Where the terms of the registry or the registrar so provide, the contract for the registration itself is concluded directly between the Customer and the registry or the registrar.

(2)Hashfox owes the proper forwarding of the registration order. Hashfox has no influence on allocation by the registry. Hashfox gives no warranty that a requested domain will be allocated, is free from third-party rights or will remain registered permanently. Information on the availability of a domain is non-binding until the registration has been confirmed.

(3)Each domain is additionally subject to the registration terms, policies and dispute resolution rules of the relevant registry and registrar. For .de domains, these are in particular the DENIC Domain Terms and Conditions and the DENIC Domain Guidelines. For generic top-level domains (e.g. .com, .net), this is in particular the registrar's registration agreement, including the ICANN policies binding on the registrar, such as the Uniform Domain Name Dispute Resolution Policy, the Transfer Policy and the Expired Registration Recovery Policy. The DENIC Domain Terms and Conditions are available at https://www.denic.de/domainbedingungen/, and ICANN's "Registrants' Benefits and Responsibilities" at https://www.icann.org/resources/pages/benefits-2013-09-16-en. Hashfox names the registrar responsible for an extension and its registration terms in the offer and, on request, in text form.

(4)By placing the order, the Customer accepts the terms under paragraph 3 and authorises Hashfox to declare them in the Customer's name vis-à-vis the registry and the registrar. To the extent that these terms establish obligations of the Customer or provide for measures that the registry, the registrar or Hashfox as their contractual partner is obliged or entitled to take, they take precedence over these Terms in the relationship between Hashfox and the Customer.

(5)Amendments to the terms under paragraph 3 apply from the date on which they take effect. Hashfox shall inform the Customer in text form of material amendments of which it is aware. If an amendment is materially disadvantageous to the Customer, the Customer may terminate the affected domain contract with effect from the date on which the amendment takes effect; the fee for the current period remains payable.

(1)The domain holder shall be the Customer or a third party designated by the Customer, for whom the Customer is answerable as for its own conduct. Hashfox is registered neither as domain holder nor as a contact unless separately agreed.

(2)The Customer warrants that the domain holder data it transmits are accurate and complete and identify the person substantively entitled to the domain. These are in particular the full name or company name with legal form, street address, e-mail address and telephone number. The Customer shall notify any changes within seven calendar days. If the Customer allows a third party to use a domain, the Customer remains responsible to Hashfox for compliance with these Terms and the terms under Section 41(3).

(3)The Customer authorises Hashfox to make and receive vis-à-vis registries, registrars and Upstream Suppliers all declarations necessary for

1. a)the registration, renewal, updating and management of the domain, including the name server and DNS records,
2. b)carrying out data verifications under paragraph 4,
3. c)implementing measures under Section 45,
4. d)the non-renewal, termination and return of the domain to the registry under Section 44 and
5. e)the deletion of the domain in the cases provided for in these Terms.

Hashfox may grant sub-authorisation to its Upstream Suppliers. The authorisation continues beyond the end of the domain contract until its wind-down under Section 44 has been completed.

(4)Registries and registrars may be obliged by law, in particular under Sections 49 to 51 of the BSI Act (BSIG), and under their terms to verify the accuracy of the registration data; Hashfox cooperates in this. The Customer shall likewise cooperate in this. It shall submit the requested evidence within five Working Days of being requested to do so or, where the registry sets shorter deadlines, without undue delay. Evidence includes, for example, identity or register documents, confirmation of an identification procedure, or confirmation of the e-mail address or telephone number. A mere correction of the data does not replace the requested evidence. Hashfox may use identification service providers for this purpose.

(5)If the Customer transmits inaccurate or incomplete data or fails to cooperate in time under paragraph 4, Hashfox may suspend the domain. The Customer is responsible for measures taken by the registry or the registrar on account of failed verification, in particular removal from the zone, suspension, termination and deletion. The Customer's obligation to pay the remuneration remains unaffected.

(6)The registration data are transmitted to the registrar and the registry, where applicable also to states outside the European Economic Area, insofar as the registry is based there. Registration data that are not personal data are made publicly available in accordance with Section 49(4) of the BSI Act (BSIG); legitimate access seekers must be granted access in accordance with Section 50 of the BSI Act (BSIG). If the Customer transmits personal data of third parties, it shall ensure that they have been informed of the processing.

(1)Each domain is the subject of a separate Individual Contract. It has a term of twelve months from registration or completed transfer to Hashfox or, where the registry prescribes a longer minimum term, that minimum term. It is extended by twelve months in each case unless terminated in text form with one month's notice to the end of the respective term.

(2)Domain contracts are independent of contracts for other services, for example hosting or e-mail. Termination of another contract ends a domain contract only if this is expressly declared. If a hosting or e-mail contract ends, the services provided under it cease even if the domain continues to exist.

(3)Domain fees are payable in advance for the respective term. The fee for the first term is due upon registration or transfer, and the fee for each subsequent term 30 calendar days before its commencement. If a domain contract ends prematurely, in particular through termination, transfer to another provider or deletion, fees already paid or due for the current period are not refunded and remain payable, unless the premature termination is based on a circumstance for which Hashfox is responsible. Fees charged by the registry or the registrar for a restoration are borne by the Customer, unless Hashfox is responsible for the deletion or expiry of the domain.

