General Terms and Conditions

Overview

Structure of these GTC

These General Terms and Conditions (GTC) replace the GTC of Decanos GmbH as of January 2026. They keep the general rules for Managed Services, Advisory Services and digital products and add special terms for Decanos AEP (Alaris Enterprise Platform), which Decanos distributes in the European Union as authorised partner of the platform's technology provider.

Order of precedence

If documents contradict each other, the following order applies (see § 1.3):

• (a) individually negotiated provisions in the Order Form, contract or Statement of Work (SoW);
• (b) the Data Processing Agreement (AVV) for all matters of data protection;
• (c) Part C, then Part B of these GTC for their respective subject matter;
• (d) Part A of these GTC;
• (e) service descriptions and the Documentation.

What these GTC are not. They are not an Order Form and do not themselves oblige either party to buy or deliver anything. They do not replace the Data Processing Agreement, which must be concluded before personal data is processed. They do not promise any certification, audit result or regulatory approval, and they do not promise that every attack will be detected or prevented. Nothing in the products or reports of Decanos is legal advice.

Part A: General Provisions

§ 1 Contract Parties, Scope of Application and Contract Formation

1.1 Contract Parties and Scope of Application. These GTC apply to all contracts and other services between Decanos GmbH, Alt-Moabit 73/73a, 10555 Berlin, Managing Director: Niclas Matz, VAT ID: DE343188316, Berlin Charlottenburg Local Court (“Provider” or “Decanos”) and its clients (“Customer”) regarding Managed Security Services, Advisory Services, products and platform services. Decanos operates the websites www.decanos.com and www.cyber-curriculum.com; the latter markets Advisory Services and training services under the brand Cyber Curriculum by Decanos. These GTC apply exclusively to entrepreneurs (§ 14 BGB), legal entities under public law and special funds under public law. They do not apply to consumers.

1.2 Deviating Terms. Deviating, conflicting or supplementary terms of the Customer, including terms in purchase orders, order portals or procurement systems, become part of the contract only if Decanos expressly agrees to them in writing. This also applies if Decanos performs without reservation in knowledge of such terms. A purchase order serves internal procurement purposes only and does not modify the contract.

1.3 Order of Precedence. In the event of contradictions the following order applies: (a) individually negotiated provisions in the Order Form, contract or SoW; (b) the Data Processing Agreement for data protection matters; (c) Part C and then Part B of these GTC for their subject matter; (d) Part A of these GTC; (e) service descriptions and the Documentation. Individual agreements take precedence over these GTC (§ 305b BGB).

1.4 Contract Formation.

• (a) A contract is formed by acceptance of a written offer or by Decanos' written confirmation of the order. Oral collateral agreements require written form to be effective.
• (b) All offers are non-binding unless expressly marked as binding.
• (c) For digital training products purchased via www.cyber-curriculum.com, the contract is formed when the Customer submits the selected products as a binding offer by selecting the corresponding button and Decanos accepts this offer within a reasonable period (§ 147 para. 2 BGB) by order confirmation sent by e-mail. For orders upon request, selecting the button is not a binding offer; in this case Decanos submits a binding offer by e-mail. The language available for contract formation is German.
• (d) Project contracts, Managed Services, Advisory Services, Decanos AEP subscriptions and Enterprise contracts are formed by mutual signature of a contract, an Order Form or a SoW, or by Decanos' written order confirmation.
• (e) Decanos may make acceptance of an order for Decanos AEP subject to a successful sanctions and export control screening (§ 12).

§ 2 Subject Matter of Services

2.1 Overview of Services. Decanos provides services and products in cybersecurity, IT compliance and data protection. The exact scope results from the respective contract, Order Form or SoW. The service offering includes in particular:

• (a) Managed Services (brand Decanos, www.decanos.com): Managed Extended Detection and Response (MXDR/MDR); 24/7 Security Operations Center (SOC); Cyber Security Incident Response Team (CSIRT); cyber attack forensics compliant with law enforcement requirements; Cyber Threat Intelligence Fusion Center (CTIFC); managed operation of Decanos AEP (Alaris Enterprise Platform).
• (b) Advisory Services (brand Cyber Curriculum by Decanos, www.cyber-curriculum.com): compliance and security audits including gap and maturity assessments; penetration testing and advanced red team operations; consulting on ISMS, BCM, GDPR, NIS2 implementation and CISO as a Service; awareness and training services for executives, boards and employees.
• (c) Platform Services and digital products: licensing and provision of Decanos AEP (Alaris Enterprise Platform), including its modules, the endpoint detection and response component and Customer-Deployed Components (Part B); implementation, integration, training, migration and configuration services for Decanos AEP; digital training products and e-learning content (exclusively via www.cyber-curriculum.com); training platform and Adaptive Defense.

2.2 Special Service Notes.

• (a) NIS2. Decanos supports the Customer in implementing the NIS2 Directive (Directive (EU) 2022/2555) and the national implementing law, including consulting, risk analyses and implementation of measures. Responsibility for compliance with legal requirements remains with the Customer.
• (b) Managed Security Services. The Customer grants Decanos access to the systems required for the agreed Managed Security Services. Consulting is based on information supplied by the Customer; Decanos is not liable for its accuracy or completeness.
• (c) No legal advice. Products and services do not constitute legal services within the meaning of the Legal Services Act (RDG). They do not claim absolute accuracy or completeness and do not replace legal, IT compliance or data protection advice. Because supervisory authorities and courts continuously develop the interpretation of the law, the Customer must regularly review the effectiveness and suitability of the products and services it uses.
• (d) Subcontractors. Decanos may have partial services provided by qualified subcontractors. Responsibility towards the Customer remains with Decanos.
• (e) Technology provider. Decanos AEP (Alaris Enterprise Platform) is based on technology that Decanos licenses from a technology provider (“Technology Provider” or “Licensor”, § 15.2). Decanos is the Customer's sole contractual partner for Decanos AEP. The Technology Provider acts as subcontractor of Decanos and, where personal data is processed, as sub-processor (§ 26).
• (f) Managed Services on Decanos AEP. Where Decanos operates Decanos AEP on the Customer's behalf, the Customer remains responsible for all business decisions on remediation, containment and incident response beyond the jointly agreed response playbook, for timely responses to escalations, and for the lawfulness of measures taken on the basis of Decanos' recommendations.

2.3 Time and Material Remuneration. Advisory Services and Platform Services under § 2.1 (b) and (c) are billed on a time and material basis unless a fixed price is agreed in the SoW or offer. Hourly or daily rates depend on the qualification of the consultants and the subject and complexity of the project and are specified in the offer or SoW. Services are documented in service records (timesheets or activity reports), which are submitted to the Customer at least monthly. If the Customer does not object in writing within five working days of receipt, the record is deemed approved; Decanos will point out this consequence when submitting the record. Billing is monthly in arrears on the basis of approved or deemed approved records. Travel and incidental expenses are invoiced separately after prior agreement.

2.4 Digital Training Products. Digital training products are provided after full receipt of the agreed remuneration via download link by e-mail. For products marked “upon request”, Decanos communicates the provision period separately; it may amount to up to four months. Repeated download is a voluntary service that Decanos may change or discontinue. If the agreed provision period is exceeded by more than two weeks, the Customer may withdraw from the contract; payments made are refunded without delay.

