General terms & conditions and contract data processing agreement pursuant to Art. 28 GDPR
A. General terms and conditions
Last update: May 29, 2024
1. Scope of Application
1.1 These General Terms and Conditions apply to the provision of the services in connection with the Loady platform (“Platform”) as well as related products and services (together “Services“) of Loady GmbH, Industriestraße 35, 68169 Mannheim (“Loady“).
1.2 The Services of Loady are aimed exclusively at Customers (“Customer(s)“) who are businesses (Sec. 14 BGB (German Civil Code)), a legal entity under public law or a special fund under public law. The provision of services to consumers (Sec. 13 BGB) is excluded.
1.3 The provision of the Services is exclusively based on these General Terms and Conditions. The general terms and conditions of the Customer shall not apply. This also applies if Loady does not expressly object to the Customer’s general terms and conditions in individual cases.
2. Offer and Acceptance
2.1 Unless indicated, offers of Loady are subject to confirmation and non-binding and are to be understood as an invitation to the Customer to make an offer to Loady. The Customer is bound by his offer for fourteen (14) days.
2.2 The agreement is concluded when Loady accepts the Customer’s offer by means of an order confirmation or by countersigning the offer document. Loady is not obliged to accept orders from the Customer.
2.3 In the case of orders via an online store or website of Loady, the Customer’s order sent with the completion of the order dialogue constitutes the legally binding offer. This is made by the Customer going through the order dialogue and selecting the button “Confirm Order”. Before doing so, the Customer can change its order or cancel the order process. Unless expressly identified as such, automated confirmation of receipt do not constitute a legally binding acceptance of the offer, but merely confirm the receipt of the order by Loady. After positive examination of the order, Loady will send an order confirmation to the Customer by e-mail, which constitutes a legally binding acceptance of the offer.
3. Quality of the Services, Test Accounts
3.1 Unless otherwise agreed, the quality of the Services shall conform exclusively to the service specification and the program description of Loady. Loady does not promise any properties or possible uses of the Services beyond these specifications. The economic risk of use for the Services lies with the Customer.
3.2 The Platform is regularly revised in order to keep it compatible with the current software and hardware environments and to provide new or improved functions. Due to the provision as a platform solution, only the latest version of the Platform is generally available. Therefore, no ongoing compatibility with certain browsers, software or hardware environments can be guaranteed. Furthermore, Loady reserves the right to change, suspend or completely terminate individual Services or functionalities of the Platform. If this results in a considerable restriction of the usability of the Platform, the Customer is entitled to extraordinary termination. In this case, fees for unused periods shall be refunded. Any further claims by the Customer are excluded.
3.3 Insofar as Loady makes the Services available via a test account or via a free beta version, this is a voluntary service provided by Loady. Test accounts and free beta versions serve exclusively to familiarize oneself with the Services, but not for productive work. Loady reserves the right to deactivate test accounts at any time, even without prior notification, or to make the test Services the subject of a paid service which can be ordered separately.
4. Advice and Additional Services
4.1 Insofar as Loady provides consultancy services beyond the contractually agreed scope of performance, this shall be done to the best of its knowledge. Details and information about the suitability and application of products and services do not exempt the Customer from carrying out its own tests and trials.
4.2 Services which are provided in addition to the provision of the Platform (e.g. installation and configuration services, training, migration support) are only owed if they have been expressly ordered. In this case, the agreed fees apply, which are in addition to the license fees for the Services. In the event that no fees have been agreed, Loady’s standard hourly rates shall apply.
4.3 Costs incurred for the provision of additional services shall be invoiced to the Customer at the purchase price and shall be reimbursed by the Customer. In the case of costs that exceed the usual level, Loady will consult with the Customer in advance.
5. Types of Customers
5.1 Depending on the license purchased by the Customer, the Customer can use the Platform as a sending and receiving company in order to predominantly pass on information and requirements for loading and unloading products at loading and unloading points (“Logistics Information”) in order to receive logistics services (“Company”) or a carrier in order to predominantly receive product and logistic information in order to provide transport services (“Carrier”).
5.2 Transactions between Companies and Carriers are taking place directly between such parties. Loady only provides the technical means to share and access such Logistic Information. Loady is therefore not responsible for the accuracy of the Logistic Information provided by the Companies or the fulfillment of transport assignments.
6. Service Fees, Prices and Payment Terms
6.1 Customers are generally charged with a recurring fee for the use of the platform (“Platform Service Fee”) and one-time fees for ordered special services (“Special Services Fees”).
6.2 The prices agreed between the parties apply. Loady is entitled to adjust the prices at any time by giving at least one (1) week notice via e-mail or via the Platform. The adjusted Platform Service Fee shall take effect on the date specified in the notice but shall only apply to running contracts upon the renewal of the contract period.
6.3 The prices quoted are net prices unless they are expressly stated as gross prices.
6.4 In the event that the general inflation according to the German consumer price index increases by more than 5% within a running contractual period, Loady shall be entitled to adjust its prices accordingly also during such contract period.