(4)If the registry or the registrar changes the fees that Hashfox must pay for a domain extension, Hashfox may adjust the domain fee by the amount of the change with effect from the next term. Hashfox shall pass on reductions in the same manner. Hashfox shall notify the adjustment in text form at least four weeks before it takes effect. The Customer may terminate the affected domain contract without notice with effect from that date, up until the adjustment takes effect; Hashfox shall point this out in the notification.

(1)At the request of the domain holder, Hashfox shall provide the authorisation code (AuthInfo), or arrange for its provision, within the deadlines set by the registry or the registrar.

(2)For .de domains and for other extensions whose terms so permit, Hashfox may withhold its cooperation in a transfer to another provider until the fees due for the domain concerned and for the hosting or e-mail services booked with it have been settled. This does not apply to claims that the Customer has disputed with substantiation. For generic top-level domains (ICANN), withholding is permissible only to the extent that ICANN's Transfer Policy permits a refusal on grounds of non-payment. A completed transfer to another provider is deemed a termination of the domain contract at the time of the transfer.

(3)If the fee for the subsequent term of a domain has not been received by Hashfox at least 15 calendar days before that term commences, Hashfox may refrain from renewing the domain and may end the registration with the registrar or Upstream Supplier at the end of the current period; in this case, the domain contract ends at the end of the current period. This requires that Hashfox, no later than 28 calendar days before the subsequent term commences, has requested the Customer in text form to pay and in doing so has drawn attention to the impending non-renewal and its possible consequences, in particular the loss of the domain and the failure of the website and e-mail services operated via it. Upon non-renewal, Hashfox's claim to the fee for the subsequent term lapses; further claims on account of payment default remain unaffected. Paragraph 4 applies to the wind-down.

(4)If a domain contract ends for whatever reason, the following applies where the Customer has neither completed a transfer to another provider nor given an instruction for deletion:

1. a)The consequences under letters b and c occur at the end of the contract or, in the case of an extraordinary termination by Hashfox, upon expiry of 14 calendar days after receipt of the notice of termination.
2. b)For .de domains, Hashfox may return the management to DENIC (DENIC direct administration).
3. c)For other extensions, Hashfox may refrain from renewing the domain and allow it to expire in accordance with the registrar's terms. If those terms do not provide for a return to the registry, Hashfox may have the domain deleted at the end of the paid period.

Hashfox shall inform the Customer in the notice of termination or of expiry of these consequences and of the time at which they occur. Fees charged by the registry for further management are borne by the Customer directly vis-à-vis the registry. In all other respects, deletion takes place only if a return is not possible, if the Customer requests it, or in the cases of Section 45(4) sentence 3.

(1)The Customer alone is responsible for ensuring that the registration and use of the domain do not infringe any third-party rights or statutory provisions, in particular trade mark, name, company name and work title rights. It shall check this before applying. Hashfox does not check requested domains or their use for infringements and is not obliged to do so.

(2)Hashfox and its Upstream Suppliers implement:

1. a)enforceable orders of public authorities and court decisions,
2. b)decisions in dispute resolution proceedings under the terms of the registry or the registrar (e.g. UDRP, URS) and
3. c)measures of the registry (e.g. a DENIC DISPUTE entry).

The Customer consents to all measures required for this purpose, including the blocking, transfer and deletion of the domain. During judicial, administrative or dispute resolution proceedings concerning the domain and until 15 calendar days after their conclusion, Hashfox may refuse a change of holder or a transfer, unless the terms of the registry or the registrar prescribe otherwise. Hashfox is not liable for the consequences of the implementation unless Hashfox implemented the measure incorrectly and is responsible for this.

(3)Sections 35 and 36 apply to domains subject to the following provisions. A breach exists in particular if a domain

1. a)is used to distribute malware, for botnets or their command and control, for phishing or pharming, or for sending spam that serves to distribute such content (DNS abuse),
2. b)is used for illegal, in particular criminal, content,
3. c)as such infringes third-party rights or statutory provisions,
4. d)is based on inaccurate registration data or
5. e)is used contrary to the terms under Section 41(3).

Where there are reliable indications of DNS abuse, and in cases of obvious illegality, Hashfox may take immediate measures under Section 35(2).

(4)Possible measures for domains include in particular:

1. a)placing the domain in a lock status with the registrar (e.g. "Hold");
2. b)removing or changing name server and DNS records, including redirection to a neutral information page;
3. c)blocking changes of holder and transfers;
4. d)blocking functions of the customer account.

Among several suitable measures, Hashfox shall choose the one least onerous for the Customer. Hashfox deletes the domain only if a registry, a registrar, a public authority or a court demands this, or after the end of the domain contract in accordance with Section 44(4).

(5)Hashfox may terminate the affected domain contract and associated Individual Contracts for good cause without notice, in particular if

1. a)a breach under paragraph 3 letter a or b was committed intentionally,
2. b)the Customer fails to cease a breach in time despite a request, or repeats it,
3. c)the infringement by the domain has been established with final and binding effect or confirmed by a decision under paragraph 2 or
4. d)the Customer intentionally provided inaccurate registration data or has definitively refused its cooperation under Section 42(4) despite a request.

