Terms & Conditions

Framework Agreement
on Software Purchase, Software Maintenance, and Software as a ServiceREAD THE FOLLOWING TERMS AND CONDITIONS CAREFULLY BEFORE USING THIS SOFTWARE.THIS AGREEMENT APPLIES TO ANY KIND OF USAGE OR ACCESS TO THE SOFTWARE, WHETHER PURCHASED DIRECTLY OR INDIRECTLY.BY CLICKING ON THE “I AGREE” BUTTON BELOW, ACCESSING OR USING THE SOFTWARE YOU AGREE THAT YOU: (1) HAVE READ ALL THE TERMS AND CONDITIONS CONTAINED IN THIS AGREEMENT, (2) UNDERSTAND ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT, (3) ACCEPT AND AGREE TO BE LEGALLY BOUND BY THE TERMS AND CONDITIONS OF THIS AGREEMENT.IF YOU DO NOT AGREE WITH THE FOLLOWING, DO NOT REGISTER, ACCESS, OR USE THE SOFTWARE.

IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF A COMPANY (OR OTHER ENTITY) YOU REPRESENT THAT YOU ARE AN EMPLOYEE OR AGENT OF SUCH COMPANY (OR OTHER ENTITY) AND YOU HAVE THE AUTHORITY TO ENTER INTO THIS AGREEMENT ON BEHALF OF SUCH COMPANY (OR OTHER ENTITY).

1. General Provisions
2. Object of the Agreement
   • This Framework Agreement stipulates the legal provisions with respect to the performance of services ordered by the Principal from the Contractor (“Individual Contracts”). If the Principal accepts the Contractor’s offer, the respective commission is concluded by submission of the Contractor’s order confirmation. The Contractor shall render to the Principal the services thereby commissioned.
   • Specific performance obligations under this Framework Agreement shall only arise in connection with Individual Contracts. The conclusion of this Framework Agreement does not trigger any claims on the part of the Principal for performance by the Contractor.
   • Unless otherwise stipulated in Individual Contracts, this Framework Agreement shall not encompass the rendering of services by the Contractor on the premises of the Principal. Any services rendered on the Principal’s premises as well as any other services beyond the scope of this Agreement shall be rendered by the Contractor against separate payment of actuals according to the agreed daily rates.
   • The Contractor shall only deploy adequately qualified personnel for the performance of its obligations under this Framework Agreement or under Individual Contracts.
3. Scope of application and hierarchy of provisions
   • To the extent an Individual Contract does not contain any explicit stipulations, the stipulations of this Framework Agreement shall apply to all services rendered by the Contractor to the Principal.
   • The following shall form the basis of the cooperation between the Parties, in the stated order of priority:

• the wording of this Framework Agreement in its clauses 1 to 51.2,
• the Annexes to this Framework Agreement,
• the wording of the respective Individual Contracts,
• the annexes to the respective offers.

Any provisions agreed by the Parties in an Individual Contract that deviate from the stipulations of this Framework Agreement shall only be valid if made in writing and expressly specified as a deviation from a specifically indicated clause of this Framework Agreement.

In the event of a contradiction between provisions on the same hierarchy level, the more specific provision shall apply.

• The Annexes to Individual Contracts as well as the Framework Agreement and its Annexes shall form an integral part of the Individual Contracts.
• Any terms and provisions of the Principal that deviate from or supplement the provisions of this Framework Agreement shall not become part of the Agreement; this shall in particular apply to the Principal’s General Terms and Conditions.