6.5 Unless otherwise agreed, the Platform Services Fee shall be payable in advance upon the start of the agreed contract period and any renewals of the contract period for the complete contract period. If payment intervals have been agreed, the Platform Service Fee shall become payable at the start of each such payment interval. Special Services Fees shall be payable within thirty (30) days of the respective invoice date at the latest.
6.6 Customers may upgrade their Service type or Service package (e.g. by adding products, loading points or transport lanes, API connectors or by upgrading to a higher Service type) during a running contract period. The additional Platform Service Fee shall be charged for the remainder of the running contract period on a pro-rata basis. Downgrades (e.g. by reducing products, loading points or transport lanes, API connectors or by downgrading to a lower Service type) is only possible at the renewal of the contract period.
6.7 In the event that the Customer uses the Services beyond the contractually agreed scope or makes them available to third parties, Loady shall be entitled to make a subsequent calculation of the license fees on the basis of the actual use.
7. Provision and Use of the Services
7.1 The Services are hosted in a third-party cloud environment. Therefore, the terms of the cloud provider apply. A current version of these conditions can be accessed via the Platform. The Customer is aware that the terms and conditions of the cloud provider may change from time to time which also may affect the provision of the Services. If this results in a considerable restriction of the usability of the Platform, the Customer is entitled to extraordinary termination. In this case, fees for unused periods shall be refunded. Any further claims by the Customer are excluded.
7.2 This server can be accessed via the internet and therefore requires a functioning internet access of the Customer. For certain Services additional hardware and software may be required as indicated by Loady, which is to be procured by the Customer at its own expense.
7.3 Insofar as the Customer is provided with access data or passwords in connection with the provision of the Services, the Customer must keep these strictly secret and not pass them on. Loady must be informed immediately of any loss of the access data or passwords.
7.4 The Customer is only entitled to use the Services within the contractually agreed scope. The Customer is not entitled to make the Services available to third parties against payment or free of charge without Loady’s prior written consent.
7.5 Loady shall endeavor to an economically reasonable extent to make the Services permanently available. However, complete availability 24 hours a day, 7 days a week cannot be guaranteed. Specific availabilities are only owed if specifically agreed. Excluded from the availability are in particular (i) planned downtimes for maintenance and service work, which are carried out outside the general office hours (Mon-Fri 9:00-17:00 CET) if possible and (ii) any unavailability caused by circumstances beyond Loady’s reasonable control, such as e.g. acts of government, flood, fire, earthquake, civil unrest, epidemics or pandemics, acts of terrorism, strikes, internet service provider failure or delay, third party application impact or denial of service attacks.
8. User Accounts and Management
8.1 The Customer can set-up user accounts for its employees to use the Platform. Unless otherwise agreed, the number of user accounts shall not be limited.
8.2 Unless otherwise agreed, user accounts may only be set-up for employees of the Customer. In case of an Loady Enterprise Company type, user accounts may also be set up for employees of affiliates of the Customer. For other service types, user accounts for affiliates of the Customer are excluded and are subject to the affiliate acquiring an own license or a license covering the entire group of companies of the Customer.
8.3 The Customer shall be responsible for the management of user accounts. This includes the deactivation of user accounts in the event that a user is no longer an employee of the Customer.
8.4 The Customer shall ensure that all users adhere to this agreement. For the purposes of this agreement, employees of the Customer or any other persons for which the Customer sets up user accounts shall be deemed vicarious agents of the Customer (Sec. 278 BGB).
9. Entering of Data
9.1 The Platform allows Companies to enter Logistics Information and other data for display and usage to Carriers and Business Partners. Companies can select which Carriers and Business Partners shall be able to view such data via the Platform. In order to view the data via the Platform, the Carriers and Business Partners will also have to subscribe to the Loady Services. In addition, Companies can make the data available via a link which they can distribute to any third party. Authorized Carriers or Business Partners who subscribed to Loady are able to create these links, too, which they can distribute to their sub-contractors and drivers.
9.2 The Customer shall be solely responsible for the data entered into the Platform. Loady does not assume any responsibility for the data entered by the Customer and made available to other Customers or third parties via the Platform.
9.3 The Customer must ensure that it is allowed to enter the data into the Platform and that the entered data does not infringe any statutory provisions or rights of any third party and that the data is accurate. The Customer indemnifies Loady, its directors, employees and agents against any claim, loss or damage, including reasonable legal fees, resulting from the data entered into the Platform by the Customer.
10. Further Terms with Respect to the Services
10.1 The provision of the Services is governed by service agreement (“Dienstvertrag”) law. The law on agreements for work and services (“Werkvertrag”) shall only apply if and to the extent that Loady has expressly promised the Customer the creation of a specific work or a specific success.