2.5 Service Periods and Delay. Delivery and performance dates are non-binding unless expressly designated as binding. Decanos is not responsible for delays caused by force majeure (§ 11) or other circumstances for which Decanos is not responsible.

2.6 Defect Notifications. The Customer notifies defects in text form without undue delay after detection and describes their nature and extent as precisely as possible. In the case of justified defect notifications Decanos remedies the defect or provides a replacement at its choice. For Decanos AEP, §§ 24 and 25 apply in addition.

§ 3 Customer's Cooperation Obligations

• (a) The Customer provides Decanos in due time with all information, access, system permissions and contact persons required for the services.
• (b) Penetration tests and red team operations require a written penetration testing authorisation issued by the Customer before commencement. Without it, these services are not provided.
• (c) The Customer informs Decanos without undue delay of security-relevant changes to its IT infrastructure that affect the scope of services.
• (d) The Customer nominates a technical and a commercial contact person and notifies changes without undue delay.
• (e) For time and material services, the Customer reviews service records in due time (§ 2.3) or raises justified objections.
• (f) For Decanos AEP, the obligations under § 21 apply in addition.
• (g) Delays and additional costs resulting from insufficient cooperation are not borne by Decanos and may be invoiced to the Customer at the agreed rates.

§ 4 Usage Rights and Intellectual Property

4.1 Content, Training Products and Work Results.

• (a) All content, products and work results are protected by copyright. Decanos does not transfer ownership. The Customer receives a simple (non-exclusive), non-transferable right to use them within its own company. Until full payment of the agreed remuneration the right of use may be revoked.
• (b) Competitor exclusion. The right of use does not extend to companies that themselves provide consulting in information security, business continuity management, data protection or IT compliance.
• (c) Transfer of rights of use to third parties, including affiliated companies, requires Decanos' prior written consent.
• (d) The Customer may adapt the content of products to the needs of its own company. Transfer to third parties, public access, posting on the internet or other networks and resale are not permitted.
• (e) Digital training products in their raw form may be used only by management and by employees designated for implementing corporate compliance. Internally they are provided as write-protected PDF files. The Customer obliges its employees to confidentiality.
• (f) Products may carry digital watermarks and DRM protection. Copyright notices, trademarks and watermarks must not be removed.

4.2 Decanos AEP. Rights of use, restrictions and intellectual property relating to Decanos AEP are governed exclusively by Part B (§§ 17 to 20). § 4.1 does not apply to Decanos AEP.

4.3 Reports and Analyses. Reports, analyses and other work results are provided after full payment for the Customer's internal use. Transfer to third parties or commercial exploitation requires Decanos' prior written consent. Disclosure to auditors, insurers, supervisory authorities and the Customer's legal advisers is permitted where they are bound to confidentiality.

4.4 Enforcement. Infringements of this § 4 and of § 18 are pursued under copyright, civil and criminal law.

§ 5 Remuneration and Payment Terms

• (a) The prices agreed in the offer, Order Form or contract apply. All prices are net plus statutory value added tax.
• (b) Recurring services (for example SOC, MDR, Decanos AEP subscriptions) are invoiced monthly in advance unless annual invoicing in advance is agreed in the Order Form.
• (c) Time and material services (§ 2.3) are invoiced monthly in arrears.
• (d) Other project and one-time services are billed according to the payment schedule in the SoW. Without a payment schedule, 50 % is due on order and 50 % on completion.
• (e) Invoices are payable without deduction within 14 days of the invoice date. If the due date is determined by the calendar, the Customer is in default upon expiry without a reminder.
• (f) If the Customer chooses SEPA direct debit, it grants the required mandate and ensures sufficient account coverage. Costs of a return debit for which the Customer is responsible are borne by the Customer.
• (g) In the event of default Decanos may claim default interest of nine percentage points above the base rate (§ 288 para. 2 BGB) and the lump sum under § 288 para. 5 BGB. If payment is more than 30 days overdue, Decanos may suspend Managed Services and access to Decanos AEP after a written warning with a deadline of five working days. The obligation to pay continues during the suspension.
• (h) Overages. Use of Decanos AEP in excess of the Billable Units in the Order Form is invoiced in accordance with § 17.4.
• (i) Price adjustment for renewal terms. Decanos may adjust the prices of recurring services with effect from the start of a renewal term. Decanos announces the adjustment in text form at least four months before the end of the current term. The Customer may then terminate with effect from the end of the current term with the notice period under § 6 (a). Prices within a current term remain unchanged.
• (j) The Customer may set off or retain payments only with undisputed or legally established claims.

§ 6 Term and Termination

• (a) Contracts for Managed Services and Decanos AEP subscriptions have a minimum term of 12 months unless the Order Form provides otherwise. They renew for 12 months each unless terminated in text form with three months' notice to the end of the respective term.
• (b) Time and material contracts without a fixed project end may be terminated by either party with four weeks' notice to the end of a month. Services rendered and documented up to then are remunerated.
• (c) Project contracts end upon full provision of the agreed services.
• (d) The right of either party to terminate for good cause remains unaffected. Good cause for Decanos exists in particular in the case of:

• unauthorised transfer of products or services to third parties or publication of content;
• a material breach of § 18 (use restrictions) or § 12 (export control) which the Customer does not remedy within 30 days after notice, or within 15 days where the breach involves a security risk, unauthorised use or a violation of law;
• payment default of an amount equal to two monthly payments;
• material breach of cooperation obligations despite a warning;
• insolvency proceedings opened over the Customer's assets or rejected for lack of assets.

• (e) Terminations require text form (e-mail suffices).
• (f) Special termination rights for Decanos AEP are set out in §§ 16.3, 25, 26.5 and 31.4.

§ 7 Confidentiality

• (a) Both parties treat all confidential information of the other party obtained in the course of the contractual relationship as strictly confidential and use it only for the purposes of the contract.
• (b) Confidential are in particular security reports, penetration test results, vulnerability analyses, threat intelligence, system architectures, trade secrets and all documents marked confidential.
• (c) Disclosure is permitted to employees, subcontractors (including the Technology Provider) and advisers who need the information for the contract and are bound by confidentiality obligations no less protective than this § 7, and to authorities where disclosure is required by law.
• (d) The obligation does not apply to information that (i) is or becomes generally known without breach of duty, (ii) was already lawfully known to the receiving party, (iii) was lawfully received from a third party without a confidentiality obligation, (iv) was independently developed by the receiving party without use of the information, or (v) must be disclosed by law or by order of a court or authority, in which case the receiving party informs the other party in advance where legally permitted.
• (e) Platform information. The Customer keeps confidential all non-public, proprietary or technical information about Decanos AEP, in particular product architecture, security measures, API specifications, algorithms and performance data.
• (f) The obligations apply during the contract and for five years after its end, for trade secrets for as long as they remain trade secrets.
• (g) Reference. Decanos may name the Customer as a reference and mention the existence of the business relationship on its website, in offers and other media unless the Customer objects in text form. The Customer may withdraw its consent at any time with effect for the future. Naming service details, security information or contract content requires the Customer's express written consent. Decanos does not permit its subcontractors, including the Technology Provider, to name the Customer publicly.

