1. Business customers and scope
1.1 These Terms apply exclusively to customers acting in the exercise of their commercial or independent professional activity within section 14 German Civil Code (BGB), and to legal persons under public law and special funds under public law (the “Customer”). The Provider does not offer services under these Terms to consumers. The Customer must provide its legal name, business address and authorised contact and confirm the business purpose of the engagement.
1.2 These Terms cover software engineering and Product Security consulting engagements agreed in an offer, order confirmation or statement of work (an “Order”). Sections 1–10 apply to all Orders; section 11 additionally applies to software engineering; section 12 additionally applies to Product Security. Both modules apply where both services are commissioned.
2. Contract formation and conflicting terms
2.1 Offers are non-binding unless stated otherwise. An Order becomes binding through the Provider’s confirmation or both parties’ agreement. These Terms must be incorporated as part of that agreement. The version supplied with or identified in the agreed Order applies throughout that Order; publication of a later version does not change an existing contract.
2.2 The Provider rejects the Customer’s and third parties’ standard purchasing, procurement, portal and other business terms. They do not apply merely because the Provider receives a purchase order, accesses a procurement portal, performs services or accepts payment with knowledge of those terms. Their application requires the Provider’s express agreement. A purchase-order number is an administrative reference only.
2.3 Individually negotiated agreements take priority as required by section 305b BGB. Subject to that rule, the agreed Order defines scope, fees, deliverables and timing; the applicable service module supplements the general provisions. An Order does not otherwise displace these Terms merely by referring to external standard terms. A data processing agreement takes priority for its specific data protection subject matter.
2.4 The parties should record amendments, change requests and deviations in text form, including email, for evidence. This provision does not invalidate a legally effective individual agreement made in another form or override a mandatory statutory form requirement.
3. Performance, cooperation and changes
3.1 The Provider performs with reasonable professional care using suitably qualified personnel. The Provider controls the organisation and method of work, subject to agreed requirements, and may use qualified subcontractors subject to confidentiality, security and applicable data protection requirements. The Provider remains responsible for its contractual performance.
3.2 The Customer supplies accurate information, lawful access, necessary permissions, test environments, decisions and a contact authorised to coordinate the work. The Provider will identify material missing inputs of which it becomes aware. The Customer remains responsible for its business decisions, production operations and implementation of recommendations except to the extent expressly assigned to the Provider.
3.3 Before changes or testing, the Customer maintains current, tested backups and an appropriate restoration procedure for systems under its control, unless that responsibility is expressly assigned to the Provider. This does not excuse the Provider’s own failures or automatically exclude liability.
3.4 Dates are binding only if agreed as binding. Customer-caused delays extend affected dates by the resulting delay and a reasonable remobilisation period. The Provider will notify the Customer of the effect and take reasonable mitigation steps. Necessary and reasonable additional work caused by the Customer’s failure to provide required, accurate and timely inputs is chargeable at the agreed rates, except to the extent caused by the Provider. The Provider will notify the Customer of the reason and expected additional charges before incurring them where reasonably practicable. Customer-requested changes accepted by the Provider are chargeable at the agreed rates unless otherwise agreed. The Provider need not implement a requested change until its scope is agreed. Statutory compensation rights remain unaffected.
3.5 The Provider is not obliged to implement Customer-requested changes unless it accepts their scope. Accepted changes are charged under section 3.4 unless otherwise agreed; the Provider may require agreement on any necessary fee or date adjustments before starting them. Pending agreement, the existing scope continues where practicable. This section does not restrict charging for Customer-caused additional work under section 3.4. A time estimate is not a fixed price. An expressly agreed budget ceiling may not be exceeded without the Customer’s approval, including for additional work under section 3.4.
4. Fees, invoices and suspension
4.1 Fees and the charging model are stated in the Order. Prices are net of applicable VAT. Unless expressly included in the agreed fees or otherwise agreed in the Order, the Customer reimburses reasonable, necessary and documented travel and accommodation expenses and third-party costs incurred specifically to perform the Order, at actual cost. For required travel, first-class rail and business-class air fares are reimbursable without separate approval, provided the fare is commercially reasonable for the route and booking circumstances. This includes travel for agreed on-site work and project-specific licences, infrastructure and external services. The Provider will give advance notice of material expenses where reasonably practicable. No unagreed increase in the Provider’s rates applies during an Order.