10.2 Loady is entitled to make and charge for part deliveries and part performances provided that the part delivery is usable for the Customer within the scope of the contractual purpose, the delivery of the remaining ordered products or the performance of the remaining Services is ensured and the Customer does not incur any considerable additional expenditure or additional costs as a result (unless Loady agrees to bear these costs).
10.3 Any deadlines and dates promised by Loady for the performance of the Services are always only approximate and are subject to change. This also applies to dates and deadlines stated in offers and order confirmations, unless these are expressly described as binding.
10.4 If acts of cooperation by the Customer are required for the provision of Services, Loady is not obliged to effect the Services insofar as and to the extent that it cannot be provided without the act of cooperation.
11. Obligations of the Customer and Authorized Users
11.1 Only data that the respective Customer is entitled to use and reproduce may be entered or uploaded into the Platform. By entering or uploading data, the Customer declares that he is authorized to use the data and that no rights of third parties are infringed by the entry, uploading and use of the data, including any associated acts of reproduction.
11.2 Use of the Platform is only permitted in accordance with the terms of this agreement, applicable laws and governmental regulations.
11.3 The Customer may not (i) make the Services available to or use it for the benefit of anyone other than the users for whom a user account has been opened; (ii) sell, resell, license, sublicense, distribute, rent or lease the Services and/or the Loady platform and its contents; (iii) use the Services to store or transmit infringing, defamatory or otherwise unlawful or tortious material or to store or transmit material which infringes the rights of any third party; (iv) use the Services to store or transmit malicious code; (v) interfere with or disrupt the integrity or performance of the Services or any third party data contained therein; (vi) attempt to gain unauthorized access to the Services or any related systems or networks; (vii) permit direct or indirect access to or use of the Services in any manner that circumvents any contractual restriction on use; (viii) copy the Services or any part, feature, function, content or user interface thereof except as necessary for the use of the Services contemplated under this agreement (e.g., loading the software into a temporary storage device) except for Customer’s data entered into the Platform. (ix) framing or mirroring any part of the Services, other than framing on its own intranet or otherwise for its own internal business purposes; or (x) accessing the Services to create a competing product or service; or (xi) reverse engineering the Services (to the extent such restriction is not mandatory to be permitted by statutory law).
11.4 In the event that the Customer or a user authorized by the Customer breaches any of the obligations under these Terms, Loady shall be entitled to terminate the agreement for cause. Furthermore, the Customer is liable for all damages incurred, including reasonable legal costs. In the event that the Services are made available to third parties by the Customer without approval by Loady, Loady is entitled to charge the Customer for the use by these third parties in accordance with Loady’s standard fees. This does not apply if the Customer is not responsible for the infringement. If there is reason to believe that a serious violation has occurred, Loady is also entitled to temporarily suspend access to the Platform. Access to the Platform will be resumed as soon as the suspicion has been dispelled. In the event of violations by the user of a specific user account, Loady is also entitled to block this account completely or temporarily.
12. Payment Default
12.1 In the event that specified payment terms are exceeded, in the case of payment on account, if the payment term of fourteen (14) days after the invoice date is exceeded, the Customer shall be in default without a separate reminder being required.
12.2 Non-payment of the remuneration when due shall constitute a material breach of contractual
12.3 In the event of default in payment on the part of the Customer, Loady is entitled to demand interest on arrears, namely, in the case of invoicing in euros, in the amount of 9 percentage points above the base interest rate announced by the Deutsche Bundesbank at the time of the occurrence of the default. The assertion of further damages caused by default by Loady remains unaffected.
13. Rights of the Customer in Case of Product Defects
13.1 The warranty for defects is governed by service agreement law. Loady must be notified of defects in the Services which can be detected during a proper inspection without delay, at the latest within two (2) weeks after the Services have been provided; Loady must be notified of other defects without delay, at the latest within four (4) weeks after they have been detected. The notification must be made in writing and must precisely describe the type and extent of the defects.
13.2 If the Services are defective and the Customer has duly notified Loady of this in accordance with the above paragraph, the Customer is entitled to the statutory rights with the following provisos:
a) Loady first has the right, at its discretion, either to remedy the defect or to supply the Customer with defect-free Services or to provide the defective performance again (subsequent performance). In the case of defects that do not impair the essential functions of the Services, rectification can also take place within the framework of the next routine update.
b) Loady reserves the right to make two attempts at subsequent performance. If the subsequent performance fails or is unreasonable for the Customer, the Customer can either terminate the agreement or demand a reduction of the price.
c) The following clause applies to claims for damages and for reimbursement of futile expenses due to a defect.
13.3 Loady warrants that the Platform and other software provided in connection with the Services is free of third-party rights. If third parties assert rights to such software, Loady is entitled to eliminate the claims by acquiring appropriate licenses or to redesign the software while preserving the essential functionality in such a way that the rights of the third parties are no longer infringed. Should this not be possible with economically reasonable effort, Loady shall be entitled to terminate the agreement.