(6)Under their terms, registries and registrars may be entitled to block, transfer or delete domains in cases of abuse, inaccurate data or breaches of their terms even without Hashfox's involvement. Hashfox is not liable for this to the extent that it is not responsible for the measure.

(1)Where the Offer provides for the production of a specific work result at a fixed price or subject to acceptance, the law on contracts for work (Werkvertrag) applies. Where the performance of development, consulting, support or maintenance services on a time-and-materials basis has been agreed, in particular in agile process models such as sprints, Hashfox owes the diligent performance of the activities and not a specific result; the law on contracts for services (Dienstvertrag) applies. Sprint reviews and comparable meetings serve coordination purposes and do not constitute acceptance.

(2)Where analysis, conception, prototype, proof of concept or implementation stages are offered separately, each of them constitutes a separate Individual Contract. There is no entitlement to the commissioning or performance of further stages.

(3)Hashfox determines the manner in which the services are performed and issues instructions to its employees and subcontractors. The Customer's requirements are coordinated through the designated contact persons.

(1)The Customer may request changes to the agreed scope of services in text form. Hashfox reviews the request and informs the Customer whether and on what terms (remuneration, deadlines) the change can be implemented. Hashfox may demand remuneration at the agreed rates for the effort required for the review, where that effort is more than insignificant, provided that Hashfox has informed the Customer of this before starting the review.

(2)Hashfox is only obliged to implement a change once the parties have agreed in text form on the change and its effects. Until then, Hashfox performs the services on the basis of the existing contractual status. Where the change affects agreed deadlines, these are postponed by the duration of the review and negotiation.

(3)Hashfox may change services where this is necessary for a valid reason, the change is reasonable for the Customer taking its interests into account, and the agreed functionality is essentially preserved. Valid reasons include, in particular, changes to Third-Party Components, interfaces or legal provisions.

(1)Upon completion, Hashfox makes work services and agreed partial services available to the Customer for acceptance and gives notice of readiness for acceptance in text form. The Customer reviews the service without undue delay, and at the latest within ten working days (review period). It declares acceptance or notifies defects in text form with a comprehensible description.

(2)Defects are classified as follows:

1. a)critical: use is impossible or unreasonably restricted.
2. b)major: use is significantly restricted, and a workaround cannot reasonably be expected.
3. c)minor: all other defects which only insignificantly reduce the suitability for the use presupposed under the contract.

The Customer may not refuse acceptance on account of minor defects; these are remedied within the scope of liability for defects.

(3)The service is deemed accepted if the Customer does not refuse acceptance within the review period, stating at least one critical or major defect. If the Customer puts the completed service into productive use and does not notify any critical or major defect in text form within two weeks from the start of productive use, the service is likewise deemed accepted. Hashfox draws attention to these consequences in text form when making the service available.

(4)Where partial acceptances have been agreed, the overall acceptance is limited to the contractually compliant interaction of the parts already accepted.

(1)In the event of defects, Hashfox first provides subsequent performance, at its own option by remedying the defect, by providing a new program version or by a reasonable workaround. If subsequent performance fails, the Customer may withdraw from the contract or reduce the remuneration in accordance with the statutory provisions. Damages and reimbursement of futile expenses are governed by Section 14, and the limitation period by Section 15.

(2)There is no defect where a malfunction is based on

1. a)changes, updates or extensions to the service, the shop system, plugins, operating systems, programming languages or interfaces that were not made by Hashfox,
2. b)use in a system environment other than the one agreed, or
3. c)improper operation or configuration by the Customer or third parties.

Hashfox owes compatibility of the service only with the versions specified in the Service Description and used at the time of acceptance. Adaptation to later versions is a service to be remunerated separately, unless it is the subject of a maintenance contract.

(3)Where Hashfox uses standard products of third parties, or where these are used at the Customer's request, Hashfox owes their careful selection and professional integration. The quality of the Third-Party Components themselves is governed by the manufacturer's service and licence terms. Hashfox passes on available updates within the scope of a maintenance contract and, at the Customer's request, assigns its own claims for defects against the manufacturer to the Customer, insofar as this is legally possible.

(4)Hashfox may use open source software. Hashfox uses open source software whose licence terms would oblige the Customer to disclose its own program code only after consultation with the Customer.

(5)The Customer reports defects in text form with a comprehensible description of the symptoms and, where possible, the steps to reproduce them. If the Customer is a merchant (Kaufmann), it reports obvious defects within two weeks of acceptance; otherwise, claims for defects in respect of these defects are excluded. This does not apply in cases of fraudulent intent, wilful misconduct or the assumption of a guarantee.

(1)If the Customer terminates a contract for work under Section 648 BGB, Hashfox may demand:

1. a)the agreed remuneration for the services performed up to termination,
2. b)reimbursement of proven expenses for third-party services that can no longer be avoided, for example for licences, hardware or reservations, and
3. c)for the part of the service not yet performed, a lump sum of 10 percent of the agreed remuneration attributable to that part.

(2)Both parties remain entitled to prove that Hashfox is entitled to a higher or lower remuneration under Section 648 sentence 2 BGB.