1. Force majeure
   • Malperformance or non-performance shall not constitute a violation of this Agreement to the extent it is caused by unpreventable occurrences, in particular earthquake, deluge, flooding, fire, explosion, blackout, embargos, governmental restrictions, riots, terrorist attacks, war or other military action, civil unrest, rebellion, vandalism, sabotage, strike at operator’s or supplier’s plant, or other causes not attributable to the affected Party (“Force Majeure”). The obligations of the affected Party shall be suspended for the duration of Force Majeure.
   • For the duration of Force Majeure, the performance period shall be extended by the delay caused by the occurrence of Force Majeure plus an adequate restarting period. The Principal’s payment obligations with respect to the affected contractual services shall be suspended for the duration of Force Majeure.
   • In the event concrete indications exist that the impediment of performance due to Force Majeure will continue for more than ninety days, the Parties shall be entitled to terminate in writing a contract on Software maintenance or a contract on the provision of Software under the software as a service model. To the extent the respective Software under a software purchase contract has not yet been delivered (downloaded), each of the Parties shall be entitled to rescind from the contract. No further rights exist.
2. Principal’s duty to cooperate
   • The Principal shall fulfil all of its cooperation obligations required for the performance of services by the Contractor.
   • In particular, the Principal shall, in accordance with the provisions of this Framework Agreement or Individual Contracts, grant to the Contractor all rights of access to premises and buildings at which the Contractor is to perform its services.
   • If the Principal fails to fulfil its cooperation obligations, the Contractor shall be released from its performance obligations to the extent the respective performance requires the Principal’s cooperation and performance is impeded due to the Principal’s non-compliance with its cooperation obligations.
   • Where the Principal commissions third parties in connection with the fulfilment of its cooperation obligations, it shall be liable for own faults as well as for the fault of such third parties. In the event the Principal culpably violates its duty to cooperate, it shall compensate the Contractor for all resulting damages, e.g. costs of idleness.
3. Remuneration, reimbursement of expenses
   • Remuneration shall be based on the respective Individual Contract, at the prices stated therein plus VAT.
   • Unless expressly agreed otherwise, remuneration shall be payable in full within fourteen (14) days from receipt of the respective invoice.
   • The Principal shall reimburse the Contractor for all expenses incurred by the Contractor in connection with its acting upon the Principal’s reporting of malfunctions, errors or defects if it turns out after inspection that no error or defect of the Contractor’s devices existed and this could have been discovered within the scope of a reasonable diagnostic inspection.
4. Rights to withhold performance, prohibition of set-off
   • All rights of the Principal to withhold or refuse performance shall be excluded. This shall not apply to claims and liabilities that exist undisputed, are legally valid or ripe for adjudication.
   • The Principal shall not be permitted to set-off any own claims against those of the Contractor. This shall not apply to a set-off against undisputed claims and claims that are legally valid or ripe for adjudication.
5. Liability
   • All rights of the Principal to claim damages or compensation for wasted expenditure shall, regardless of their legal nature, be subject to this section 7.
   • The Contractor shall be fully liable for damages in connection with injuries to life, body or health resulting from an intentional or grossly negligent violation of an obligation by the Contractor, its legal representatives or its vicarious agents. The Contractor shall also be fully liable for other damages caused by an intentional or grossly negligent violation of obligations by the Contractor, its legal representatives or its vicarious agents.
   • In cases of simple negligence, the Contractor shall only be liable for the violation of such obligations that are material for the proper implementation of the Agreement and on whose fulfilment the Principal relies and regularly may rely (material duties). In such cases, liability shall be limited to foreseeable typical damage.
   • Moreover, in the event of a simply negligent violation of a material duty, liability shall be limited to a maximum amount corresponding to the purchase price stipulated in the Individual Contract (for to the purchase of Software pursuant to clause BI) or to the annual remuneration (for the use of Software as a service pursuant to clause BIII).
   • The Principal shall be obliged to provide adequate protection of the data processed with the help of the Software in accordance with current technical standards but at least in correspondence with the guidelines of the Federal Office for Information Security (BSI; bsi.bund.de). If any data is destroyed or lost, the Contractor’s liability shall be limited to such amount that would have been required for the recovery or replacement of such data if the Principal had made proper backups. Recovery expenses shall extend to the actually incurred additional costs for recovery and/or replacement of the data.
   • All other liability of the Contractor, in particular the liability pursuant to Sec. 536 German Civil Code, shall be excluded.
   • Limitation and exclusion of liability pursuant to this clause 7 shall not affect the Contractor’s liability pursuant to the mandatory statutory provisions of the German Product Liability Act, liability for fraudulent concealment of defects, or liability in connection with a guarantee on quality (Garantie für die Beschaffenheit der Sache).
   • The provisions of this clause 7 shall also be applicable to the vicarious agents of the Contractor.
6. Marketing
   • Each Party shall be entitled to reference the name and trademark and/or the logo of the respective other Party on its website and in presentations for the term of the contractual relationship, unless the other Party objects in writing.
   • The use of the name and trademark and/or the logo of the respective other Party for other marketing purposes, in particular in the context of press releases and media articles shall require the prior consent of the other Party.
7. Confidentiality

The Parties undertake not to disclose to any third party information or trade secrets of the respective other Party or any other non-public information of which they gain knowledge within the scope of negotiating and implementing this Agreement, and to likewise bind their respective employees to secrecy. The Contractor shall be entitled to name the Principal as a reference.

1. Language
   • The services under this Agreement shall be rendered in the German or the English language.
   • The Contractor shall ensure that all persons entrusted with maintenance and support works have adequate command of the German or English language.
2. Applicable law and place of jurisdiction
   • German law shall exclusively be applicable between the Parties. The regulations of the UN Convention on Contracts for the International Sale of Goods dated 11 April 1980 (CISG) shall be excluded.
   • Exclusive venue for all disputes between the Parties arising out of or in connection with this Agreement or the offers and order confirmations shall be Cologne, Germany.
3. Final Provisions
   • This Agreement including its Annexes conclusively reflects the agreements between the Parties. No oral side agreements exist.
   • All amendments, supplements or substantiations to the provisions of this Agreements as well as special guarantees and arrangements shall require the written form. The aforesaid also applies to any amendments of this clause2.
   • Should a provision of this Agreement be or become invalid, this shall not affect the validity of the remaining provisions. The Parties shall, to the extent legally permissible, immediately replace such provision with a provision that comes closest to the content of the invalid provision and corresponds as closely as possible to the underlying business interests of the Parties.

1. Special Provisions
2. Purchase of Software

The provisions of this clause BI shall apply to all Individual Contracts whose object is the purchase of Software.

1. Object of contract
   • Object of the contract is the permanent surrender of the software “aqua” (hereinafter referred to as the “Software”) as described on the Contractor’s website (aqua-cloud.io/) to the Principal in the object code. Furthermore, the Contractor shall surrender to the Principal the pertaining user documentation in electronic form.
   • The Contractor shall provide the Software for download via the internet. The download link shall be provided to the Principal after full payment has been effected. Unless the Parties expressly agree on the delivery of a backup copy of the Software on a data carrier in the respective Individual Contract, the delivery of the Software on a data carrier shall not be an object of the contract.
   • Unless otherwise provided for in Individual Contracts, installation shall be effected by the Principal.
   • The Principal is not entitled to receive a copy of the source code of the Software or any other way of access to such code.
2. Rights of use
   • Within the scope of the licensing model agreed under an Individual Contract, the Contractor shall grant to the Principal the permanent, non-exclusive right to execute the Software for its own purposes on its own computers and, to the extent required, to copy it. The executions of the Software for own purposes shall permit the use at the companies indicated in the Individual Contract. Apart from the above-stated right to copy the Software according to this clause 14, no further rights of use in the Software are granted to the Principal. In particular, the Contractor reserves its rights with respect to any publication, reconstruction, processing and use of the Software. The Principal warrants that only authorised employees shall be granted access to the Software.

If the Principal has acquired a concurrent user licence under the licensing model, it shall have the right to install the Software on more than one device; however, contemporaneous use shall only be permissible for the number of acquired licences.

