Special Terms for Organizations

Preamble

These special terms govern the use of the module "CertMap for Organizations". They supplement the general part of the General Terms and Conditions of Threat-Informed Cybersecurity Solutions GmbH, Ober-Saulheimer Str. 15, 55291 Saulheim, Germany (Amtsgericht Mainz, HRB 53346, VAT ID DE 450829291), represented by its managing director Daniel Thomas Heessel (hereinafter the "Provider"). Order of precedence in case of conflict: the individual offer in text form, then these special terms, then the general part. The processing of personal data on behalf of the customer is governed primarily by the data processing agreement.

1. Scope

(1) This module is aimed exclusively at entrepreneurs within the meaning of Sec. 14 BGB, legal entities under public law and special funds under public law. Consumers cannot create an organization.

(2) The person creating an organization confirms their authority to represent the customer and the exclusively business use.

2. Conclusion of Contract

(1) The contract for the free trial is concluded upon creation of the organization. It requires confirmation of these terms, the data processing agreement, the legal basis for processing employee data and the business use.

(2) The contract for a paid plan is concluded by acceptance of an offer of the Provider in text form. The Provider activates the booked plan after conclusion of the contract. There is no online checkout and no payment service provider.

3. Trial

(1) The trial lasts 14 days from the creation of the organization. It is free of charge and comprises the full range of functions. An individually negotiated data processing agreement is not part of the trial; the standard agreement under section 14 applies.

(2) During the trial, a maximum of 15 people can be recorded. Recording beyond that is refused.

(3) There is no self-service extension of the trial. A second trial for the same organization or the same company domain is not granted. The Provider may extend the trial in individual cases.

4. Read-Only Access after the Trial

(1) After the trial ends, the organization is in read-only access for 30 days.

(2) In read-only access all data remains visible. Changes, invitations, imports and the retrieval of reports are no longer possible. Open invitations expire.

(3) The only export in read-only access is the complete data copy of the organization in a machine-readable format. It is available at any time.

5. Deletion without a Contract

(1) If no contract for a paid plan is concluded during read-only access, the organization and all its data are deleted without undue delay and completely once 44 days have passed since creation, including the audit log.

(2) The Provider informs the administrators by email seven days before deletion. Deletion takes place at the stated time regardless of whether this email could be delivered.

(3) Deletion is final. Restoration is excluded. The customer is responsible for downloading the data copy before deletion. Personal CertMap accounts of employees are not affected by the deletion.

6. Paid Plans and Scope of Services

(1) The Provider offers the paid plans Core, Pro and Max. They include 25, 75 or 200 people respectively. The scope of functions of the booked plan and the price follow from the offer in text form on which the conclusion of the contract is based. Statements on the Provider's website are non-binding.

(2) Additional people can be added at the surcharge per person and month stated in the offer. A change of plan is not required for this.

(3) The Provider may further develop the software as long as the contractual core of the booked scope of functions is preserved. Functions of the trial that are not included in the booked plan are not owed.

7. Term, Renewal and Termination

(1) The term of a contract for a paid plan is 12 months from activation.

(2) The contract renews automatically for further periods of 12 months unless terminated by either party in text form with three months' notice to the end of the respective term.

(3) A late termination takes effect at the end of the following term. Until the termination takes effect, the customer retains full access.

(4) The right to terminate for cause remains unaffected.

(5) In the event of late payment, the Provider may, after a reminder with a deadline, restrict access to the read function. No deletion takes place during the contract term.

8. Remuneration and Price Adjustment

(1) Prices are per month, net plus statutory VAT, and are invoiced annually in advance. Payment is due 14 days after the invoice date.

(2) No pro rata refund is made in the event of termination, a change to a lower plan or a reduction in the number of people during the term. A change to a higher plan is possible at any time; the difference is charged pro rata until the end of the term.

(3) The Provider may adjust prices in text form with three months' notice to the end of the respective term. In the event of an increase, the customer may terminate as of the date the adjustment takes effect.

9. End of Contract and Deletion for Paid Plans

(1) After the termination takes effect, the organization is in read-only access for 90 days. Section 4 paragraphs 2 and 3 apply accordingly; the 30-day period under section 4 paragraph 1 does not apply here.

(2) Thereafter the organization and all its data are deleted without undue delay, completely and finally, including the audit log; section 5 paragraphs 2 and 3 apply accordingly. Statutory retention obligations remain unaffected.

(3) If the customer concludes a new contract for a paid plan within the read-only period, the organization continues without loss of data.

10. Obligations of the Customer

(1) The customer is the controller within the meaning of the GDPR for the data of its employees. It ensures a legal basis for their processing, involves employee representatives in accordance with the rules applicable to it and informs employees under Art. 13 and 14 GDPR.

(2) The customer appoints administrators, keeps access data secret and ensures that contact addresses are up to date. Deadline emails are sent exclusively to verified administrator accounts.

(3) The customer uses the software only for its own business purposes. Data it needs beyond the end of the contract is secured by the customer itself via the data copy.

11. Linked Accounts of Employees

(1) Personal CertMap accounts that employees link to the organization belong to the employees. The customer sees only the certifications that employees expressly release.

(2) A release can be revoked by the employee at any time, including while the organization is in read-only access. The deletion of the organization has no effect on these accounts.

(3) Personal economic data (cost per person) is visible only under the conditions of the application's data protection model (collective basis or consent, depending on the customer's market).

12. Availability and Support

(1) No specific availability is guaranteed in the plans Core and Pro. The Provider strives for high availability and announces maintenance windows where possible.

(2) Support is provided by email on working days.

(3) In the plan Max, availability and response times can be agreed in the offer.

13. Liability

(1) The liability provisions of the general part apply, including the liability that remains unaffected there under the German Product Liability Act, for guarantees assumed and for damage arising from injury to life, body and health.

(2) By way of derogation, in the free trial and in free read-only access the Provider is liable only for intent and gross negligence, to the extent permitted by law.

(3) For paid plans, liability for simple negligence is limited to the foreseeable damage typical for the contract, capped in amount at the remuneration for the current contract term.

(4) Compensation for data loss is excluded if the customer did not secure the data copy before the deletion date despite notice.

14. Data Protection and Data Processing Agreement

(1) The data processing agreement is part of the contract. In case of conflict, it takes precedence over these terms and the general part for the processing of personal data.

(2) An individual data processing agreement or a template of the customer is negotiated exclusively in the plan Max.

15. Amendments to these Terms

(1) The Provider may amend these terms with effect for the next contract term. It communicates amendments in text form no later than six weeks before the end of the notice period of the current term. The customer may then terminate as of the end of the current term.

(2) For the current contract term, amendments apply only with the customer's express consent; a fiction of consent is excluded.

(3) The version accepted by the customer is stored per organization and shown in the settings.

16. Final Provisions

(1) German law applies, excluding the UN Convention on Contracts for the International Sale of Goods.

(2) If the customer is a merchant, a legal entity under public law or a special fund under public law, the exclusive place of jurisdiction is the Provider's seat.

(3) Terminations and instructions require text form.

(4) Version of these terms: 11 September 2026, Version 0.7.