§ 8 Data Protection

• (a) Decanos processes Customer data relating to individuals for order processing, provision, invoicing and payment in accordance with the GDPR, the BDSG and other applicable data protection law. Data is not sold and is passed to third parties only where necessary for performance of the contract.
• (b) Where Decanos processes personal data on behalf of the Customer (Art. 28 GDPR), in particular for Managed Services and Decanos AEP, the parties conclude a Data Processing Agreement (AVV) before processing begins. It forms part of the contract. For Decanos AEP, § 26 applies in addition.
• (c) The Customer ensures that it fulfils its information obligations towards data subjects and has a legal basis for the processing.
• (d) Decanos implements appropriate technical and organisational measures pursuant to Art. 32 GDPR.
• (e) Decanos does not use personal data of the Customer's data subjects for advertising, market or opinion research without consent. Details are set out in the privacy policies at www.decanos.com and www.cyber-curriculum.com.

§ 9 Liability

• (a) Unlimited liability. Decanos is liable without limitation for intent and gross negligence; for culpable injury to life, body or health; under mandatory statutory provisions, in particular the Product Liability Act; for fraudulently concealed defects; and to the extent Decanos has expressly assumed a guarantee in writing.
• (b) Slight negligence. For slight negligence Decanos is liable only for breach of material contractual obligations (cardinal obligations), meaning obligations whose fulfilment makes proper performance of the contract possible in the first place and on whose observance the Customer may regularly rely. Liability is limited to the damage typically foreseeable at the time of contract conclusion, and at most to the net remuneration paid by the Customer under the affected contract in the 12 months before the damaging event.
• (c) Indirect damage. Within the liability under (b), Decanos is not liable for lost profit, indirect damage and consequential damage.
• (d) No guarantee of complete security. Decanos does not guarantee that all cyber attacks or security incidents will be detected or averted. The services provide professional support according to the state of the art; absolute security is technically impossible. Subject to (a), Decanos is not liable for undetected or unaverted attacks unless it has culpably breached its contractual obligations.
• (e) Data loss. In Decanos-Hosted and Managed Cloud, Decanos maintains the backups described in Annex 1 and is liable for data loss in accordance with this § 9; a failure of the Customer to make its own exports under § 21 (c) is taken into account under § 254 BGB. In all other Deployment Models Decanos is liable for data loss only for the effort required to restore the data from backups that the Customer must keep in accordance with § 21 (c).
• (f) Content and consulting results. Decanos does not warrant that content and work results remain current, correct or complete unless expressly agreed in writing. Generalised content is not tailored to the individual Customer.
• (g) Contributory fault. If damage was co-caused by lack of cooperation, incorrect or incomplete information or a breach of duty by the Customer, § 254 BGB applies.
• (h) Representatives and subcontractors. The limitations and exclusions also apply in favour of Decanos' legal representatives, employees, vicarious agents and subcontractors, including the Technology Provider (see also § 32).
• (i) Limitation period. Damage claims of the Customer become time-barred, to the extent legally permissible, 12 months from the time the Customer obtained or ought to have obtained knowledge of the damage and the circumstances giving rise to the claim, at the latest three years after the damaging event. This does not apply to claims under (a).

§ 10 Contractual Penalty

• (a) For each culpable breach of the usage conditions under § 4 or § 18, in particular transfer of products or services to third parties, their publication, resale, or reverse engineering of Decanos AEP, the Customer pays Decanos a reasonable contractual penalty of up to EUR 25,000.
• (b) Decanos determines the amount in the individual case at its reasonable discretion, taking into account the nature, extent and duration of the breach and the degree of fault. The Customer may have the amount reviewed by the competent court.
• (c) The contractual penalty is credited against claims for damages arising from the same breach.

§ 11 Force Majeure

• (a) Neither party is liable for delays or failure to perform to the extent caused by events beyond its reasonable control, in particular natural disasters, war, terrorism, pandemics, governmental measures, sanctions, cyber attacks on infrastructure despite appropriate protective measures, widespread failures of telecommunications or power supply. Payment obligations remain unaffected.
• (b) The affected party informs the other without undue delay of the event and its expected duration and makes reasonable efforts to mitigate its effects.
• (c) If the event lasts longer than 60 consecutive days, either party may terminate the affected contract or the affected part. Prepaid remuneration for the period after termination is refunded.

§ 12 Export Control, Sanctions and Compliance

• (a) The Customer complies with all applicable export control, import and sanctions rules, in particular the EU Dual-Use Regulation (EU) 2021/821, EU sanctions regulations, the German Foreign Trade and Payments Act (AWG) and Ordinance (AWV), and, to the extent applicable to products of US origin, the US Export Administration Regulations and OFAC sanctions. Decanos AEP contains technology of US origin.
• (b) The Customer does not export, re-export or make Decanos AEP or the services accessible to persons, entities or countries subject to comprehensive sanctions or listed on applicable sanctions lists. The Customer represents that neither it nor its owners or Authorised Users are so listed or located in a comprehensively sanctioned country.
• (c) The Customer does not use the services in connection with weapons of mass destruction or their delivery systems, for criminal purposes or otherwise in breach of applicable law, and does not use them for military end uses that require an export authorisation which has not been obtained.
• (d) The Customer includes equivalent obligations in any agreement under which it permits affiliates to use Decanos AEP.
• (e) If there are concrete indications of a violation, Decanos may suspend services immediately and terminate the contract for good cause. Decanos may terminate or suspend without notice where continuing performance would violate applicable law, sanctions or official orders.
• (f) Each party complies with applicable anti-corruption law (in particular §§ 299 et seq. and §§ 331 et seq. StGB, the UK Bribery Act 2010 and the US Foreign Corrupt Practices Act) and neither offers, grants, demands nor accepts improper advantages.

§ 13 Changes to Services and GTC

• (a) Decanos may further develop and adapt services, in particular platform modules, technologies and tools, provided the agreed service level is not materially impaired and the change is reasonable for the Customer. For Decanos AEP, § 25 applies in addition.
• (b) Decanos notifies changes to these GTC in text form at least six weeks before they take effect. If the Customer does not object in text form within four weeks of receipt, the amended GTC are deemed accepted; Decanos expressly points out this consequence in the notification. Changes to the main performance obligations and to the price are not made through this procedure.
• (c) If the Customer objects, the previous GTC continue to apply. If the change is required by law, by an official order or by a change in the terms of the Technology Provider that Decanos cannot avoid, and continuation on the previous terms is unreasonable for Decanos, Decanos may terminate the affected contract with three months' notice; prepaid remuneration for the period after termination is refunded.

§ 14 Final Provisions

• (a) Applicable law. The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG).
• (b) Place of jurisdiction. The exclusive place of jurisdiction for all disputes arising from or in connection with the contract is Berlin, provided the Customer is a merchant, a legal entity under public law or a special fund under public law. Decanos may also sue at the Customer's general place of jurisdiction.
• (c) Form. Amendments and supplements to the contract require text form unless these GTC prescribe written form. This also applies to waiver of the form requirement. § 305b BGB remains unaffected.
• (d) Severability. Should individual provisions be or become invalid, the validity of the remaining provisions is not affected. The statutory provisions apply in place of the invalid provision (§ 306 para. 2 BGB).
• (e) Assignment. The Customer may assign rights and obligations under the contract only with Decanos' prior written consent. § 354a HGB remains unaffected. Decanos may transfer the contract with the Customer's consent under § 31.5.
• (f) No waiver. Failure to exercise a right does not constitute a waiver of that right.