4.2 Time-based services are invoiced monthly in arrears with a reasonable activity summary. For fixed-price software engineering work with an agreed work result, 30% of the agreed net price is payable as an advance upon conclusion of the Order and before work begins, unless the Order states a different payment schedule. The advance is credited against the price. The balance is invoiced upon acceptance, subject to agreed milestone payments and statutory rights to progress payments. If the Order ends before completion, the Provider will account for the advance against the amount legally due and refund any excess. Payment for other fixed-price work, including Product Security work, follows the Order; absent an agreed payment schedule, applicable statutory rules govern. Retainers and other advance payments apply only where expressly agreed.
4.3 Undisputed amounts are payable within 14 calendar days after receipt of a properly issued invoice and maturity of the underlying payment claim. The Customer shall notify the Provider in text form without undue delay of any apparent invoice error, identifying the disputed item and reason. A dispute concerning one item does not postpone payment of the undisputed balance. Statutory default requirements apply. In default, the Provider may claim statutory interest, the statutory recovery-cost lump sum and other recoverable loss, without duplicate recovery.
4.4 The Customer may set off undisputed or finally adjudicated claims and claims arising from the same contractual relationship. Statutory withholding rights for connected counterclaims, including defects, remain unaffected.
4.5 If an undisputed amount other than a trivial shortfall remains unpaid when due, the Provider may suspend further services under the affected Order with immediate effect by notice in text form. The first overdue-payment notice may also give notice of suspension; no further reminder or cure period is required. Suspension must be proportionate to the unpaid amount and affected services and does not apply to amounts subject to a valid withholding right. The Provider will take reasonable steps to avoid imminent harm to Customer data or systems directly caused by stopping work, but need not continue the suspended services. Affected dates extend by the period of suspension and a reasonable remobilisation period. Suspension does not authorise deletion of Customer data or disabling already licensed software.
5. Intellectual property and deliverables
5.1 Each party retains its pre-existing materials. The Customer grants the Provider the rights to Customer materials reasonably necessary to perform the Order and confirms it is entitled to do so.
5.2 On full payment of the remuneration attributable to a deliverable, the Customer receives a perpetual, worldwide, non-exclusive right to use, reproduce and modify that deliverable for the agreed contractual purpose. Before payment, use is permitted only as needed for agreed evaluation and acceptance. Where the Order commissions software for the Customer’s own commercial product, the licence includes integration and distribution of the deliverable as part of that product, and sublicensing only to the extent necessary for its use, distribution or support. Separate licensing or sale of the deliverable requires agreement in the Order. The Customer may engage service providers acting for it under suitable confidentiality duties. The Customer shall retain existing Provider copyright notices and legally required third-party notices in delivered source code and accompanying materials, except where removal is agreed or legally permitted. Any public-facing credit is governed by the Order.
5.3 Exclusive rights, standalone resale rights, transfer of repositories and delivery of particular source files or build materials must be specified in the Order to the extent they are not already necessary for the agreed contractual purpose. Rights necessary to fulfil an expressly agreed purpose are not withheld by this clause.
5.4 The Provider retains general methods, tools, templates, libraries and know-how developed independently or reusable without disclosing Customer confidential information. Where embedded in a deliverable, they are licensed to the Customer to the extent required to use that deliverable as agreed.
5.5 Third-party and open-source components remain subject to their own licences. The Provider will disclose material licence restrictions and obtain agreement before introducing components whose terms require disclosure of the Customer’s proprietary source code. The Provider will supply required notices and available licence information. This does not exclude liability for a breach of the Provider’s agreed obligations.
6. Confidentiality, customer references and personal data
6.1 Each party protects the other’s non-public business, technical and security information with reasonable care and uses it only for performance of the contract. Access is limited to personnel and advisers who need it and are subject to appropriate confidentiality obligations. Credentials, vulnerability details, source code and security reports are confidential by their nature.
6.2 This duty does not cover information demonstrably public without breach, already lawfully known, independently developed or lawfully received without restriction. Legally required disclosure is permitted, limited to what is required, with prior notice where lawful. Neither party may publish the other’s confidential findings without consent. Customer references are permitted only within sections 6.6–6.7 or under a separate agreement.
6.3 Confidentiality continues for five years after the Order ends; protection of trade secrets continues for as long as they qualify as such, and protection of personal data and credentials continues as required by law or their sensitive nature.
6.4 Each party complies with applicable data protection law. Where the Provider processes personal data on behalf of the Customer, the parties must conclude the necessary Article 28 GDPR agreement before that processing begins, including security measures, subprocessors, incident handling, transfers and deletion. These Terms do not replace that agreement or limit statutory rights of data subjects or supervisory authorities.
6.5 At the end of an Order, the Provider returns or securely deletes Customer confidential materials on request, except material required by law or reasonably needed for legal claims. Retained material remains protected and use-restricted. Backup copies are removed through the ordinary documented retention cycle, subject to overriding data protection requirements. Credentials are revoked or returned promptly.