(1)In this Section:

1. a)“Custom Results” means the work results created by Hashfox under the contract specifically for the Customer, in particular customer-specific program code, configurations, designs and texts.
2. b)“Hashfox Components” means software, libraries, plugins, modules, frameworks, templates, tools and know-how that Hashfox has developed or develops independently of the respective contract, or that are not created exclusively for the Customer.
3. c)“Third-Party Components” means software and content of third parties, including open source software and the services of AI model providers.

(2)Upon full payment of the remuneration owed for the respective Custom Results, Hashfox grants the Customer, insofar as intellectual property rights exist in the Custom Results, the non-exclusive right, unrestricted in terms of territory and time, to use them for the Customer's own business purposes and those of the companies affiliated with it within the meaning of Sections 15 et seq. AktG. This right includes, in particular, the right to reproduce, install and operate the Custom Results and to edit and further develop them itself or through commissioned third parties. The Customer may transfer this right to a third party only together with the business operation or business unit in which it uses the Custom Results. Distribution, rental or other commercial exploitation vis-à-vis third parties is permitted only where agreed. Exclusive rights of use require an express agreement.

(3)With respect to Hashfox Components that are incorporated into Custom Results or are required for their use, Hashfox grants the Customer, upon full payment, a non-exclusive right of use, unlimited in time, to the extent required for the contractual use of the Custom Results under paragraph (2). This right is transferable only together with the Custom Results. In all other respects, all rights to Hashfox Components remain with Hashfox. Hashfox remains entitled to use Hashfox Components, general insights and know-how for other customers as well; Section 17 remains unaffected.

(4)Third-Party Components are governed exclusively by the licence and usage terms of the respective rights holder, which Hashfox names to the Customer upon request. The Customer complies with these terms, in particular when passing software on to third parties.

(5)Until full payment, Hashfox permits the Customer to use the work results to the extent set out in paragraphs (2) and (3) on a revocable basis. Hashfox may revoke this permission if both of the following conditions are met:

1. a)The Customer is in default with an amount of at least 20 percent of the remuneration due for the work result.
2. b)A grace period of at least 14 calendar days set by Hashfox in text form, combined with a warning of revocation, has expired without result.

Revocation is excluded to the extent that the Customer is justifiably withholding payments.

(6)Hashfox owes the provision of source code, build and deployment documentation and access credentials for development and operating environments only where this is expressly agreed in the Offer; provision takes place after full payment. Deposit with an escrow agent may be agreed separately.

(7)Where work results are generated wholly or partly with the aid of AI systems, Hashfox grants rights only insofar as rights arise in the results. Hashfox does not owe that the results are capable of protection.

(1)The provisions on sale apply to the delivery of hardware. Installation and configuration services are governed by the Service Description.

(2)The risk passes to the Customer upon handover of the goods to the carrier. Where Hashfox owes installation at the Customer's premises, the risk passes upon delivery at the agreed installation site. Partial deliveries are permissible insofar as they are reasonable for the Customer.

(3)If the contract is a commercial transaction for both parties, Section 377 HGB applies. The Customer notifies transport damage and recognisable deviations in type and quantity without undue delay, at the latest within five working days of delivery, and does so in text form.

(4)In the event of defects, Hashfox provides subsequent performance, at its own option, by remedying the defect or by delivering a defect-free item. Hashfox passes on manufacturer guarantees to the Customer. Hashfox assumes a guarantee of its own only where expressly agreed under Section 4(4). In all other respects, Sections 14 and 15 apply.

(1)Delivered hardware remains the property of Hashfox until the purchase price and all further claims of Hashfox arising from the business relationship with the Customer have been paid (Reserved Goods). Claims arising after conclusion of the purchase contract are also secured, in particular fees for Recurring Services. Ownership passes to the Customer as soon as, after payment of the purchase price, there are at any point in time no claims of Hashfox against the Customer that are due and outstanding; the retention of title does not revive thereafter.

(2)The Customer handles the Reserved Goods with care and notifies Hashfox in text form without undue delay of any third-party access, in particular attachments; it shall inform the third party of Hashfox's ownership. Without the consent of Hashfox in text form, it may not sell, pledge or transfer the Reserved Goods by way of security, unless paragraph 3 provides otherwise.

(3)If it is agreed in the Offer, or recognisable to Hashfox at the conclusion of the contract, that the Customer acquires the hardware for resale, the following applies:

1. a)The Customer may resell the Reserved Goods in the ordinary course of business as long as it is not in default with payments to Hashfox. Section 39 remains unaffected.
2. b)The Customer hereby assigns to Hashfox the claims arising from the resale, including all ancillary rights, in the amount of the final invoice amount (including value added tax) of the Reserved Goods concerned. Hashfox accepts the assignment. A resale in which the Customer agrees with its purchaser that this claim may not be assigned is not in the ordinary course of business; Section 354a HGB remains unaffected.
3. c)The Customer is authorised to collect the assigned claims in its own name. Hashfox shall not collect the claims itself as long as the Customer meets its payment obligations.
4. d)Hashfox may revoke the authorisations under letters a and c in text form if the Customer is in default with payments, a direct debit is not honoured or the Customer suspends its payments. After revocation, the Customer shall, upon request, inform Hashfox of the assigned claims and their debtors, hand over the documents required for collection and notify the debtors of the assignment.

