Terms Of Service

General Terms and Conditions
 for the Use of the teamdecoder Software

 

 

1              Scope

1.1          teamdecoder is an offer by mytpt GmbH. mytpt GmbH is registered with the Commercial Register of the Local Court of Charlottenburg in Berlin (Amtsgericht Charlottenburg) under HRB 250937 B, with its business address at Leipziger Straße 48, 10117 Berlin (“mytpt”).

1.2          mytpt provides a software that supports transformation processes in corporate structures on www.teamdecoder.com (“App”). Subscribers may register to the App (“Subscriber”). These are the general terms and conditions for the business relationship between mytpt and a Subscriber (“GTC”).

1.3          mytpt provides its services exclusively to Subscribers which are entrepreneurs within the meaning of Section 14 of the German Civil Code (BGB).

1.4          These GTC apply unless the parties have agreed on different regulations in the specific Contract. Deviating, opposing or supplementary general terms and conditions of Subscribers shall only become integral components of the contractual relationship if mytpt agrees to their validity in text form. This requirement of approval also applies if mytpt initiates the performance of services after becoming aware of Subscriber’s general terms and conditions.

2              Object of the Contract

2.1          Mytpt offers the App in different subscription models (“Licenses”), each with different functionalities specified under the respective License in the App.

2.2          Mytpt provides the App by means of a cloud-based application via an internet browser. The Subscriber does not download the App itself but uses the App on mytpt IT infrastructure. Such provision of the App and its contents is referred to as the “Service”.

2.3          mytpt offers access to the App via a FREE version, and a GO License.

3              Conclusion of the Contract

3.1          Contracts about the use of the App and/or additional services are concluded online via the App. The Subscriber shall select the license of his choice and optionally additional services and enter the required profile data.  In the course of this process, the Subscriber provides to mytpt an offer to conclude a subscription. If mytpt accepts this offer by e-mailing the respective invoice for the ordered License to Subscriber or confirming the FREE account, the subscription agreement is concluded (“Contract”).

3.2          Upon registering, the Subscriber guarantees that it acts in its capacity as entrepreneur. The representative who registers on behalf of a company as Subscriber guarantees by registering to be legally authorized to act for the company.

4              Functions and Use of the App and additional services

4.1          The Subscriber chooses between different licenses and additional services specified on https://pricing.teamdecoder.com/ 

4.2          The Subscriber may upgrade to more extensive Licenses against payment as specified on https://pricing.teamdecoder.com/.

4.3          The Subscriber is granted a non-exclusive, non-transferable, non-sublicensable, revocable right, limited to the term of the Contract, to use the App according to these GTC and according to the Contract. In particular, the Subscriber is not entitled to make the App or contents thereof accessible to third parties or to copy, decompile, reversely engineer or edit the App.

4.4          The Subscriber may only use the App and additionally available content of the App (“App Content”) as set out in the Contract and these GTC. In particular, the Subscriber may not (i) rent, lease, distribute, license, sublicense, sell, transfer, assign, distribute or otherwise grant access to App Content to any third party; (iii) reproduce, modify, adapt, create derivative works from, or adapt the App Content; (iv) reverse engineer, disassemble, decompile, transfer, exchange or translate the App Content, or otherwise attempt to obtain or derive the source code or API; (iv) remove or tamper with any disclaimer or other legal notice; (v) combine all or any part of the App Content with any other software, data or material; (vi) store or use any data not owned by you in an archival or other searchable database.

4.5          The provision of the necessary internet access is not part of the Contract. The Subscriber is responsible for the procurement and maintenance of the necessary hardware and connections to public telecommunications networks. mytpt is not liable for the security, confidentiality or integrity of the data communication, which is conducted via third party communication networks. mytpt is also not liable for malfunctions in data transmission caused by technical errors or configuration problems on the part of the Subscriber.

4.6          Unless otherwise agreed, the Subscriber grants mytpt a non-exclusive, transferable, sublicensable right to use the data entered by the Subscriber into the App for the purpose of performing the Service and any additional services according to these GTC and the Contract.

5              Cooperation Obligations of the Subscriber

5.1          The Subscriber shall

(a)        not pass on the access details to the Subscriber Account to third parties and shall protect them against third-party access.

(b)        inform mytpt in case of suspected abuse of the App without undue delay.

(c)         only enter data, texts, pictures and other content to the Subscriber Account that comply with applicable law, do not infringe third party rights and that the Subscriber is legally entitled to enter without any restrictions.

