ARCNM

Terms of Service

ARCNM's General Terms and Conditions for business (B2B) use, including the Art. 28 GDPR Data Processing Agreement as Annex 1. This English text is a convenience translation; the legally binding version is the German original.

Effective: 17 August 2026

Binding language: This English text is a convenience translation provided for readability only. The legally binding version of these Terms is the German original (Allgemeine Geschäftsbedingungen), available at /de/terms. In the event of any discrepancy between the two versions or any question of interpretation, the German version prevails (see Section 12).

1. Scope, contracting parties and exclusive B2B use

These General Terms and Conditions (the “Terms”) govern the business relationship between rattle mng GmbH, Langgasse 21, 88662 Überlingen, Germany – registered in the commercial register of the Local Court (Amtsgericht) of Freiburg under HRB 733144, represented by its managing director Dr. Alexander Menges (the “Provider”) – and the users of the software platform it operates, “ARCNM” (the “Customer”). The Data Processing Agreement under Art. 28 GDPR set out in Annex 1 (“DPA”) forms part of these Terms. By accepting these Terms the Customer simultaneously accepts the DPA; no separate execution is required.

Exclusively B2B (entrepreneurs within the meaning of § 14 BGB): ARCNM is directed exclusively at entrepreneurs within the meaning of § 14 of the German Civil Code (BGB), i.e. natural or legal persons or partnerships with legal capacity acting, when entering into the contract, in the exercise of their commercial or independent professional activity. Use by consumers within the meaning of § 13 BGB is excluded. On registration the Customer expressly confirms that it is not a consumer and – where it acts for a company – that it is authorised to represent that company. The Provider records this confirmation with a timestamp. If it transpires that the Customer gave this confirmation untruthfully, this does not affect the validity of the contract; in that case the Provider is entitled to terminate for cause.

Incorporation, knowledge and storage: Before entering into the contract the Customer had the opportunity to review these Terms in full, including Annex 1 (DPA), in a reasonable manner, and to save and print them; by accepting them the Customer agrees to their application. The Provider stores the applicable version of the Terms, together with the version identifier and the timestamp of acceptance, in an audit-proof manner, so that it remains verifiable which version the Customer accepted.

Priority of these Terms; no counter-confirmation: Any conflicting, deviating or supplementary general terms and conditions of the Customer do not apply, even if the Provider does not expressly object to them or renders the service without reservation while aware of such terms. They apply only where the Provider has expressly agreed to their application in text form in the individual case. These Terms also apply to all future contracts and services within the scope of using ARCNM, without the need to refer to them again.

2. Description of services and subject matter of the contract

With ARCNM, the Provider makes available a cloud-based Software-as-a-Service platform (SaaS) whose core function is the calculation of the manufacturing and unit costs of manufactured parts (the “Parts Calculation Engine”). Users submit a part description (materials, geometry, machine/process parameters, lot sizes and similar) and receive a structured cost breakdown. The platform also supports the management of part master data, bills of materials (“BOM”), routings, supplier quotes and the associated calculation and comparison data. The scope of functions depends on the subscription plan selected.

Service owed; quality: What is owed is the provision of the platform in its respective current version for use over the internet (procurement of the possibility of use), not any particular calculation result or business outcome. A specific quality is deemed agreed only where the Provider has expressly warranted it as binding in text form; public statements, advertising, roadmaps or product announcements do not constitute an agreement on quality or a guarantee.

Calculations as a non-binding decision aid: All calculation results, cost estimates, quantity and time determinations produced by the platform, and any documents derived from them, are non-binding and serve solely as a tool and basis for decision-making. They do not replace professional review; to the extent legally permissible, no substantive correctness, accuracy, completeness or fitness for a particular purpose is owed. The Customer is solely responsible for independently checking all results for plausibility and correctness before using them, in particular before passing them on to third parties or submitting binding quotes (see Section 7 and Section 9).

Pluggable engines: Cost determination is performed through interchangeable calculation engines. By default ARCNM is available – the Provider’s own deterministic engine without external network calls. Further engines and data sources (e.g. to enrich procurement or supplier data) may be added by the Provider or integrated on a customer-specific basis.

Model and provider independence; fee neutrality: The Provider is entitled to change, add or replace the engines, AI/VLM models (including proprietary and open-weight models) and sub-processors used to provide the service at any time, and to run them hosted at third parties or on its own infrastructure, as long as the essential nature of the service is preserved. Such changes are internal measures of the Provider; they do not affect the agreed fees for calculations and do not constitute a price or service change within the meaning of Section 4. Where such a change first transmits personal data to a new sub-processor, Annex 1 (DPA) applies; where models are run solely on the Provider's own or Provider-controlled infrastructure, no transmission to third parties takes place in that respect.

ARCNM is provided over the internet and is accessible via a web browser as well as via the REST API described in Section 2a. The Provider handles hosting, maintenance and updating of the software; no local installation effort is required of the Customer. The Provider continuously develops the platform and may improve or extend functions. In doing so the core functionalities are maintained; the Customer has no claim to any particular future functions or updates as long as the essential nature of the service is preserved.

AI-assisted functions (optional): Certain functions may – depending on the plan and only where activated – incorporate AI components for text and image analysis. These may be proprietary third-party models or open-weight models, run by the Provider either hosted at third parties or on its own or Provider-controlled infrastructure (including within the EU/EEA). AI outputs serve solely as a decision aid and must be reviewed by the Customer on the merits; no substantive correctness, completeness or fitness for a particular purpose is owed. The Customer ensures that it is entitled to transmit the input data; the processing of special categories of personal data within the meaning of Art. 9 GDPR is excluded.

Beta functions: The Provider may grant the Customer access to functions marked as “Beta”, “Preview” or “Experimental”. Beta functions are provided “as is”, may be changed or discontinued at any time without notice and are not suitable for production-critical applications. Any warranty is excluded to the extent legally permissible. Liability is limited to intent and gross negligence; liability for culpable injury to life, body or health and liability under mandatory law remain unaffected.

2a. REST API (programmatic interface)

As part of the platform the Provider makes available a REST API (accessible under /api/v1/) that gives the Customer programmatic access to selected platform functions and data. The availability and scope of the usable endpoints depend on the Customer’s respective subscription plan.

Availability by plan: Productive use of the REST API is part of the paid plans. Under the Free plan and during the trial period there is no entitlement to availability, stability or scope of the API; any test API keys (ak_test_) serve solely for evaluation and integration testing and are not released for production-critical applications. Liability for the consequences of productive use under the Free plan/trial is excluded to the extent legally permissible.