(4)If the realisable value of the securities exceeds the claims to be secured by more than 10 percent, Hashfox releases securities of its own choice at the Customer's request.

(5)If the Customer acts in breach of contract, in particular in the event of payment default, Hashfox may withdraw from the contract in accordance with the statutory provisions and demand the return of the Reserved Goods. If the purchase price has been paid and the retention of title continues to exist only on account of other claims under paragraph 1 sentence 2, Hashfox may, after prior warning in text form with a reasonable deadline, demand the return of the Reserved Goods and realise them without withdrawing from the purchase contract; the proceeds of realisation less reasonable realisation costs shall be credited against the secured claims, and any surplus shall be paid out to the Customer. Customer data stored on the Reserved Goods is, at the Customer's option, handed over by Hashfox or deleted in accordance with the state of the art.

(1)Where Hashfox provides hardware to the Customer for temporary use, it remains the property of Hashfox. Sections 20, 29 and 30(1), (2), (4) and (5) apply accordingly to the provision. A suspension is limited, under Section 29(4) letter d, to the discontinuation of Hashfox's services.

(2)The Customer handles the hardware with care, insures it in accordance with the Service Description and notifies Hashfox in text form without undue delay of any third-party access.

(3)After the end of the contract, the Customer returns the hardware to Hashfox within 14 calendar days at its own cost and risk, unless collection has been agreed. Before the return, the Customer backs up its data. Hashfox deletes any remaining customer data in accordance with the state of the art.

(1)AI systems generate outputs on the basis of statistical probabilities. Their outputs may be incomplete, outdated, inaccurate or inappropriate, even if the system is professionally designed, configured and operated. Hashfox owes the professional design, configuration, integration and, where agreed, operation of the AI system in accordance with the Service Description. Hashfox does not owe the substantive accuracy or completeness of individual outputs. Hashfox owes specific quality metrics, such as hit rates in a test data set, only if they have been expressly agreed.

(2)A proof of concept serves to demonstrate basic technical feasibility on the basis of the agreed test cases. Suitability for productive operation is not owed.

(3)The Service Description determines which role Hashfox and the Customer each assume under Regulation (EU) 2024/1689 (AI Act). If Hashfox develops an AI system individually for the Customer and the Customer puts it into service under its own name, the Customer is responsible, as between the parties, for the obligations of the provider, unless the Service Description provides otherwise.

(1)The Customer reviews outputs on its own responsibility before using them. This applies in particular before it publishes them or makes decisions on their basis with legal, financial, health-related or safety-relevant effect.

(2)AI agents have authority to act only to the extent that the Customer has approved in text form or in the configuration, for example for sending messages or transferring or modifying data. Actions that an agent performs within these approvals are deemed, as between the parties, to be actions of the Customer; Hashfox's liability under Section 14 for faulty configuration or implementation of the agent for which it is responsible remains unaffected.

(3)The Customer does not use AI systems for practices that are prohibited under the AI Act. The Customer uses AI systems for purposes by which a system would have to be classified as a high-risk AI system only where this has been expressly agreed. If the Customer substantially changes the intended purpose or the system, it bears the resulting obligations.

(4)Where the Customer is the deployer or bears the provider obligations under Section 54(3), it fulfils the obligations incumbent upon it. These are in particular measures to ensure the AI literacy of its staff, transparency notices to affected persons and use in accordance with the intended purpose. Hashfox provides the technical functions required for this to the extent set out in the Service Description, for example a notice of an AI interaction or the labelling of outputs.

(5)Where the Customer uses voice and telephone assistants, it is, as controller, responsible in particular for the following:

1. a)It informs callers before any recording or transcription begins and, where necessary, obtains their consent.
2. b)It provides privacy notices.
3. c)It determines retention and deletion periods.
4. d)It approves the content of the announcements.

Hashfox does not provide legal advice.

(6)The Customer ensures that it is entitled to use the documents, data and content it provides, for example for knowledge bases. Where third-party claims are based on a breach of this obligation for which the Customer is responsible, Section 16 applies.

(1)Unless otherwise agreed, Hashfox selects the AI models and services used. Their use is additionally governed by the usage policies of the respective provider, which Hashfox makes available to the Customer upon request; the Customer complies with them.

(2)If a provider discontinues a model, changes it substantially, or if its continued use is unreasonable for Hashfox, Hashfox may use an essentially equivalent model. Hashfox informs the Customer in good time in advance. Any necessary adaptations are to be remunerated separately, unless they are covered by a maintenance or operating contract.

(3)Without the Customer's consent in text form, Hashfox does not use the Customer's content and data for training or improving its own or third-party AI models. For third-party services, Hashfox uses, where available, services or configurations for which use of customer content for training purposes is excluded under the provider's contractual terms. Hashfox does not assume any guarantee for the provider's compliance with these terms; upon request, Hashfox assigns to the Customer any claims it is entitled to in this respect. Hashfox's responsibility under Article 28(4) sentence 2 GDPR within the limits of Section 14 remains unaffected. Where a model provider stores data under its terms, for example for abuse detection, Hashfox indicates this in Annex 1b, insofar as the provider supplies information on this.

