General Terms and Conditions (GTC) of Modular Minds GmbH for crality Services

§ 1 Scope of Application

The following terms and conditions are valid for the services offered under the brand "crality" by Modular Minds GmbH (in the following called crality) to its contracting parties (in the following called customers) and the contracts made by the customer with crality. Deviations from this must be in written form. This is also valid for the cancellation of the preceding sentence.
General terms and conditions or deviating conditions of the customer are not valid for the contractual relationship.
All contracts with crality shall be governed by the current version of the GTC.

§ 2 Definitions

For the purposes of these General Terms and Conditions, the following definitions apply:

crality Customer Account: Refers to the contractual construct including all crality accounts and access rights as well as contracted services and is the central billing instance for the respective contract.

crality Access: Refers to a specific account access of an individual user to crality's system.

Cyber Resilience Act (CRA): Refers to Regulation (EU) 2024/2847 of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements, as well as the legal acts, technical standards and official requirements issued for its implementation, specification or supplementation, in their respective applicable version.

Compliance Function: Refers to the tools, analyses, documentation aids and process support provided by crality that technically support the customer in obtaining and maintaining the conformity within the scope of the Cyber Resilience Act sought by the customer.

Integration Component: A software element optionally provided by crality (e.g. an SDK, an agent or an interface connection) that the customer integrates into its own products, systems or processes so that crality can perform certain parts of the Compliance Function.

Client: Entrepreneur or company according to §14 of the German Civil Code (BGB) who has concluded a contract with crality.

Customer data: This is data that the customer provides to crality as part of the order for order fulfillment and billing, as well as for the provision of access to crality.

User Data: This is particular data about the users of the Customer's products and systems that is transmitted to crality at the Customer's request for the purpose of providing and performing crality's Compliance Function.

§ 3 Subject of the Contract

crality provides services for the technical support of the customer in obtaining and maintaining compliance within the scope of the Cyber Resilience Act.
crality will provide a software-as-a-service solution that supports the customer with tools, analyses, documentation aids and process support in its own responsible compliance work, as well as, where applicable, an Integration Component that the customer integrates into its own products, systems or processes, and a corresponding backend for configuration.
crality provides the customer exclusively with technical support. The responsibility for the conformity of the customer's products with the Cyber Resilience Act as well as with all other legal requirements applicable to the customer remains with the customer at all times. crality makes no representation regarding, and assumes no warranty for, the actual achievement of a particular compliance status. In particular, crality is not obliged to cover, map or address all aspects, obligations or requirements of the Cyber Resilience Act; the customer has no claim to a complete, comprehensive or conclusive coverage of the requirements of the Cyber Resilience Act by crality's services.
The notices, analyses, classifications and recommendations provided by crality are determined in an automated or semi-automated manner on the basis of the information available in each case and according to the respective state of knowledge. They may differ from the actual circumstances as well as from the assessment of competent authorities, notified bodies or courts. crality does not guarantee the accuracy, completeness or legal robustness of these results. They do not constitute legal, conformity or certification advice and replace neither an independent review by the customer nor the involvement of qualified third parties.
crality does not guarantee availability for its services or for the functions of third parties required to perform the Compliance Function.
crality can change the scope of its services at any time, if this is possible due to improvements or necessary due to laws, changed regulatory requirements or the discontinuation of functions at integrated third parties. The customer cannot derive any claims against crality from this.
crality can continuously adjust the scope of functions as well as the underlying procedures, evaluation logics and assessment criteria in order to optimize the Compliance Function or to adapt it to changed legal or technical conditions. This may result in changed results and assessments. The customer cannot derive any claims against crality from this.
Communication on the part of crality will be done exclusively by mail or in the backend of crality. crality can also offer other ways of communication.

§ 4 Charging, Billing, Terms of Payment

The charges for the services of crality results from the price offer on the website and in the order process of crality at the time of signing the contract or at the time of placing the order or after announced changes which are not rejected by the customer.
The payment for the services of crality is due in full at the beginning of each billing period for the whole billing period. This also applies to service quotas ordered, regardless of whether the quota is used or exhausted. If usage-dependent charges are charged, the usage-dependent payment shall be due at the end of the billing period.
All payments shall be made immediately when due.
The customer's obligation to pay fees remains in effect even in cases where services to be provided by third parties - for whatever reason - are not provided, unless crality is at fault.
crality is entitled to invoice all services ordered by the customer, even if the customer does not use the services or the results of the services or does not use them completely.
All prices are net prices and do not include value added tax.
crality keeps the created invoices in the crality customer account. If necessary, crality will send the invoices by e-mail to the e-mail address stored in the crality customer account. crality can also send the invoices to the customer in any other electronic form.