5.2          mytpt may monitor the proper contractual use of the App by adopting suitable technical measures in compliance with data protection law and enforcing them if necessary, for instance by restricting access or blocking access or deleting content entered by the Subscriber that infringes applicable law or these GTC. mytpt also reserves the right to change the access details of Subscribers for reasons pertaining to security; in such cases, mytpt will promptly inform the Subscriber of this fact.

5.3          The Subscriber shall communicate any defect of the App to mytpt immediately upon appearance. mytpt shall remedy any duly notified defects appearing in the App within a reasonable period of time.

5.4          Breaches of cooperation obligations can lead to extra expenses for mytpt. The Subscriber must repay these extra expenses except the Subscriber is not responsible for the extra expenses.

6              Service Level

6.1          If mytpt plans to decommission the App in part or in whole at times, mytpt must announce this at least three business days before the planned decommissioning. The Subscriber may only object to this decommissioning if there is good cause, and this objection must be submitted without undue delay. If possible, mytpt will name a replacement time unless the decommissioning cannot be postponed.

6.2          mytpt intends to use state-of-the-art technology and shall be entitled to regularly carry out or introduce updates, new versions or upgrades of the App in order to adapt the App to new technical or commercial requirements, to implement new features, or to make changes to existing features in order to improve the App.

7              Liability and Damages

7.1          mytpt assumes unlimited liability for willful intent and gross negligence on the part of mytpt, its agents and legal representatives; for simple negligence mytpt shall only be liable in the event of breaches concerning cardinal contractual duties.

7.2          Liability for breaches of cardinal contractual duties is restricted to the damages which are typical for this type of contract and which mytpt was able to anticipate when establishing the Contract based on the circumstances known at that time.

7.3          The no-fault based liability pursuant to Section 536 a Paragraph (1) BGB for defects in the software existing at the time of contracting shall be excluded, unless the defect relates to a feature of the software essential for the Service.

7.4          mytpt is only liable for the loss of data according to the above paragraphs if the Subscriber could not have prevented this loss by adopting suitable data backup measures.

7.5          The present limitations of liability do not apply if explicit guarantees have been made, for claims due to a lack of warranted qualities or for damages due to injury of life, body or health. Liability according to the product liability law (Produkthaftungsgesetz) also remains unaffected.

7.6          mytpt accepts no liability for breakdowns of the cloud.

7.7          The Subscriber is obliged to immediately notify any damage pursuant to the above liability provisions to mytpt in text form or to have such damage documented by mytpt, so that mytpt has a chance to mitigate the damage together with the Subscriber.

7.8          This liability arrangement shall also apply in favor of legal representatives and agents of mytpt if claims are asserted directly against them.

8              Limitation of Claims

Claims of the Subscriber based on the breach of any duty not consisting of a defect become time-barred, except in the event of intention or gross negligence, within one year from beginning of the limitation period. This shall not apply if the damage in question incurred by the Subscriber consists in personal injury. Claims for personal injury become statute-barred within the statutory limitation period.

9              Remuneration and payment conditions

9.1          The Subscriber shall pay mytpt the subscription fee as specified on http://pricing.teamdecoder.com at the time of concluding the Contract.

9.2          All prices are net. VAT shall be added where applicable.

9.3          The remuneration shall be due immediately after receipt of the invoice.

9.4          If the Subscriber chooses to pay by Credit Card and, for a reason not within mytpts responsibility, the amount due can not be charged on the Credit Card, Customer is obliged to provide a new payment method or pay the amount according to Section 9.3.

9.5          mytpt’s claim for remuneration shall be independent of whether the Subscriber actually makes use of the App.

9.6          mytpt may, by written notice to the Subscriber, change the subscription fees for the subscription period following the notice. In this case, mytpt will send the notice about the upcoming fee change to the Client at least one month prior to the end of the subscription period in question. This notice represents mytpt’s offer to conclude the following subscription period at the new fees. The Subscriber may terminate the subscription after receipt of the notice to the end of the current billing period. If the Subscriber does not terminate the subscription and makes use of the Service in the following subscription period, the fee change shall be deemed accepted by the Subscriber. 

10            Duration, Termination and Cancellation of Service

10.1   The FREE account runs indefinitely. If the Subscriber wishes to upgrade to a more extensive License, he can do so through his account.

10.2   The Contract for paid licenses is concluded for a fixed term which will automatically renew for periods equal to the original term unless a Party terminates the Contract to the end of the then current term.