6.6 Private CV references. After completion, the Provider may name the Customer or, where work was arranged through an intermediary, the end client in CVs and experience profiles shared privately with recruiters, staffing agencies and prospective business clients to assess the Provider’s experience, including ordinary forwarding for that purpose. The reference may state the engagement period and a brief, non-confidential description of the role, and must accurately identify work through an intermediary. The Customer shall disclose before the Order is agreed any confidentiality restriction that prevents this use and, where it is an intermediary, obtain any end-client permission required under its arrangements. This clause does not override an NDA, rights of a non-party or applicable data-protection law; it permits no logos, confidential project details or implied endorsement. The Customer or end client may object to future use at any time. The Provider will promptly stop new use and update materials under its control.
6.7 Public references and logos. A website or other public customer reference, and use of a Customer’s or end client’s logo in any medium, requires separate prior permission in text form (including email) from that entity or a representative with authority to grant it. If the Provider seeks public-reference permission, it will request it from the Customer, or from the end client where an intermediary is involved, at least 14 calendar days before expected completion of the Order; for shorter Orders, it will request it when the Order is agreed. The request creates no duty to consent, and silence is not consent. Permission must specify the approved name, logo or wording and permitted channels. The Provider will use them only within that scope, respect any withdrawal or brand rules, and accurately describe intermediary work. An intermediary’s acceptance of these Terms alone cannot grant an end client’s rights. A later permission remains effective within its scope.
7. Liability
7.1 The Provider is liable without the limitations below for intent or gross negligence; culpable injury to life, body or health; fraudulent concealment; liability under an expressly assumed guarantee to its applicable extent; and liability under the German Product Liability Act or other mandatory law that cannot validly be excluded or limited.
7.2 For simple negligence outside section 7.1, the Provider is liable only for breach of an essential contractual obligation: an obligation whose performance is necessary for proper fulfilment of the contract and on which the Customer may ordinarily rely. Liability for such a breach is limited to the damage typical for the contract and foreseeable when the Order was concluded.
7.3 Subject to section 7.1, the Provider’s total aggregate liability for damages and reimbursement of wasted expenditure arising out of or in connection with an Order shall not exceed 100% of that Order’s net Contract Value as defined in section 7.4. This is one aggregate limit for all claims under the affected Order, not a separate limit for each claim, breach or damaging event. The limitation in section 7.2 to damage typical for the contract and foreseeable at its conclusion applies in addition to this monetary cap. The existence or amount of the Provider’s insurance cover does not increase the agreed cap or constitute an assumption of additional liability.
7.4 “Contract Value” means the total net fees agreed for the affected Order, including agreed changes, excluding taxes and reimbursed expenses. For time-based work without a fixed total, it means fees paid or payable for work performed plus any remaining binding minimum fee commitments under that Order, without double counting. For an indefinite recurring engagement, it means the agreed net fees for the twelve-month contract year in which the first damaging event occurs; a shorter agreed total term uses that shorter term’s fees. An estimate is not a binding fee commitment. Related claims from the same event are allocated once to the applicable Order and period; unrelated Orders are not combined to reduce recovery.
7.5 Liability for simple negligence outside sections 7.1 and 7.2 is excluded. The limitations apply regardless of legal basis, including claims for reimbursement of wasted expenditure, and also benefit personnel and other persons used to perform the contract. They do not restrict performance, cure, price-reduction, rescission or repayment rights where their legal requirements are met. No category such as lost profit or data loss is categorically excluded if it is recoverable under sections 7.1–7.3. Statutory contributory-negligence and loss-mitigation rules remain applicable.
8. Term and termination
8.1 Each Order states its start, duration and any minimum commitment. A fixed-term Order ends at expiry without automatic renewal unless renewal is expressly agreed. Unless a different notice period is expressly agreed in the Order, an indefinite service engagement may be terminated by either party on seven calendar days’ notice in text form.
8.2 Statutory termination rights, including termination for good cause and sections 627 and 648 BGB where applicable, remain unaffected. The statutory conditions, notice periods and settlement consequences govern their exercise.
8.3 On termination, the Customer pays fees properly earned and approved unavoidable third-party costs to the extent legally recoverable. Unused advances are accounted for and refunded to the extent no fee entitlement remains. Termination of work contracts is settled under the applicable statutory rules, including deduction of saved expenditure and relevant substitute earnings. There is no automatic forfeiture of all prepaid fees.
8.4 The Provider supplies paid-for deliverables and Customer materials then due for handover. Additional transition assistance is separately agreed at the agreed rates; this does not make an existing handover obligation chargeable twice. Accrued rights and provisions intended to survive remain effective.
