General Terms and Conditions (EU) - FLIP GmbH

Preamble

Flip GmbH, Rotebühlstraße 50, 70178 Stuttgart, Germany (the “Provider”) operates the employee platform “Flip” (the “Software Service” or the “Platform”). The Provider’s customers are exclusively entrepreneurs within the meaning of section 14 of the German Civil Code (BGB), legal persons under public law or special funds under public law that wish to use the Platform for internal communication and collaboration, in particular with employees who do not work at a desk (frontline employees). The Platform can be extended by additional modules (for example Frontline Identity, Flip Fusion), for which special terms may apply in addition.

These General Terms and Conditions are the Provider’s English-language terms for customers established in the European Union or the European Economic Area outside Germany. They are binding in this English version. Customers established in Germany contract on the Provider’s German-language Allgemeine Geschäftsbedingungen; customers established in the United Kingdom or the United States contract on the Provider’s respective General Terms and Conditions (UK) or (US).

1. Definitions

“Authorised Users” / “Users” means the natural persons designated by the Customer under clause 4.

“DPA” means the single, consolidated data processing agreement under Art. 28 GDPR including its annexes and the applicable EU, UK, Switzerland and US modules, in the version published at the time the contract is concluded, available online at https://www.getflip.com/legal/dpa-eu/.

“Order Form” means an offer or order document or an online order specifying the software service to be provided under this agreement, concluded between the Customer and either the Provider or a Reseller or one of their affiliates, including all supplements and addenda thereto.

“Documentation” means the Provider’s current, generally made available user and system documentation.

“Customer” means, where an individual accepts this agreement on behalf of a company or other legal entity, that company or other legal entity for which that individual accepts this agreement, and the affiliates of that company or legal entity (for as long as they remain affiliates) which have completed Order Forms.

“Customer Content” or “Customer Data” means all data, content and materials which the Customer or Authorised Users provide or have generated in the course of using the Software Service.

“Modules” means additionally bookable service components in accordance with the Service Description or the special terms.

“Usage Data” means technical information arising from use of the services (for example logs, telemetry and aggregated usage metrics) which identifies neither the Customer nor any natural person; identifying Customer Content is excluded.

“Reseller” means a third party engaged and authorised by the Provider which resells services to the Customer.

“Service Description” means the document containing a description of the respective Software Service, in the version published at the time the contract is concluded, available online at https://www.getflip.com/legal/softwaredescription/ (Flip platform), https://www.getflip.com/legal/softwaredescription-flows/ (Flip Flows), https://www.getflip.com/legal/softwaredescription-fusion/ (Flip Fusion), https://www.getflip.com/legal/softwaredescription-identity/ (Frontline Identity by Flip) and https://www.getflip.com/legal/softwaredescription-gyde/ (gyde). Where no Service Description is available on the Provider’s website for the offering to be purchased, the Documentation is deemed to be the “Service Description” for the purposes of this agreement.

“Service” or “Software Service” means the products and services ordered by the Customer via an Order Form or an online purchasing portal, or made available to the Customer online by the Provider free of charge (as applicable) or as part of a free trial.

“SLA” means the service level agreement applicable to the Software Service ordered, in the version published at the time the contract is concluded, available online at https://www.getflip.com/legal/sla-eu/ (Flip platform) and https://www.getflip.com/legal/sla-identity-eu/ (Frontline Identity by Flip).

“Switching Support” means the document “Support for Provider Switching (EU)” in the version published at the time the contract is concluded, available online at https://www.getflip.com/legal/support-for-provider-switching-eu/.

2. Subject matter, services and responsibilities of the Provider

2.1 The subject matter of the contract is the Provider’s services governed by this clause 2; the Provider performs them in accordance with these General Terms and Conditions (the “Terms”), the applicable Order Form and the Service Description. The Provider will provide the Software Service in compliance with the laws and regulatory requirements which apply generally to the provision of the software services by the Provider to its customers (that is, irrespective of the Customer’s particular use of the software services) and subject to use by the Customer and the Users in accordance with these Terms, the applicable Service Description and the applicable Order Form.

2.2 The contract is formed as soon as the Customer accepts the Order Form in text form within the acceptance period stated therein. Where the parties agree a later commencement date, the contract is formed at the earliest on that date. Where an affiliate of the Customer concludes its own Order Form referring to these Terms, it becomes a party to the contract thereby established upon that Order Form taking effect; the rights and obligations under these Terms apply to it as if it were an original contracting party. Consent under clause 18.3 is not required for this; clause 18.3 remains unaffected in respect of the transfer of existing contracts.