10.3   The right to extraordinary termination for good cause remains unaffected. Good cause for mytpt includes, inter alia, any breach of Subscriber’s obligations according to Sections 11 or 12 or any use of the App to an extent exceeding the scope of use agreed in the Contract.

10.4   mytpt may terminate the right to use the free version or make use of any free content at any time.

10.5       Terminations shall be declared through the Subscriber Account (Settings > Manag Account).

11            Data Protection and Data Security

11.1       The Subscriber is aware of the general risk that transmitted data may be intercepted during transmission. This applies not only to the exchange of information via e-mails that leave the system, but also to all other data transmission. For this reason, the confidentiality of data transmitted when using App cannot be guaranteed.

11.2       The Subscriber is obliged to comply with applicable data protection laws with respect to the personal data of third parties, such as other Subscribers, which the Subscriber may obtain when using App. The Subscriber will only use this data for contractual communication or for communication prior to entering into a contract. The Subscriber will instruct all of its executive bodies, employees, representatives and agents accordingly.

11.3       The parties conclude a data processing agreement which is attached hereto as an Annex and forms an integral part of these GTC.

11.4       Any information provided to mytpt that is subject to the General Data Protection Regulation (GDPR) of the EU will be processed according to mytpts Privacy Policy and the Data Processing Agreement. For more information on data privacy visit this site

12            Confidentiality

12.1       “Confidential Information” means all information, data, know-how and experience, whether scientific, technical, engineering, operational, marketing or of a business or economic nature, (including prototypes of mechanical devices, designs, specifications, drawings, plans, manuals, samples of products or parts of products, algorithms, processes, specifications, technical requirements, computer software, source code and object code), whether or not available in writing or any other recorded form, which (i) is marked as confidential or is deemed to be confidential by its nature and (ii) is disclosed or made available during the term of this agreement

12.2       The parties are obliged

(a)        To treat the other party’s Confidential Information as strictly confidential, and only to use such information for the purpose of fulfilling contractual obligations resulting from the contractual relationship with the Subscriber,

(b)        To refrain from passing on or disclosing the other party’s Confidential Information to third parties and to refrain from providing access to Confidential Information for third parties,

(c)         To adopt appropriate measures to prevent unauthorized persons from obtaining access to the other party’s Confidential Information.

12.3       The obligations listed in Paragraph 2 do not apply to Confidential Information

(a)        that was general knowledge or generally accessible to the public before it was disclosed to the other party, or that becomes public without violating any confidentiality obligations;

(b)        that was already known to the receiving party before it was disclosed and it can be demonstrated that no confidentiality obligations were violated;

(c)         that was developed independently by the receiving party without the use or reference of the disclosing party’s Confidential Information;

(d)        that is handed over or made accessible to the receiving party by an authorized third party without violating any confidentiality obligations;

(e)        that must be disclosed due to mandatory statutory provisions or a court decision and/or a decision of an authority.

12.4       The parties shall ensure through suitable contractual arrangements that the employees and contractors working for them shall also, without temporal restriction, refrain from individual use or disclosure of Confidential Information. The parties shall only disclose to employees or contractors Confidential Information to the extent such employees or contractors need to know the information for the fulfilment of the Contract.

12.5       The Subscriber consents that mytpt may disclose the collaboration between the parties for marketing purposes and may also use the company logo of the Subscriber in this context. The Subscriber may revoke this consent at any time by declaration in text form.

12.6       The obligations under Section 12 of this document continue to apply for a period of three years after the termination of the contractual relationship. Statutory provisions concerning the protection of business secrets remain unaffected.

13            Changes to these GTC

mytpt reserves the right to change or amend these GTC in whole or in part with future effect for the following reasons: legal or regulatory reasons, security reasons, to further develop or optimize existing qualities of mytpt services and to add additional qualities, to adapt to technical progress and make technical adjustments, or in order to guarantee the future functionality of the Service provided by mytpt, or to introduce fees. mytpt will inform the Subscriber of any changes, communicating the specific content of the modified provisions with sufficient advance notice at least two weeks before the planned entry into force of the changes. The changes are deemed accepted by the Subscriber if the Subscriber does not object to them within six weeks upon receipt of the notification. In the change notification, mytpt will separately inform the Subscriber concerning the right of objection and the above-mentioned legal consequences of remaining silent.