14. Liability
14.1 Loady shall in principle be liable for damages in accordance with the statutory provisions. Loady is liable for damages – irrespective of the legal grounds – within the scope of fault liability in the case of intent and gross negligence. In the event of a breach of material contractual obligations due to simple negligence (obligations the fulfilment of which is a prerequisite for the proper performance of the agreement and the observance of which the contractual partner regularly relies on and may rely on), Loady’s liability is, however, limited to compensation for typical, foreseeable damage; in the event of a breach of non-material contractual obligations due to simple negligence Loady’s liability is excluded.
14.2 The limitations of liability in accordance with the preceding paragraph do not apply
a) in the case of damages arising from injury to life, body or health which are based on a negligent breach of duty by Loady or an intentional or negligent breach of duty by a legal representative or vicarious agent of Loady,
b) insofar as Loady has fraudulently concealed a defect,
c) insofar as Loady has assumed a guarantee for the quality of a product or a service,
d) for claims under the Product Liability Act.
14.3 Loady’s liability for indirect damage (e.g. loss of profit, interruption of business, consequential damage) is excluded.
14.4 The Customer itself is responsible for properly securing the data entered into the system and for making regular backups. Liability for loss of data is limited to the damage that would have occurred if the Customer had properly backed up the data.
15. Statute of Limitation
15.1 The limitation period for claims arising from defects of the Services including defects of title shall be one year from delivery or performance. If acceptance has been agreed, the limitation period shall begin with acceptance.
15.2 The limitation period for contractual and tortious claims for damages shall be one year from the commencement of the statutory limitation period.
15.3 Notwithstanding the above paragraphs, the statutory limitation periods shall apply where prescribed as mandatory under statutory laws, in case of intent or gross negligence and in cases of section 14.2.
16. Right to Set-Off, Right of Retention
The Customer is only entitled to set-off or to assert rights of retention insofar as his counterclaims are undisputed or have been legally established.
17. Securities
In the event of justified doubts as to the solvency of the Customer, in particular in the event of default in payment, Loady may, without detriment to further claims, revoke payment periods granted and make further deliveries and services dependent on the granting of other securities or advance payments.
18. Intellectual Property and Use of Data
18.1 Loady reserves all rights to the Platform and any other software provided in connection with the Services.
18.2 Loady grants Customer the non-exclusive, non-transferable and non-sublicensable right to use the Platform, software or other work results of the Services in accordance with the agreements, including these General Terms & Conditions. Exclusive rights are only granted if specifically agreed. The Customer is not entitled to use or exploit the Platform or other software or work results in any form that is not covered by agreements with Loady. The respective right of use expires automatically when the present agreement or the period of use for individual service types or packages ends.
18.3 A right to edit software exists only with the prior written consent of Loady as well as in the legally compelling cases according to Sec. 69 et seq. UrhG (German Copyright Act). The right of use granted shall automatically expire upon termination of the underlying contractual
18.4 Unless otherwise agreed, the Customer shall receive software only in object code. There shall be no entitlement to the source code.
18.5 In the event that Customer edits or otherwise redesigns the Platform or any other software provided by Loady, Loady shall be exclusively entitled to any and all results arising therefrom.
18.6 The Customer shall own the data submitted to the Platform. The Customer grants Loady and its affiliated companies and agents a worldwide, royalty-free license to host, copy, transfer and display the data insofar as this is necessary for the provision of the Services. This also applies in the event of modifications or further developments of the Services. Loady is entitled to copy the entered or uploaded data for backup purposes.
18.7 Loady will provide Customers the opportunity to use Loady data also in other software solutions and platforms. Therefore, Loady will conclude individual agreements with third-party software solution providers ensuring that the Customer’s data ownership and data governance rights apply when deploying the Loady Plugin. Third-party software solutions and platforms shall require Customer’s active agreement to use the Loady Plugin before Customers start using it. Loady will in no event pass on individual data provided by the Customer to third parties without prior consent.
18.8 Loady is entitled to use data entered into the Platform or gathered as part of the provision of the Services for other purposes, including for the preparation of forecasts on an aggregated level only. An individual use of Customer data by Loady is prohibited. Furthermore, Loady is entitled to use metadata (e.g. how many sites of what countries and companies are in Loady, how many products, how many transport lanes) for commercial and other similar services and products or for benchmarking purposes.
19. Term and Termination
19.1 The term of the agreement shall be agreed between the parties. In the event that the parties have agreed fixed performance periods, ordinary termination shall be excluded.
19.2 Furthermore, the agreement can be terminated in writing by either party without notice for good cause. Good cause for termination by Loady exists in particular if the Customer uses the Platform beyond the extent permitted under this agreement and this violation is not stopped within a reasonable period of time despite a warning or if the Customer is in default with the payment of fees for a period of more than one (1) month. A good cause for termination by the Customer exists if essential functions of a purchased service type or package cease to exist due to a change in the Platform during the subscription period.