Authentication via API keys: Access to the REST API is via API keys that the Customer can create through account management. API keys have the format ak_<mode>_<prefix>_<secret> and use ak_live_ for the production environment or ak_test_ for the test environment; for historical reasons the earlier format ak_<prefix>_<secret> is also accepted. Authentication is via the HTTP header X-API-Key. The API additionally supports authentication via existing session cookies for use through the platform’s own interface.

Key management and storage: The full API key is shown to the Customer once, at creation, in clear text. Thereafter the Provider stores only a cryptographic hash (Argon2) of the key; the full key can therefore not be displayed again. The Customer is obliged to store the key securely upon creation.

Access control (scopes): Each API key can be assigned permission scopes that restrict access to specific resources and operations. The Customer should observe the principle of least privilege and assign each key only the scopes required for the respective integration purpose. Optionally, the Customer can set an expiry date per key.

Test and production environments: Keys with the prefix ak_test_ are rejected in production environments. The Customer must ensure that test and production keys are not mixed.

API versioning and deprecation: The REST API is versioned. When new API versions are introduced, the previous version continues to operate for a period of at least 12 months after the deprecation is announced. Deprecation is announced through suitable channels (e.g. API documentation, email). Beyond the announced transition period there is no entitlement to continued operation of older API versions.

Documentation: The authoritative technical description of the REST API is the respective current OpenAPI specification, which the Provider makes available through the platform. The Customer may rely solely on documented endpoints and parameters; undocumented behaviour or internal endpoints are not part of the scope of services and may be changed without notice.

Idempotency support: For mutating requests (POST, PUT, PATCH, DELETE) the API supports the HTTP header Idempotency-Key. This allows the Customer to ensure that a request re-sent after a network error does not result in duplicate operations. Idempotency keys are cached for a limited period; the exact duration is set out in the documentation.

Outbound webhooks: Where the Customer configures webhook endpoints, the Provider delivers event notifications via HTTPS POST to the configured endpoints. Each delivery contains the HTTP header webhook-signature in the format v1,<base64(HMAC-SHA256(id.timestamp.body))> per the Standard Webhooks scheme. The Customer must validate this signature before processing the message. The Customer’s receiving endpoints must respond with an HTTP 2xx status within the period set out in the documentation; otherwise the delivery is deemed to have failed. Delivery is on a best-effort basis; missed or duplicate deliveries do not give rise to warranty claims; the Customer must implement its receiving systems to be idempotent.

Rotation of the webhook signing secret: The Customer can regenerate the signing secret of a webhook endpoint at any time through account management (rotation). After a successful rotation, only the new secret applies; the previous secret is invalidated without delay. The Customer is obliged to rotate compromised secrets without delay and to switch its receiving systems fully to the new secret as part of the rotation. The Provider is not liable for discarded deliveries due to late or failed switchover on the Customer’s side.

TDDDG responsibility (formerly TTDSG): Where the Customer uses the REST API via client-side applications (e.g. JavaScript in the browser), responsibility for compliance with the provisions of the TDDDG (in particular § 25 TDDDG, formerly § 25 TTDSG) regarding the storage of access data on the user’s end device lies with the Customer.

3. Registration and user account

Use of ARCNM requires prior registration. For this the Customer creates a user account and provides the mandatory details requested in the registration form truthfully and completely: the full name of the contact person, a valid business email address, a secure password and the company name of the organisation for which the Customer acts. Immediately above the button completing the registration, the Customer is clearly shown a declaration with links to these Terms (including Annex 1, DPA) and the Privacy Policy. By submitting the registration form – the express act of confirmation – the Customer confirms that it is an entrepreneur within the meaning of § 14 BGB and uses the platform exclusively in the exercise of its commercial or independent professional activity, and accepts these Terms including Annex 1 (DPA). Both confirmations are recorded in the system with a timestamp and the version hash of the Terms.

If the stored details change (in particular contact or company data), the Customer is obliged to update them promptly in its account. On registration the Customer chooses secure password access. The access data (email and password) must be kept confidential by the Customer and protected against access by third parties. The Customer ensures that only persons authorised by it gain access to the user account. If a compromise is suspected, the Customer must inform the Provider without delay and change the password itself.

API keys as access data: The API keys described in Section 2a are deemed access data within the meaning of these Terms and must be treated with at least the same care as passwords. API keys must not be stored in client-side source code (e.g. JavaScript in the browser), publicly accessible code repositories, unencrypted configuration files or other locations visible to third parties. The Customer must revoke without delay keys that are compromised or no longer needed. The Customer is responsible for all requests made with its API keys unless it proves that it is not responsible for the compromise. The Provider is entitled to revoke API keys without notice where there is reasonable suspicion of compromise or misuse; the Provider will inform the Customer without delay.

Depending on the plan booked, the Customer may create and manage further user accounts for employees within its organisation. The Customer is responsible for ensuring that co-using employees or agents comply with these Terms. Acts of authorised employees are deemed, vis-à-vis the Provider, to be acts of the Customer. In particular, when employees leave, the Customer must withdraw or change their access rights without delay.

The registration process requires acceptance of these Terms and of the Privacy Policy. Where applicable, the Customer must confirm its email address in a double-opt-in procedure to complete registration. The usage contract is concluded only upon successful registration and activation of the account by the Provider. No claim to conclusion of a contract: The Provider reserves the right to refuse a registration or the conclusion of a contract in an individual case – for example where there are legitimate doubts as to creditworthiness, entrepreneur status or compliance with these Terms. In such a case any payments already made for services not rendered will be refunded; no further claims exist.

4. Subscription models, prices and payment terms

Use of ARCNM takes place within a subscription model with various plan tiers. The Provider may offer both a free basic plan (Free plan) with a limited scope of functions and paid plans with extended functions and usage allowances. The respective current plans, prices and included services are set out in the plan overview in the application or on the Provider’s website. Switching between plans is possible during the contract term in accordance with the options offered in the account.

Free trial period: The Provider may grant the Customer a free trial period for paid plans. The duration and conditions are communicated at the start of the trial. After the trial period ends, access to the paid functions ends automatically unless the Customer has previously taken out a paid subscription. All provisions of these Terms apply to the trial period accordingly, in particular the limitations of liability. The Provider gives no warranty as to the availability, freedom from defects or fitness of the service during the trial period. There is no claim to the grant or extension of a trial period.