• In accordance with clause 1, the Principal shall be entitled to print out and copy the user documentation indicated in clause 13.1 above. Any forwarding to third parties (pursuant to clause 14.1 sentence 1) outside the Principal’s business is not permissible.
• The Contractor warrants that the Software is free of any third-party rights that would restrict or exclude its contractually agreed use. Should the contractual use of the Software be affected by third-party industrial property rights, the Contractor shall be entitled, on a scale acceptable to the Principal, to either modify the Software in such a way that it no longer falls under the protection of such rights while at the same time preserving its essential usage functions, or to obtain authorisation that the Software may be used without restrictions pursuant to the contract and without any additional costs for the Principal. Should the contractual use of the Software, for reasons not attributable to the Contractor, be affected by third-party industrial property rights, the Contractor shall be entitled to refuse performance of the affected services. In such case, the Contractor shall immediately notify the Principal accordingly and provide it with adequate access to its data; the Principal shall be exempt from respective payment obligations. All other rights and obligations of the Principal shall remain unaffected.
• The Principal shall be obliged to protect the access to the Software download provided to it against any unauthorised third-party access. The Principal shall instruct its employees to comply with the provisions of this contract.
• In the event the Principal was not provided with a backup copy pursuant to clause 2, it shall be entitled to make one (1) machine-parsable copy of the Software for backup purposes, ensuring that such copy is labelled as a “backup copy” in machine-readable form or plain writing. The Principal shall ensure that no backups or copies of the computer programme are made within the scope of other data backups.
• The removal of serial numbers, copyright notices or other programme identification features is not permissible. The same applies with respect to the suppression of the on-screen display of such features.

1. Purchase price
   • Unless otherwise expressly provided for, the purchase price shall be payable prior to the download of the Software.
   • The Contractor shall provide the Principal with a download link for the download of the Software within two (2) working days after receipt of payment.
2. Modifications and compiling
   • Unless expressly permissible under this agreement or Individual Contracts, the Principal is not permitted to reconstruct the various development stages of the Software or to modify the programme in any way; this shall in particular apply to a reconstruction of the provided programme code into another code form (decompiling).
   • Should the Principal need information on interfaces in order to ensure interoperability with another programme, it shall be entitled to perform the actions pursuant to clause 1 above, if the Contractor, despite a written request by the Principal is unwilling or unable to provide the required information. If the Contractor declares its willingness to provide the required information, the Parties shall conclude a separate agreement on the provision of such information.
   • If the Principal performs any of the actions pursuant to clause 1, only the Principal and its employees shall be entitled to use the information gained and solely for internal purposes of the Principal. Every ulterior use, in particular a use for commercial purposes or a forwarding to third parties, shall require the prior consent of the Contractor. The Contractor shall not withhold such consent unreasonably.
   • The removal of copy protection or other protection mechanisms is not permissible.
3. Resale and pre-emption right
   • If the Software is assigned to a third party, the Principal shall renounce all further use of the Software and delete all existing copies or return them to the Contractor. The Principal shall confirm to the Contractor in writing the deletion of all copies and provide information on the assignee to enable the Contractor to verify compliance with its intellectual property rights and licence terms. Upon assignment, the Principal loses all of its rights in the Software.
   • The Principal shall not assign the Software to a third party if reasonable suspicions exist that such third party will violate the provisions of this agreement, in particular that it will make unauthorised copies of the Software.
   • The Principal shall grant to the Contractor a pre-emption right in the Software with the proviso that it is entitled to enter into a purchase contract concluded between the Principal and a third party in lieu of such third party. In this context, the following shall apply:

• The Principal shall only conclude the contract with the third party upon condition that the Contractor will not exercise its pre-emption right.
• The Principal shall immediately notify the Contractor in writing of the content of the contract concluded with the third party, including name and full address of the respective third party.
• The Contractor shall submit a written declaration to the Principal regarding the exertion of its pre-emption right within 10 working days after receipt of the Principal’s notification.
• Upon exertion of the Contractor’s pre-emption right, the contract between Contractor and Principal shall be concluded at the conditions agreed between the Principal and the third party.

1. Obligation to examine and obligation to notify defects
   • The Principal shall examine the Software with respect to completeness and possible defects immediately but no later than 14 days after receipt and completed installation, including a test of the functionality of the programme components. The obligation to notify any defects pursuant to Sec. 377 German Commercial Code shall apply.
   • A notice of defects shall state the asserted defects as detailed as possible, indicating the ambient conditions of the installation, performed functions, the detected error pattern, the effects of such error on the functionality of the Software, and any on-screen error messages (qualified error message).
2. Claims for defects
   • The Contractor shall assume warranty for defects of the Software pursuant to the provisions of this clause 19.
   • The nature and quality of the Software is conclusively described in the programme specifications on the Contractor’s website under aqua-cloud.io/. The Contractor shall not assume any guarantee with respect to the nature and quality and/or durability of the Software nor any other guarantee, unless it has expressly and in writing assumed a specified guarantee under an Individual Contract.
   • The Contractor shall not be liable for any defects resulting from the use of hardware and environment software that do not meet the system requirements described on the Contractor’s website (http://aquawiki.andagon.com/system_requirements.html). The Principal may not assert any claims for defects resulting from a programme modification not carried out, arranged for or approved by the Contractor. If the Principal installs the Software itself, it may not assert any claims for immediate or subsequent defects occurring in connection with the installation. The aforesaid shall not apply if the defect results from incorrect installation instructions by the Contractor.
   • The Contractor shall remedy any material defects and/or defects of title upon receipt of a timely and reasonable notice of defect on the part of the Principal. The Contractor may, at its own discretion, remedy the defect either by rectification or additional delivery. In particular, the Contractor shall be entitled to remedy defects by delivery of new programme packages (patches, updates) that are free of the reported defect. Where reasonable, such programme packages shall be installed by the Principal. Otherwise, the Contractor shall install the package via remote access. In the latter case, the Principal shall grant to the Contractor the required remote access to the installation environment of the Software. The Contractor shall moreover be entitled to carry out rectification at the Principal’s premises. If reasonable for the Principal, the Contractor may, as a means of rectification, provide a workaround solution for the period until final remedy of the defect. In the event of a defect of title, the Contractor shall, at its own choice, either provide a design that allows the use of the Software without infringement of third-party rights or modify the Software to this effect.
   • If no remedy is achieved within a reasonable period of at least four (4) weeks, the Principal shall be entitled to request an adequate decrease of the agreed purchase price. A right of rescission shall not apply.
   • In the event of new delivery, the Contractor shall be entitled to deliver a new programme version with an equivalent range of functions, unless this is unacceptable for the Principal, e.g. because it would require another operating system or more powerful hardware. An initial training or user instruction for a modified programme shall, in principle, not be deemed unacceptable for the Principal.
   • If the Individual Contract provides that the Contractor shall carry out the installation upon instruction of the Principal, warranty rights shall become time-barred after one (1) year of completed installation of the Software by the Contractor. Otherwise, the Principal’s claims for defects shall be come time-barred one (1) year from the date of the download of the Software by the Principal. In the event of a wilful concealment of defects, statutory warranty provisions shall apply.
   • With respect to damage claims for defects clause 7 shall apply.
3. Maintenance and servicing of Software