Part B: Special Terms for Decanos AEP

§ 15 Scope, Technology Provider and Definitions

15.1 Scope. This Part B applies in addition to Part A to the provision of Decanos AEP (Alaris Enterprise Platform), its modules, the endpoint detection and response component, Customer-Deployed Components, Documentation, updates and related support (together the “Platform”), including Managed Services that Decanos provides on the Platform.

15.2 Technology Provider. The Platform is developed by a technology provider with registered office in the United States (“Technology Provider” or “Licensor”). Decanos distributes the Platform in the European Union as authorised partner of the Technology Provider under the name Decanos AEP. The Technology Provider is not a party to the contract with the Customer. The provisions of this Part B protecting the Licensor (in particular §§ 7 (e), 18, 19, 23 and 32) also serve the Licensor's interests; Decanos may enforce them on the Licensor's behalf. The Technology Provider is named in the sub-processor annex of the Data Processing Agreement.

15.3 Definitions. In this Part B:

• (a) Order Form: the offer accepted by the Customer, the order confirmation or the contract specifying modules, Billable Units, Deployment Model, hosting region, Support Tier, term and fees.
• (b) Authorised Users: employees, contractors and agents whom the Customer authorises to use the Platform on its behalf.
• (c) Customer Data: all data that the Customer uploads, transmits or generates in the Platform, including personal data, Customer Materials and Output.
• (d) Customer Materials: configurations, detection rules, playbooks, response scripts, dashboards, integrations and other content created by the Customer.
• (e) Output: reports, analyses, alerts, recommendations, risk scores, investigation summaries and other results generated by the Platform.
• (f) Customer-Deployed Components: software agents, sensors, connectors, collectors, Kubernetes operators, serverless functions and similar components that run in the Customer's infrastructure.
• (g) Billable Units: the units in which fees are calculated, in particular Endpoints, Cloud Assets, AI Credits, Data Credits, Runs/Scans, Agents and Users, as defined in the Order Form and the Documentation.
• (h) Deployment Model: Decanos-Hosted, Managed Cloud, BYOC or On-Premise (§ 16.2).
• (i) Documentation: user guides, release notes, API documentation, system requirements and technical specifications for the Platform.
• (j) Support Tier: Baseline, Plus or Elite as described in Annex 1.
• (k) Threat Intelligence: malware samples, indicators of compromise, tactics, techniques and procedures, signatures, behaviour patterns and security telemetry that contain no personal data or have been de-identified so that they can no longer reasonably be attributed to an identified or identifiable natural person (Recital 26 GDPR).
• (l) Usage Data: aggregated, de-identified metrics on use and performance of the Platform that permit identification neither of the Customer nor of any natural person.
• (m) Automated Actions: actions that the Platform executes in the Customer's systems without real-time human approval (§ 23.4).
• (n) Beta Features: functions designated as beta, preview or early access.

§ 16 Modules, Deployment Models and Hosting Regions

16.1 Modules. The Platform comprises application modules (currently Dashboards, Copilot Chat, Security Workbench, Attack Surface, Autopilot, Knowledge, Graph Explorer, Threat Intelligence, Workflows and Settings), infrastructure modules (currently AgentOps, Security Graph, Workflows Engine, Security Lake, platform databases and APIs) and, where ordered, the endpoint detection and response component. The modules and quantities owed result from the Order Form. Modules may be added, renamed or merged; a reduction of functionality during a current term is governed by § 25.

16.2 Deployment Models. The Order Form specifies one of the following:

• (a) Decanos-Hosted (standard): Decanos operates the Platform in a cloud infrastructure controlled by Decanos in the EU, currently Amazon Web Services, region Frankfurt (eu-central-1). The Technology Provider deploys and maintains the application layer through automated pipelines. Towards the Customer, Decanos is responsible for the infrastructure and the application layer.
• (b) Managed Cloud: where agreed in the Order Form, Decanos provides the Platform through the Technology Provider in an approved hosting region in the EU/EEA. Decanos is responsible towards the Customer for the application and the infrastructure layer.
• (c) BYOC (Bring Your Own Cloud): the Platform is deployed and maintained by automated pipelines in a cloud account owned by the Customer (AWS, Microsoft Azure, Google Cloud or another approved provider). § 22 applies.
• (d) On-Premise: the Platform is installed in the Customer's own data centre. Depending on the Order Form, the Customer operates it itself, or Decanos operates it through remote access released by the Customer. Decanos has no access without that release. The Customer is responsible for the infrastructure; Decanos gives no availability commitment.

16.3 Hosting Regions. Customer Data at rest, including backups, is stored exclusively in the EU/EEA hosting region specified in the Order Form. For Decanos-Hosted this is the AWS region Frankfurt (Germany). For Managed Cloud and BYOC, Frankfurt (Germany), Amsterdam (Netherlands) and Dublin (Ireland) are currently available. If the Order Form specifies no region, Frankfurt applies. If an active region is to be discontinued, Decanos notifies this at least 180 days in advance and migrates the Customer free of charge to another EU/EEA region. A shorter period applies only where required by law, by the infrastructure provider's discontinuation or by a security vulnerability that cannot reasonably be mitigated; if no suitable EU/EEA region is available, the Customer may terminate the affected subscription and prepaid fees are refunded pro rata.

16.4 No Transfer outside the EU/EEA. Customer Data is not transferred, stored or processed outside the EU/EEA except (i) with the Customer's explicit prior authorisation in the Data Processing Agreement or otherwise in writing specifying the destination country and the safeguards, or (ii) under Art. 49 GDPR. The Data Processing Agreement describes any authorised processing outside the EU/EEA and the safeguards applied, in particular (a) time-limited, ticket-based and logged support and troubleshooting access by authorised personnel of the Technology Provider in the United States, including the permitted scope of such access, and (b) AI model providers outside the EU/EEA selected by the Customer (§ 23.6).

16.5 Change of Deployment Model. A change of Deployment Model or hosting region requires a written change agreement specifying the target model, timetable, data migration and encryption, access changes, service levels during migration and the allocation of costs.

§ 17 Rights of Use, Scope and Overages

17.1 Grant. Subject to full payment, Decanos grants the Customer for the subscription term a simple (non-exclusive), non-transferable and non-sublicensable right to (a) access and use the Platform in the agreed Deployment Model, (b) have Authorised Users use it, (c) use the Documentation and (d) install Customer-Deployed Components in its infrastructure as necessary for operation of the Platform.

17.2 Scope. Use is limited to the modules, Billable Units and Support Tier in the Order Form and to the Customer's own internal business and cybersecurity purposes. Processing data on behalf of third parties, other than affiliated companies named in the Order Form, requires express agreement in the Order Form. The rights granted to the Customer do not exceed those available to Decanos from the Technology Provider.