2.3 Conflicting, deviating or supplementary terms of the Customer become part of the contract only where the Provider has expressly consented to their application in writing. Acceptance of orders, performance of services or reference to the Customer’s documents do not constitute such consent. The Customer’s purchasing conditions or order forms have administrative significance only.

2.4 Where the Customer books additional Modules or features during the term, this is done by way of a separate Order Form or addendum; these Terms continue to apply and are supplemented or modified only to the extent expressly provided for by the special terms of the relevant Module.

2.5 The Provider makes the Software Service available to the Customer and the Authorised Users in its current version, to the agreed extent, as software as a service via the internet; there is no entitlement to the provision or retention of any particular earlier version. Use requires the Provider’s initial setup and onboarding of the Customer with the Customer’s cooperation (clause 6); details, the timetable and any one-off fees are set out in the Order Form. The scope of functions and the quality follow conclusively from the Order Form (including the service packages and Modules agreed therein) in conjunction with the Service Description; public statements, advertising or product announcements do not constitute an agreement as to quality. The handover point is the router output of the data centre used by the Provider. Provision of the Flip platform comprises access to the Flip web app via the current versions of common web browsers and via the Flip Android app and the native iOS app, operation of the platform, and hosting in a data centre in Europe secured in accordance with the current state of the art. The platform is provided for the number of user accounts agreed in the Order Form. The Provider carries out daily data backups and is responsible for release management; details, in particular backup intervals, retention periods and restore times, follow from the Service Description and the SLA.

2.6 The Provider provides support services in accordance with the Order Form and the SLA, where applicable by way of remote diagnostics. The Provider will use commercially reasonable efforts to make the Software Service available in accordance with the SLA, with the exception of (i) software services for which there is no SLA, (ii) planned downtime of which the Provider gives advance notice electronically, and (iii) any unavailability caused by circumstances outside the Provider’s reasonable control, for example force majeure, acts of authorities, floods, fire, earthquakes, civil unrest, terrorist attacks, strikes or other labour disputes (other than those involving the Provider’s employees), failures or delays of internet service providers, of third-party applications, or denial-of-service attacks.

2.7 The Provider performs consultancy, implementation, training and other services (“Professional Services”) in accordance with the Order Form or separate statements of work (SOW) as services within the meaning of sections 611 et seq. BGB, unless a particular result is expressly agreed. All rights in the work results arising in this context belong to the Provider; the Customer receives a simple, non-exclusive right of use in respect of them for internal purposes for the term of the contract, unless otherwise agreed in the SOW. The Provider remains free to provide comparable services to third parties.

2.8 Subject to express agreement in the Order Form, the following are not owed: individual extensions or adaptations of the Software Service, compliance with customer-specific or sector-specific regulatory requirements, and ongoing user administration including the manual resetting of passwords.

2.9 The Provider may develop, modify and update the Software Service (for example by new versions, updates or changed user interfaces), provided that this does not materially adversely affect the core functionality in accordance with the Service Description. The provisions of this contract apply accordingly to new versions, upgrades and updates. The Customer has no claim to the provision of new, separately marketed Modules. Where the Provider discontinues a material function of the Software Service without replacement, it will give at least six (6) months’ notice in text form; where the discontinuation materially affects the core functionality under the Service Description, the Customer may terminate the affected part of the services for extraordinary cause with effect from the date the discontinuation takes effect. Changes required to comply with statutory requirements or to remedy a material security risk remain unaffected.

2.10 The Provider may perform services in whole or in part through subcontractors; it remains responsible for performance of the contract.

2.11 Where the Provider expressly makes features available free of charge for testing as beta, pilot, preview, early access or under a comparable designation, these do not form part of the services owed. Neither the SLA nor the availability and functionality commitments of this contract apply to them; the Provider may change or discontinue them at any time and is not obliged to make them generally available. The Provider’s liability is limited in this respect to intent and gross negligence; clause 15.1 remains unaffected. In all other respects the provisions of this contract, in particular on confidentiality, information security and data protection, also apply to beta and pilot features. The engagement of sub-processors within the meaning of data protection law is governed exclusively by the DPA.