Maintenance and servicing, including the provision of updates or upgrades are not part of the object of the Software purchase contract. The maintenance of software is outlined in section B.II. of this framework agreement.

1. Retention of title
   • Should an Individual Contract provide for different payment terms than those pursuant to clause 15, the right of ownership in the Software delivered and in the pertaining documentation shall remain with the Contractor until full settlement of all obligations under such contract.
   • If Principal asserts its right of retention or rescinds from the contract, it shall immediately cease to use the Software and delete all copies made by it. The Principal loses all rights of use in the Software.
2. Protection of the Software and audit
   • The Software, the user documentation and any access data shall be protected against unauthorised third-party access.
   • The Contractor shall be entitled to review the proper contractual use of the Software, in particular the quality and quantity of the Principal’s use of the Software, once a year (Software audit). To this purpose, the Principal shall provide all required documents and support the review of the use of the Software in accordance with the contract. The Contractor shall be entitled to carry out the audit on the premises of the Principal during normal business hours. To facilitate the review of compliance with the licensing provisions, the Principal shall be obliged to grant the Contractor or a third party commissioned by it for the auditing access to all business premises, to furnish all required and requested information and documents, to grant access to such computers on which the Software is installed, and, upon request, grant all required access rights to such computers, including administrator rights. The Contractor shall ensure that the operational procedures of the Principal or not unnecessarily disturbed. After termination of the audit, the Contractor shall inform the Principal in writing of the respective results.
   • Should the Principal intend to exert any rights beyond those agreed under the respective licensing model, it shall acquire the required rights of use against payment of a licence fee. Should the Principal significantly exceed its rights of use (e.g. a continuous unpermitted use of more than 10%), it undertakes to pay to the Contractor a contractual penalty. The contractual penalty shall amount to 50% of the licence fee payable for such additional use. The obligation to pay respective licence fees shall remain unaffected. The Contractor shall not be obliged to state its entitlement to contractual penalties upon acceptance of the licence fee.

1. Maintenance of Software

For Individual Contracts that include the maintenance of the Software in its object of contract, the provisions of this clause BII shall apply.