(4)Insofar as rights arise in outputs of AI systems, they belong to the Customer in accordance with Section 51. Hashfox owes neither that the outputs are capable of protection nor that they are free from third-party rights. Before publication or commercial exploitation, the Customer checks outputs for possible third-party rights.

(5)Usage-based costs of model providers are borne by the Customer in accordance with Section 7(2).

(1)Search engine optimisation, optimisation for AI-supported search and answer systems, advertising management and content marketing are services. Hashfox owes their professional performance. Hashfox does not owe the achievement of specific rankings, visibility, mentions, click, conversion or sales figures, unless such a result has been expressly agreed as a guarantee under Section 4(4). Results depend to a significant extent on decisions of the operators of search engines, AI systems and advertising platforms over which Hashfox has no influence.

(2)Hashfox performs the services in compliance with the policies of the respective platforms in the version applicable at the time of performance. Insofar as Hashfox has complied with these policies, the following events do not constitute a breach of duty by Hashfox: suspensions, rejections of advertisements, changes to algorithms or policies, and losses in ranking.

(1)Advertising campaigns are run via advertising accounts of the Customer, to which the Customer grants Hashfox access rights. The Customer is the contractual partner of the advertising platform. It bears the advertising costs directly vis-à-vis the platform and is responsible towards it for compliance with its terms.

(2)Where it has exceptionally been agreed that Hashfox advances advertising costs or processes them via its own accounts, the Customer pays the advertising budget in advance. Without a covered budget, Hashfox is not required to continue campaigns. Hashfox settles unused amounts after the end of the contract. Hashfox passes on credits from the platforms only insofar as they have actually been received by Hashfox.

(3)After the end of the contract, the Customer revokes Hashfox's access rights to its accounts. Hashfox releases the access granted to it.

(1)The Customer is responsible for ensuring that content, advertising claims, product information, keywords and brand terms supplied or approved by it are lawful, in particular under competition, trade mark, copyright, price indication and medicinal product advertising law and under the professional law applicable to it.

(2)Hashfox submits content created by Hashfox to the Customer for approval before publication. If the Customer does not object in text form within five working days, the content is deemed approved, provided that Hashfox drew attention to this consequence when submitting it. In the case of legal infringements in content created by Hashfox, the indemnification under Section 16 applies only insofar as the Customer has expressly approved the content or the infringement is based on information, materials or specifications supplied by the Customer.

(3)Hashfox does not owe a legal review of content. If Hashfox recognises obvious legal concerns, it notifies the Customer of them.

(4)The Customer's indemnification obligation is governed by Section 16.

(1)Insofar as Hashfox processes personal data on behalf of the Customer in the course of the services, the Customer is the controller and Hashfox is the processor within the meaning of Article 4(7) and (8) and Article 28 GDPR. The data processing agreement in Annex 1 applies to this. It becomes part of the contract upon conclusion of the respective Individual Contract and takes precedence over these Terms in matters of data protection. Data processing agreements, templates or purchasing conditions of the Customer apply only insofar as Hashfox has expressly agreed to them in text form.

(2)For its own purposes, Hashfox processes personal data as an independent controller. Own purposes are in particular the initiation, performance and invoicing of the contract, communication with the Customer's contact persons, the fulfilment of statutory obligations, including the obligations under Section 39(4) and Section 42, and the security, stability and abuse prevention of its own systems and networks, including the processing under Section 34(6). Hashfox may also use technical operating data of its own systems in anonymised or aggregated form for the further development and improvement of its services; personal data processed on behalf and the Customer's content are excluded from this.

(3)The Customer is responsible for the lawfulness of the processing. This includes in particular legal bases, consents (for example for tracking, call recordings and the use of AI systems), information obligations and data protection impact assessments. In addition, the Customer checks whether the booked services and security measures are appropriate for its processing.

(4)Hashfox offers the services as standardised services. The parties agree separately, and against remuneration, on additional security measures that the Customer considers necessary for its processing.

(5)Before conclusion of the contract or before the start of the processing concerned, the Customer notifies Hashfox in text form if data are to be processed that are subject to professional secrecy or a special official secrecy, or data of special categories under Article 9 GDPR. Without this notification, Hashfox is not obliged to take special measures going beyond the agreed services. Hashfox processes social data within the meaning of Section 67 SGB X only on the basis of a separate agreement.

(1)Hashfox may engage sub-processors. For this purpose, the Customer grants general authorisation under Article 28(2) GDPR in accordance with Annex 1. The sub-processors engaged at the time of conclusion of the contract are set out in Annex 1b in the version applicable at the time of conclusion of the contract. Hashfox transmits the version applicable from time to time to the Customer in text form upon request; Hashfox notifies changes in accordance with paragraph (2). Annex 1b names each sub-processor with its company name, address, service, processing location and transfer mechanism.