3. AI features

3.1 The Software Service may contain features based on artificial intelligence (“AI”) (for example assistance, search, translation and generation features; the “AI Features”). Which AI Features are made available follows from the Service Description or the special terms of the relevant Module. Where provided for therein, the Customer may activate and deactivate AI Features at tenant level.

3.2 AI Features produce outputs on a probabilistic basis. The parties agree as a matter of quality that AI-generated outputs may be substantively incorrect, incomplete or unsuitable and require review by the Customer before being used externally or for decisions with legal effect. The Provider owes the provision of the AI Feature in accordance with the Service Description, not the substantive accuracy of individual outputs.

3.3 The parties comply with the obligations of Regulation (EU) 2024/1689 (the “AI Act”) applicable to them respectively. The Customer does not use AI Features for practices prohibited under Art. 5 of the AI Act, nor as or for high-risk AI systems within the meaning of Art. 6 in conjunction with Annex III of the AI Act (in particular not for the automated assessment, monitoring or management of employees). The Provider fulfils the transparency obligations incumbent on it as a provider within the meaning of Art. 3(3) of the AI Act under Art. 50(1) and (2) of the AI Act, in particular by product-side labelling of AI interaction and by machine-readable marking of AI-generated content, insofar as this is technically feasible and not exempt under Art. 50(2) of the AI Act. The Customer fulfils the obligations incumbent on it as a deployer on its own responsibility, in particular under Art. 26 and Art. 50(3) and (4) of the AI Act, and will neither remove nor suppress product-side labelling. The Customer ensures that outputs of AI Features are reviewed as to substance by a natural person before being used externally or before a decision with legal or employment-related effect. The information and involvement of employees, employee representatives and works councils required under applicable law is the Customer’s responsibility.

3.4 The Provider does not use the Customer’s personal data to train, fine-tune or improve AI models; details, including the use of anonymised data, are governed by the DPA.

4. Authorised Users, user accounts

4.1 The Customer may, at its discretion and up to the number of licences agreed in the Order Form, designate as Authorised Users natural persons who are employees of the Customer. The Customer may also permit use in the same environment, by way of sublicensing and to the contractually agreed extent, to undertakings affiliated with it within the meaning of the applicable company law and to their employees, and to persons otherwise particularly connected to the Customer (for example applicants, alumni, temporary agency workers and engaged external service providers), provided that it has notified the Provider and no further setup or onboarding by the Provider is required. The Customer is answerable for compliance with the contract by affiliates as for its own conduct. Where additional setup or onboarding is required, the Provider is entitled to charge additional fees in accordance with its current price list. The designation of employees or agents of competitors of the Provider is not permitted. Each user account may be used by one authorised person only.

4.2 The Customer (i) is responsible for compliance with the contract by the Authorised Users and for all acts carried out via their accounts, unless these result from a breach of duty by the Provider; (ii) obliges the Authorised Users to use the service in accordance with the contract; and (iii) informs the Provider without undue delay of any unauthorised use of accounts or credentials. Credentials must be treated as confidential. The assignment, reassignment and withdrawal of user accounts is the Customer’s responsibility via the admin console.

4.3 Only the Customer may claim performance under the contract. The parties agree that the creation of user accounts and the provision of content or functions to Authorised Users neither establishes a contract for the benefit of third parties nor is intended to confer contractual protective effect in favour of the Authorised Users or other third parties. Statutory claims of third parties remain unaffected.

5. Rights of use, restrictions on use

5.1 For the term of the contract the Customer receives the simple, non-exclusive, non-transferable and (subject to clause 4) non-sublicensable right to use the Software Service for its own internal business purposes in accordance with the contract and the Documentation. The software is not physically supplied. Initial provision of the Software Service is subject to receipt of the first payment due under the Order Form; in all other respects, in the event of default in payment, the Provider’s rights under clause 8 apply. The Customer may use the Software Service worldwide, except from countries in which use is not permitted under the applicable import, export control or sanctions law.

5.2 The Customer is prohibited from (i) making the Software Service available to third parties outside the contractually envisaged group of users, whether against payment or free of charge; (ii) reproducing, modifying, reverse engineering or decompiling the software or determining its source code, except where this is mandatorily permitted by law; (iii) using the Software Service to build a competing product or for benchmarking for the benefit of competitors; (iv) circumventing security mechanisms, carrying out vulnerability scans without the Provider’s prior consent, or impairing the operation of the Software Service; (v) posting unlawful content or using the Software Service unlawfully.