§ 5 Upgrades/Downgrades, Options

Upgrades: The customer may - if available - switch to a higher-value service or a longer billing period at any time. If this occurs within a billing period, the remaining unused credit prior to the upgrade shall be credited to the upgrade.
Downgrades: If available, the customer may switch to a lower-value service or a shorter billing period at any time, effective at the end of a billing period, in the crality customer account.
Options: Additional services offered by crality as options to the existing contract may be added to the main service at any time. If this is done within a billing period of the main service, the charge for the option will be prorated for the remaining billing period of the main service. An option can be cancelled in the crality customer account at any time with effect from the end of the billing period of the main service. For upgrades/downgrades of options, the above points regarding upgrades/downgrades apply.

§ 6 Term of Contract, Termination of Contract, Cancellation

The contract begins with the completion of the order in the online form and has an indefinite term. The minimum term is one payment period.
The contract can be terminated by either party at any time at the end of a payment period. If the customer cancels the contract by other means than in the crality customer account, the customer has to give us one week time of notice to the end of a payment period ("processing period").
A premature termination of the contract is possible in case of a contradiction of the customer in case of changes of general terms and conditions or prices according to §11.1 under observance of the period of time mentioned there. Immediate termination by a contracting party is possible if the other contracting party grossly violates its contractual obligations and it permanently fails to fulfill its obligations despite a written request to do so. Otherwise, early termination shall be excluded.
In the event of premature termination of the contract - for whatever reason - the payment for services already provided but not yet invoiced shall immediately become due in full. A refund of payments made in advance will not be made unless the customer has justifiably terminated the contract in accordance with the previous paragraph. In this case, the fees paid beyond the end of the contract will be refunded.

§ 7 Late Payment, Debt Collection

In case of delayed payment by the customer crality is entitled to pause or completely stop the services until payment of all outstanding amounts and receivables. The pausing or discontinuation of services by crality does not exempt the customer from the obligation to pay. Periods of pausing or discontinuation cannot be offset by the customer - even in case of subsequent payment.
crality is allowed to provide further services only if all outstanding debts including all costs for collection or legal action are settled.

§ 8 Right of Set-Off and Withholding of Payment

The customer shall only be entitled to set-off against claims of crality insofar as the counterclaims arise from the same contractual relationship and are undisputed or have been finally determined by a court of law. The exercise of a right of withholding is only permissible insofar as the counterclaim is based on the same contractual relationship.

§ 9 Data Protection

As a German provider crality is bound to comply with the General Data Protection Regulation (GDPR), known in Germany as the Datenschutz-Grundverordnung (DSGVO). crality collects and processes the collected data exclusively on servers and with systems that are subject to the GDPR.
crality collects, stores and processes customer data by means of electronic systems, as far as it is necessary for the provision and billing of the functions of crality. This may include personal or personally identifiable data. No data will be transferred to third parties, unless this is necessary for billing purposes (e.g. payment providers) or crality is obliged to transfer customer data due to laws or judicial decisions.
crality collects, stores and processes user data by means of electronic systems, as far as it is necessary for the function of crality to perform the Compliance Function. This may include personal or person-related data (for storage of such data see next point). No data will be transmitted to third parties, unless crality is required to do so by law or court order and crality is able to reconstruct the data at all.
crality stores user data exclusively anonymized or irreversibly encrypted. This way crality ensures that no personal or personally identifiable data is stored or that it cannot be reconstructed, unless the customer decides otherwise in his crality customer account on his own responsibility.
The customer can retrieve the privacy policy with the exact description of the scope of the stored data as well as the procedure description of the data processing of both customer and user data according to DSGVO both on the crality website and in his crality customer account or request it at any time under datenschutz@crality.io.
crality explicitly points out to the customer that data protection and data security for data transmissions in open networks like the internet cannot be guaranteed according to the current state of the art. crality has taken all technical and organizational measures in accordance with the law to secure stored personal data against misuse and unauthorized access. However, especially in the case of data transmission via the Internet, crality has no control over the access possibilities of third parties and therefore cannot assume any responsibility for the security of data transmitted via the Internet.