Prices: All fees for the paid subscriptions are stated in euros and, unless expressly indicated otherwise, are exclusive of statutory value-added tax. The respective applicable prices and included services can be viewed on the Provider’s website or in the application.

Billing period: Billing takes place in advance for the chosen billing period (e.g. monthly or annually), starting on the day the paid plan is activated. Plan changes: Upgrades take effect immediately and are billed on a pro-rata basis for the remaining billing period. Downgrades and terminations take effect at the end of the current billing period.

Allowances and limits: Plans include allowances for users, records and storage. The exact allowances and any additional allowances are set out in the plan overview. API rate limits: Use of the REST API is subject to plan-dependent rate limits. The respective applicable values are described in the API documentation and are communicated at runtime via the HTTP response headers X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. Exceeding the rate limit leads to a temporary rejection of further requests with HTTP status code 429; this does not constitute an outage or defect. The deliberate circumvention of rate limits constitutes a breach of contract.

Payment processing via a payment service provider: For payment processing the Provider uses an external payment service provider; the current provider is set out in the sub-processor directory. Payment of the subscription fees is made via the payment method stored by the Customer (e.g. credit card, SEPA direct debit) in the payment service provider's system. As part of the booking process the Customer must store valid payment information; without a valid payment method the Provider cannot activate or continue paid services. The payment method is charged automatically at the start of each new billing period (recurring subscription payment). The Customer authorises the Provider or the payment service provider to collect the amounts due in accordance with the selected plan. The Provider does not store full payment card data; these are processed exclusively by the payment service provider, whose terms of use and privacy provisions apply in addition.

Invoicing: The Customer receives an electronic invoice for each payment (by email or for download in the account area). The Customer agrees to electronic invoicing. The Customer is obliged to check invoices and to notify any objections in text form within 14 days of receipt.

Due date and default: All fees are due without deduction upon invoicing. If a due subscription amount cannot be collected, the Provider will inform the Customer and re-attempt the payment or request payment. If the Customer is in default of payment, the Provider is entitled to charge default interest at the statutory rate; in legal transactions in which a consumer is not involved this amounts to nine percentage points above the base rate (§ 288 (2) BGB). In addition, the Provider may claim a flat fee of EUR 40 pursuant to § 288 (5) BGB as well as compensation for further default damage (in particular reasonable reminder and collection costs); the flat fee is credited against any damages owed to the extent the damage consists of costs of legal action. If payment ultimately fails and the Customer fails to meet its payment obligation within a reasonable period even after a request, the Provider is entitled to suspend or restrict services. In particular, access may be temporarily deactivated or the plan downgraded to the free Free plan. The Customer’s obligation to pay the outstanding fees remains unaffected.

Set-off and retention: The Customer may set off against the Provider’s claims only with undisputed or legally established claims. The Customer is entitled to a right of retention only to the extent that its counterclaim is based on the same contractual relationship.

Price changes: The Provider reserves the right to adjust the prices and/or the scope of services of the plans offered in future, in order to respond to changed cost structures or further developments of the product. The Provider makes changes to the scope of services only to the extent that they are reasonable for the Customer, taking into account the Provider’s interests, and the essential agreed service features are preserved. The Provider will announce price or service changes for existing contracts to the Customer at least 4 weeks before they take effect in text form. If the Customer does not agree to the change, it may terminate the subscription extraordinarily as of the time the change takes effect. The Provider will point out the right of termination and its consequences in the change notice. If the Customer does not terminate and continues to use the service beyond the time of the price change, this is deemed acceptance of the changed conditions. Price reductions or extensions of the scope of services in the Customer’s favour may also take effect without prior notice.

No refund for non-use: Not making use of the service does not entitle the Customer to a refund of fees already paid, provided the Provider was ready and able to render the service. Likewise, in the case of downgrades or termination by the Customer during an ongoing billing period, no pro-rata refund of amounts already paid is made, unless mandatory law provides otherwise.

5. Contract term, termination and return of data

Start and duration of the contract: The contract for the use of ARCNM is concluded upon successful registration (or, in the case of an upgrade, upon payment of the first subscription fee). Paid subscriptions run for an indefinite period, each renewing continuously by the chosen billing period, until terminated by the Customer or the Provider. Free accounts (Free plan) are likewise provided for an indefinite period until terminated or discontinued by the Provider.

Termination by the Customer: The Customer may terminate a paid subscription at any time as of the end of the current billing period. Termination may be declared directly via the account settings or in text form (e.g. by email to [email protected]). After effective termination the account is automatically switched to the Free plan at the end of the paid term, unless the Customer expressly requests full deletion of the account.

Termination by the Provider: The Provider is entitled to give ordinary notice of termination of the contract for a paid subscription with a period of 4 weeks to the end of the month. For the Free plan the Provider may discontinue provision at any time with a period of 4 weeks. In both cases the Provider will inform the Customer in a suitable manner (e.g. by email).

Extraordinary termination: The right of both parties to terminate for cause without notice remains unaffected. Good cause for termination by the Provider exists in particular in the case of: serious or repeated breaches of the Customer’s obligations under Section 7, default of payment despite a reminder and the setting of a reasonable grace period, unauthorised disclosure or publication of the software, or any other conduct that makes it unreasonable for the Provider to continue the contract. In the case of justified termination for cause without notice, the Customer loses access to the platform upon the termination taking effect; in this case there is no claim to a refund of fees already paid.

Data export after the end of the contract: After termination of a paid subscription, the Customer’s data is available for export for a period of 30 days after the termination takes effect, provided the account is switched to the Free plan. Data export is via the platform export functions (e.g. CSV, JSON) and, where applicable, via the REST API; API access after the end of the paid subscription is available only if the Free plan includes API access. The Customer is obliged to export and back up all data important to it within this period. After the period expires, the Provider may irreversibly delete data exceeding the Free plan allowances. If the account is fully terminated or deleted, all Customer data is deleted without delay after a transition period of 14 days. There is no claim to particular export formats, to support with the export, or to data transfer to third parties. The Customer bears sole responsibility for the timely backup of its data.

Inactive accounts: The Provider is entitled to classify customer accounts as inactive if no sign-in has occurred over a period of 3 months and no paid subscription exists. Before deleting inactive accounts, the Provider will inform the Customer at least 14 days in advance by email. If no response occurs within this period, the Provider may permanently delete the account including all associated data. Recovery of deleted inactive accounts is not possible. This provision does not apply to paid subscriptions; for these, only the termination provisions of this section apply.