19.3 In the event of extraordinary termination for good cause by the Customer, Loady shall refund any fees received for unused subscription periods. In the event of extraordinary termination for good cause by Loady, unused reference periods shall lapse unless the Customer proves that Loady has saved corresponding expenses due to the premature termination of the agreement.
19.4 Loady is entitled to terminate the contract extraordinarily if the platform is discontinued altogether. Loady will notify the customer of this in advance, giving reasonable notice. In this case, Loady will refund to the customer the fees received for unused subscription periods.
19.5 After the termination of this Agreement, the Customer is obligated to discontinue the use of the Services and, upon Loady’s request, to delete any software installed on Customer’s systems for the use of the Services as well as to return to Loady or destroy any user documentation received.
19.6 After the termination of this Agreement, Loady grants the Customer the possibility to export data stored on the Platform to a general data format for a period of one (1) month. Any assistance on the part of Loady shall be subject to the payment of a Special Services Fee and requires a separate agreement between the parties.
19.7 In the event of termination of the agreement, those provisions shall continue to apply which, according to their meaning and purpose, are intended to survive the agreement. This applies in particular to the provisions regarding property rights and licenses, warranty, liability, confidentiality, data protection and final provisions.
20. Confidentiality
20.1 “Confidential Information” means any information disclosed by one party (“Disclosing Party“) to the other party (“Receiving Party“), orally or in writing, which is designated as confidential or which, given the nature of the information and the circumstances of disclosure, is reasonably to be understood to be confidential. However, Confidential Information does not include information that, as demonstrated by the Receiving Party, (i) is or becomes generally known to the public without breach of any duty owed to the Disclosing Party; (ii) was known to the Receiving Party prior to its disclosure by the Disclosing Party without breach of any duty owed to the Disclosing Party; (iii) received from a third party without breaching any obligation owed to the disclosing party; (iv) independently developed by the Receiving Party; or (v) otherwise to be disclosed as agreed between the parties.
20.2 The Receiving Party shall use the same degree of care as it uses to protect the confidentiality of its own Confidential Information of the same nature (but not less than reasonable care) to (i) not use Confidential Information of the Disclosing Party for purposes outside the scope of this agreement and (ii) limit access to Confidential Information of the Disclosing Party to those of its employees and its affiliates and contractors who need such access for purposes consistent with this Agreement, unless otherwise approved in writing by the Disclosing Party.
20.3 The Receiving Party may disclose Confidential Information of the Disclosing Party to the extent it is compelled to do so by law or by a court or governmental order, provided that the Receiving Party notifies the Disclosing Party in advance of the compelled disclosure.
21. Force Majeure
Should events and circumstances, the occurrence of which lies outside the sphere of influence of Loady (such as, for example natural events, epidemics, war, industrial disputes, shortage of raw materials and energy, traffic and operational disruptions, damage caused by fire and explosion, public-law decrees), reduce the possibility of performance so that Loady cannot fulfil its contractual obligations (taking into account other internal or external performance obligations on a pro rata basis), Loady is (i) released from the contractual obligations for the duration of the disruption and to the extent of its effects and (ii) not obliged to procure the Services from third parties. Sentence 1 also applies insofar as the events and circumstances make the performance of the affected business sustainably uneconomical for Loady or are present at Loady’s upstream suppliers. If these events last longer than three (3) months, Loady is entitled to withdraw from or terminate the agreement.
22. Place of Performance
Irrespective of the place of delivery of the goods or documents or the place of performance of the Services, the place of performance for the Customer’s payment obligation is the registered office of Loady.
23. Data Protection
23.1 If Loady provides the Customer with personal data of its employees or other third parties (hereafter “Personal Data“) in the context of the performance of the agreement or if the Customer otherwise obtains knowledge of such Personal Data, the following provisions shall apply. Personal data disclosed in the aforementioned manner and not processed on behalf of Loady may be processed by the Customer exclusively for the performance of the agreement and may not – except where permitted by law – be processed in any other way, in particular disclosed to third parties and/or analyzed for its own purposes and/or used to create profiles. This also applies in the case of the use of anonymized data.
23.2 The Customer shall ensure that the Personal Data is only made accessible to those employees of the Customer who are deployed for the performance of the relevant agreement and only to the extent necessary for the performance of this agreement (need-to-know basis). The Customer shall organize its internal organization in such a way that it complies with the requirements of the applicable data protection law, in particular by taking technical and organizational measures to adequately protect the Personal Data from misuse and loss.
23.3 The Customer shall not acquire any rights to the Personal Data and shall be obliged to correct, delete and/or restrict the processing of the Personal Data at any time under the statutory conditions. Rights of retention in relation to Personal Data are excluded.
23.4 In addition to its legal obligations, the Customer shall inform Loady without undue delay, at the latest within 24 hours, of a breach of the protection of Personal Data, in particular in the event of loss. Upon termination of the relevant agreement, the Customer will delete the Personal Data, including all copies made, in accordance with the statutory requirements.
