General Terms and Conditions of the Cybervize Companies

Courtesy translation. In case of discrepancies between this English version and the German version, the German version is binding.

Version: 2026-10-28

Section 1 Scope, Contracting Entity, Order of Precedence

(1) These General Terms and Conditions ("GTC") apply to contracts for advisory and assessment services relating to information security/cybersecurity, for operations and managed services, and for the provision of software-as-a-service (in particular the "OdySecure" platform), and to all other contracts of the following companies with their customers. These GTC are used by:

• Cybervize Consulting GmbH ("CVC"), Graf-Adolf-Straße 41, 40210 Düsseldorf, Germany, commercial register Düsseldorf local court, HRB 101465 — advisory services;
• Cybervize Operations GmbH ("CVO"), Graf-Adolf-Straße 41, 40210 Düsseldorf, Germany, commercial register Düsseldorf local court, HRB 101821 — operations, managed services and provision of OdySecure as SaaS,

individually and jointly referred to as "Cybervize". The customer's contracting party is exclusively the Cybervize company named in the relevant offer, contract or statement of work ("contracting Cybervize entity"); rights and obligations under a contract bind only that entity, not the other companies named above. Each Cybervize company is bound solely by the contracts it has concluded itself and the performance obligations assumed therein. Where several Cybervize companies provide services to the same customer, they do so on the basis of clearly allocated contractual relationships or an express individual agreement. The joint use of these GTC does not give rise to joint and several liability of several Cybervize companies. Mandatory statutory grounds of liability remain unaffected.

(2) These GTC apply exclusively to businesses within the meaning of § 14 of the German Civil Code (BGB). No contracts are concluded with consumers (§ 13 BGB).

(3) Individual agreements, including side agreements, supplements and amendments, take precedence over these GTC regardless of their form (§ 305b BGB); subject to proof to the contrary, a written contract or Cybervize's written confirmation is decisive for their content. The customer's own general terms and conditions do not apply alongside these GTC, even if Cybervize does not expressly object to them.

(4) Subject to individual agreements under paragraph 3, where documents conflict, the following order of precedence applies to the content of an individual contract: (a) the signed individual contract, (b) the related offer or statement of work, including any service level agreement (SLA), (c) a separately concluded data processing agreement (DPA) under Art. 28 GDPR, to the extent personal data is processed, (d) these GTC.

(5) Third parties may only derive claims from the contract between Cybervize and the customer if expressly agreed or required by mandatory statutory provisions. These terms also apply to such third parties with respect to such claims.

Section 2 Scope and Performance of the Engagement

(1) The subject of the engagement is the agreed service, not a specific result for the customer. Cybervize does not assume management functions of the customer through its services and is not responsible for the use or implementation of the results of its services.

(2) Cybervize is entitled to engage subcontractors (including infrastructure and communication service providers). Cybervize ensures that all requirements of the contract with the customer applicable to the part performed by the subcontractor — in particular confidentiality and, where personal data is involved, the obligations under Art. 28 GDPR — become part of the contract Cybervize concludes with the respective subcontractor.

(3) Cybervize does not owe performance under a contract for work (Werkvertrag) unless the parties expressly agree otherwise. Section 3 applies in addition to the provision of OdySecure as software-as-a-service.

(4) No security guarantee. Cybervize's services support the customer in identifying, assessing, monitoring and reducing information security risks to the contractually agreed extent. Cybervize does not owe the complete prevention of all cyber attacks, security incidents, vulnerabilities or data losses. Cybervize gives no guarantee of complete or permanent security of the customer's IT systems. Cybervize's obligation to perform the expressly agreed services properly remains unaffected.

Section 3 Provision of OdySecure as Software-as-a-Service

(1) Scope and availability. The scope, features and availability of OdySecure result from the relevant offer or a separate statement of work, or from a service level agreement (SLA) agreed as an annex to the contract, which specifies in particular the measuring point, measuring period, availability target, maintenance windows, incident priorities and response times. If no availability figure is agreed there, Cybervize provides the service using state-of-the-art means and reasonable commercial effort (best-efforts commitment), without guaranteeing a specific minimum availability as a warranty within the meaning of § 443 BGB. Maintenance windows that Cybervize announces to the customer with reasonable advance notice do not count as a shortfall of the availability owed.

(2) Access and use. The customer is responsible for the confidentiality of the credentials provided to it or its users and for their proper use, and must notify Cybervize without undue delay of any known misuse.

(3) Data processing. To the extent Cybervize processes personal data on behalf of the customer when providing OdySecure, the parties shall enter into a data processing agreement (DPA) under Art. 28 GDPR before processing begins; the DPA takes precedence over these GTC (Section 1(4)). Without an effective DPA, Cybervize is not obliged to process personal data of the customer or third parties within OdySecure.

(4) Data backup. Cybervize currently backs up data stored in OdySecure in production daily, with a retention period of 30 days; a different arrangement may be agreed in the offer. This does not replace the customer's own archiving for purposes beyond restoring OdySecure. Cybervize verifies at reasonable intervals that the backups can be restored. Recovery objectives (recovery time objective, RTO, and recovery point objective, RPO) apply only where expressly agreed in a service level agreement.