14            Final provisions

14.1       The Subscriber shall only have a right to set-off, reduction and/or retention against mytpt if its counterclaim has been legally established, undisputed or acknowledged by mytpt. Furthermore, the Subscriber may only exercise a right of retention if the counterclaim is based on the same contractual relationship. The Subscriber’s right to reclaim remuneration not actually owed shall remain unaffected by the limitation of this Section.

14.2       All declarations concerning and amendments to the Contract and these GTC including this form requirement must be submitted in text form (e.g. e-mail). This also applies to amendments of this clause.

14.3       The Contract and these GTC shall be governed by the laws of the Federal Republic of Germany.

14.4       Berlin shall be the place of fulfilment and exclusive place of jurisdiction for all disputes arising out of or in connection with the Contract and these GTC. However, mytpt is entitled to bring legal action at the registered seat of the Subscriber. In case the registered seat of the Subscriber is outside the European Economic Area all disputes arising out of or in connection with the Agreements shall be finally settled in accordance with the Arbitration Rules of the German Arbitration Institute (DIS) without recourse to the ordinary courts of law. The arbitral tribunal shall be comprised of a sole arbitrator. The seat of the arbitration is Berlin, Germany and the language of the arbitration shall be English.

ANNEX: DATA PROCESSING AGREEMENT

between

 

mytpt GmbH

Leipziger Straße 48

10117 Berlin  (Germany)                                                           

-        processor -

and

 

teamdecoder software Licensor

-        controller -

 

 

SECTION I

Clause 1

Purpose and scope

(a)      The purpose of these Data Processing Agreement clauses (the Clauses) is to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

(b)      The parties to the Software-as-a-Service and Development Agreement have agreed to these clauses by incorporating this Data Processing Agreement into the main agreement in order to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679.

(c)      These Clauses apply to the processing of personal data as specified in Appendix  I.

(d)      Appendices I to III are an integral part of the Clauses.

(e)      These Clauses are without prejudice to obligations to which the controller is subject by virtue of Regulation (EU) 2016/679.

Clause 2

Interpretation

(a)      Where these Clauses use the terms defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.

(b)      These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.

(c)      These Clauses shall not be interpreted in a way that runs counter to the rights and obligations provided for in Regulation (EU) 2016/679 or in a way that prejudices the fundamental rights or freedoms of the data subjects.

Clause 3

Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties existing at the time when these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

 

SECTION II – OBLIGATIONS OF THE PARTIES

Clause 4

Description of processing(s)

The details of the processing operations, in particular the categories of personal data and the purposes of processing for which the personal data is processed on behalf of the controller, are specified in Appendix  I.

Clause 5

Obligations of the Parties

5.1. Instructions

(a)      The processor shall process personal data only on documented instructions from the controller, unless required to do so by Union or Member State law to which the processor is subject. In this case, the processor shall inform the controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest. Subsequent instructions may also be given by the controller throughout the duration of the processing of personal data. These instructions shall always be documented.

(b)      The processor shall immediately inform the controller if, in the processor’s opinion, instructions given by the controller infringe Regulation (EU) 2016/679 or the applicable Union or Member State data protection provisions.

 

5.2. Purpose limitation

The processor shall process the personal data only for the specific purpose(s) of the processing, as set out in Appendix  II, unless it receives further instructions from the controller.

 

5.3. Duration of the processing of personal data

Processing by the processor shall only take place for the duration specified in Appendix  I.

 

5.4. Security of processing

(a)      The processor shall at least implement the technical and organisational measures specified in Appendix  II to ensure the security of the personal data. This includes protecting the data against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to the data (personal data breach). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks involved for the data subjects.

(b)      The processor shall grant access to the personal data undergoing processing to members of its personnel only to the extent strictly necessary for implementing, managing and monitoring of the contract. The processor shall ensure that persons authorised to process the personal data received have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

 

5.5. Sensitive data

If the processing involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (“sensitive data”), the processor shall apply specific restrictions and/or additional safeguards.

 

5.6 Documentation and compliance

(a)      The Parties shall be able to demonstrate compliance with these Clauses.

(b)      The processor shall deal promptly and adequately with inquiries from the controller about the processing of data in accordance with these Clauses. 

(c)      The processor shall make available to the controller all information necessary to demonstrate compliance with the obligations that are set out in these Clauses and stem directly from Regulation (EU) 2016/679. At the controller’s request, the processor shall also permit and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or an audit, the controller may take into account relevant certifications held by the processor.

(d)      The controller may choose to conduct the audit by itself or mandate an independent auditor. Audits may also include inspections at the premises or physical facilities of the processor and shall, where appropriate, be carried out with reasonable notice.