(2)Hashfox informs the Customer in text form to the stored contact address at least 30 calendar days before engaging a new sub-processor or replacing an existing one. The Customer may object in text form within 14 calendar days of receipt of the information, stating a reason relating to data protection law. Before expiry of the objection period, the new sub-processor does not process any personal data of the Customer. If the Customer objects, Hashfox may, at its own option, refrain from the change for the Customer or terminate the affected Individual Contract with effect from the planned date of engagement; until the end of the contract, the new sub-processor does not process any personal data of the Customer. The Customer may likewise terminate the affected Individual Contract with effect from the planned date of engagement. Remuneration paid in advance for the period after the end of the contract is refunded; no further claims exist. Section 30(3) and Section 32(7) do not apply to these terminations.

(3)Where the immediate replacement of a sub-processor is necessary to maintain the services or security, Hashfox may make the replacement without the notice period under paragraph (2). This applies in particular in the event of insolvency, discontinuation of services or a security incident at the previous sub-processor. Hashfox informs the Customer without undue delay; paragraph (2) sentences 2 and 4 to 7 apply accordingly, with the proviso that the termination may be declared with immediate effect.

(4)If a sub-processor itself changes the further sub-processors engaged by it, Hashfox informs the Customer without undue delay after Hashfox has become aware of this, insofar as the change concerns customer data. The notice period under paragraph (2) sentence 1 and the obligation under paragraph (2) sentence 3 do not apply in this respect; the period granted to Hashfox by the sub-processor is decisive. If the Customer objects within the period under paragraph (2) sentence 2, it may terminate the affected Individual Contract with effect from the date on which the change takes effect; paragraph (2) sentences 6 and 7 apply accordingly. The lists of further sub-processors of the providers named there, as specified in Annex 1b, are covered by the authorisation under paragraph (1).

(5)Hashfox processes customer data in principle within the European Union or the European Economic Area. In third countries, customer data are processed only by sub-processors listed in Annex 1b, and only in compliance with Articles 44 et seq. GDPR. By commissioning a service for which such a sub-processor is listed, the Customer thereby instructs Hashfox to carry out the associated transfer. Hashfox owes a specific location, for example a specific data centre or exclusively Germany, only if this has been expressly agreed in the Individual Contract.

(1)If the Customer is a merchant (Kaufmann), a legal entity under public law or a special fund under public law, or has no general place of jurisdiction in Germany, the exclusive place of jurisdiction for all disputes arising from and in connection with the contractual relationship is the registered office of Hashfox. This is currently Niederkassel; accordingly, depending on the amount in dispute, the Local Court (Amtsgericht) of Siegburg or the Regional Court (Landgericht) of Bonn has jurisdiction. Hashfox may also sue the Customer at the Customer's general place of jurisdiction. Exclusive statutory places of jurisdiction remain unaffected.

(2)The place of payment is the registered office of Hashfox. The place of performance is the place specified in the Service Description. If no such place is specified, the place of performance for services rendered remotely is the registered office of Hashfox.

(3)The law of the Federal Republic of Germany applies, excluding the United Nations Convention on Contracts for the International Sale of Goods (CISG).

(1)Annexes 1, 1a and 1b form part of these Terms.

(2)If individual provisions of these Terms are or become invalid, or do not become part of the contract, the remainder of the contract remains valid. The affected provisions are replaced by the statutory provisions.

(3)Headings serve only for ease of reference and have no significance for interpretation.

(4)Translations of these Terms are for information only; the German version is authoritative.

1.1This agreement applies to all services in which Hashfox processes personal data on behalf of the Customer. The subject matter, nature and purpose of the processing follow from the respective Individual Contract, the Service Description and clause 2.

1.2The term of this agreement corresponds to the term of the Individual Contracts to which it relates. It continues to apply beyond that for as long as Hashfox processes personal data of the Customer.

1.3In matters of data protection, this agreement takes precedence over the Terms. Templates and purchasing conditions of the Customer apply only to the extent that Hashfox has agreed to them in text form.

Special categories of data under Article 9 GDPR and data subject to professional secrecy are processed only after notification in accordance with Section 60(5) of the Terms.

In the case of email services, Hashfox processes master data and traffic data as the provider of a telecommunications service under its own responsibility in accordance with the TDDDG, in particular for delivery, billing, fault and abuse prevention and for the fulfilment of obligations under the TKG; to that extent this agreement does not apply.

3.1Hashfox processes personal data only on documented instructions from the Customer, unless Hashfox is required to process them by Union or Member State law. In such a case, Hashfox informs the Customer of that legal requirement before processing, unless that law prohibits such information. Such obligations may arise in particular from the TKG, the TDDDG, the BSI Act (BSIG) and criminal procedure law.

3.2The contract, the Service Description and the configurations made by the Customer constitute the complete initial instruction. Subsequent instructions are given in text form by the persons designated by the Customer.

3.3Hashfox carries out instructions that go beyond the agreed scope of services only against separate remuneration. Hashfox may refuse them if they are technically or economically unreasonable; in that case the Customer may terminate the affected service. Hashfox does not refuse instructions for the rectification, erasure or restriction of processing that serve to fulfil the rights of data subjects on the ground of economic unreasonableness.

3.4If Hashfox considers that an instruction infringes data protection provisions, Hashfox informs the Customer without undue delay. Hashfox may suspend the execution of the instruction until the Customer confirms or amends it.

Hashfox ensures that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Sections 17 and 27 of the Terms apply in addition.