23.5 Loady will observe the data protection requirements of the GDPR in the performance of the agreement and the provision of the Services.
23.6 In the event that the Customer or the Customer’s employees enter personal data into the Platform, the Customer must ensure that he has all the necessary consents or other authorizations. This applies in particular to the creation and management of user accounts. The Customer shall indemnify Loady, its organs, employees or agents against all costs or damages resulting from the Customer’s breach of these obligations upon first request.
24. Jurisdiction
In the event that the contracting parties are merchants, legal entities under public law or special funds under public law, the exclusive place of jurisdiction is the registered office of Loady. However, Loady is entitled to bring an action at the general place of jurisdiction of the Customer.
25. Applicable law
The contractual relationship shall be governed by the law of the Federal Republic of Germany to the exclusion of German international private law and to the exclusion of the United Nations Convention on Contracts for the International Sale of Goods of 11 April 1980.
26. Miscellaneous
26.1 There are no verbal ancillary agreements. Amendments or supplements to this contract must be made in writing (Sec. 126 BGB). This also applies to the waiver of the written form requirement.
26.2 Should one or more provisions of the contract prove to be invalid, void or incomplete, this shall not affect the validity of the remaining provisions of the contract. The parties shall – if necessary, in the due form – replace the invalid or void provision by such a provision or fill the gap in the contract by such a provision with which the economic purpose pursued by them can be achieved as closely as possible. If the ineffectiveness or invalidity of a provision is based on a measure of performance or time (deadline or date), a legally permissible measure shall take the place of the ineffective or invalid performance or time provision.
B. Contract data processing agreement pursuant to Art. 28 GDPR
Preamble
The Client wishes to commission the Contractor with the services specified in § 2. Part of the fulfilment of the contract is the processing of personal data. Art. 28 GDPR in particular places certain requirements on such commissioned processing. The parties conclude the following agreement in order to comply with these requirements.
1. Definitions
For terms used in this agreement for which Art. 4 GDPR provides a definition, this legal definition shall also apply to this agreement in the version applicable at the time the agreement is concluded.
2. Subject matter of the contract
2.1 The Contractor shall provide services for the Client in the area of the Loady platform. In doing so, the Contractor and its employees or persons authorised by the Contractor shall have access to personal data and shall process such data exclusively on behalf of and in accordance with the instructions of the Client. The scope and purpose of data processing by the Contractor are set out in the main contract (and, if available, in the associated service description) and in Annex 1 to this contract. The Client is responsible for assessing the permissibility of the data processing.
2.2 The parties conclude the present agreement in order to concretise the mutual rights and obligations under data protection law. In case of doubt, the provisions of this agreement shall take precedence over the provisions of the main agreement.
2.3 The term of this contract shall be based on the term of the main contract, unless obligations extending beyond the term of the main contract arise from the following provisions. Any rights of cancellation arising from this contract shall remain unaffected by the above provision.
2.4 This agreement shall remain valid beyond the end of the main contract for as long as the Contractor has personal data that was provided to it by the Client or that it has collected for the Client.
2.5 The provision of the contractually agreed data processing shall take place exclusively in a member state of the European Union or another state party to the Agreement on the European Economic Area. Any relocation to a third country requires the prior consent of the client and may only take place if the special requirements of Art. 44 et seq. GDPR are fulfilled.
3. Right to issue instructions
3.1 The Contractor may only process data within the scope of the main contract and in accordance with the instructions of the Client. If the Contractor is obliged by the law of the European Union or the Member States to which it is subject to carry out further processing, it shall inform the Client of these legal requirements prior to processing, insofar as it is legally permitted to do so.
3.2 The client’s instructions are initially set out in this contract and may subsequently be amended, supplemented or replaced by the client in writing or in text form by individual instructions (individual instructions). The client is authorised to issue corresponding instructions at any time. This includes instructions regarding the correction and deletion of data and the restriction of processing. The persons authorised to issue instructions are listed in Appendix 4. In the event of a change or long-term absence of the named persons, the successor or representative must be named to the contractual partner immediately in text form.
3.3 All instructions issued must be documented by both the Client and the Contractor. Instructions that go beyond the service agreed in the main contract shall be treated as a request for a change in service. This shall be without prejudice to any provisions regarding compensation for additional expenses incurred as a result of additional instructions issued by the Client to the Contractor.
3.4 If the Contractor is of the opinion that an instruction of the Client violates data protection regulations, it must inform the Client of this immediately. The Contractor shall be entitled to suspend the implementation of the instruction in question until it has been confirmed or amended by the Client. The Contractor may refuse to carry out an obviously unlawful instruction.
4. Type of data processed, group of data subjects
As part of the performance of the main contract, the Contractor shall have access to the personal data of the data subjects specified in more detail in Annex 1.
5. Protective measures of the contractor
5.1 The Contractor is obliged to comply with the statutory provisions on data protection and not to disclose the information obtained from the Client’s area to third parties or expose it to their access without corresponding instructions. Documents in paper form and data must be secured against unauthorised access, taking into account the state of the art.