5.3 Access to the Software Service is personal to the individual. Use of one access by several persons, and generic or shared logins, are not permitted where this circumvents the agreed number of user accounts. The same applies to indirect access to the Software Service or its content via upstream portals, interfaces or automations for the benefit of persons who are not Authorised Users. Technical service accounts for automating processes initiated by Authorised Users remain permitted, as do kiosk, noticeboard and display devices, where the Order Form provides for such forms of use. Use by the Customer’s affiliates remains unaffected in accordance with the Order Form and is not restricted by this clause.

5.4 The Software Service may contain open-source components; the respective open-source licence terms apply to these in addition, and the Provider identifies them on request or in the Documentation.

5.5 Where the Customer makes a customer-specific (branded) app available via an app store in accordance with the Order Form, the Customer is responsible for compliance with the respective app store terms, unless the Provider has assumed publication as a managed service.

6. Customer’s obligations to cooperate

6.1 The Customer supports the Provider to the extent necessary for performance of the services. In particular it will (i) provide required information, data, interfaces and contacts in good time; (ii) designate an email distribution list for maintenance announcements and emergency communication; (iii) report defects and incidents without undue delay and in comprehensible form; (iv) create the technical prerequisites required for use within its own area of responsibility (system requirements in accordance with the Service Description) and protect its IT systems against malware in accordance with the state of the art; (v) not unreasonably delay required approvals. To the extent and for as long as the Customer fails to provide required cooperation, the Provider is released from the performance obligations dependent on it; agreed deadlines are extended reasonably.

6.2 The Customer is responsible for ensuring that its use of the Software Service, including the processing of Customer Content, is compatible with the law applicable to it (including data protection law and employee co-determination). The Provider does not provide legal advice; template texts provided by the Provider as a courtesy (for example terms of use or privacy notices for users) are non-binding examples which the Customer must review and adapt on its own responsibility.

7. Fees

7.1 The Customer pays the fees agreed in the Order Form. The fees for the Software Service are determined in particular by the agreed user package (maximum number of user accounts) and the Modules booked and are invoiced annually in advance unless otherwise agreed. Where more than two weeks elapse between conclusion of the contract and completion of onboarding, the obligation to pay fees for the Software Service does not apply for the period until onboarding is completed, to the extent the Provider is responsible for the delay. One-off fees (for example setup) fall due upon conclusion of the contract. Professional Services are invoiced on a time-and-materials basis at the rates agreed in the Order Form or at the Provider’s then-current rates.

7.2 The user package is firmly agreed for the agreed term; the payment obligation exists irrespective of actual use. A change to a smaller user package during the agreed contract term and any pro-rata refund are excluded.

Where the number of user accounts created exceeds the agreed user package at any time, the Provider notifies the Customer in text form. The Customer may reduce the number of user accounts within 30 days of receipt of the notice. In the notice the Provider expressly draws attention to the deadline and to the fact that a failure to reduce is deemed to be consent to an increase of the user package. Otherwise the user package increases upon expiry of the deadline by the number of additional users. The price per user account and month agreed in the Order Form applies to additional users. The additional fee is calculated pro rata from the month of the increase until the end of the current contract year and is invoiced with the next annual invoice. From the following contract year the increased user package forms the basis of the fees.

7.3 Unless otherwise agreed, invoices are due for payment without deduction within 30 days of receipt. All prices are exclusive of statutory value added tax. The Provider issues invoices electronically (e-invoicing).

7.4 The Customer may set off or withhold payment only in respect of counterclaims that are undisputed, have been finally determined by a court, or are ripe for decision. The Customer’s right to withhold payment on account of counterclaims arising from the same contractual relationship remains unaffected.

7.5 Adjustments to recurring fees are governed exclusively by the provision made in the Order Form.

8. Temporary suspension

The Provider may temporarily restrict or suspend the access of the Customer or of individual Authorised Users where this is necessary to avert specific risks, in particular where (i) the Customer breaches material restrictions on use under clause 5.2; (ii) the Customer is more than 30 days in default with payments due despite a reminder and the setting of a further period; (iii) mandatory statutory provisions so require; or (iv) the use poses a risk to the security, availability or integrity of the Software Service or of third parties. The Provider announces the suspension in advance in text form where possible and permissible, selects the least intrusive suitable means, and lifts the suspension without undue delay once the reason for it has ceased. The Customer’s payment obligation remains unaffected by a justified suspension.

