General Terms and Conditions

1.1 Parties: COBACK GmbH, Pfarrgasse 4, 01067 Dresden, Germany („COBACK“), offers business customers software-as-a-service solutions to automate compliance, reporting, and sustainability processes. The parties to the contract are COBACK and the company named in the respective offer, individual offer, or individual contract („Customer“). COBACK and the Customer are jointly referred to as the „Parties“.

1.2 Conclusion of contract: The contract is concluded by accepting an offer or individual offer issued by COBACK, by entering into a separate individual contract, or by concluding an online subscription via the COBACK platform. Upon conclusion, the Customer accepts these terms as a binding part of the contract. The contract consists of the respective offer, individual offer, or individual contract together with the annexes referenced therein, including these terms.

1.3 Scope: These terms govern the provision and use of the services and products offered by COBACK, in particular the cloud-based software platform, its functions, modules, data-processing operations, and any expressly agreed additional services („Services“). Conflicting, deviating, or supplementary terms of the Customer do not apply, even if COBACK does not expressly object to them.

„Subscription term“ means the term of the right to use the cloud services as set out in the respective offer, individual offer, or individual contract, including any renewals.

„Authorised user“ means any natural person to whom the Customer grants access to use the Services within the agreed scope, in particular employees, freelancers, agents, or representatives of the Customer or an affiliated company.

„Cloud service“ means any subscription-based, hosted software solution operated and supported by COBACK and provided to the Customer under the contract.

„Documentation“ means the descriptions, usage notes, technical explanations, or functional materials provided by COBACK in relation to the Services.

„Customer data“ means all content, data, documents, records, files, and information that the Customer or an authorised user uploads, enters, processes, or generates while using the Services, including report-specific content.

„Materials“ means all content, documentation, templates, analyses, models, technical structures, interfaces, user flows, and other work results provided or developed by COBACK in performing the contract. Customer data and the Customer’s confidential information are not Materials.

„Usage metric“ means the agreed measure for determining the permitted scope of use and, where applicable, for calculating fees, e.g. number of users, modules, reports, processing volume, or other units.

„Services“ comprises the cloud services provided by COBACK and any expressly agreed supplementary services.

„Affiliated companies“ of a party are legal entities in which that party directly or indirectly holds more than 50 % of the shares or voting rights or which are under corresponding control.

„Contract“ means the respective offer, individual offer, or individual contract including all referenced annexes and these terms.

„Confidential information“ means all information of a party that is designated as confidential or is by its nature to be regarded as confidential, in particular, for the Customer, business records, financial data, internal processes, documents, personal data, and uploaded content, and for COBACK, the Services, source and structure information, models, prices, product development, documentation, Materials, and non-public product information.

The subject of the contract is the provision of the Services ordered by the Customer and agreed in the contract.

In particular, COBACK provides the Customer with a cloud-based software platform with which documents, invoices, company data, and other information can be processed, analysed in a structured manner, and prepared for compliance, reporting, and sustainability purposes.

Unless expressly agreed otherwise, COBACK owes no tax advice, legal advice, audit, or other advisory service requiring authorisation.

4.1 Scope of services: The specific scope and functionality of the Services derives exclusively from the contract including its annexes. Statements, depictions, or descriptions in presentations, on websites, in advertising materials, pitch documents, demos, or other communications outside the contract are not part of the contract and constitute no guarantee, agreement on characteristics, or assurance of specific properties. Where COBACK provides Services free of charge or for testing, these serve evaluation and test purposes only.

4.2 Warranty: COBACK provides the Services with the care that can be expected from a qualified provider of cloud-based enterprise software. Unless expressly agreed otherwise, COBACK does not warrant that the Services are fit for a particular purpose pursued by the Customer, interoperate flawlessly with third-party software, or are available without interruption and error. The assured scope does not apply where deviations result from the Customer not using the Services as agreed, from errors attributable to incomplete, incorrect, or unsuitable customer data, or from impairments caused by systems, interfaces, software, hardware, or services of third parties. Where legally permissible, warranty claims become time-barred within one year from the statutory commencement of the limitation period.

4.3 Priority of cure: If the Customer is entitled to assert rights due to a defect, COBACK first has the right to cure within a reasonable period, at its choice by rectification, replacement provision, workaround, or other suitable measures. Before exercising further rights, the Customer must give COBACK the opportunity to cure, unless this is legally dispensable.

4.4 Availability: Where no separate service-level agreement has been made, COBACK owes an industry-standard availability of the Services within what is technically and operationally reasonable. Excluded are in particular scheduled maintenance windows, security updates, technical enhancements, disruptions of general telecommunications infrastructure, and circumstances beyond COBACK’s control.

5.1 Use for contractual purposes only: The Customer uses the Services only within the agreed scope, for the intended business purposes, and in compliance with all applicable laws. The Customer refrains from any use that could impair the functionality, integrity, or security of the Services.

5.2 Customer data: The Customer is responsible for the entry, upload, quality, legality, accuracy, and completeness of the customer data. COBACK is not obliged to review the content materially, legally, or professionally. The Customer grants COBACK and any subcontractors the non-exclusive right to use and process customer data to the extent necessary to provide the Services. The Customer remains the owner of the rights to its customer data.