(e)      The Parties shall make the information referred to in this Clause, including the results of any audits, available to the competent supervisory authority/ies on request.

 

5.7. Use of sub-processors

(a)      The Processor has the general authorization of the Controller to engage sub-processors listed in Annex III. The Parties shall keep Annex III up to date at all times. The Processor shall expressly notify the Controller in writing at least one week in advance of any intended changes to this list by adding or replacing sub-processors, thereby allowing the Controller sufficient time to object to such changes prior to engaging the relevant sub-processor(s). The Processor shall provide the Controller with the necessary information to enable the Controller to exercise its right to object.

(b)      Where the processor engages a sub-processor for carrying out specific processing activities (on behalf of the controller), it shall do so by way of a contract which imposes on the sub-processor, in substance, the same data protection obligations as the ones imposed on the data processor in accordance with these Clauses. The processor shall ensure that the sub-processor complies with the obligations to which the processor is subject pursuant to these Clauses and to Regulation (EU) 2016/679.

(c)      At the controller’s request, the processor shall provide a copy of such a sub-processor agreement and any subsequent amendments to the controller. To the extent necessary to protect business secret or other confidential information, including personal data, the processor may redact the text of the agreement prior to sharing the copy.

(d)      The processor shall remain fully responsible to the controller for the performance of the sub-processor’s obligations in accordance with its contract with the processor. The processor shall notify the controller of any failure by the sub-processor to fulfil its contractual obligations.

 

5.8. International transfers

(a)      Any transfer of data to a third country or an international organisation by the processor shall be done only on the basis of documented instructions from the controller or in order to fulfil a specific requirement under Union or Member State law to which the processor is subject and shall take place in compliance with Chapter V of Regulation (EU) 2016/679.

(b)      The controller agrees that where the processor engages a sub-processor in accordance with Clause 5.7. for carrying out specific processing activities (on behalf of the controller) and those processing activities involve a transfer of personal data within the meaning of Chapter V of Regulation (EU) 2016/679, the processor and the sub-processor can ensure compliance with Chapter V of Regulation (EU) 2016/679 by using standard contractual clauses adopted by the Commission in accordance with of Article 46(2) of Regulation (EU) 2016/679, provided the conditions for the use of those standard contractual clauses are met.

Clause 6

Assistance to the controller

(a)      The processor shall promptly notify the controller of any request it has received from the data subject. It shall not respond to the request itself, unless authorised to do so by the controller.

(b)      The processor shall assist the controller in fulfilling its obligations to respond to data subjects’ requests to exercise their rights, taking into account the nature of the processing. In fulfilling its obligations in accordance with (a) and (b), the processor shall comply with the controller’s instructions

(c)      In addition to the processor’s obligation to assist the controller pursuant to Clause 6(b), the processor shall furthermore assist the controller in ensuring compliance with the following obligations, taking into account the nature of the data processing and the information available to the processor:

(1) the obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (a ‘data protection impact assessment’) where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons;

(2) the obligation to consult the competent supervisory authority/ies prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk;

(3) the obligation to ensure that personal data is accurate and up to date, by informing the controller without delay if the processor becomes aware that the personal data it is processing is inaccurate or has become outdated;

(4) the obligations in Article 32 Regulation (EU) 2016/679/.

(d)      The Parties shall set out in Appendix  II the appropriate technical and organisational measures by which the processor is required to assist the controller in the application of this Clause as well as the scope and the extent of the assistance required.

Clause 7

Notification of personal data breach

In the event of a personal data breach, the processor shall cooperate with and assist the controller for the controller to comply with its obligations under Articles 33 and 34 Regulation (EU) 2016/679, where applicable, taking into account the nature of processing and the information available to the processor.

 

7.1 Data breach concerning data processed by the controller

In the event of a personal data breach concerning data processed by the controller, the processor shall assist the controller:

(a)      in notifying the personal data breach to the competent supervisory authority/ies, without undue delay after the controller has become aware of it, where relevant/(unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons);

(b)      in obtaining the following information which, pursuant to  Article 33(3) Regulation (EU) 2016/679/, shall be stated in the controller’s notification, and must at least include:  

(1) the nature of the personal data including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

(2) the likely consequences of the personal data breach; 

(3) the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

(c)      in complying, pursuant to  Article 34 Regulation (EU) 2016/679, with the obligation to communicate without undue delay the personal data breach to the data subject, when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.