9. Customer Content

9.1 The Customer grants the Provider the non-exclusive, worldwide rights in the Customer Content, limited to the term of the contract, which are required for the performance of the contractual services (in particular storage, reproduction, technical processing, display and transmission within the Software Service including the subcontractors engaged, to the extent required for the performance of the services).

9.2 The Customer is responsible for the Customer Content and warrants that it holds the necessary rights and that the Customer Content does not infringe any third-party rights or applicable law.

9.3 Where the Provider is notified of a possible infringement by Customer Content or such an infringement is asserted, the Provider may temporarily block the Customer Content concerned to the extent this is necessary to avert damage and reasonable for the Customer; the Provider informs the Customer without undue delay and gives it the opportunity to comment. Where the Customer does not demonstrate lawfulness within a reasonable period, the Provider’s further rights (including termination for cause) remain unaffected.

9.4 All rights in the Software Service, the Documentation, the Usage Data and the Provider’s templates, formats and dashboards remain with the Provider or its licensors. Where the Customer submits feedback or suggestions for improvement to the Provider, the Provider may use these free of charge and without restriction. The Provider may use usage and performance data from the operation of the Software Service in aggregated and anonymised form which does not permit any conclusions to be drawn about the Customer, the Authorised Users or the Customer Content, in order to ensure operation, for error analysis, for capacity planning and to improve and further develop its services. Customer Content is used for these purposes, or to train AI models, only where separately agreed.

9.5 (a) The data storage provided by the Provider serves exclusively to support the functionality of the Software Service and may not be used as general cloud storage. (b) The Provider may manage the data storage and, to the extent necessary to maintain system performance, to comply with applicable law or to implement the Customer’s policies, limit it technically. The storage capacity promised in the Service Description is not thereby reduced. No inspection of the substance of Customer Content takes place; monitoring measures are limited to volume, operational and security metrics. (c) Where the Service Description states retention periods for individual data categories, these apply; where they are designated as configurable there, the Customer may set them itself within the limits provided for. In all other respects Customer Content is retained for the term of the contract. (d) Any deletion of Customer Content by the Provider going beyond paragraph (c) takes place only after prior notice in text form and a reasonable opportunity to export. Automated deletions after expiry of the retention periods stated in the Service Description do not require separate notice. Customer Content in this sense means the data and content posted by the Customer or its users; it does not include artefacts generated by the Software Service, the portability of which is governed by the respective Service Description. Deletion after the end of the contract, the Customer’s rights under clause 16.2 (Switching Support) and the provisions of the DPA remain unaffected.

10. Confidentiality

10.1 “Confidential Information” means all information which one party (the “Disclosing Party”) discloses to the other party (the “Recipient”) in connection with the contract and which is marked as confidential or is reasonably to be regarded as confidential by its nature and the circumstances of disclosure. The Provider’s Confidential Information includes in particular the contractual conditions and technical and performance-related information about the services; the Customer’s Confidential Information includes in particular the Customer Content.

10.2 The Recipient will (i) protect Confidential Information with the same care it applies to its own confidential information, but at least with reasonable care; (ii) use it only to perform the contract; and (iii) make it accessible only to those employees, advisers and subcontractors who need to know it and who are subject to comparable confidentiality obligations. The obligations apply for the term of the contract and for three years thereafter; for trade secrets they apply without limitation in time.

10.3 Excluded is information which demonstrably (i) is or becomes publicly known without any breach of duty; (ii) was already lawfully known to the Recipient; (iii) was lawfully obtained from third parties without any confidentiality obligation; or (iv) was independently developed. Disclosures required by law, by an authority or by a court remain permissible; the Recipient informs the Disclosing Party in advance to the extent legally permissible and seeks confidential treatment.

11. Data protection

The parties comply with applicable data protection law. Where the Provider processes personal data on behalf of the Customer, the Provider’s single, consolidated data processing agreement applies (with the applicable EU, UK, Switzerland and US modules and the relevant transfer mechanisms), available online at https://www.getflip.com/legal/dpa-eu/; it is hereby incorporated into this contract by reference and takes precedence over this clause in data protection matters. The Customer is the controller in respect of the personal data processed by the Provider on its behalf and ensures in particular that the Authorised Users are informed and that a legal basis exists. The Customer’s acceptance of this contract and the conclusion of an Order Form by an affiliate are deemed to constitute conclusion of the transfer mechanisms together with their annexes by the Customer.