17.3 Reservation. All rights not expressly granted remain with the Licensor or Decanos. Mandatory rights under §§ 69d and 69e UrhG remain unaffected.

17.4 Overages. Consumption of Billable Units is measured by platform telemetry and is visible to the Customer in the Platform. Decanos informs the Customer when consumption reaches 80 % of the ordered quantity. Consumption above the ordered quantity is invoiced monthly in arrears at the overage rates in the Order Form or, where none are agreed, at Decanos' list prices applicable at the time. The Customer may dispute an overage invoice within 30 days with reasonable documentation; the undisputed part remains due. Use above the ordered quantity is not covered by the service levels (Annex 1).

17.5 Change Orders. Additional quantities, modules or a higher Support Tier during a term are ordered by change order. They end together with the current subscription and are invoiced pro rata for the remaining term unless otherwise agreed.

§ 18 Use Restrictions

18.1 The Customer shall not, and shall not permit any third party to:

• (a) reverse engineer, decompile or disassemble the Platform or otherwise attempt to derive its source code, except to the extent expressly permitted by mandatory law (§ 69e UrhG);
• (b) modify, adapt or translate the Platform or create derivative works of it;
• (c) remove, alter or obscure proprietary notices, labels or markings;
• (d) sublicense, resell, rent, lease, lend or otherwise make the Platform available to third parties;
• (e) use the Platform to develop a competing product or service, or to perform competitive analyses or benchmarks for publication without prior written consent;
• (f) publish or disclose results of performance, security or functionality tests of the Platform without prior written consent;
• (g) circumvent or disable security measures, access controls or usage limits;
• (h) conduct penetration tests, vulnerability scans or other security assessments of the Platform without Decanos' prior written authorisation;
• (i) transmit malicious code to or through the Platform, interfere with its integrity or performance, overload it, or attempt to gain unauthorised access to the Platform, the systems of Decanos or the Technology Provider, or data of other customers;
• (j) use the Platform in breach of applicable law, in particular data protection law, export control law and anti-corruption law.

18.2 Authorised Security Testing. At the Customer's request Decanos authorises one penetration test of the Platform per year by an independent testing company agreed in advance that does not compete with Decanos or the Technology Provider. The test requires 30 days' notice, an agreed scope and rules of engagement, and may be observed in real time. Results are confidential information of Decanos and the Licensor. The Customer bears the costs. Penetration tests that Decanos performs on the Customer's own systems (§ 2.1 (b)) are not affected by § 18.1 (h).

18.3 Consequences. Breaches entitle Decanos to suspension (§ 30), termination for good cause (§ 6 (d)) and the contractual penalty (§ 10).

§ 19 Intellectual Property, Customer Data and Output

19.1 Platform. All intellectual property rights in the Platform, including software, algorithms, models, Documentation, trade secrets and proprietary technology, and in modifications, enhancements and derivative works, are and remain the exclusive property of the Licensor and/or its technology providers. The Customer acquires no ownership. Its rights are limited to the rights of use expressly granted in this Part B and are subject to § 18.

19.2 Customer Data and Customer Materials. As between the parties, all rights in Customer Data and Customer Materials remain with the Customer. The Customer grants Decanos and its subcontractors for the term the non-exclusive right to host, store, reproduce and process them to the extent necessary to provide the Platform. The Customer is responsible for the lawfulness, accuracy and quality of Customer Data and Customer Materials.

19.3 Output. The Customer may use Output for its internal business and cybersecurity purposes. It shall not (a) distribute Output to third parties as a standalone product or service, (b) use Output to reverse engineer algorithms, models or detection methods, or (c) use Output as an official assessment, audit report, compliance certification, regulatory filing or external report without Decanos' prior written consent. All AI-generated Output serves informational and operational purposes, is not professional advice, legal opinion or regulatory certification and does not replace qualified human review. The Customer may use information contained in Output, after its own review and under its own responsibility, in its own reports and in notifications to authorities.

19.4 Threat Intelligence and Usage Data. Decanos and the Licensor may derive Threat Intelligence and Usage Data from the operation of the Platform and use them to improve detection, the Security Graph, AI models and the Platform; the rights in them belong to the Licensor. Customer personal data is not used for training, fine-tuning or optimising AI models or for enriching the Security Graph unless the Customer has given explicit prior written authorisation. Documentation of the de-identification method is made available on request. Threat Intelligence and Usage Data never identify the Customer to third parties.

19.5 Feedback, Open Source, Marks. Decanos and the Licensor may use suggestions and feedback on the Platform without restriction and without remuneration. Open source components are subject to their own licences, which prevail for those components; a list is provided on request. The Customer may use trademarks of Decanos or the Licensor only with prior written consent.

§ 20 Customer-Deployed Components

• (a) Customer-Deployed Components are licensed as part of the Platform and are not sold; they remain the property of the Licensor. The Customer deploys and operates them in accordance with the Documentation and the published system requirements.
• (b) The Customer keeps Customer-Deployed Components no more than two major releases behind the current version. Malfunctions caused by outdated versions are excluded from warranty and service levels.
• (c) Decanos and the Technology Provider may remotely update, patch or deactivate Customer-Deployed Components where necessary for security, compatibility or legal compliance, and minimise disruption in doing so. Remote deactivation may impair the Platform's function.
• (d) Within 15 days of the end of the right of use, the Customer removes all Customer-Deployed Components and revokes all associated service principals, API credentials, IAM roles and other access, and confirms this in text form on request. If it fails to do so, Decanos may deactivate the components remotely after five business days' notice. Decanos limits the deactivation to its own components. Decanos is not liable for the loss of protection resulting from the removal; its liability under § 9 for damage caused by a culpably faulty deactivation remains unaffected.

§ 21 Customer Obligations for the Platform

• (a) Access credentials. The Customer keeps credentials, API keys and authentication mechanisms confidential, assigns personal credentials to each Authorised User (sharing is prohibited), enforces multi-factor authentication for all accounts, regularly reviews authorisations and is responsible for all activity under its credentials.
• (b) Notification. The Customer notifies Decanos without undue delay of any suspected unauthorised access, compromised credentials or security incident affecting the Platform or Customer Data.
• (c) Backups. The Customer keeps its own backups of Customer Data by regular exports in accordance with the Documentation. Backups made by Decanos or the Technology Provider serve disaster recovery and do not replace the Customer's own backup.
• (d) Users. The Customer trains Authorised Users in the proper use of the Platform and is responsible for their acts and omissions.
• (e) Systems. The Customer provides the hardware, software, networks and connectivity required for use, including compatible systems for Customer-Deployed Components.
• (f) Lawful data. The Customer warrants that it has collected Customer Data lawfully and holds the required legal bases. It does not intentionally process special categories of personal data (Art. 9 and 10 GDPR) through the Platform unless agreed in the Order Form with additional safeguards. Both parties acknowledge that security monitoring may incidentally capture such data.
• (g) Co-determination. The Customer is responsible for involving its works council (in particular § 87 para. 1 no. 6 BetrVG) or staff council and for informing its employees before the Platform is deployed.
• (h) Onboarding. The Customer provides access, personnel and information required for onboarding, support and incident handling in good time.