5.3 Access to customer data: During the contract term, the Customer can access its customer data within the available functions. After the contract ends, the Customer is given, upon request and within a reasonable period, the opportunity to export its customer data in a common format, where technically possible and economically reasonable.

5.4 Security: The Customer takes appropriate technical and organisational measures to prevent unauthorised access to its user accounts and the Services. Access credentials must be kept confidential; the Customer is liable for use of its access attributable to it.

5.5 Usage metrics: The Customer may use the Services only within the agreed usage metrics. COBACK is entitled to monitor usage to the extent necessary for billing, abuse prevention, system security, or control of the agreed scope. The Customer refrains from measures to circumvent technical restrictions, usage metrics, or security mechanisms.

6.1 Provision and support: COBACK grants the Customer’s authorised users access to the Services within the agreed scope and provides support within the agreed scope.

6.2 Security: COBACK takes appropriate technical and organisational measures to ensure the confidentiality, integrity, and availability of the customer data and Services within what is technically and economically reasonable.

6.3 Changes, updates, and enhancements: COBACK is entitled to continuously enhance, update, or modify the Services, provided the essential contractual functions are not unreasonably impaired. If changes exceptionally lead to a significant restriction of essential functions and COBACK cannot remedy this within a reasonable period, the Customer is entitled to terminate the affected Service for cause.

7.1 Right of use: For the term of the contract, COBACK grants the Customer a simple, non-exclusive, non-transferable, and non-sublicensable right to access the Services and use them for its own business purposes. Use for third parties is permitted only where expressly agreed.

7.2 Authorised users: Use is limited to the authorised users named by the Customer and the agreed scope. Access credentials may not be used by several persons simultaneously. The Customer is responsible for all actions of its authorised users attributable to it.

7.3 Impermissible use: The Customer is in particular prohibited from reproducing, renting, leasing, selling, or making the Services available to third parties, circumventing security mechanisms or access restrictions, carrying out reverse engineering, decompilation, or similar measures (unless mandatorily permitted by law), and using the Services abusively or unlawfully.

7.4 Third-party services: The Services may contain interfaces, integrations, or connections to third-party offerings. Third-party services are not part of COBACK’s main contractual performance unless expressly agreed otherwise; COBACK assumes no responsibility for their availability, content, or function.

8.1 Term: The contract term derives from the respective offer, individual offer, or individual contract.

8.2 Ordinary termination: A right to ordinary termination exists only if and to the extent expressly provided for in the contract.

8.3 Termination for cause: Either party may terminate the contract for cause, in particular where the other party fails to remedy a breach of a material obligation within a reasonable period, in the event of serious breaches of confidentiality, data-protection, or usage provisions, in the event of insolvency of the other party, or upon a legal or regulatory prohibition of continued performance.

8.4 Consequences of termination: Upon termination, the Customer’s right to use the Services ends. Both parties return or destroy the other party’s confidential information upon request, unless statutory retention obligations apply.

8.5 Data export after the contract ends: COBACK supports the Customer to a reasonable extent in exporting its customer data, where technically possible. Further migration services are provided only where expressly agreed.

8.6 Survival: Provisions on confidentiality, data protection, intellectual property, liability, remuneration for services already rendered, jurisdiction, and final provisions survive the end of the contract where their purpose so requires.

9.1 Fees: The amount of the fees derives from the contract. Unless stated otherwise, all prices are net plus the applicable statutory VAT.

9.2 Recurring fees: Recurring fees fall due in advance in accordance with the agreed billing interval or as provided in the contract.

9.3 One-off fees: Agreed one-off fees, e.g. for setup, onboarding, data migration, or additional modules, are invoiced separately under the contract.

9.4 Invoicing and payment: Invoicing is electronic to the email address named by the Customer. Invoices are due within 14 days of invoicing without deduction, unless the contract provides otherwise. In the event of default, COBACK is entitled to claim statutory default interest.

9.5 Suspension in the event of default: If the Customer fails to pay despite a reminder and a reasonable grace period, COBACK is entitled to temporarily restrict or suspend access to the Services until all outstanding amounts are settled.

9.6 Set-off and retention: The Customer is entitled to set-off or retention only where its counterclaims have been finally established, are undisputed, or have been acknowledged by COBACK.

10.1 COBACK rights: COBACK and, where applicable, its licensors own all rights to the Services, the documentation, the Materials, the software architecture, models, algorithms, user interfaces, data structures, and other content provided or developed by COBACK. Unless rights are expressly granted to the Customer, all rights remain with COBACK.

10.2 Customer rights to customer data: The Customer retains all rights to its customer data.

10.3 IP rights: The Customer undertakes not to challenge COBACK’s rights and not to file any IP applications based on COBACK Materials, Services, or structures derived therefrom.

COBACK is entitled to evaluate information from the use of the Services in anonymised and aggregated form in order to enhance the Services technically and functionally, improve product quality, user flow, and system performance, optimise internal planning, security, and resource allocation, and develop models, automations, AI-assisted features, and benchmarks.