6. Rights of use to the platform and intellectual property

Grant of rights of use: The Provider grants the Customer the right to use the ARCNM software platform within the scope of the plan booked for the duration of the contract. This right of use is non-exclusive, non-transferable and non-sublicensable. The Customer may use the software solely for the Customer’s own business purposes. Provision to third parties is not permitted, apart from granting access to the Customer’s authorised employees.

Rights in the system: All copyrights, trademarks, industrial property rights and other intellectual property rights in the software, the web design, the “ARCNM” logo/branding and all content, databases and materials provided by the Provider belong to the Provider or its licensors. The source code of the software is not the subject of the grant. No ownership rights in the software are granted to the Customer; it merely receives the authority to use the software within the SaaS service described above. All rights not expressly granted remain with the Provider (reservation of rights).

Results and Customer data: The content submitted by the Customer and the specific calculation results generated for the Customer (“output data”) remain, as between the parties, with the Customer; the Customer may use them for its own business purposes without limitation in time or territory. The Provider is entitled to use purely technical operational, usage and error metrics unrelated to the Customer's content (e.g. error/response rates, latencies, usage counters) to provide, secure, analyse statistically and further develop the platform. The Customer's content, results or corrections are not used – including in anonymised or aggregated form – to train or develop models (Section 10b).

Feedback: If the Customer voluntarily submits suggestions, improvement proposals, bug reports or other feedback on the platform, it grants the Provider a free, unlimited (in time and territory), non-exclusive, transferable and sublicensable right of use to use them in any way, including their incorporation into the platform. The Customer has no claim to implementation, remuneration or attribution. This does not affect the Customer’s confidential information that is not manifestly feedback.

Restrictions: The Customer is prohibited from using the software outside the contractually intended use or making it accessible to third parties. In particular, no copies of the software may be made, and no modification, adaptation, reverse development or reverse engineering of the underlying source code may be undertaken, unless a statutory permission (such as § 69d, § 69e UrhG) expressly applies. It is likewise impermissible to circumvent existing security mechanisms or protective measures of the software. The Customer must not remove, conceal or alter the Provider’s designations, trademarks and legal notices in the software interface.

No competing or benchmarking use: The Customer will not use the platform to develop, replicate or train a competing product or service, and will not analyse the platform for competitive or benchmarking purposes or publish the results of such analyses without the Provider’s prior consent in text form. Mandatory statutory powers (in particular §§ 69d, 69e UrhG) remain unaffected.

Updates and changes to the service: During the contract term the Provider is entitled to make technical changes, updates, upgrades and further developments to the platform. Such changes may result in the user interface or certain workflows changing. Major changes that significantly affect the contractual use are – where possible – announced in advance. The Customer has no claim to the retention of particular versions or functions, provided the essential agreed service features are not impaired.

Open-source and third-party software: The platform uses open-source software and other third-party software components (including open-source libraries as well as open-weight AI/VLM models). Within the SaaS service these components are operated solely server-side by the Provider; they (or their source or object code) are not supplied, distributed or otherwise conveyed to the Customer. Obligations under copyleft or other open-source licences that are triggered only by such conveyance to third parties therefore do not arise for the Customer. Where, by way of exception, separate licence or usage terms apply to a component for mere use, those terms prevail over these Terms for that component; in case of doubt the Customer receives rights only to the extent that the Provider itself has been granted them by the respective rights holder. Open-source and third-party components are typically provided by their respective authors “as is” and without any warranty or liability on the authors’ part; the Provider gives no warranty for such components beyond the one granted to it, and its liability is governed exclusively by Section 9. The Provider will make available, on request and in text form, a list of the principal open-source components used together with their licences (software bill of materials / SBOM).

7. Obligations and responsibilities of the Customer

Responsibility for content: The Customer is solely responsible for all content and data that it submits to, stores in, or makes accessible to third parties via ARCNM. This includes in particular the stored part descriptions, geometry, material and process parameters, bills of materials, routings, supplier quotes and other information that the Customer enters into or generates on the platform. The Provider performs no review of the content of this data for correctness, completeness or lawfulness and does not adopt such content as its own. The Customer ensures that the content it provides is accurate and up to date and does not infringe the rights of third parties.

Calculations as a decision aid: All calculation results, cost estimates, quantity determinations produced by the software, and the documents derived from them, are non-binding and serve solely as a tool and basis for decision-making. The Customer is solely responsible for independently checking all results for correctness, completeness and plausibility before using them – in particular before passing them on to third parties or submitting binding quotes. The Provider gives no warranty as to the freedom from error, accuracy or fitness of such calculations for a particular purpose.

AI outputs and automation: Where the Customer uses AI-assisted functions, it remains responsible for the inputs and for the use of the outputs. The results serve only as a tool and must be reviewed by the Customer on the merits. AI outputs must not be used as the sole basis for safety-critical or legally binding decisions.

Lawful use: The Customer warrants that it holds all rights required in the content it uploads or generates. In particular, it will not distribute or store via ARCNM any content that is unlawful, infringes copyrights, trademarks, patents or other property rights, unlawfully discloses trade or business secrets, or violates the personal rights of third parties. The processing of special categories of personal data (Art. 9 GDPR) is excluded.

Processing of personal data: Where the Customer processes personal data of third parties via ARCNM (e.g. of the Customer’s employees or suppliers), it is the controller within the meaning of Art. 4 No. 7 GDPR; the Provider acts in that respect as processor under Art. 28 GDPR. The details of the processing are governed by Annex 1 (DPA) of these Terms; a separate DPA execution is not required.

Data-protection warranty of the Customer: The Customer warrants that, for every processing of personal data of third parties submitted to or processed via ARCNM, it has a valid legal basis under Art. 6 (and, where applicable, Art. 9, 10) GDPR, fulfils the information obligations under Art. 13/14 GDPR towards the data subjects, and has properly obtained any consents. The Customer ensures that no processing takes place for which it is not authorised; in particular, it refrains from submitting data whose processing would breach applicable data-protection law. Breaches within the Customer’s area of responsibility fall under the indemnification obligation in Section 7, paragraph “Indemnification for breaches of duty”.