The Provider will take appropriate administrative, physical and technical security measures to protect the security, confidentiality and integrity of the Customer Data, as described in more detail in clause 12 and in the DPA. These security measures include, among other things, measures to prevent unauthorised access to or disclosure of Customer Data (other than by the Customer or the Users).

12. Information security

The Provider implements the security measures described in the Trust Center at https://trust.getflip.com/, in the version published at the time the contract is concluded; subsequent changes to the Trust Center may not fall below the level of protection thereby promised. This does not constitute a guarantee in the legal sense. The Provider operates, among other things, an information security management system in accordance with ISO/IEC 27001 and takes technical and organisational measures in accordance with the state of the art pursuant to the DPA. The Provider informs the Customer without undue delay of security incidents which materially affect the Customer Content; data protection notification obligations are governed by the DPA.

13. Warranty

13.1 The statutory warranty rules of German lease law apply, with the following provisos: the Provider’s strict liability for defects already existing at the time the contract was concluded under section 536a(1) alternative 1 BGB is excluded. The Customer’s right of self-remedy under section 536a(2) BGB is excluded, except where the remedy of a defect is necessary to avert acute material risks and the Provider is in default with the remedy. An insignificant reduction in fitness for use is disregarded (section 536(1) sentence 3 BGB).

13.2 The Customer shall notify defects without undue delay in comprehensible form, stating the information useful for identifying the defect; the incident procedure under the SLA remains unaffected. A reduction on account of unavailability is set off against the service credits under the SLA and vice versa. The Customer may not assert a reduction on account of unavailability by deducting it from the fees; in that respect it is limited to reclaiming overpaid fees. Clause 7.4 remains unaffected.

13.3 In particular, impairments are not defects where they result from (i) improper use or use contrary to the contract; (ii) environments which do not meet the system requirements; (iii) third-party software, third-party platforms or disruptions outside the Provider’s area of responsibility; or (iv) interventions made by the Customer or third parties.

14. Indemnification

14.1 Where a third party asserts against the Customer that the use of the Software Service in accordance with the contract infringes its industrial property rights or copyrights in the territory of the European Union, the United Kingdom or Switzerland, the Provider will defend the Customer against those claims at its own cost and reimburse the Customer for damages and costs finally awarded, or amounts of settlements approved by the Provider, provided that the Customer (i) informs the Provider without undue delay in text form, (ii) leaves the defence and settlement negotiations to the Provider, and (iii) provides the Provider with reasonable support.

14.2 The Provider may, at its option, (i) obtain the right of use for the Customer, (ii) modify or replace the Software Service such that no property rights are infringed and the essential functions are retained, or, where neither is possible with reasonable effort, (iii) terminate the affected part of the services for extraordinary cause and refund fees paid in advance on a pro-rata basis.

14.3 The obligations under clause 14.1 do not exist to the extent the infringement results from (i) Customer Content, (ii) use contrary to the contract or the Documentation, (iii) a combination with products or services not provided by the Provider, (iv) the Customer’s specifications, or (v) modifications not made or approved by the Provider.

14.4 The Customer indemnifies the Provider against third-party claims based on unlawful use of the Software Service by the Customer or the Authorised Users, or on infringing Customer Content, including the reasonable costs of legal defence; clause 14.1(i)–(iii) applies accordingly in favour of the Customer. The indemnity obligation exists only to the extent the Customer is responsible for the infringement. Sentence 1 applies accordingly to third-party claims and measures of competent authorities based on the Customer using AI Features contrary to clause 3.3.

15. Limitation of liability

15.1 The Provider is liable without limitation for intent and gross negligence, for damage arising from injury to life, body or health, under the German Product Liability Act, in the event of fraudulent concealment of a defect, and to the extent of any guarantee assumed.

15.2 In the case of ordinary negligence the Provider is liable only for breach of a material contractual obligation (cardinal obligation), that is, an obligation the performance of which makes proper performance of the contract possible in the first place and on compliance with which the Customer may regularly rely, and limited in amount to the foreseeable damage typical for this type of contract at the time the contract was concluded. In all other respects liability for ordinary negligence is excluded.

15.3 Strict liability under section 536a(1) alternative 1 BGB is excluded (clause 13.1). For the loss of data the Provider is liable within the scope of the foregoing provisions only to the extent that would also have occurred with proper, regular and risk-appropriate data backup by the Customer, unless data backup has been contractually assigned to the Provider.