5.2 The Contractor shall design the internal organisation in its area of responsibility in such a way that it meets the special requirements of data protection. The Contractor warrants that it has taken all necessary technical and organisational measures to adequately protect the Client’s data in accordance with Art. 32 GDPR, in particular at least the measures listed in Annex 2. If special categories of personal data are also processed, the Contractor shall additionally take the appropriate and specific measures resulting from Section 22 (2) BDSG, which are specified in more detail in Annex 2. At the request of the client, the contractor shall disclose the detailed circumstances of the determination of which measures are taken and the implementation of the measures.
The Contractor reserves the right to improve the security measures taken, whereby it shall ensure that the contractually agreed level of protection is not undercut and that the Client is informed immediately of any significant changes.
5.3 Data protection officer or – if a data protection officer does not have to be appointed in accordance with Art. 37 para. 1 GDPR or § 38 BDSG or a state data protection law: The Contractor shall publish the contact details of the data protection officer on its website and communicate them to the data protection supervisory authority. The contractor shall provide suitable evidence of publication and notification at the request of the client. A change in the person of the data protection officer/contact person for data protection must be communicated to the client immediately.
5.4 The persons employed by the Contractor for data processing are prohibited from processing personal data without authorisation. The Contractor shall oblige all persons entrusted by it with the processing and fulfilment of this contract (hereinafter referred to as employees) accordingly (obligation of confidentiality, Art. 28 para. 3, para. 1 sentence 2 lit. b GDPR), instruct them about the special data protection obligations arising from this contract as well as the existing instruction or purpose limitation and ensure compliance with the aforementioned obligation with due care. These obligations must be formulated in such a way that they remain in force even after termination of this contract or the employment relationship between the employee and the contractor. Proof of the employee’s obligations must be provided to the client in an appropriate manner upon request.
6. Information obligations of the contractor
6.1 In the event of disruptions in the processing activities, suspected data protection violations or breaches of contractual obligations of the Contractor or suspicion of other security-relevant incidents at the Contractor, at persons employed by the Contractor within the scope of the order or by third parties, the Contractor shall inform the Client immediately in writing or text form. The same applies to audits of the Contractor by the data protection supervisory authority that concern processing or circumstances relevant to the Client. The notification of a personal data breach shall contain the following information, where possible:
a) description of the nature of the personal data breach, including, where possible, the categories and number of data subjects concerned, the categories and number of personal data records concerned
b) a description of the likely consequences of the injury
c) a description of the measures taken or proposed to be taken by the contractor to remedy the breach and, where appropriate, measures to mitigate its possible adverse effects
6.2 The Contractor shall immediately take the necessary measures to secure the data concerned and to minimise possible adverse consequences for the person(s) concerned, inform the Client thereof, request further instructions from the Client and provide the Client with further information at any time insofar as the Client’s data is affected by a breach pursuant to para. 1.
6.3 Should the Client’s data be jeopardised by seizure or confiscation, by insolvency or composition proceedings or by other events or measures by third parties, the Contractor shall inform the Client of this immediately, unless it is prohibited from doing so by court or official order. In this context, the Contractor shall immediately inform all competent authorities that the decision-making authority over the data lies exclusively with the Client.
6.4 The Contractor shall inform the Client immediately of any significant changes to the security measures in accordance with Section 6 (2).
6.5 The Contractor shall keep a list of all categories of processing activities carried out on behalf of the client, which shall contain all information pursuant to Art. 30 para. 2 GDPR. The list shall be made available to the client upon request.
6.6 The Contractor shall cooperate to an appropriate extent in the preparation of the list of procedures by the Client and in the preparation of a data protection impact assessment pursuant to Art. 35 GDPR and, if applicable, in the prior consultation of the data protection supervisory authorities pursuant to Art. 36 GDPR. It must provide the Client with the necessary information in an appropriate manner.
7. Control rights of the client
7.1 The Client shall satisfy itself of the Contractor’s technical and organisational measures before commencing data processing and thereafter on a regular basis. For this purpose, it may, for example, obtain information from the Contractor, have existing certificates from experts, certifications or internal audits presented to it or, if possible, personally inspect the Contractor’s technical and organisational measures after timely consultation during normal business hours or have them inspected by a competent third party, provided that the latter is not in a competitive relationship with the Contractor. The Client shall only carry out inspections to the extent necessary and shall not disproportionately disrupt the Contractor’s operating procedures.
7.2 The Contractor undertakes to provide the Client with all information and evidence required to carry out a check of the Contractor’s technical and organisational measures in accordance with Annex 2 within a reasonable period of time at the Client’s verbal or written request.
7.3 The Client shall document the results of the checks it has carried out and inform the Contractor accordingly. In the event of errors or irregularities that the client discovers, in particular during the inspection of order results, the client shall inform the contractor immediately. If facts are discovered during the inspection that require changes to be made to the ordered procedure in order to avoid them in the future, the client shall inform the contractor of the necessary procedural changes without delay.