9. Events outside reasonable control
A party is excused from affected performance only for the duration and extent that an unavoidable event outside its reasonable control legally excuses that performance. It must notify the other promptly and take reasonable mitigation steps. Ordinary staffing shortages, lack of funds or preventable security incidents are not automatically such events. Fees for services not performed are not earned merely because of the event. Statutory termination, adjustment and repayment rights remain unaffected.
10. Governing law and courts
10.1 German law applies, excluding the United Nations Convention on Contracts for the International Sale of Goods. Mandatory applicable law remains unaffected.
10.2 The courts in Oldenburg (Oldb.), Germany, have exclusive jurisdiction where the parties meet the requirements of section 38(1) ZPO, or where a valid choice of court may otherwise be made under applicable law, including Article 25 of Regulation (EU) No 1215/2012. Mandatory exclusive jurisdiction and applicable form requirements remain unaffected. Where this choice is not legally permitted, statutory jurisdiction applies. Business-customer status alone does not establish merchant status under section 38(1) ZPO.
10.3 If a provision is ineffective, the legal consequences follow the applicable statutory rules. It is not automatically replaced by the most provider-favourable provision that might have been valid.
11. Software engineering module
11.1 The Provider owes professional services performed with reasonable care, not a particular result, unless the Order agrees a specific result and its acceptance criteria. Only that agreed result is subject to acceptance and defect remedies. Legal classification follows the substance of the agreed obligations.
11.2 On completion of a work deliverable, the Provider makes it available for testing and requests acceptance within a reasonable period reflecting its complexity. The Customer identifies defects in reasonable detail. Minor defects do not justify refusal of acceptance. Deemed acceptance applies only where its statutory requirements are met, including completion, a reasonable acceptance deadline and failure to refuse acceptance within that deadline specifying at least one defect. Acceptance may also occur through conduct. Following completion and a reasonable opportunity to test, the Customer accepts the deliverable by using it in regular production without an acceptance reservation, where that conduct objectively demonstrates approval as substantially conforming to the Order. Use solely for testing or temporary use compelled by operational necessity does not constitute acceptance.
11.3 For a defect, the Customer gives the Provider a reasonable opportunity to cure unless the law permits immediate further remedies. The Provider may choose repair or replacement within the applicable statutory limits. If cure fails, is refused or is unreasonable, statutory remedies remain available. Statutory limitation periods apply; damages are governed by section 7.
11.4 Maintenance, future compatibility work, feature additions and updates outside agreed conformity or other legal obligations require a separate Order. A fault caused solely by unauthorised Customer modifications or misuse is not a defect attributable to the Provider; unrelated defect claims remain unaffected.
12. Product Security module
12.1 An Order may include security strategy, architecture and threat modelling, application or API review, code review, remediation advice, training or verification. Unless a specific work result is agreed, the obligation is professionally diligent advisory work. An agreed report or other defined result remains subject to applicable work-contract obligations; section 11’s acceptance and defect provisions apply correspondingly.
12.2 Findings reflect the systems, versions, information, methods and time available within the agreed scope. Sampling or time-limited reviews cannot identify every vulnerability. The Provider does not promise immunity from attack, certification, regulatory approval or a particular commercial outcome unless expressly agreed. These qualifications do not reduce an expressly agreed testing scope, standard of care or deliverable requirement.
12.3 Intrusive or active testing may begin only after an agreed written rules-of-engagement document identifies authorised assets and owners, permitted techniques, exclusions, environments, time windows, emergency contacts, stop conditions and handling of evidence. The Customer obtains required owner and third-party permissions. Customer authorisation alone is insufficient for assets it has no authority to authorise. The Provider may refuse or pause testing where authority is unclear.
12.4 Denial-of-service testing, destructive actions, social engineering, persistence and access to third-party systems are excluded unless separately and lawfully authorised. Production testing requires express agreement on backups, impact controls and recovery responsibilities. The Provider stops or adjusts activities when an unexpected material risk becomes apparent and promptly informs the agreed contact.
12.5 The Provider communicates material findings through agreed secure channels and promptly escalates apparent critical vulnerabilities. Reports may be shared confidentially with the Customer’s advisers, auditors, regulators and business partners for the agreed purpose, with context and limitations preserved. No independent reliance duty to a third party is created by permitted sharing. Public disclosure of vulnerabilities requires coordination and appropriate authorisation, subject to overriding legal duties.
12.6 The Customer decides on remediation and risk acceptance except where implementation is separately commissioned. Retesting, continuous surveillance, emergency response and certification support are separate services unless included in the Order. No incident-response service level arises from merely discovering or reporting a vulnerability.