15.4 Where the Provider is liable under clause 15.2 for breach of a material contractual obligation in the case of ordinary negligence, liability is additionally limited in amount to the net annual fees owed by the Customer in the twelve (12) months preceding the event causing the damage; where several damaging events occur within one contract year, the Provider’s liability is limited to that amount in aggregate. This cap does not apply to the cases of unlimited liability under clause 15.1.

15.5 By way of derogation from clause 15.4, the Provider’s liability for (i) claims under the indemnity in clause 14.1 and (ii) damage arising from breach of data protection obligations (clause 11 including the DPA) is limited in aggregate in amount to twice (200%) the net annual fees owed by the Customer in the twelve (12) months preceding the event causing the damage. Several breaches or damaging events based on the same event, the same cause or the same single set of facts are deemed to be one single damaging event (series loss) and are set off against that cap; this applies irrespective of the number of data subjects, records or individual breaches concerned and irrespective of how many contract years they affect. This limitation does not apply to the cases of unlimited liability under clause 15.1 and does not affect statutory claims of data subjects under Art. 82 GDPR; in that respect it concerns only the apportionment between the parties.

15.6 The foregoing limitations of liability also apply in favour of the Provider’s officers, employees and agents and to all contractual and non-contractual claims.

15.7 Claims for damages of the parties become time-barred twelve (12) months from the point at which the party entitled to the claim becomes aware, or should have become aware without gross negligence, of the circumstances giving rise to the claim, and in any event twenty-four (24) months from the event causing the damage; the running of this maximum period is suspended for as long as the party entitled to the claim neither knew nor, without gross negligence, should have known of the circumstances giving rise to the claim. This does not apply to claims in the cases of clause 15.1, to claims under the indemnity in clause 14 and to payment claims; the statutory limitation periods apply in those respects.

16. Term, termination, switching providers (Data Act)

16.1 The term follows from the Order Form. Minimum term, renewal and notice period are governed exclusively by the Order Form. The right to terminate for cause (section 314 BGB) remains unaffected; cause exists for the Provider in particular where the Customer is more than two months in default with a not insignificant part of the fees or persistently breaches clause 5.2. Cause further exists for both parties where insolvency proceedings are opened in respect of the other party’s assets or the opening of such proceedings is refused for lack of assets.

16.2 The Customer is entitled, on a notice period of no more than two months, to switch to a data processing service of the same service type provided by another provider, to switch to its own ICT infrastructure, or to port its exportable data and digital assets, and to terminate the contract for that purpose. The procedure, the transitional period (30 calendar days; the Customer may extend it once for a period it considers appropriate, Art. 25(5) Data Act; where it is technically unfeasible, Art. 25(4) Data Act applies), a retrieval period of at least 30 calendar days from the end of the transitional period, formats, interfaces, excluded data categories and support services are governed by the Switching Support and by Regulation (EU) 2023/2854 (the “Data Act”). From 12 January 2027 no switching charges will be levied for the switch; until then, at most reduced charges in accordance with the Switching Support. The Provider does not levy any charges for the switch or for the support services under the Switching Support which are impermissible under Art. 29 of the Data Act. The obligation to pay the fees for the agreed minimum or renewal term remains unaffected; it is consideration for the agreed term and is not a switching charge. The information under Art. 26 and Art. 28(1) of the Data Act – in particular on data structures, data formats, standards and open interoperability specifications, and on the jurisdiction of the ICT infrastructure used and the measures against international governmental access to non-personal data – is available at https://trust.getflip.com/.

16.3 Where the contract is terminated at the Customer’s instigation before expiry of the agreed term without the Customer having a statutory or contractual right of termination and without a switch under clause 16.2, the Customer undertakes to pay reasonable compensation of no more than 90% of the pro-rata recurring fees payable by the Customer for the remaining term. The compensation is assessed taking into account the following criteria: (i) the pro-rata value of the contractually agreed services for the remaining period, (ii) the Provider’s saved expenses, and (iii) any advantages accruing to the Provider as a result of the early termination (for example alternative use of resources). On request the Provider provides the Customer with a comprehensible calculation of the compensation. The Customer is entitled to demonstrate that the actual compensation must be lower taking the stated criteria into account; in that case the compensation is adjusted accordingly. Where the Customer terminates for cause (section 314 BGB) or on the basis of a statutory right of termination, no compensation is payable. Clause 16.2 applies exclusively to switching providers and data porting under clause 16.2. This clause does not establish a right of termination for the Customer; where the Customer ceases use without a right of termination, the obligation to pay the fees for the remaining term continues to apply, whereby the Provider is entitled to limit itself instead to the compensation under this clause.