Care in access and use: The Customer must use the platform in accordance with the contract and refrain from any misuse. In particular, the Customer is prohibited from:

Obligations in API use: For the use of the REST API (Section 2a) the following additional obligations apply:

Measures for breaches of duty; suspension: If the Customer breaches the aforementioned obligations, the Provider is entitled to take appropriate measures (warning, temporary blocking of individual content or functions, deactivation of the account or – in the case of serious breaches – extraordinary termination). In the event of a concrete threat to the security, integrity or availability of the platform or of other customers’ data, of impending legal disadvantages for the Provider, or of reasonable suspicion of a compromise, the Provider may temporarily suspend access or individual functions even without prior notice; it will inform the Customer without delay and lift the suspension as soon as the reason no longer applies. In doing so the Provider observes proportionality and takes the Customer’s legitimate interests into account. During a justified suspension the Customer’s payment obligation remains unaffected; for an unjustified suspension the Provider’s fee claim for the suspension period lapses, and the Customer’s claims for damages remain unaffected. The Provider’s statutory claims for damages are reserved.

Indemnification for breaches of duty: The Customer undertakes to indemnify the Provider against all third-party claims asserted against the Provider on account of legal infringements for which the Customer is responsible in connection with the use of ARCNM. This includes in particular claims based on unlawful content, the infringement of copyrights, trademarks or personal rights, and data-protection breaches within the Customer’s area of responsibility. The Customer will hold the Provider harmless from all resulting damage, costs and expenses, including the reasonable costs of legal defence. The Provider will inform the Customer of any asserted claim without delay and – to the extent legally possible – leave the conduct of the legal defence to the Customer and make no admissions without the Customer’s consent. The indemnification obligation does not apply to the extent the Customer is not responsible for the alleged infringement.

Export control and sanctions: The Customer warrants that it will not use the platform in a manner that breaches applicable export control provisions, economic sanctions or embargo provisions of the European Union, the Federal Republic of Germany or the United States. The Customer warrants that neither it nor its beneficial owners are listed on any relevant sanctions list. In the event of breaches the Provider is entitled to immediate suspension and extraordinary termination; the Customer indemnifies the Provider against all resulting claims, fines and costs.

8. Availability, maintenance and disruptions

The Provider endeavours to achieve high availability of the ARCNM platform. The software is operated in a professional cloud environment within the European Union and is subject to regular backups and monitoring. The Customer acknowledges, however, that completely uninterrupted availability of IT systems is not possible.

Backups: The Provider creates regular encrypted backups of the database at industry-standard intervals and retains them for an appropriate period. The Customer is nonetheless required to keep its own additional backups of particularly critical data, since backups primarily serve to protect against system-side data loss.

Dependencies on third parties: Parts of the service (e.g. hosting, payment processing, AI functions, email dispatch) are provided by third parties. Outages or restrictions of these services are outside the Provider’s sphere of influence; in such cases the availability and liability provisions apply accordingly.

Scheduled maintenance: The Provider carries out scheduled maintenance and updates. Maintenance windows are placed where possible outside usual business hours and are announced in advance where possible. During necessary maintenance periods the service is deemed to have been properly rendered.

Force majeure: Neither party is liable for non-performance or delayed performance of its contractual obligations to the extent this is due to circumstances of force majeure (in particular natural disasters, pandemics, war, strikes, official measures, cyber-attacks, the failure of essential upstream suppliers, and systemic outages of essential infrastructure providers – such as cloud, DNS, CDN, identity or telecommunications providers). For the duration of the impediment the affected performance obligations are suspended. If the impediment lasts longer than three months, either party may terminate the contract extraordinarily with a period of 14 days; fees already paid for services not rendered are refunded on a pro-rata basis.

Service level: Where the Provider has given binding availability commitments in a separate Service Level Agreement (SLA), those commitments take precedence. In all other cases any statement on availability is to be understood as a non-binding target.

Support: The Provider provides the Customer with technical support depending on the plan. Standard support is provided on business days during usual business hours by email to [email protected]. A guaranteed resolution time is not assured unless otherwise agreed.

Support access (view-only inspection): To analyse and remedy faults, to handle support requests and to investigate security incidents, the Provider may, on a case-by-case basis, view Customer content within the platform. Such inspection is strictly read-only in a technically enforced read-only mode (write operations are excluded by the system), is limited to persons entrusted with the performance of the contract who are bound to confidentiality (need-to-know), requires additional authentication and approval by a second authorised person (four-eyes principle), is limited to short-lived, automatically expiring and revocable sessions, and is logged including start and end. Any inspection going beyond the specific occasion – in particular of original files uploaded by the Customer (e.g. CAD or drawing files) where not required to remedy the fault – requires the Customer's separate consent in text form. The inspection serves diagnosis and performance of the service only; Section 10b (no training with Customer content) remains unaffected. Where personal data is processed in this context, this takes place within the scope of Section 10 and Annex 1 (DPA).

9. Liability and limitation of liability

Free use: Where the Customer uses ARCNM free of charge (Free plan, trial period), the service is provided without any guarantee or warranty of a particular quality. In this case the Provider is liable for damage to property and financial loss only in the event of intent and gross negligence. Liability for simple negligence is excluded – with the exception of damage arising from injury to life, body or health.

Statutory bases of liability: In other respects the Provider is liable in the context of paid use in accordance with the statutory provisions, but with the following limitations:

The foregoing liability provisions apply accordingly in favour of the Provider’s employees, agents and vicarious agents if claims are asserted directly against them.

Note: the above provisions do not change the statutory allocation of the burden of proof. In particular, it remains for the Customer to prove a liability-triggering circumstance and the Provider’s fault, unless a different rule is provided by law or contract.

Limitation period: Claims of the Customer against the Provider arising from or in connection with this contract become time-barred – to the extent legally permissible – within one year of the statutory start of the limitation period. This shortened limitation period does not apply to claims arising from injury to life, body or health, in the event of intent or gross negligence of the Provider, in the event of fraudulent concealment of a defect, to claims arising from the culpable breach of essential contractual obligations (cardinal obligations), or to claims under the Product Liability Act; in those respects the statutory limitation periods apply.

Claims for defects: The platform is provided as the supply of software for use over the internet against payment (a lease within the meaning of §§ 535 et seq. BGB). The one-year period above – calculated in each case from the statutory start of the limitation period – also applies to any of the Customer's claims for defects; it therefore does not fall below the one-year-from-statutory-start minimum regarded as reasonable for shortening defect-claim limitation. Claims for defects based on the culpable breach of essential contractual obligations (cardinal obligations), and the other claims excepted above, remain unaffected and become time-barred under the statutory periods.