(5) Fault remedy. A shortfall of the availability owed under paragraph 1, outside the maintenance windows announced under paragraph 1, constitutes a defect regardless of whether Cybervize is at fault. Claims for damages arising from such a shortfall are governed by Section 7, including the no-fault liability categories named there. Cybervize remedies reported faults within a reasonable time using state-of-the-art means. Otherwise, Section 6(2) and (3) apply to the customer's remedies for defects.

(6) Data on termination. After termination of the contract, Cybervize makes the exportable data stored by the customer in OdySecure available to the customer for a period of 30 calendar days in a common, machine-readable format, unless statutory requirements provide otherwise. Cybervize supports the customer in taking over the data and in switching to another provider to the extent required by law. Further migration services require a separate agreement and may, where permitted by law, be charged separately. Details on data formats, export procedures, responsibilities and technical limits may be set out in an exit plan annexed to the contract. After expiry of the applicable return or export periods, the data is deleted in accordance with the data processing agreement and statutory provisions, unless statutory retention obligations apply. The customer's mandatory statutory rights to switch providers, to data portability and to terminate the contract remain unaffected.

(7) Further development and changes to the service. Cybervize is entitled to develop OdySecure further and to make technical changes, in particular where these are necessary to maintain or improve information security or to adapt to the state of the art or to changed legal requirements. Cybervize may not unilaterally withdraw material contractually agreed features or restrict them in a manner unreasonable for the customer. Cybervize informs the customer of material changes in text form with reasonable advance notice, unless an immediate change is required for security reasons.

Section 4 Customer's Duties to Cooperate

The customer shall designate a suitable point of contact for the engagement and shall provide Cybervize in good time with all documents and information required to perform the engagement. The point of contact shall keep Cybervize informed, for the duration of the engagement, of all events and circumstances that may be relevant to its performance.

Section 5 Rights of Use and Disclosure

(1) Upon full payment of the agreed fee, the customer receives a simple, non-exclusive right, unlimited in time, to use the work results created under the engagement for its own business purposes, unless otherwise agreed in the individual contract. This right is non-transferable. All rights to methods, concepts, templates, software components, scripts, tools and other know-how that already exist or were developed independently of the engagement remain with Cybervize or the respective rights holders. Cybervize remains entitled to use general knowledge, methods and experience as well as reusable components for other customers, provided that no trade secrets, personal data or other protected information of the customer are disclosed as a result.

(2) For the use of OdySecure, Cybervize grants the customer, for the term of the contract, a simple, non-transferable right to use the platform to the agreed extent (in particular the number of users/tenants under the offer). Any transfer to third parties outside the customer's own organisation requires Cybervize's prior written consent.

(3) The customer undertakes to obtain Cybervize's written consent before disclosing any results, information or information provided by Cybervize to third parties, unless such disclosure is part of the contract or required by law. Disclosure without consent is permitted to the customer's lawyers and auditors, to competent supervisory authorities, and to service providers of the customer who are contractually bound to confidentiality, to the extent required for the agreed purpose.

Section 6 Remedy of Defects

(1) In the event of defects, the customer is entitled to subsequent performance (Nacherfüllung) by Cybervize. Only if subsequent performance fails, is omitted, is unjustifiably refused, or is unreasonable or impossible, may the customer reduce the fee or withdraw from the contract.

(2) Claims for remedy of defects must be asserted by the customer in writing without undue delay. Claims under this contract become time-barred one year after the statutory limitation period begins; excepted are claims based on intent or gross negligence, claims for injury to life, body or health, claims under an expressly assumed guarantee, and mandatory statutory liability, for which the statutory limitation period applies.

(3) For the ongoing provision of OdySecure, the provisions of Section 3 and of any agreed service level agreement take precedence with regard to availability, faults and defects. Where these contain no provision, the statutory remedies for defects apply; paragraph 1 does not apply to the provision of OdySecure, paragraph 2 applies to it as well.

Section 7 Liability

(1) Cybervize is liable without limitation for intent and gross negligence, for damage resulting from injury to life, body or health, and in cases of mandatory statutory liability.

(2) In the event of a simply negligent breach of material contractual obligations, Cybervize is liable for the typical damage foreseeable at the time the contract was concluded, limited to EUR 1,000,000 per damage event. Material contractual obligations are those whose fulfilment makes the proper performance of the contract possible in the first place and on whose observance the customer may regularly rely.

(3) In the event of a simply negligent breach of non-material contractual obligations, liability for damages is excluded.

(4) Indirect damage, business interruption, lost profits, data recovery costs and third-party claims are recoverable in the case of simple negligence only to the extent they constitute typical damage, foreseeable at the time the contract was concluded, resulting from the breach of a material contractual obligation; the liability cap under paragraph 2 applies accordingly.

(5) The limitations of liability do not apply where Cybervize has assumed an expressly agreed guarantee or where mandatory statutory liability precludes them.

Section 8 Confidentiality and Use as a Reference

(1) Cybervize undertakes to keep confidential all business and trade secrets of the customer that become known to it in the course of its contractual activities.