16.4 Upon termination of the contract the Customer’s rights of use end; the Provider ceases the services. The deletion and return of personal data is governed by the DPA, the return of other exportable data by the Switching Support. Backups may be overwritten in the regular backup cycle and are subject to the confidentiality obligations until deletion.

16.5 Provisions which by their nature are intended to survive (in particular clause 7 for outstanding claims, 9.4, 10, 11, 14, 15, 16.2 to 16.4, 18) remain unaffected by termination.

17. Amendments to the Terms and to the incorporated documents

As a matter of principle, the version of the Terms and of the incorporated documents incorporated at the time the contract was concluded applies for the term. The Provider may adapt the Terms, the Service Description and the SLA with effect for the future, (i) where the amendment is exclusively advantageous for the Customer or purely editorial, with notice also for the current contract period; (ii) in all other cases only with notice in text form giving at least six weeks’ notice and with effect at the earliest from the beginning of the next renewal period. Where the Customer objects in text form to an announced amendment under (ii) before it takes effect, the contract is renewed on unchanged terms; in that case both parties have a right of termination with effect from the date the amendment takes effect. The Provider draws attention to the right of objection and the right of termination in the notice. Amendments to the DPA are governed exclusively by the DPA. Amendments to the Service Description which materially adversely affect the core functionality are permissible only in accordance with clause 2.9.

18. Final provisions

18.1 In the event of conflicts between the constituent parts of the contract, the following order of precedence applies: (1) the Order Form; (2) the special terms of the relevant Module; (3) the DPA; (4) these Terms; (5) the applicable SLA; (6) the Service Description; (7) the Documentation. The precedence of the DPA in data protection matters (clause 1.2 of the DPA) and the precedence of individually agreed terms under section 305b BGB remain unaffected.

18.2 Amendments and supplements to the contract require text form. The precedence of individually agreed terms (section 305b BGB) remains unaffected; such terms are also effective without any formal requirement. Amendments should be agreed on the Provider’s side by the management or a person authorised by it.

18.3 The Customer may transfer rights and obligations under the contract only with the Provider’s prior consent; section 354a of the German Commercial Code (HGB) remains unaffected. The Provider may transfer the contract to affiliates or in the context of universal or partial succession (for example conversion or sale of the business).

18.4 Neither party is liable for non-performance of obligations (other than payment obligations) to the extent this results from events outside its reasonable control (for example war, terrorism, pandemic, strike, orders of authorities, large-scale internet or power outages, natural disasters). The affected party informs the other party without undue delay; obligations are suspended for the duration of the event. Where the event continues for more than 60 days, either party may terminate the affected part of the services for extraordinary cause.

18.5 Performance of the contract is subject to there being no obstacles arising from national or international provisions of foreign trade, export control and sanctions law. The Customer represents that it is not subject to any relevant sanctions lists of the EU, the UN, the United Kingdom or the USA.

18.6 The Provider may name the Customer as a reference customer using its name and logo and include it for that purpose in its customer directory, which is used for reference and acquisition purposes, for example naming on the website and inclusion in social media campaigns. Any further reference use – in particular success stories, video case studies, press releases, quotations, telephone references and joint participation in webinars – requires the Customer’s prior consent in the individual case. Content showing the Customer by name or with its logo is approved by the Customer in text form before publication; the Customer may revoke an approval granted for cause with effect for the future.

18.7 The contract sets out the parties’ agreements on the subject matter of the contract in full; there are no oral collateral agreements. Should individual provisions of the contract be invalid or unenforceable, the contract remains effective in all other respects. The statutory provision applies in place of the invalid provision.

18.8 German law applies, excluding the UN Convention on Contracts for the International Sale of Goods and excluding conflict-of-laws rules. The exclusive place of jurisdiction for all disputes arising out of or in connection with the contract is Stuttgart, Germany, where the Customer is a merchant, a legal person under public law or a special fund under public law; the Provider may also sue the Customer at the Customer’s general place of jurisdiction.

18.9 The language of this contract is English. Where a German translation is provided, it serves for information only; the English version prevails. Customers established in Germany contract on the Provider’s German-language Allgemeine Geschäftsbedingungen; customers established in the United Kingdom or the United States contract on the Provider’s General Terms and Conditions (UK) or (US), unless otherwise agreed in the Order Form.