Notice of defects and supplementary performance: The Customer is obliged to notify the Provider in text form of identified defects or malfunctions of the platform without delay, but no later than within 14 days of discovery; this is an incidental duty, the breach of which leaves the Customer’s statutory defect rights unaffected, unless statute provides otherwise (e.g. § 377 HGB). The notice of defects should contain as precise a description of the defect as possible. The Provider is entitled, at its option, to remedy the defect by rectification (error correction) or by providing a workaround. The Provider must be given at least two attempts at rectification before the Customer may assert further rights. In the case of insignificant defects, rights to reduce the price or to withdraw are excluded.

10. Data protection and confidentiality

Data protection: The Provider and the Customer will observe the applicable data-protection provisions – in particular the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The details of the data processing by the Provider are described in the Privacy Policy available on the ARCNM website.

Processing on behalf (DPA): Where the Customer has personal data of third parties processed in ARCNM, it is the controller within the meaning of Art. 4 No. 7 GDPR; the Provider acts as processor under Art. 28 GDPR. The data processing agreement required for this is integrated into these Terms as Annex 1 and is deemed concluded without further ado upon acceptance of these Terms. A separate DPA execution is not required.

Hosting location: The Customer’s data is hosted and processed on servers within the European Union. Where processing outside the EU/EEA becomes necessary (e.g. through object-storage and edge infrastructure, payment processing or Single Sign-On – but not the AI drawing analysis, which takes place exclusively in the EU), this takes place only on the basis of appropriate safeguards under Art. 46 GDPR (e.g. EU Standard Contractual Clauses) or other permissible legal bases. A current list of sub-processors can be found in Annex 1.2 (Sub-processors).

Technical security: The Provider takes appropriate technical and organisational measures (TOMs) under Art. 32 GDPR. The measures are described in Annex 1.3 (TOMs).

Confidentiality: Both parties undertake to keep secret all confidential information of the other party that becomes known to them in connection with the conclusion and performance of this contract, to use it only for the purposes of this contract, and to make it accessible only to those employees or agents who need it to perform the contract and who are subject to a corresponding duty of confidentiality. Confidential information means all documents, communications and information of a party that are marked as confidential or are to be regarded as confidential by virtue of their content. The obligation continues beyond the end of the contract for a period of three years. It does not apply to information that becomes generally known without a breach of this agreement, was already lawfully known to the receiving party or was developed independently, or in the case of disclosure due to a statutory or official obligation – in which case the other party is (to the extent legally permissible) to be informed in advance.

10a. AI-assisted processing and permitted use

(1) AI-generated results: The results of the automated drawing analysis (dimensions, tolerances, material, processes, costs, etc.) are AI-generated and are provided without warranty of completeness or correctness; the Customer must review the results on its own responsibility before any commercially binding use (in particular quoting or procurement decisions). In other respects Section 9 (Liability) applies.

(2) Permitted use (binding, model-independent): The Customer undertakes to use the service and the results generated with it solely in accordance with applicable law and, in particular, not,

This catalogue of prohibitions applies regardless of which model the Provider uses and is an essential contractual obligation. It conclusively reflects the pass-through of usage restrictions required by the model providers’ licence terms; separate acceptance of the terms of individual models is not required. A breach of this catalogue of prohibitions entitles the Provider to the measures under Section 7 (in particular warning, suspension and extraordinary termination) and triggers the Customer’s indemnification obligation under Section 7.

(3) Models used and model-specific policies (declaratory): The Provider is entitled to change the AI model used at any time (e.g. for reasons of quality, cost, data residency or availability), and may use both third-party (closed) models and open-source models. Where a model used provides its own usage policies, their restrictions are already covered in substance by para. 2. An up-to-date overview of the models used together with references to their licence and usage terms is provided by the Provider in the AI model directory (available via the ARCNM website); those restrictions apply in their respective current version. A change of model does not give rise to any obligation to obtain the Customer’s consent again.

(4) Rights in the results: The providers of the models used assert no rights in the results generated. As between the parties, the results belong to the Customer; the Customer is solely responsible for them and their further use. The Provider does not warrant that AI-generated results are correct, complete, fit for a particular purpose or free of third-party rights; in other respects Section 9 (Liability) applies accordingly.

(5) Data protection in AI processing: To perform the extraction, the drawings uploaded by the Customer are processed by AI models. This processing takes place exclusively on documented instruction within the framework of processing on behalf (Section 10, Annex 1) on the basis of Art. 6(1)(b) GDPR or documented instruction. The Provider only engages third-party providers that, under their applicable API/contract terms, do not use the transmitted content to train their models; the Provider’s own further development of its services is governed by Section 10b. The AI-assisted analysis of the drawings takes place exclusively within the EU/EEA – both for self-operated (open-source) models and for any third-party models, which the Provider engages only with processors that process within the EU/EEA. There is no fallback to a model outside the EU/EEA; if the EU path fails, the analysis is performed purely deterministically and rule-based without an AI model. The current status of each sub-processor is stated in Annex 1.2 (Sub-processors).

10b. No use of your data for training – processing only to provide the service

(1) No training on Customer Content (binding commitment): The Provider does not at any time use the content uploaded by the Customer (drawings, files, inputs), the results generated from it, or any of the Customer's corrections and confirmations to train, fine-tune, evaluate or otherwise develop its own or any third party's AI models – neither in identifiable, nor in anonymised, nor in aggregated form. Customer Content is not used across customers for these purposes.

(2) Processing solely to provide the service: The Provider processes the Customer's content – including any personal data it contains that the Customer knowingly provides (e.g. names or contact details in a drawing's title block) – solely to deliver the service the Customer has requested: to read, extract, calculate, prepare and return the results to the Customer, including the technical steps required to do so (storage, rasterisation, transmission to instruction-bound processors, security). Legal basis: Art. 6 (1)(b) GDPR (performance of contract); otherwise the instruction-bound processing under Section 10 and Annex 1 (DPA) applies.

(3) Development without your data: To improve, calibrate and validate its extraction, recognition and cost models, the Provider uses exclusively its own, synthetic or publicly available data – not your content, results or corrections. Purely technical operational and security metrics unrelated to your content (e.g. error/response rates, latencies) are unaffected.

(4) Ownership, confidentiality and pass-through of the commitment: The Customer's content remains, as between the parties, with the Customer (Section 6) and is subject to confidentiality under Section 10. The commitment in para. 1 also binds every AI provider the Provider engages: content transmitted to them is not used to train their models under the applicable processing terms (details in the sub-processor directory).

11. Amendment of the Terms

The Provider reserves the right to adjust these Terms with effect for the future where there is good reason to do so (e.g. changes in the legal situation or in supreme court case law, further development of the platform, the closing of gaps).