(2) Cybervize is entitled to publish work results only with the customer's prior written consent. Consent is not required if publication is in anonymised form and does not disclose any business or trade secrets of the customer within the meaning of paragraph 1; paragraph 1 otherwise remains unaffected.

(3) Cybervize has the right to use the project, including a short description and the customer's name and logo, as a reference in its own physical and/or digital sales materials, including its own websites, but only with the customer's prior written consent. The customer may revoke this consent at any time with effect for the future.

Section 9 Data Protection

Cybervize collects, processes and uses personal data only to the extent required for the establishment, substantive design, execution, performance and amendment of the contractual relationship with the customer and/or to the extent the customer has consented to the collection, processing and use of the data. Section 3(3) applies to the processing of personal data of the customer or third parties on the customer's behalf.

Section 10 Fees

(1) Advisory and other services are remunerated based on time spent. Remuneration for advisory and other services is based on a fixed daily rate agreed in the offer. One person-day comprises 8 hours.

(2) Fees for operations, managed services and the provision of OdySecure are set out in the relevant offer (e.g., a flat fee, usage-based, or per user/tenant).

(3) Unless expressly stated otherwise, total prices and durations stated in Cybervize's offers are non-binding estimates of the expected cost and time required, based on professional calculation.

(4) Services rendered by Cybervize are invoiced to the customer monthly and/or at the latest upon completion of the services. Value-added tax is charged at the statutory rate.

(5) Payment terms. Unless otherwise agreed in the offer, recurring fees for SaaS and managed services are payable monthly in advance; other fees are payable without deduction within 14 calendar days of receipt of a proper invoice. In the event of late payment, the statutory provisions apply.

(6) Price adjustment. For continuing obligations relating to operations, managed services or the provision of OdySecure, Cybervize may adjust the recurring fee, at the earliest 12 months after the start of the contract or after the last adjustment and no more than once per contract year, at its reasonable discretion (§ 315 BGB) in line with the development of the costs relevant to the provision of the services, in particular personnel, infrastructure, hosting and licence costs. Cost reductions must be taken into account in the same way as cost increases; the adjustment may reflect only the actual cost development. If the relevant costs decrease overall, Cybervize is obliged to reduce the fee accordingly, applying the same standards and at the same points in time. Cybervize announces an adjustment in text form at least three months before it takes effect, stating the relevant reasons. If the increase exceeds 5% of the previous fee, the customer may terminate the contract with effect from the date on which the adjustment takes effect; Cybervize points this out in the announcement.

(7) Suspension of services. If the customer is in default with a not insignificant part of the fees due, Cybervize may, after a prior reminder and the setting of a reasonable deadline, temporarily suspend further performance, to the extent permissible having regard to the interests of both parties and the statutory provisions. The customer must be informed in advance of the impending suspension and its material effects. Cybervize suspends security-relevant core services, in particular security monitoring and alerting, only after a prior assessment of the possible effects; no automated blocking takes place. The parties' statutory rights remain unaffected.

Section 11 Term and Termination

(1) Project-based advisory services end upon provision of the service agreed in the offer or on the date stated in the contract.

(2) Continuing obligations for operations, managed services or the provision of OdySecure run, unless otherwise agreed in the offer, for a minimum term of 12 months and are automatically extended by 12 months at a time, unless terminated with 3 months' notice to the end of the then-current term. The customer's mandatory statutory rights of termination and switching, in particular under Regulation (EU) 2023/2854 (Data Act), remain unaffected.

(3) The right to extraordinary termination for cause remains unaffected. Termination requires written form.

Section 12 Electronic Communication

The parties assume that, for the efficient organisation of internal operations, order-related information and data may be stored and evaluated in electronically managed files; such information and data may also be stored on decentralised storage media of external service providers. If communication by e-mail occurs in connection with the engagement, neither party shall derive claims from the fact that e-mail messages, including attachments, may be read, altered or falsified by third parties, may be lost, or may be infected with viruses; this does not apply to the extent the relevant circumstance is attributable to a breach by Cybervize of material contractual obligations or a case exists in which Cybervize is liable without limitation under Section 7(1) or (5) — Section 7 applies in that case. At the customer's request, the parties shall agree on a common encryption method. Where work results are forwarded electronically at the customer's request, only the signed written version provided to the customer remains binding.

Section 13 Final Provisions

(1) The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG).

(2) The exclusive place of jurisdiction for all disputes arising out of or in connection with a contract is Düsseldorf, Germany, provided the customer is a merchant (Kaufmann) within the meaning of the German Commercial Code (HGB) or has no general place of jurisdiction within the Federal Republic of Germany (§ 38(1), (2) of the German Code of Civil Procedure, ZPO). If the customer is a business within the meaning of § 14 BGB but not a merchant and has a general place of jurisdiction domestically, the statutory rules on jurisdiction apply instead.

(3) Should individual provisions of these GTC be or become wholly or partly invalid or require supplementation, the validity of the remaining provisions remains unaffected. The invalid provision is replaced by the statutory provisions (§ 306(2) BGB).