§ 10 Duties of the Customer

The customer is exclusively responsible for establishing the necessary technical and legal conditions for the use of crality.
The customer is solely responsible for identifying, fulfilling and maintaining the obligations incumbent upon it under the Cyber Resilience Act as well as under other applicable law. In this respect, crality provides exclusively technical support and assumes neither the customer's obligations nor any warranty for their fulfillment. In particular, the customer ensures that the information stored by it with crality regarding its products, systems, processes and risks is accurate, complete and up to date; crality may rely on the accuracy of this information and is not obliged to carry out its own substantive review. The customer reviews all notices, analyses and results provided by crality on its own responsibility for suitability and accuracy for its specific purposes before using them.
Insofar as the customer uses an Integration Component provided by crality, the customer integrates it exclusively by himself. For the correct function of crality the customer has to integrate and operate the Integration Component according to the documentation provided by crality. The customer is solely responsible for the correct integration into his products and systems. A modification of the Integration Component or an integration deviating from the documentation on the part of the customer is not permitted.
Important messages from crality will be sent by e-mail and/or in the crality customer account. The customer has to take care that these messages reach him and that he takes note of them.
The customer keeps his data stored at crality always up to date. This concerns in particular data, which concern fiscal aspects, the account as well as the contact possibility. The customer is fully and unlimitedly liable to crality for any damages resulting from non-compliance.
The customer is responsible to inform employees, customers and other third parties, which are directly or indirectly affected by the use of crality, about the collected data and the kind of data processing, according to the legal requirements.
Overall the customer commits himself not to violate contractual provisions or applicable law in connection with the use of crality.

§ 11 Contractual Adjustments

crality is allowed to change these terms and conditions and prices. crality will announce such changes in the crality customer account and, if necessary, textually with a minimal notice period of 2 weeks. The changes will become effective according to the announcement, if the customer does not reject them textually until the announced time of the changes' coming into effect. If the customer disagrees in due time, the contract will end at the time the change will take effect.

§ 12 Liability

crality is only liable for damages caused by intentional or grossly negligent actions. Any further liability is excluded. The liability is in any case limited to the value of the order.
crality is not liable for impairments, limitations or impediments of performance as well as interruptions or malfunctions of crality services, which are caused by circumstances beyond the responsibility of crality.
In particular, crality is not liable for the failure to achieve a compliance status sought by the customer, for official, judicial or other measures, fines or sanctions in connection with the Cyber Resilience Act or other law, or for consequences resulting from the fact that crality's services do not cover, or do not completely cover, individual requirements of the Cyber Resilience Act. The responsibility for conformity remains with the customer in accordance with § 3.
Liability towards commercial customers for loss of profit is excluded.

§ 13 Reference Use

crality is entitled to name the customer as a reference customer for the duration of the contractual relationship, stating its name and using its company logo, in particular on crality's website, in presentations, and in other promotional and informational materials.
The customer may object to the reference use pursuant to point 1 at any time with effect for the future. The objection may be made informally, for example by email. Upon receipt of the objection, crality will discontinue the reference use within a reasonable period; this does not affect any use already made in materials that had already been produced or distributed at the time of the objection, insofar as their adaptation cannot reasonably be expected of crality.
Any presentation of the customer going beyond point 1, in particular in the form of a case study or user report reproducing specific project content, key figures, or other detailed information about the customer, shall take place exclusively after prior consultation with the customer regarding the content and the customer's approval of the respective publication.
The above provisions are without prejudice to confidentiality obligations and the customer's rights in its trademarks and signs. crality will use the customer's logo and signs exclusively within the scope of the reference use and in a manner that preserves the customer's reputation.

§ 14 Final Clauses

The German language version of these General Terms and Conditions shall always be used to interpret the content of the contract and the rights and obligations of the contracting parties.
Place of fulfillment and place of payment is Kiel, Federal Republic of Germany. This contract shall be governed by the laws of the Federal Republic of Germany. The application of the UN Sales Convention is excluded.
The exclusive place of jurisdiction for all claims arising out of or in connection with the contractual relationship between the contracting parties, including actions on checks and bills of exchange, as well as all disputes arising between the parties concerning the formation, fulfillment or termination of the contract, shall be Kiel, Federal Republic of Germany, in the case of business persons, merchants, legal entities under public law or special funds under public law, or if the customer does not have a general place of jurisdiction within the Federal Republic of Germany. crality reserves the right to bring an action against the customer at the customer's general or other place of jurisdiction, which may be competent according to national or international law.
Should individual terms be or become ineffective, or should the terms contain a loophole, the legal effectiveness of the remaining terms shall remain unaffected. In place of the invalid term or condition, a valid term or condition shall be considered agreed upon that comes closest to the intended term or condition in economic sense.