§ 22 BYOC: Customer Infrastructure Responsibilities

22.1 Application. This § 22 applies only where the Order Form specifies BYOC. It applies correspondingly where a third party designated by the Customer owns the cloud account.

22.2 Responsibility. The Customer is solely responsible for (a) provisioning, configuration, operation, maintenance, security and availability of its cloud account; (b) compliance with the technical requirements published in the Documentation; (c) cloud audit logging that captures all access by Decanos and the Technology Provider; (d) provisioning IAM roles for deployment pipelines and support access; (e) data residency and regulatory compliance of the infrastructure; (f) disaster recovery for the infrastructure layer; and (g) notifying Decanos within 24 hours of security incidents at infrastructure level.

22.3 Access. The Customer grants access for the automated deployment pipelines and time-limited, ticket-based troubleshooting access as specified in the Documentation, and may monitor and revoke such access at any time. Revocation releases Decanos and the Technology Provider from update and patch obligations for the affected environment. Personnel of Decanos and the Technology Provider access infrastructure components (hypervisor, network, storage, host operating system, account-level IAM) only with the Customer's written authorisation for a specific purpose.

22.4 Minimum Standards. The Customer's infrastructure provides at least (a) AES-256 encryption at rest; (b) TLS 1.2 or higher in transit; (c) multi-factor authentication for administrative access; (d) network segmentation isolating the Platform; (e) automated security patching of infrastructure components; and (f) a hosting region that meets the applicable data residency requirements. Audit logs are kept for at least 12 months. The cloud account requires approval by Decanos before production use.

22.5 Exclusion. Decanos is not responsible for downtime, data loss, performance degradation or security breaches caused by (a) failures of the Customer's infrastructure, (b) unauthorised IAM changes, (c) revocation of access that prevents maintenance, or (d) acts or omissions of the cloud provider, unless Decanos or its subcontractors caused them. The service levels apply to the application layer only.

§ 23 Artificial Intelligence and Automated Actions

23.1 AI Functions. The Platform uses artificial intelligence, machine learning and automated decision-making. The agreed quality of the Platform results from the Documentation. Output that is accurate, complete and free from errors, omissions or bias in every case is not part of the agreed quality, and neither Decanos nor the Licensor gives a guarantee to that effect. Output may be incomplete or unsuitable for the Customer's environment and must be reviewed by qualified personnel before the Customer acts on it. The Platform is a tool and does not replace a CISO or qualified security personnel. It may not reflect the most recent laws, regulations or standards. § 9 remains unaffected.

23.2 AI Regulation. The Technology Provider classifies the AI components of the Platform according to Regulation (EU) 2024/1689 (AI Act). On request, Decanos provides a summary of this classification, a description of the AI models and their purpose, known material limitations including false positive and false negative rates where reasonably measurable, the human oversight mechanisms and the types of training data, at a level sufficient for the Customer's own risk assessment and without disclosure of trade secrets. The Customer is responsible for classifying its own use of the AI functions and for its obligations as deployer. Where the Platform contributes to decisions within the meaning of Art. 22 GDPR, Decanos provides the information and functions required for human oversight, review and explanation.

23.3 Automated Actions. Functions of the Platform, in particular Autopilot, workflow automation and automated responses of Customer-Deployed Components, can take actions in the Customer's systems without real-time human approval. These include containment, isolation, quarantine and process termination on endpoints; changes to IAM roles, policies, access keys, security groups and firewall rules; quarantine or termination of cloud resources, pods and containers; blocking of network traffic; suspension of user accounts and sessions; and commands to third-party platforms via configured integrations.

23.4 Customer Responsibility. The Customer is solely responsible for (a) configuring the scope and permissions of Automated Actions, with access rights limited to the minimum necessary; (b) establishing approval workflows and change management for actions affecting production systems; (c) testing configurations in a non-production environment before production use; (d) monitoring the results; and (e) maintaining override, rollback and emergency access capabilities. Where Decanos configures Automated Actions as part of Managed Services, the response playbook approved by the Customer in text form defines the configured scope.

23.5 Liability for Automated Actions. Decanos and the Licensor are not liable for adverse effects of Automated Actions that operate within the scope configured by or approved by the Customer, or that result from foreseeable variability of AI results. Decanos is liable under § 9 where a defect, meaning a reproducible software error, data processing error or algorithm failure, causes an Automated Action to deviate materially from the configuration. § 9 (a) remains unaffected in all cases.

23.6 Choice of AI Models. The Platform is vendor-agnostic with respect to large language models. The Customer selects the model provider(s) and model(s) from the options supported by the Platform. The processing location follows the selected provider and endpoint. Before the selection, Decanos informs the Customer of the available options, their processing locations and the providers' terms on data retention and training, uses EU/EEA endpoints where the provider offers them, and documents the selection in the sub-processor annex of the Data Processing Agreement. Processing outside the EU/EEA requires the Customer's express authorisation (§ 16.4). Model providers may not use Customer Data to train or improve their models. The quality of Output may differ between models; § 23.1 applies.

§ 24 Service Levels and Support

24.1 Support Tier. The Order Form specifies the Support Tier; without specification, Baseline applies. Annex 1 sets out availability, response times, maintenance windows, service credits, reporting and disaster recovery. Service levels beyond Annex 1 apply only if expressly agreed in the Order Form.

24.2 Support Process. Decanos provides first-line support (ticket intake, triage, severity classification and known-issue handling) and escalates to the Technology Provider for second- and third-line support. Response times run from receipt of the ticket by Decanos through the agreed support channels. Decanos classifies the severity of each ticket under Annex 1; the Customer may request reclassification with additional information.

24.3 Out of Scope. Support does not cover issues caused by modifications or use contrary to these GTC; issues in the Customer's infrastructure, network or third-party software; custom development, custom integrations and Professional Services (available under a SoW); training beyond standard onboarding; and Beta Features (best effort only).

24.4 Service Credits. If the Monthly Uptime Percentage falls below the commitment for the Customer's Support Tier, the Customer receives the service credit set out in Annex 1. Service credits are a flat-rate reduction of the remuneration for the affected month and are credited against future invoices; they are paid out only on termination. The Customer requests the credit in text form within 30 days of the end of the month with the times, impact and available evidence of the downtime. Further claims for the same downtime exist only under § 9, and service credits are credited against them. The right to terminate for good cause remains unaffected.

24.5 Deployment Models. For Decanos-Hosted and Managed Cloud, the service levels in Annex 1 apply to the entire Platform, including the infrastructure layer. For BYOC they apply to the application layer only. For On-Premise, Decanos provides support but no availability commitment, also where Decanos operates the Platform.