Procedure for amendments: The Provider will announce amendments to the Terms to the Customer at least 30 calendar days before the planned entry into force in text form, usually by email to the address on file. The notice contains the new text and the date of entry into force and expressly points out the right of objection.

B2B context: The following provision on tacit acceptance (continued use after entry into force is deemed consent) applies exclusively because this contract, in accordance with Section 1, is concluded only with entrepreneurs within the meaning of § 14 BGB. Were a Customer – contrary to the express confirmation given on conclusion of the contract – to qualify as a consumer, this provision does not apply; in that case amendments take effect only upon the Customer’s express consent.

Carve-out for price and service changes: Price changes and material reductions of the contractually agreed scope of services are subject exclusively to the procedure under Section 4 (separate announcement with extraordinary right of termination). They are not deemed accepted merely through continued use, but require the Customer’s express confirmation or the absence of a timely termination under Section 4.

Right of objection: Should the Customer not agree to the amended conditions, it may object in text form up to the entry into force of the amendment. In the event of a timely objection, both parties are entitled to terminate the contract as of the time the amendment takes effect. Any fees paid in advance for periods after the end of the contract are refunded on a pro-rata basis. If the Customer does not object in good time and continues to use the service after the new Terms enter into force, the amended Terms are deemed accepted. The Provider will expressly point this out in the change notice. A change to the services (including prices) otherwise follows the provisions in Section 4.

12. Final provisions

Applicable law: The law of the Federal Republic of Germany applies, excluding the conflict-of-laws rules and the UN Convention on Contracts for the International Sale of Goods (CISG).

Place of jurisdiction: If the Customer is a merchant within the meaning of the German Commercial Code (HGB), a legal person under public law or a special fund under public law, the exclusive place of jurisdiction for all disputes arising from or in connection with this contract is the Provider’s registered office (Überlingen, Germany). The Provider also remains entitled, at its option, to bring proceedings at the Customer’s general place of jurisdiction.

Contract language and authoritative version: These Terms are provided in German and the contract is concluded in German. The German version is solely legally binding. Where the Provider makes translations available (e.g. an English version), these serve solely for ease of understanding; in the event of substantive discrepancies or doubts of interpretation, the German version prevails.

Severability clause: Should a provision of these Terms be or become wholly or partly invalid or unenforceable, this does not affect the validity of the remaining provisions. The statutory provision takes the place of the invalid or unenforceable provision. This does not establish a validity-preserving reduction (geltungserhaltende Reduktion) of a clause that is invalid in itself.

Survival: Provisions which by their meaning and purpose are intended to apply beyond the end of the contract remain effective after the end of the contract. This concerns in particular the provisions on rights of use and their restrictions and on feedback (Section 6), on indemnification (Section 7), on liability and limitation (Section 9), on data export and deletion (Section 5), on confidentiality (Section 10), on these final provisions (Section 12), and on the continuing obligations under Annex 1 (DPA).

No third-party rights: This contract does not create rights in favour of third parties, except where these Terms expressly provide otherwise (such as the extension of the liability provisions to the Provider’s employees and vicarious agents under Section 9).

No collateral agreements: These Terms, including Annex 1 (DPA), together with any additional agreements concluded in writing, constitute the entire agreement between the Provider and the Customer regarding the subject matter of the contract. Amendments or supplements require text form. There are no oral collateral agreements. The priority of an individual agreement (§ 305b BGB) remains unaffected.

Assignment: The Customer is not entitled to assign or transfer rights or obligations under this contract to third parties without the Provider’s prior consent. The Provider may transfer the contract as a whole or individual rights and obligations under it to an affiliated company or, in the context of a transfer of the business, to third parties, provided that no legitimate interests of the Customer are thereby impaired.

Notices and communication: Legally relevant notices from the Provider to the Customer (e.g. terminations, amendments to the Terms, price changes) are sent to the email address stored by the Customer or via the platform’s messaging system. The Customer is obliged to keep its contact details up to date and to check notices regularly. Notices are deemed received when they have been sent to the stored email address.

Annex 1 – Data Processing Agreement (DPA) under Art. 28 GDPR

This Annex 1 forms part of the Terms and governs the processing of personal data on behalf of the Customer (the “Controller”) by rattle mng GmbH as the provider of the ARCNM platform (the “Processor”).

1. Subject matter and duration of the processing

The subject matter of the processing is the provision of the ARCNM SaaS platform (Parts Calculation Engine) in accordance with Section 2 of the Terms. Duration: the processing begins with the conclusion of the main contract (acceptance of the Terms) and ends automatically with its termination; retention and deletion obligations follow from Section 9 of this Annex.

2. Nature and purpose of the processing

Storage, structuring, alteration, retrieval, calculation, transmission to authorised recipients of the Controller, and deletion of personal data for the purpose of providing the agreed SaaS services, including authentication, auditing, IT security and – where activated – AI-assisted functions.

3. Categories of data and categories of data subjects

Categories of data: master and contact data (name, business email address, company name), authentication data (hashed passwords, API key hashes), usage and log data (IP address, timestamp, endpoint, status code, request ID), content data (part descriptions, bills of materials, routings, supplier quotes submitted by the Controller – to the extent they contain personal data), billing data (references to the payment provider's transactions; no full card or account data). Categories of data subjects: employees and agents of the Controller and, where applicable, contact persons at suppliers and business partners whose data the Controller enters into the platform. Special categories of personal data under Art. 9 GDPR are excluded.

4. Obligations of the Processor

The Processor processes personal data solely on documented instructions of the Controller – including with regard to transfers of personal data to a third country or an international organisation –, unless required to do so by Union or Member-State law to which the Processor is subject; in such a case the Processor informs the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest (Art. 28 (3)(a) GDPR). Documented instructions include in particular the Terms and the configurations and operations carried out by the Controller in the platform interface and via the REST API. The Processor will inform the Controller without delay if, in the Processor’s opinion, an instruction infringes applicable data-protection law (Art. 28 (3) sentence 3 GDPR).

The Processor obliges the persons authorised to process the data to confidentiality or ensures that they are subject to an appropriate statutory duty of confidentiality (Art. 28 (3)(b) GDPR).

5. Security of processing (Art. 32 GDPR)

The Processor takes all technical and organisational measures required under Art. 32 GDPR to ensure a level of protection appropriate to the risk. The measures are described in Annex 1.3 (TOMs) and are adapted to the state of the art as needed.