7.4 Upon request, the Contractor shall provide the Client with a comprehensive and up-to-date data protection and security concept for order processing and for persons authorised to access the data.
7.5 Upon request, the Contractor shall provide the Client with evidence of the obligation of the employees in accordance with Section 6 (4).
8. Use of subcontractors
8.1 The contractually agreed services or the partial services described below shall be performed with the involvement of the subcontractors listed in Annex 3. Within the scope of its contractual obligations, the Contractor is authorised to establish further subcontracting relationships with subcontractors (“subcontractor relationship”). The Contractor shall inform the Client of this immediately. The Contractor is obliged to carefully select subcontractors according to their suitability and reliability. When engaging subcontractors, the Contractor must bind them in accordance with the provisions of this agreement and ensure that the Client can also exercise its rights under this agreement (in particular its inspection and control rights) directly against the subcontractors. If subcontractors in a third country are to be involved, the Contractor must ensure that an appropriate level of data protection is guaranteed at the respective subcontractor (e.g. by concluding an agreement based on the EU standard data protection clauses). Upon request, the Contractor shall provide the Client with evidence of the conclusion of the aforementioned agreements with its subcontractors
8.2 A subcontractor relationship within the meaning of these provisions shall not exist if the Contractor commissions third parties with services that are to be regarded as purely ancillary services. These include, for example, postal, transport and dispatch services, cleaning services, telecommunication services with no specific connection to services provided by the contractor for the client and security services. Maintenance and testing services constitute subcontractor relationships within the meaning of para. 1 insofar as they are provided for IT systems that are also used in connection with the provision of services for the client.
9. Enquiries and rights of data subjects
9.1 The Contractor shall support the Client with suitable technical and organisational measures in fulfilling the Client’s obligations pursuant to Art. 12-22 as well as 32 and 36 GDPR.
9.2 If a data subject asserts rights, such as the right to information, correction or deletion of their data, directly against the contractor, the contractor shall not react independently, but shall immediately refer the data subject to the client and await the client’s instructions.
10. Liability
10.1 The Client and the Contractor shall be liable to data subjects in accordance with the provisions of Art. 82 GDPR. The Contractor shall coordinate any fulfilment of liability claims with the Client.
10.2 The Contractor shall indemnify the Client against all claims asserted by data subjects against the Client for breach of an obligation imposed on the Contractor by the GDPR or for failure to comply with or breach of an obligation set out in this Agreement or an instruction issued separately by the Client.
10.3 The parties shall indemnify each other against liability if/insofar as one party proves that it is not responsible in any respect for the circumstance that caused the damage to a data subject. Otherwise, Art. 82 para. 5 GDPR shall apply.
10.4 Unless otherwise stipulated above, the liability under this contract corresponds to that of the main contract.
11. Extraordinary right of cancellation
The Client may terminate the main contract in whole or in part without notice if the Contractor fails to fulfil its obligations under this contract, intentionally or grossly negligently violates provisions of the GDPR or is unable or unwilling to carry out an instruction of the Client. In the case of simple – i.e. neither wilful nor grossly negligent – breaches, the Client shall set the Contractor a reasonable deadline within which the Contractor can remedy the breach.
12. Termination of the main contract
12.1 Upon termination of the main contract or at any time at the Client’s request, the Contractor shall return to the Client all documents in paper form, data and data carriers provided to it or – at the Client’s request, unless there is an obligation to store the personal data under Union law or the law of the Federal Republic of Germany – delete them. The obligation to return or destroy also applies to any data backups at the Contractor. The Contractor must provide documented proof of proper deletion.
12.2 The client has the right to check the complete and contractually compliant return or deletion of the data at the contractor in a suitable manner or to have it checked by a competent third party, provided that this third party is not in a competitive relationship with the contractor.
12.3 The Contractor is obliged to treat as confidential any information that becomes known to it in connection with the main contract, even after the end of the main contract.
13. Final provisions
13.1 The parties agree that the contractor has no right of retention with regard to the data to be processed and the associated data carriers.
13.2 Amendments and additions to this contract, the declaration of cancellation and the amendment of this clause must be made in writing to be effective (Section 126 (1), (2) BGB). Replacement of the written form by the electronic form (Sections 126 (3), 126 a BGB) or the text form (Section 126 b BGB) is excluded. The precedence of individual contractual agreements remains unaffected by this.
13.3 Should individual provisions of this agreement be or become invalid or unenforceable in whole or in part, this shall not affect the validity of the remaining provisions.
13.4 This agreement is subject to German law. The exclusive place of jurisdiction shall be the Contractor’s registered office.
Attachments
Annex 1: Description of the data subjects/groups of data subjects and the particularly sensitive data/data categories: Customer data, address data, communication data
Annex 2: Technical and organisational measures of the contractor