1. Object of contract
   • The Contractor shall maintenance the computer programme “aqua” (hereinafter “Software”) sold by it to the Principal in its respectively most recent version on the basis of an Individual Contract (hereinafter “Software Licensing Agreement”). The Software is described on the Contractor’s website (aqua-cloud.io/).
   • The use of updates for maintenance purposes may require an adaptation of the environment software (e.g. the operating system) or of the hardware. The adaptation of the environment software or of the hardware is not part of the respective update. To the extent new minimum system requirements apply, the Contractor shall inform the Principal accordingly. The Principal shall ensure that such requirements are complied with.
   • The maintenance of computer hardware is not an object of this agreement.
2. Maintenance services
   • The maintenance services for the Software rendered by the Contractor shall include the following:
     • Remote diagnosis in case of programme errors or bugs via telephone or a mode of access pursuant to clause 2 of this agreement;
     • Support and consultation via telephone and email under the hotline in case of defects in the Software pursuant to clause 27 of this agreement.
     • Provision of new versions of the Software, with or without new features (hereinafter “Upgrades” or “Updates”), as soon as these are available and have been released for delivery by the Contractor. The point in time for such release shall be determined by the Contractor.
     • Keeping available the programme versions installed at the Principal in their respective current versions to ensure that these may immediately be replaced in case of a destruction or loss of the programme and to be able to track bugs and errors also in programme components that may have been modified for specific users.
   • Not included in the contractual maintenance services to be rendered by the Contractor shall, in particular, be the following:
     • Maintenance services required due to the use of the Software on other hardware or another operating system.
     • Maintenance services required due to Principal’s interference with the Software.
     • Maintenance services in connection with the interoperability of the Software with other computer programmes than those supported by the Software (cf. the current list on the Contractor’s website under https://aquawiki.andagon.com/test_automation.html, subject to clause 25.
     • If Contractor provides services pursuant to clauses 24.2.1, 24.2.2., 24.2.3 due to a wrong error message Contractor shall be free to purchase the services as in clause 29 (Help Desk).
   • For the performance of servicing works pursuant to this agreement, the Contractor shall only deploy personnel that is adequately trained with respect to the computer programme aqua and its applications.
   • Any services beyond the provisions of this agreement, like e.g. the provision of non-included upgrades or further programme components, shall be rendered by the Contractor on the basis of specific agreements and against separate remuneration.
3. Updates and upgrades
   • The provisions of clauses 13, 15, 16, 19 and 20 of the Software Licensing Agreement shall also apply to Updates and Upgrades.
   • Upon download of an Update or Upgrade by the Principal, the rights of use in the respective previous version of the Software granted to the Principal by the Contractor shall expire. If the Principal immediately, but no later than five (5) working days after being informed about the availability of the Update or Upgrade, notifies the Contractor that it does not wish to deploy these, it shall remain entitled to use the previous version subject to clause 5 below, on condition that it restitutes all copies of the Update or Upgrade pursuant to clause 25.3 below.
   • Upon expiry of the rights of use in the respective previous version of the programme pursuant to clause 2 above, the Principal shall be obliged to restitute such respective previous version of the programme to the Contractor. If a new Update or Upgrade is provided, the Principal shall deinstall the old version. A proper restitution shall include the complete and final deletion of all existing copies. The Contractor shall have the right to demand, by a respective written notification, that instead of a restitution the Software is deleted and all existing copies and documentation are destroyed.
   • The Contractor shall synchronise with the Principal the timing of all measures to be carried out in connection with maintenance works, error recovery or the installation of Updates or Upgrades.
   • Subsequent to the publishing of an Update or Upgrade, support shall continue to be available for the last version of the previous Update or Upgrade for a period of 12 months. The Principal shall be obliged to cut over to the new Update or Upgrade within such 12-months period. Should this, for objective reasons, not be acceptable to the Principal, it shall be entitled to terminate the maintenance contract with a notice of 3 months prior to expiry of support for the previous version pursuant to sentence 1 of this clause5.
4. Principal’s obligations to cooperate
   • To support the Contractor in the performance of its services under this agreement, the Principal shall in particular
     • fully support the Contractor with respect to error recovery;
     • not modify the Software or have it modified by third parties without the Contractor’s explicit consent in writing;
     • inform the Contractor immediately of all bugs and errors occurring during the use of the Software, including, where possible, a detailed description of such bugs or errors, upon request provide the Contractor with system error notifications, system protocols, test results, and other means to apt to illustrate the defect, and be available for further information;
     • provide suitable test data upon request of the Contractor should any tests become necessary. This shall not apply if the Principal allows the Contractor to carry out such tests in the system of the Principal or if the Parties agree that the tests are to be carried out by the Principal;
     • notify the Contractor in the text form (e.g. by email) of any changes with respect to the operating system software and other programmes required for the running of the programme (“Environment Software”);
     • notify the Contractor of any changes of the hardware configuration or hardware installation as well as the location in which the programme is installed (“Installation Location”). The Contractor shall be entitled to refuse continuation of maintenance at the new Installation Location for objective reasons.
   • If required, other servicing activities of the IT system of the Principal shall be suspended or discontinued during the period in which the maintenance works are carried out.
   • The Principal shall create the prerequisites for remote servicing of the Software as described on the website of the Contractor under http://aquawiki.andagon.com /remote_support.html.
5. Service Desk
   • The Contractor shall receive the services requested by the Principal under this maintenance agreement (hereinafter “Messages”) via email.
   • The support service shall document all properly submitted Messages in a help desk system and tag them with a ticket.
   • The Contractor shall respond to servicing requests in accordance with the response times stated under clause 28 within the following maintenance times: Monday to Friday from 9. a.m. to 5 p.m., except on public holidays in North Rhine-Westphalia, Carnival Monday, and 24 and 31 December of each year (hereinafter “Maintenance Times”).
6. Error recovery
   • The Contractor undertakes to respond to error notices within the below stated response times and to inform the Principal about the preliminary error analysis and possible workaround steps for emergency relief.

category of error class of error* response time category 1 serious error 12 hours category 2 moderate error 40 hours category 3 slight error no guarantee * the error classes used in this table are defined below in clause 28.3.4.

• The response time commences upon receipt of the error notice by the Contractor. The error notice shall at least include the affected programme component, the entered data, the current Environment Software and the reaction of the Software and has to be submitted in accordance with clause 27. The response time shall only run during Maintenance Times; Messages received outside Maintenance Times shall be deemed received at the beginning of the next maintenance period. The response time shall end upon Contractor’s response to the Principal.
• The classification of errors under the error categories shall be as follows:
  • “Serious error” shall mean that an important functionality of a programme component or the overall system is significantly impaired, so that the essential functionalities or the overall system can only be used exerting undue efforts, or cannot be used at all.
  • “Moderate error” shall mean that the functionality of a programme component is impaired but the overall system may still be used without undue efforts being required in the day-to-day operations to work around the error.
  • “Slight error” shall mean that the error merely affects the layout or does not substantially affect the functionality of a programme component, so that the programme component and the overall system can be used as intended.
  • Should the Contractor and the Principal disagree with respect to the classification of an error, or if in doubt, the error shall be classified under the less serious category.

1. Help desk

User support shall be available at a help desk hotline. Support rendered via the help desk, including the handling of user errors, is always fee-based. The help desk is available Mondays to Fridays from 9 a.m. until 5 p.m. CEST, except for public holidays in North Rhine-Westphalia, Carnival Monday, and 24 and 31 December.

1. Remuneration
   • Remuneration for the maintenance services shall be calculated on a yearly basis commencing at the beginning of the second year after acquisition of the Software (i.e. one year from the date of delivery, i.e. from provision of the link for download), and shall be payable in advance on account. The respective invoices shall be immediately payable in full and without any deductions.
   • The Contractor shall invoice the maintenance remuneration stipulated in the Individual Contract in accordance with the acquired licences. Should the number of acquired licences change, the remuneration for maintenance shall be adjusted accordingly.
   • In the event of a delay in payment of more than three months, the Contractor shall be entitled to terminate the agreement without notice.
2. Term and termination
   • The Individual Contract shall enter into force upon acceptance of the offer by the Principal and the pertaining order confirmation of the Contractor.
   • The Contractor’s obligation to perform maintenance services under this agreement shall commence as from the date stipulated in the Individual Contract (“Commencement of Contract”). Unless otherwise stipulated in the Individual Contract, this agreement shall have a term of 24 months as from Commencement of the Contract. After expiry of such minimum contractual term, the agreement shall automatically be renewed for one year, unless one of the Parties terminates the agreement by giving three months’ notice prior to expiry of the contractual term. Receipt by the respective other Party shall be decisive for the timeliness of the notice of termination.
   • After termination of an Individual Contract Principal can enter into a new contract (late renewal) within 12 months from the date of termination. A late renewal costs 50% more than the list price for software maintenance for the first 12 months. If for over 12 months no valid Contract exists a renewal is not possible.
   • Each of the Parties may terminate the agreement by extraordinary termination for good cause. Good cause shall in particular mean that:

• Performance under the contract becomes legally or factually impossible or economically unreasonable for reasons not attributable to the terminating Party.
• The respective other Party, despite prior warning, fails to fulfil its material contractual obligations within a reasonable deadline. A violation of material contractual obligations shall in particular include a delay in payment on the part of the Principal in the amount of two monthly payments. The right to termination shall continue to exist if only partial payment of the arrears is effected.
• Fulfilment of the obligations under this agreement is jeopardised due to deterioration of the financial situation of the respective other Party. Deterioration of the financial situation shall in particular mean a repeated delayed performance for more than 10 days by the respective other Party, or an unsuccessful enforcement attempt at the respective other Party.
  • All terminations shall require the written form.

• Software as a Service

Where the object of the offer and the order confirmation is the provision of Software under the software as a service model, the stipulations of this clause BIII shall apply.

1. Object of contract
   • Object of the contract is the provision of the Software aqua as described on the Contractor’s website (aqua-cloud.io/) (hereinafter referred to as “Server Software”) under the software as a service model (hereinafter “SaaS Model”). The Contractor shall make the Software available for use by the Principal on data processing systems (servers). The Principal may access the Server Software via the internet and use the functionalities of the Server Software within the scope of this agreement. To this purpose, the Contractor shall provide the Principal with the client software aqua Client (hereinafter “Client Software”).
   • The Client Software shall be made available for download via the internet exclusively in the object code. The Principal shall install the Client Software itself and shall not be entitled to obtain a copy of the source code of the Client Software or any other means of access to the source code.
   • Services for the establishment of interoperability of the Server Software with other programmes than those stated as supported programmes and programme versions on the current list on the Contractor’s website under https://aquawiki.andagon.com/test_automation.html, shall only be rendered under a separate contract to be concluded between the Contractor and the Principal.
2. Point of handover / availability
   • The Contractor shall provide the Principal with the Server Software in accordance with the availability described in Annex SLA (Service Level Agreement and Error Management) at the point of handover; point of handover shall be the external firewall of the Contractor, which is connected to the internet.
   • The Principal shall be responsible to ensure its connectivity to the internet, including required data transmission rates, and to establish the system requirements as described on the Contractor’s website (http://aquawiki.andagon.com/system_requirements.html).
3. Rights of use
   • The Contractor shall grant to the Principal the right to use for its own purposes the Server Software in accordance with the licence model described in the offer for the term of the agreement. The use for own purposes shall permit the use at the companies indicated in the Individual Contract. This shall also extend to any Upgrades or Updates (new versions of the Software with or without new functionalities) made available by the Contractor during the contractual term.
   • The Principal shall not be granted the right to copy or reproduce the Server Software and shall not be entitled to download and/or execute the Server Software operated and made available by the Contractor on its own systems. The Contractor’s Server Software is protected by copyright and all pertaining intellectual property rights, rights of use and other protected rights shall remain with the Contractor.
   • The Contractor warrants that the Software is free of any third-party rights that would restrict or exclude its contractually agreed use. Should the contractual use of the Software be affected by third-party industrial property rights, the Contractor shall be entitled, on a scale acceptable to the Principal, to either modify the Software in such a way that it no longer falls under the protection of such rights while at the same time preserving its essential usage functions, or to obtain authorisation that the Software may be used without restrictions pursuant to the contract and without any additional costs for the Principal.. Should the contractual use of the Software, for reasons not attributable to the Contractor, be affected by third-party industrial property rights, the Contractor shall be entitled to refuse performance of the affected services. In such case, the Contractor shall immediately notify the Principal accordingly and provide it with adequate access to its data; the Principal shall be exempt from respective payment obligations. All other rights and obligations of the Principal shall remain unaffected.
   • The Principal shall not be entitled to grant any third parties access to the Software.
   • The Principal shall be entitled to print out and copy the user documentation mentioned in clause 1 in accordance with clause 14.1. Any forwarding to third parties outside the Principal’s business (pursuant to clause 14.1 sentence 1) shall not be permissible.
   • The access to the download of the Client Software made available to the Principal must be protected against unauthorised third-party access. The Principal shall instruct its employees to comply with the provisions of this agreement.
   • The removal of serial numbers, copyright notices or other programme identification features from the Client Software is not permissible. The same applies with respect to the suppression of the on-screen display of such features.
4. Further obligations of the Principal
   • The Principal shall fulfil all of its obligations in connection with the performance under this agreement and its implementation. In particular, the Principal shall
     • take appropriate precautions to protect the Server Software and the access to the server download against unauthorised third-party access. To this purpose, it shall store the login data entrusted to it and administrated by it in a secure location and instruct its employees and other dependent persons entitled to use the Server Software accordingly. In the event the Principal reasonably suspects that its identification codes have been obtained by unauthorised third parties or are being improperly used by them, it shall immediately notify the Contractor thereof.
     • comply with all applicable legal and statutory provisions when using the Server Software. In particular, the Principal shall be prohibited to store, transmit or otherwise publish any content that infringes statutory provisions, especially in connection with industrial property rights or intellectual property rights of third parties.
     • test the Software for viruses prior to using it for the processing of data and implement state-of-the-art anti-virus programmes.
     • in accordance with Annex SLA (Service Level Agreement) immediately report any errors or bugs concerning the contractual services, state the circumstances in which such error or defect occurs, and actively support the Contractor in the troubleshooting.
   • Should a third party assert any claims vis-à-vis the Contractor in connection with the violation of the Principal’s obligations under this agreement, the Principal shall hold the Contractor harmless from such claims and shall at its own cost endeavour to ward off such claims. The Contractor shall immediately notify the Principal of the assertion of any claims and provide it with all necessary information to ward off such claims.
   • Access to the Software via a registered point of access shall be restricted to the respective registered user. Access by more than one user shall not be permissible.
   • Should the Principal violate a material duty under this agreement, the Contractor shall be entitled to temporarily discontinue its services, i.e. it may block access to the Software and the data. Access shall only be restored once the violation of the respective duty has been permanently remediated. The Principal shall remain obliged to pay the agreed remuneration.
5. Claims for defects
   • The Contractor warrants that for the duration of the contractual term the Server Software is provided in the quality agreed pursuant to this agreement including its annexes, and that availability in accordance with Annex SLA (Service Level Agreement) is ensured.
   • The provisions of this clause 2 shall exclusively apply to a shortfall in the warranted availability. In the event of a shortfall in the warranted availability the Principal shall be entitled to reduce remuneration by the percentages stated in clause 2 of Annex SLA (Service Level Agreement).
   • For all defects of the contractual services that do not concern a defect of availability, (“Other Defects”) the Contractor shall be liable pursuant to clauses 4 to 36.8.
   • The Contractor shall be obliged to remedy all Other Defects after receipt of a notice of defect within a reasonable deadline. In principle, only reproducible defects shall be deemed remediable. A warranty in connection with defective third-party software licensed by the Contractor for use by the Principal shall be excluded to the extent the defect may not be removed by procurement and installation of commonly available upgrades, updates and service packs or by way of service calls.
   • If, for reasons attributable to the Contractor, a defect is not successfully remedied within a reasonable deadline fixed by the Principal, the Principal shall be entitled to reduce the agreed remuneration by an adequate amount. The right to reduction shall be limited to the amount of the monthly remuneration apportioned to the defective part of performance.
   • The Principal shall cooperate free of charge in the remediation of Other Defects and shall, in particular, provide all required documents, data, etc. that the Contractor needs for purposes of analysis and remediation of the defect.
   • The Principal shall be obliged to immediately notify the Contractor of all defects in the Software as well as all errors and bugs occurring during the use of the Software as described in clause 3 of Annex SLA. To the extent the Contractor is unable to fulfil its performance obligations due to lacking or delayed cooperation by the Principal, the Contractor shall be released from its performance obligations.
   • The right to rescind from the contract on the continuous use of the Software for reasons of defects shall be excluded. The right to termination for good cause shall remain unaffected.
6. Remuneration, terms of payment, delay of payment
   • The Principal shall pay in advance for each calendar year the agreed remuneration according to the respective usage model agreed under an Individual Contract (12 x monthly base price). Should a contract be terminated in the course of a calendar year, the respective partial amount of the yearly remuneration shall be reimbursed to the Principal. Should a contract commence in the course of a calendar year, the respective partial remuneration amount shall be paid in advance by the Principal.
   • The Contractor shall be entitled to increase its remuneration in correspondence with the increase of its own costs; the increase of remuneration may, however, not exceed the increase in the German consumer price index. The Contractor shall notify the Principal of any price adjustments at least three months prior to their taking effect.
   • Should the Principal not fulfil its agreed payment obligations, the Contractor shall be entitled to refuse performance; e.g., in case of a significant delay in payment it may block the Principal’s access to the Software for the default period. The Principal shall remain obliged to pay the agreed remuneration.
7. Data protection and data security
   • The Contractor and the Principal shall comply with all applicable provisions of data protection laws and bind the employees deployed by them in connection with the agreement and its implementation to data secrecy pursuant to Sec. 5 Federal Data Protection Act (BDSG), to the extent these are not already bound to secrecy pursuant to generally existing provisions.
   • With respect to the collection, processing and use of personal data by means of the Software provided to it by the Contractor under this agreement, the Principal shall be the solely responsible data controller within the meaning of the BDSG and warrants that it is entitled thereto. The Principal shall hold the Contractor harmless from and against all third-party claims pursuant to clause 2.
   • If the Principal cannot exclude the possibility that the Contractor might get access to personal data within the scope of the performance of its services, it shall work towards the conclusion of a data processing agreement (Sec. 11 BDSG) with the Contractor pursuant to clause C of this Agreement.
   • The Contractor will use personal data of the Principal to administrate the use of the Software, to perform its services, for billing purposes and for the prevention of technical defects. For these purposes, the Contractor shall, in addition to personal data, also collect data like e.g. IP address, date, time, type of browser and accesses web pages.
   • The Principal shall ensure that regular backups of its data are carried out and that its computers are equipped with state-of-the-art security protection.
8. Term, termination and exit management
   • The agreement shall enter into force upon signing by the Parties. The minimum lease period for the Software under the SaaS model shall be twelve (12) months and shall commence on the date of deployment of the Software in operative condition.
   • The contractual relationship may be terminated by both Parties upon expiry of the contract with a notice period of three (3) calendar months. If not terminated, the contractual period shall automatically be extended by twelve (12) months on each occasion.
   • Each Party shall be entitled to extraordinary termination of the agreement for good cause. Important cause shall in particular mean that:

• Performance under the contract becomes legally or factually impossible or economically unreasonable for reasons not attributable to the terminating Party.
• The respective other Party, despite prior warning, fails to fulfil its material contractual obligations within a reasonable deadline. A violation of material contractual obligations shall in particular include a delay in payment on the part of the Principal in the amount of two monthly payments. The right to termination shall continue to exist if only partial payment of the arrears is effected.
• Fulfilment of the obligations under this agreement is jeopardised due to deterioration of the financial situation of the respective other Party. Deterioration of the financial situation shall in particular mean a repeated delayed performance for more than 10 days by the respective other Party, or an unsuccessful enforcement attempt at the respective other Party.
  • Should the Principal be in default of payment pursuant to clause 3(b), the Contractor shall be entitled to claim damages in form of an immediately payable lump-sum in the amount of one quarter of the remaining monthly prices up to the end of the ordinary contractual term, unless the Contractor is able to prove higher damages or the Principal is able to prove lower damages. The Contractor’s right to assert further claims for delayed payments shall be reserved.
  • All terminations shall require the written form.
  • The Parties undertake to immediately restitute to the respective other Party (or if requested delete) upon that Party’s request all documents and documentation, records or concepts made available to them in the course of the contractual term upon termination of the agreement.
  • Upon termination of the licensing relationship, irrespective of the reason thereof
• all of the Principal’s rights of use in the Software shall expire. All rights granted by the Contractor to the Principal according to the usage provisions hereunder shall automatically revert to the Contractor,
• the Principal shall be obliged to delete all access data and any printouts of pertaining documentation. The Contractor shall be entitled to request a respective affidavit.
  • In case of ordinary termination, the Principal shall, prior to expiry of the licensing relationship, delete and store elsewhere all contents and files previously stored by it. The Contractor shall, at its own cost, be entitled to instruct the Principal to keep data available beyond the foregoing.
  • In case of extraordinary termination, the Contractor’s data shall, after termination of the licensing relationship, be stored for a period of 30 days in such a way that the Principal may download its data and store it elsewhere. Upon expiry of such 30-day period, the Principal’s data shall be deleted, unless the Principal, at its own cost, instructs the Contractor to keep its data stored beyond such period.