6. Sub-processors (Art. 28(2) and (4) GDPR)

The Controller grants the Processor general authorisation to engage further processors (sub-processors). The sub-processors engaged at the time the contract is concluded are listed in Annex 1.2. The Processor will inform the Controller in advance of any intended engagement or replacement of a sub-processor with a period of at least 30 days (by email or via the platform). The Controller may object in writing within this period for good cause; if the objection cannot be resolved, either party is entitled to terminate the main contract extraordinarily. The Processor imposes on each sub-processor by contract the same data-protection obligations as apply to the Processor itself under this DPA. For sub-processors with published standard business and data processing terms (in particular cloud, AI, payment and communication providers; the current providers and their terms are set out in the sub-processor directory), the Processor fulfils its obligation under Art. 28 (4) GDPR by concluding/incorporating the respective sub-processor's data processing addendum upon use of the service as a contract in electronic form (Art. 28 (9) GDPR); these addenda apply to API customers without separate signature and meet at least the level of protection of this DPA. The Processor evidences such conclusion on request.

Where the Processor engages a sub-processor, it remains liable to the Controller for that sub-processor's compliance with its data-protection obligations as if they were its own (Art. 28 (4) GDPR). The liability provisions of § 12 of this Annex and of Section 9 of the Terms (in particular the monetary cap and the precedence of Art. 82 GDPR) remain unaffected.

Self-operated models: Where the Processor itself runs AI/VLM models (including open-weight models) on its own or Provider-controlled infrastructure (in particular within the EU/EEA), no sub-processor is engaged in that respect and no personal data is transmitted to third parties. Where, by contrast, hosted third parties are used for AI/VLM models, they are sub-processors and are added to Annex 1.2 under the procedure above.

Data flow during the objection period: Until the 30-day objection period expires, no transmission of personal data to a newly added sub-processor takes place unless maintaining platform availability strictly requires it. When replacing an existing sub-processor, the ongoing processing remains with the existing sub-processor until the Controller has consented or the objection period has expired without objection; mandatory migration to maintain availability remains unaffected and is justified to the Controller.

7. Third-country transfers

Where personal data is transferred to a third country outside the EU/EEA (e.g. for object-storage and edge infrastructure, payment processing or Single Sign-On; but not for the AI drawing analysis, which takes place exclusively in the EU), the Processor will ensure that this takes place only on the basis of appropriate safeguards under Art. 46 GDPR (in particular EU Standard Contractual Clauses) or an adequacy decision under Art. 45 GDPR – including the EU-US Data Privacy Framework (Commission Implementing Decision of 10 July 2023) for US recipients certified under that framework.

8. Support with data-subject rights and the Controller’s obligations

The Processor supports the Controller with appropriate technical and organisational measures in responding to requests from data subjects (Art. 15–22 GDPR) and in fulfilling its obligations under Art. 32–36 GDPR (data security, notification of breaches, data protection impact assessment, prior consultation), to the extent this is possible for the Processor taking into account the nature of the processing and the information available to it. Requests from data subjects addressed directly to the Processor are forwarded by it to the Controller without delay.

Controller’s responsibility: The Controller is solely responsible for the lawfulness of the processing, for the existence of a legal basis, and for the admissibility of its instructions and of the data it enters into the platform (Art. 5, 6, 9 GDPR). In particular, it is for the Controller to inform the data subjects – including third parties whose personal data is contained in uploaded drawings or files – under Art. 13 and 14 GDPR and, where required, to ensure a legal basis (including any consents). The Processor has no separate obligation to inform those data subjects.

9. Notification of personal data breaches

The Processor notifies the Controller of any personal data breach that comes to its knowledge without undue delay after becoming aware of it, in text form (email), so that the Controller can meet its own obligations under Art. 33, 34 GDPR in good time. The notification contains the information under Art. 33 (3) GDPR, to the extent available.

10. Return or deletion after the end of the contract

After the end of the main contract the Processor deletes all personal data processed on the Controller’s behalf, or returns it at the Controller’s choice, in accordance with the periods set out in Section 5 of the Terms (30-day export transition period, then deletion with backup roll-off). Existing statutory retention obligations remain unaffected; in that respect the processing is limited to the statutory minimum.

11. Evidence and audits (Art. 28(3)(h) GDPR)

On request, the Processor provides the Controller, to a reasonable extent, with the information required to demonstrate compliance with the obligations set out in this DPA. Audit rights may be exercised primarily through current audit reports or certificates of recognised auditors. On-site inspections are possible by prior arrangement, once a year and during usual business hours; beyond the annual inspection, event-based inspections for good cause (in particular after a personal data breach) are permitted. The costs of the on-site inspection are borne by the Controller; if material breaches by the Processor of this DPA or of mandatory data-protection requirements are established in the process, the Processor bears the costs of the inspection and the costs of remedying the defects.

12. Liability and priority

The liability provisions of the main contract (Section 9 of the Terms) apply accordingly to liability, unless mandatory statutory provisions (in particular Art. 82 GDPR) provide otherwise. In the relationship between the DPA and the main contract, the provisions of this DPA take priority in data-protection matters.

Annex 1.2 – Sub-processors

The current, complete list of the sub-processors engaged by the Processor – each with name, registered seat, purpose, the categories of data processed and the applicable safeguard for third-country transfers (Art. 46/45 GDPR) – is published in the sub-processor directory at arcnm.io/subprocessors and forms part of this DPA (Annex 1.2). By category, these are: hosting; AI-assisted drawing analysis (an open-weights model at a processor inside the EU; no fallback to a model outside the EU); payment processing; transactional email delivery and customer-relationship management (CRM); object storage and edge infrastructure (CDN/DNS/TLS); and – only where the end user activates it – identity providers for single sign-on. Where a recipient acts as an independent controller for its own supervisory, payment or anti-money-laundering purposes (e.g. the payment provider), this is indicated in the directory or in the terms incorporated there. Changes to this directory constitute a change of sub-processors within the meaning of § 6 of this Annex and are notified in accordance with it (general authorisation, 30-day advance notice, right to object for good cause).

Annex 1.3 – Technical and organisational measures (TOMs)

The following measures are described, taking into account the state of the art and the risk, in general, non-exhaustive terms; they are continuously adapted to the state of the art and constitute neither an agreed quality, nor a service level, nor any guarantee going beyond Art. 32 GDPR.


These General Terms and Conditions, including Annex 1 (DPA), enter into force in Version 1.0 on 12 July 2026 (last amended on 17 August 2026) and apply until amended in accordance with Section 11. The German version is legally binding (see Section 12).