 

7.2 Data breach concerning data processed by the processor

In the event of a personal data breach concerning data processed by the processor, the processor shall notify the controller without undue delay after the processor having become aware of the breach. Such notification shall contain, at least:

(a) a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects and data records concerned);

(b) the details of a contact point where more information concerning the personal data breach can be obtained;

(c) its likely consequences and the measures taken or proposed to be taken to address the breach, including to mitigate its possible adverse effects.

Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

The Parties shall set out in Appendix  III all other elements to be provided by the processor when assisting the controller in the compliance with the controller’s obligations under Articles 33 and 34 of Regulation (EU) 2016/679.

 

 

SECTION III – FINAL PROVISIONS

Clause 8

Non-compliance with the Clauses and termination

(a)      Without prejudice to any provisions of Regulation (EU) 2016/679, in the event that the processor is in breach of its obligations under these Clauses, the controller may instruct the processor to suspend the processing of personal data until the latter complies with these Clauses or the contract is terminated. The processor shall promptly inform the controller in case it is unable to comply with these Clauses, for whatever reason.

(b)      The controller shall be entitled to terminate the contract insofar as it concerns processing of personal data in accordance with these Clauses if:

(1) the processing of personal data by the processor has been  suspended by the controller pursuant to point (a) and if compliance with these Clauses is not restored within a reasonable time and in any event within one month following suspension;

(2) the processor is in substantial or persistent breach of these Clauses or its obligations under Regulation (EU) 2016/679;

(3) the processor fails to comply with a binding decision of a competent court or the competent supervisory authority/ies regarding its obligations pursuant to these Clauses or to Regulation (EU) 2016/679.

(c)      The processor shall be entitled to terminate the  contract insofar as it concerns processing of personal data under these Clauses where, after having informed the controller that its instructions infringe applicable legal requirements in accordance with Clause 5.1 (b), the controller insists on compliance with the instructions.

(d)      Following termination of the contract, the processor shall, at the choice of the controller, delete all personal data processed on behalf of the controller and certify to the controller that it has done so, or, return all the personal data to the controller and delete existing copies unless Union or Member State law requires storage of the personal data. Until the data is deleted or returned, the processor shall continue to ensure compliance with these Clauses.

 

Clause 9

Place of jurisdiction and applicable law

(a)      Place of performance is Berlin (Germany). The exclusive place of jurisdiction for all disputes arising from this contract or in connection with this contract or this service shall be Berlin.

(b)      The law of the Federal Republic of Germany shall apply, excluding the conflict-of-law rules of private international law and excluding the UN Convention on Contracts for the International Sale of Goods.


 

 

ANNEX I: DESCRIPTION OF THE PROCESSING

 

1.     Categories of data subjects whose personal data is processed

 

Customers, employees of Customers or their clients.

 

2.     Categories of personal data processed

 

The categories of personal data that are processed depend on the respective main agreement, but may include in particular:

 

Names, job descriptions and job roles, hierarchies, email addresses, optionally phone numbers.

 

3.     Nature of the processing

 

The type of data processing is determined by the respective main agreement.

 

4.     Purpose(s) for which the personal data is processed on behalf of the controller

 

The purpose of the data processing is determined by and can be found in the respective main agreement, but is in particular:

 

Team transformation management software to build, document and develop organizational structures.

 

5.     Duration of the processing

 

The duration of the data processing shall correspond with the respective Agreement between the Parties.

 


 

APPENDIX  II: see below

 


 

APPENDIX  III: LIST OF SUB-PROCESSORS

 

Name of Subcontractor
IONOS


Address
IONOS SE

Elgendorfer Str. 57

56410 Montabaur


Work to be performed
Hosting





 

 

 


ANNEX II: TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

1. Pseudonymization (Art. 32 para. 1 lit. a GDPR; Art. 25 para. 1 GDPR).

The processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information, provided that this additional information is kept separately and is subject to appropriate technical and organizational measures:


 

2. Encryption (Art. 32 para. 1 lit. a GDPR)

Cryptographic measures by which personal data are modified in such a way that they can no longer be read or understood without a key, especially during their transmission:


 

3. Confidentiality (Art. 32 para. 1 lit. b GDPR)

 

 


 


 

4. Integrity (Art. 32 para. 1 lit. b GDPR)


 


 

5. Availability and resilience (Art. 32 para. 1 lit. b GDPR)


Cloud servers hosted by IONOS:


 

6. Procedures for regular review, assessment and evaluation (Art. 32 (1) (d) GDPR; Art. 25 (1) GDPR)