5.1Hashfox takes the measures required under Article 32 GDPR in accordance with Annex 1a. Annex 1a consists of three parts: Part A contains the baseline measures, Part B the measures of the booked services in accordance with the Service Description, and Part C the responsibility overview by operating model.

5.2Hashfox does not owe services that have not been booked. These include in particular data backups, round-the-clock monitoring, and hardening and patch management of the Customer's systems.

5.3Hashfox may adapt the measures to the state of the art, provided that the level of protection is not reduced. Hashfox notifies the Customer of material changes.

5.4Before placing the order, the Customer checks whether the measures are appropriate for its processing. The parties agree on additional measures against remuneration.

6.1The Customer grants general authorisation for the engagement of sub-processors. The procedure for changes is governed by Section 61 of the Terms.

6.2Hashfox contractually imposes on sub-processors the same data protection obligations as are set out in this agreement (Article 28(4) GDPR). Upon request, Hashfox provides the contracts in extracts or in summary form. If a sub-processor fails to fulfil its data protection obligations, Hashfox is liable to the Customer in accordance with the second sentence of Article 28(4) GDPR; clause 12.1 applies to the extent legally permissible.

6.3Service providers without access to Customer Data, such as operators of data centre space without system access and network operators, are not sub-processors. Hashfox lists them in Annex 1b for information.

7.1Transfers to third countries take place only in accordance with Section 61(5) of the Terms and on the basis of a mechanism under Articles 44 et seq. GDPR. Such mechanisms are in particular an adequacy decision or standard contractual clauses.

7.2If a mechanism ceases to apply, Hashfox may switch to another permissible mechanism or another provider. Hashfox informs the Customer thereof. Hashfox continues its assessment of the transfer and communicates it in summary form upon request.

8.1Hashfox forwards requests from data subjects addressed to Hashfox to the Customer and does not answer them itself.

8.2Within the limits of the available technical possibilities and against remuneration on a time and materials basis, Hashfox assists the Customer in fulfilling the rights of data subjects, with data protection impact assessments, with prior consultations and with enquiries from supervisory authorities.

8.3The provision of existing system information, notifications under clause 9 and assistance made necessary by a breach of duty by Hashfox are free of charge.

9.1If Hashfox becomes aware of a personal data breach affecting data of the Customer, Hashfox notifies the Customer without undue delay.

9.2The notification is made by email to the designated contact. It contains the information under Article 33(3) GDPR to the extent available to Hashfox; the information may be provided in phases.

9.3Notifications to supervisory authorities and communications to data subjects under Articles 33 and 34 GDPR are the responsibility of the Customer. Hashfox's own statutory notification and communication obligations, in particular under Sections 168 and 169 TKG and Section 32 of the BSI Act (BSIG), remain unaffected. To the extent legally permissible and possible without jeopardising statutory time limits, Hashfox informs the Customer before communicating with data subjects.

10.1Hashfox demonstrates compliance with its obligations primarily by means of suitable documentation. Such documentation includes in particular the current description of the technical and organisational measures, self-assessments and existing certificates and audit reports of Hashfox, of data centres and of sub-processors. Suitable documentation may also include registration confirmations and summary descriptions of measures that Hashfox prepares on the basis of statutory obligations vis-à-vis the Federal Office for Information Security or the Federal Network Agency (Bundesnetzagentur); security-critical details are not disclosed.

10.2An on-site inspection by the Customer or by an auditor engaged by it who is bound to confidentiality and is not a competitor of Hashfox takes place if

1. a)the Customer demonstrates that the evidence under clause 10.1 is not sufficient,
2. b)there are specific indications of an infringement,
3. c)a breach under clause 9 has occurred, or
4. d)a supervisory authority so requires.

10.3Inspections take place no more than once per calendar year, except where there is cause under clause 10.2 letters b to d. The Customer gives 30 calendar days' notice of them, or five Working Days' notice where there is cause. They take place during business hours and without disrupting operations. There is no right to inspect data of other customers or information whose disclosure would compromise security. In data centres and at sub-processors, their evidence takes the place of an inspection by the Customer; to the extent that Hashfox has more extensive audit rights vis-à-vis them, Hashfox exercises those rights upon reasoned request and at the Customer's expense.

10.4The Customer bears the costs of the audit, including the effort of Hashfox, which is remunerated on a time and materials basis. This does not apply if the audit reveals a material infringement of this agreement by Hashfox.

11.1After the end of the services, Hashfox returns or deletes the personal data at the Customer's choice. The procedure and time limits are governed by Sections 31 and 32 of the Terms. If the Customer has not made a choice by the end of the data retrieval period, Hashfox deletes the data.

11.2Data are deleted from backups in accordance with the backup cycle of the booked service, at the latest after the period set out in Section 31(4) of the Terms.

11.3Statutory retention obligations remain unaffected. Upon request, Hashfox confirms the deletion in text form free of charge; Hashfox prepares detailed deletion logs against remuneration.

12.1Liability is governed by Section 14 of the Terms, including Section 14(6).

12.2Hashfox may update Annexes 1a and 1b in accordance with the procedure in clause 5.3 and Section 61 of the Terms.

12.3If a provision of this agreement is invalid, the requirements of Article 28 GDPR apply in its place.