§ 25 Updates, Maintenance and Discontinuation

• (a) Updates. Decanos provides updates (patches, bug fixes, security updates and minor releases). In Decanos-Hosted and Managed Cloud they are applied automatically, in BYOC via the deployment pipelines. For On-Premise they are applied by Decanos where it operates the Platform, otherwise by the Customer within a reasonable period.
• (b) Maintenance. Scheduled maintenance takes place in the windows and with the notice periods set out in Annex 1, generally outside business hours. Emergency maintenance to address critical vulnerabilities or imminent threats may take place at any time with the earliest practicable notice.
• (c) Deprecation. Decanos notifies the deprecation of a material feature or module included in the Customer's subscription at least 90 days in advance, naming the feature, the date, any replacement and required action. If no substantially equivalent replacement is provided, the Customer may terminate the affected subscription with effect from the deprecation date; prepaid fees are refunded pro rata.
• (d) Major versions and APIs. Major version changes that require action by the Customer are announced at least 60 days in advance with migration guides. Published APIs remain backward compatible for at least 12 months after announcement of a breaking change.
• (e) End of life. Decanos notifies the discontinuation of the Platform or a module at least 180 days in advance, offers a migration path where possible and continues to provide the discontinued service for the current term. If no substantially equivalent replacement is available, the Customer may terminate the affected subscription; prepaid fees are refunded pro rata.
• (f) New features. New features or modules that are licensed separately are not included in existing subscriptions and require a separate order.

§ 26 Data Protection for the Platform

26.1 Roles. The Customer is controller and Decanos is processor. Sub-processors of Decanos are in particular the infrastructure provider (for Decanos-Hosted) and the Technology Provider. Before personal data is processed, the parties conclude a Data Processing Agreement specifying (a) the subject matter and purpose of processing, (b) the types of personal data, (c) the categories of data subjects, (d) the obligations of each party, (e) the procedure for data subject rights, (f) the engagement of sub-processors and notification of changes, (g) the technical and organisational measures, and (h) retention and deletion.

26.2 Sub-processor Annex. The sub-processor annex of the Data Processing Agreement names all sub-processors of Decanos and the further sub-processors of the Technology Provider, including the AI model providers selected by the Customer, with their location, the processing they perform and the transfer mechanism. The annex is authoritative for the Customer; lists published by the Technology Provider for its own offering do not apply.

26.3 Location and Transfers. Personal data is processed and hosted only in approved EU/EEA hosting regions (§ 16.3). Transfers outside the EU/EEA take place only under § 16.4 and on the basis of the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914) with supplementary measures, including encryption in transit and at rest, restrictive access control, and the obligation to challenge disproportionate government access requests and to notify them where legally permitted.

26.4 Purpose Limitation. Personal data is processed only to provide the Platform and the agreed services. It is not sold and is not used for AI training, model optimisation or other purposes without the Customer's explicit prior written authorisation.

26.5 Change of Sub-processors. Decanos notifies intended changes of sub-processors without undue delay, as a rule at least 30 days in advance. The Customer may object on reasonable data protection grounds within ten working days of notification. If no alternative solution is found within 30 days, the Customer may terminate the affected services without penalty; prepaid fees for the period after termination are refunded.

26.6 Personal Data Breaches. Decanos notifies the Customer without undue delay after becoming aware of a personal data breach, with the information under Art. 33 para. 3 GDPR as far as available, and supplements it as the investigation progresses. Decanos supports the Customer in notifications to authorities and data subjects.

26.7 Assistance and Audits. Decanos supports the Customer with data subject requests, data protection impact assessments and prior consultations. The Customer may verify compliance once per calendar year with 30 days' notice during business hours, itself or through an independent auditor bound to confidentiality who is not a competitor of Decanos or the Technology Provider. Verification is primarily by current audit reports, certificates and answers to written questions. Audit effort beyond five person-days per year is remunerated at the agreed rates. Audit results are confidential.

26.8 Deletion. After the export period (§ 31.2), personal data is deleted from primary systems within 30 days and from backups within a further 90 days, unless statutory retention obligations apply. Decanos confirms deletion on request.

26.9 On-Premise. For On-Premise, Decanos processes personal data only to the extent the Customer grants remote access for support purposes.

§ 27 Information Security, NIS2 and KRITIS

27.1 Security Measures. Decanos ensures, also through its agreements with the Technology Provider, appropriate technical and organisational measures. These include in particular encryption in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent); multi-factor authentication, role-based access control and least privilege; logical tenant isolation and network segmentation; web application firewall, DDoS protection and intrusion detection; a secure development lifecycle with static and dynamic security testing; remediation of critical vulnerabilities within 24 hours, high within 7 days, medium within 30 days and low within 90 days of discovery; penetration tests by independent third parties at least annually; tamper-resistant audit logs retained for at least 12 months; 24/7 security monitoring; a documented incident response plan; background checks and security training for personnel with access to Customer Data; and daily encrypted backups within the hosting region. Details are set out in the annex to the Data Processing Agreement. Material reductions of these measures do not take effect for a current term.

27.2 Certifications. Decanos provides information on current certifications, attestations and audit reports of Decanos and the Technology Provider on request under a confidentiality agreement. A specific certification is owed only if expressly agreed in the Order Form.

27.3 NIS2 and KRITIS. Where the Customer is subject to NIS2, the BSIG or other critical infrastructure regulation, Decanos (a) provides the information reasonably required for supply chain risk assessments (Art. 21 para. 2 (d) NIS2); (b) provides technical documentation and evidence of the security measures; (c) notifies the Customer without undue delay of significant security incidents affecting the Platform that may trigger reporting obligations, and supports the preparation of notifications with technical details; and (d) cooperates in audits by competent authorities to the extent its involvement is required. The Customer's own registration and reporting obligations remain with the Customer.

§ 28 Third-Party Platforms and Integrations

• (a) The Platform may connect to third-party platforms, services and applications at the Customer's direction. The Customer is responsible for authorising such access, for compliance with the third parties' terms of use and for valid credentials.
• (b) Third-party platforms are not part of the Platform and are not covered by the service levels, the security measures or the Data Processing Agreement. Data transmitted to third-party platforms at the Customer's direction is the Customer's responsibility.
• (c) Decanos makes reasonable efforts to maintain integrations with widely used third-party platforms but is not responsible for disruptions caused by changes to their interfaces, functions or terms.

§ 29 Beta Features and Non-Production Environments

• (a) Beta Features are provided free of charge for testing and feedback, are not intended for production use, are excluded from the service levels and support obligations, and may be changed or discontinued at any time. For Beta Features Decanos is liable only under § 9 (a). Once a feature becomes generally available, § 25 applies.
• (b) Non-production environments (staging, test, sandbox) are excluded from the service levels, may not be used for personal data unless agreed in writing, are subject to the same use restrictions and may be changed or ended at any time.

§ 30 Suspension

• (a) Decanos may suspend access to the Platform immediately and without prior notice if (i) use poses an imminent security risk to the Platform, Decanos, the Technology Provider or other customers, (ii) use may adversely affect the Platform, (iii) suspension is required by law, court order or official order, or (iv) Decanos reasonably believes that the Customer's account has been compromised.
• (b) Decanos informs the Customer at the same time or immediately afterwards, stating the reasons. Decanos reviews an objection by the Customer within 4 hours for Elite and within 24 hours for other Support Tiers.
• (c) In the case of other material breaches of this Part B, Decanos may suspend access if the Customer does not remedy the breach within ten days of notice in text form.
• (d) Suspension under § 5 (g) for payment default remains unaffected.
• (e) Suspension is limited in scope and duration to what is necessary. Access is restored without undue delay once the reason has ceased. The obligation to pay continues unless the suspension was unjustified.