Such evaluations may not contain directly identifiable customer data or personal data unless a separate legal basis or agreement exists.

12.1 Confidential treatment: The parties treat all confidential information of the other party as strictly confidential and use it only for the purposes of the contract. It may be disclosed only to employees, advisors, or service providers who need it to perform the contract and are themselves appropriately bound to confidentiality.

12.2 Protective measures: Each party protects the other party’s confidential information with at least the same care as its own, but at least with reasonable commercial care.

12.3 Exceptions: The confidentiality obligation does not apply to information that is generally known or publicly available without breach of contract, was already lawfully known to the receiving party, was lawfully disclosed by a third party without a confidentiality obligation, was independently developed, or must be disclosed due to a legal obligation or an official or court order.

12.4 Duration: The confidentiality obligations apply during the contract term and for five years after the contract ends.

13.1 IP claims against the Customer: If third parties assert claims against the Customer due to the contractual use of the Services, the Customer informs COBACK without delay and supports it reasonably in its defence. COBACK may, at its choice, obtain a sufficient right of use, adapt the Services so that no third-party rights are infringed, or terminate the affected Service for cause where continuation is not reasonable.

13.2 Indemnification by the Customer: If claims are asserted against COBACK by third parties based on customer data, its use, or content provided by the Customer, the Customer indemnifies COBACK on first demand, to the extent it is at fault.

14.1 Unlimited liability: The parties’ liability is unlimited for intent or gross negligence, for injury to life, body, or health, for claims under the Product Liability Act, for mandatory statutory liability, and for intentional breaches of data-protection or confidentiality obligations.

14.2 Liability for slight negligence: In the case of slight negligence, COBACK is liable only for the breach of material contractual obligations (cardinal obligations); in this case, liability is limited to the foreseeable damage typical for the contract.

14.3 Liability cap: Where legally permissible and subject to clause 14.1, COBACK’s total liability within a contract year is limited to the annual fees paid by the Customer for the affected Services in the relevant twelve-month period.

14.4 Exclusion of indirect damages: Where legally permissible, liability for indirect damages, consequential damages, lost profit, lost savings, business interruption, and reputational damage is excluded.

14.5 No liability for customer data: COBACK is not liable for errors, delays, or inaccurate results that result from faulty, incomplete, unsuitable, or late customer data.

Neither party is liable for delays or failures to perform due to force majeure, in particular natural disasters, war, strikes, pandemics, official measures, failures of telecommunications networks, or other unforeseeable events beyond the respective party’s control.

Performance obligations are suspended for the duration of the event. If a force-majeure event lasts longer than two months, either party is entitled to terminate the contract for cause.

16.1 Roles: Where COBACK processes personal data on the Customer’s behalf, COBACK acts as processor and the Customer as controller.

16.2 Compliance with data-protection law: Both parties comply with applicable data-protection laws, in particular the General Data Protection Regulation and the German Federal Data Protection Act.

16.3 Processing agreement: Where necessary, the parties conclude a separate data-processing agreement pursuant to Art. 28 GDPR.

Additional services beyond the mere provision of the cloud services, in particular setup, onboarding, data migration, customising, training, or other supporting services, are owed only where expressly agreed in the contract. Unless agreed otherwise, these terms also apply accordingly to such additional services.

The parties comply with all applicable export-control, embargo, and sanctions regulations of the Federal Republic of Germany, the European Union, and other applicable jurisdictions.

The Customer warrants that neither it nor companies controlled by it nor beneficial owners are listed on relevant sanctions lists and that the Services are not used, passed on, or made available in breach of export-control requirements.

19.1 Entire agreement: The contract including these terms constitutes the complete agreement between the parties regarding the subject matter and supersedes all prior arrangements, declarations, or correspondence relating thereto.

19.2 Severability: If individual provisions are wholly or partly invalid, unenforceable, or void, the validity of the remaining provisions is unaffected. The parties replace the invalid provision with a valid one that comes closest to its economic purpose.

19.3 Form and notices: Unless otherwise provided, notices may be made in text form, in particular by email. Electronic signatures and acceptances are valid where legally permissible.

19.4 Changes to the terms: COBACK is entitled to change these terms with effect for the future where required for legal, technical, or operational reasons and where this does not unreasonably disadvantage the Customer. Changes are notified in good time; if the Customer does not object within a reasonable period, they are deemed accepted, provided COBACK expressly pointed this out in the notice.

19.5 Assignment: The Customer may assign or transfer rights and obligations under the contract only with COBACK’s prior written consent. COBACK is entitled to transfer the contract to an affiliated company.

19.6 Subcontracting: COBACK is entitled to use subcontractors to perform its obligations and remains responsible to the Customer for their performance, where legally permissible.

19.7 Compliance with laws: Each party ensures compliance with the laws and regulations applicable to it in connection with the contract.

19.8 Relationship of the parties: The parties act as legally independent contractual partners. No company, agency, employment, franchise, or joint-venture relationship is created.

19.9 Governing law and jurisdiction: The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods. The exclusive place of jurisdiction for all disputes arising from or in connection with the contract is, where legally permissible, COBACK’s registered seat (Dresden).