§ 31 End of Contract, Data Export and Continuity

31.1 End of Rights of Use. The rights of use end with the end of the subscription. The Customer then ceases all use of the Platform and Documentation, removes Customer-Deployed Components (§ 20), and each party returns or deletes the other's confidential information on request. Decanos deactivates access.

31.2 Data Export. During the term the Customer may request an export of Customer Data at any time. For 30 days after the end of the contract (export period), Decanos provides Customer Data on request in a common machine-readable format (for example JSON, CSV or Parquet). Exports are provided within ten business days of the request. If the contract ends because continued provision would be unlawful (§ 12 (e)), the export takes place to the extent legally permissible.

31.3 Account Continuity. Accounts, configurations, Customer Data and entitlements remain intact for the duration of the subscription regardless of the Deployment Model. Conversion from an evaluation (Part C) to a subscription does not require a new account.

31.4 Inability of the Technology Provider. If Decanos can no longer provide the Platform because the Technology Provider ceases to make it available (for example due to insolvency, cessation of business or end of the distribution relationship), Decanos (a) informs the Customer without undue delay; (b) gives at least 60 days' notice where possible; (c) ensures access to Customer Data and configurations for export and transition; and (d) refunds prepaid fees for the period after the end of provision pro rata. The Customer may then terminate the affected subscription without notice. Where the Order Form provides for a source code escrow, the conditions agreed there apply.

31.5 Transfer for Continuity. To ensure uninterrupted operation, Decanos may, with the Customer's consent in text form, transfer the contract on the Platform, with all data, configurations and entitlements, to another authorised partner of the Technology Provider or to a company of the Technology Provider, in each case established in the EU/EEA. The hosting region, the Data Processing Agreement and the rules on access from third countries continue to apply unchanged; Customer Data remains in the agreed EU/EEA hosting region. If the Customer does not consent, § 31.4 applies.

§ 32 Liability for the Platform and Protection of the Licensor

• (a) § 9 applies to the Platform.
• (b) The Customer has no contractual claims against the Licensor. To the extent the Customer asserts claims against the Licensor on other legal grounds in connection with the Platform, the Licensor's total liability is limited to the fees paid by the Customer for the Platform in the 12 months before the event giving rise to the claim, and the Licensor is not liable for indirect, incidental, special or consequential damages, punitive damages, or loss of profit, revenue, data, goodwill or business opportunities.
• (c) The limitation under (b) does not apply to intent, gross negligence or fraud, to injury to life, body or health, to liability under the Product Liability Act or to any other liability that cannot be limited under mandatory law.
• (d) Decanos is not liable for the Customer's BYOC infrastructure (§ 22), for third-party platforms (§ 28) or for Automated Actions within the configured scope (§ 23.5), subject in each case to § 9 (a).

Part C: Evaluation and Proof of Value

§ 33 Evaluation Access to Decanos AEP

33.1 Subject. Decanos may grant time-limited access to the Platform for evaluation or as a Proof of Value (“Evaluation”). Scope, Deployment Model, period and any fee result from the evaluation confirmation. Unless otherwise agreed, the Evaluation is free of charge.

33.2 Purpose and Restrictions. The Evaluation serves exclusively internal testing and assessment of the Platform and not commercial purposes or the protection of production environments, unless agreed otherwise in the evaluation confirmation. § 18 applies. The Customer shall also not (a) use robots, scrapers or other automated means to access the Platform beyond its intended interfaces, (b) use data from the Platform for purposes other than the Evaluation, or (c) create datasets, AI models or analyses outside the scope of the Evaluation.

33.3 Support and Changes. Decanos provides reasonable support by e-mail and in agreed meetings. Annex 1 does not apply. Decanos may change features during the Evaluation; § 25 applies only under a subscription.

33.4 Data. Before personal data is processed in the Evaluation, the parties conclude a Data Processing Agreement. Where possible, the Customer uses test, synthetic or pseudonymised data. The security measures under § 27.1 also apply during the Evaluation.

33.5 Warranty and Liability. In a free Evaluation the Platform is provided in its current state. Decanos is liable for defects only if it fraudulently conceals them, and otherwise only for intent and gross negligence, for injury to life, body or health and under the Product Liability Act. In a paid Evaluation, § 9 applies.

33.6 End. Either party may end the Evaluation with 15 days' notice in text form, and immediately in the case of a breach of § 18. When the Evaluation ends, the right of use ends. The Customer removes Customer-Deployed Components within 15 days and deletes confidential information. Evaluation data is deleted 30 days after the end unless a subscription is concluded beforehand; in that case it is carried over (§ 31.3).

33.7 No Purchase Obligation, Publicity. The Evaluation does not oblige either party to conclude a subscription. Results of the Evaluation are confidential information of Decanos and the Licensor (§ 7). Decanos uses the Customer's name or a case study only with the Customer's prior written consent.

Annex 1: Service Levels and Support Tiers

This annex applies to Decanos AEP in Decanos-Hosted and Managed Cloud in full and, for the application layer, in BYOC (§ 24.5). The Support Tier follows from the Order Form; without specification, Baseline applies.

A1.1 Availability

The Monthly Uptime Percentage is the number of minutes in a calendar month minus the minutes of Downtime, divided by the minutes in the month. Downtime is any period in which the Platform is materially unavailable or materially impaired, in particular when the Customer cannot log in, cannot use core functions, or more than 5 % of requests fail over a continuous five-minute period. Downtime is measured in one-minute increments; single incidents shorter than five consecutive minutes are not counted. Decanos provides status information on availability, planned maintenance and incident history. Not counted as Downtime are: scheduled maintenance with the notice above; emergency maintenance to address critical vulnerabilities or imminent threats; force majeure; causes in the Customer's sphere, including misconfiguration; third-party services and integrations not provided by Decanos or its sub-processors; failures of BYOC or customer infrastructure; Beta Features; and use beyond the ordered Billable Units.

A1.2 Service Credits

For annual or multi-year subscriptions the monthly fee is one twelfth of the annual fee for the affected services. Service credits in a month do not exceed 100 % of the monthly fee. Request and offsetting are governed by § 24.4.

A1.3 Severity Levels and Resolution Targets

Resolution means a fix or an effective workaround. Resolution times are targets and not commitments; the response times in the table above are commitments.

A1.4 Reporting and Disaster Recovery

• For Critical incidents lasting more than 30 minutes, Decanos provides a written root cause analysis within five business days of resolution.
• For Plus and Elite, Decanos provides a monthly service report within ten business days after month end and holds quarterly service reviews.
• Decanos-Hosted and Managed Cloud: backups at least every 24 hours with point-in-time recovery; recovery point objective 24 hours; recovery time objective as in the table above; operation across several availability zones within the hosting region; disaster recovery tests at least annually. Cross-region failover for Elite only on request and only within the EU/EEA.
• BYOC and On-Premise: disaster recovery for the infrastructure layer is the Customer's responsibility; Decanos ensures redeployment of the application layer once the infrastructure is available.

Decanos GmbH · Alt-Moabit 73/73a, 10555 Berlin · contact@decanos.com · www.decanos.com · www.cyber-curriculum.com · Managing Director: Niclas Matz · VAT ID: DE343188316 · Berlin Charlottenburg Local Court