1. Amendments

The Contractor shall be entitled to amend the services agreed hereunder, in particular if any changes in the services of involved third parties occur. Any amendments of this agreement shall be deemed accepted by the Principal, if the Principal does not object to such amendment within a period of 6 weeks from receipt of a respective notification in the text form. At the commencement of such period, the Contractor shall explicitly inform the Principal about the intent of its conduct. Any amendments to this agreement shall only be deemed accepted by the Principal, if the Contractor has provided it with such information. If the Principal objects to the envisaged amendment in due time, the Contractors shall be entitled to ordinary termination of the agreement to the earliest permissible date or to the date of cutover if a continuation of the previous system is not feasible.

1. Modification and compiling
   • Any reconstruction by the Principal of the various development stages of the Client Software, including a programme modification, shall be prohibited; this shall in particular apply to a reconstruction of the provided programme code into another code form (decompiling).
   • The removal of copy protections or similar protective mechanisms is not permissible.
   • The removal of any copyright notices, serial numbers, copyright notices or other programme identification features is not permissible. The same applies with respect to the suppression of the on-screen display of such features.

1. Data Protection Provisions

With respect to personal data being processed by the Contractor for the Principal as the data controller, the Principal and the Contractor conclude the following data processor agreement pursuant to Sec. 11 BDSG. In case of contradictions with other parts of this Framework Agreement or an Individual Contract, the provisions of this clause C shall prevail.

1. Object and term of contract
   • Object of the order is the provision of the Software under the software as a service model as described on the Contractor’s website (aqua-cloud.io/).
   • The term of the order shall correspond to the term of the performance agreement.
2. Order details
   • The details with respect to scope, manner and purpose of the collection, processing and/or use of personal data by the Contractor for the Principal are described in the performance agreement.
   • The processing and use of the data shall take place on the territory of the Federal Republic of German. The Contractor shall notify the Principal prior to any transfer to another country and shall, in case of a transfer to a third country outside the European Economic Area, ensure that the special requirements of Secs. 4b, 4c BDSG are fulfilled.
   • The type of personal data to be used is described in detail in the performance agreement. Object of the collection, processing and/or use are the Principal’s personnel data, to the extent required for purposes of software quality assurance (in particular test management, error management, and project management).
   • Data subjects pursuant to this order are the Principal’s employees having a licenced user account for the software.
3. Technical and organisational measures
   • Prior to carrying out any data processing, the Contractor shall document the implementation of the technical and organisational measures stipulated prior to awarding of the contract, in particular with respect to specific performances under the contract, and submit such documentation to the Principal for inspection. If accepted by the Principal, the documented measures shall become the basis for the order. If the inspection or audit reveals a need for adjustments, these shall be mutually agreed between the Parties and implemented accordingly.
   • Generally, the measures to be implemented relate to organisational control, access control (Zutrittskontrolle[1], Zugangskontrolle[2], Zugriffskontrolle[3]), transmission control, job control, availability control, and separation control (cf. Annex TOM). Specific measures to be implemented under Individual Contracts shall be stipulated in the respective offer.
   • The technical and organisational measures are subject to technical progress and technical developments. The Contractor shall be entitled to implement adequate alternative measures, which must, however, meet the security level of the originally stipulated measures. Significant changes must be documented. Upon Principal’s request, the Contractor shall provide the information pursuant to Sec. 4g para. 2 sentence 1 BDSG.
4. Correction, blocking and deletion of data

The data processed by the Contractor under the data processing agreement shall only be corrected, deleted or blocked upon Principal’s instruction. The Contractor shall immediately forward to the Principal any requests by data subjects to correct or delete their data.

1. Monitoring and other obligations of the Principal

In addition to compliance with the provisions of this order, the Contractor shall have the following obligations pursuant to Sec. 11 para. 4 BDSG:

• Appointment in writing – to the extent required by law – of a data protection officer, who shall perform its tasks pursuant to Secs. 4f, 4g BDSG.
• Compliance with data secrecy pursuant to Sec. 5 BDSG. All persons entitled to access the Principal’s personal data shall be bound to data secrecy and shall be instructed with respect to any special data protection obligations in connection with this order as well as any issues subject to directives or specific purposes.
• Implementation of and compliance with all technical and organisational measures pursuant to Sec. 9 BDSG required under this order.
• Immediate notification of the Principal with respect to any monitoring activities and measures carried out by data protection authorities pursuant to Sec. 38 BDSG. This shall also apply to an investigation of the Principal by a competent authority pursuant to Secs. 43, 44 BDSG.
• Order supervision by means of regular controls with respect to contractual performance, in particular compliance with and, where necessary, adjustment of stipulations and measures required for performance under the contract.
• Verifiability of implemented technical and organisational measures vis-à-vis the Principal. To this purpose, the Contractor may also submit up-to-date certificates, reports or excerpts of reports by independent institutions (e.g. auditor, controller, data protection officer, IT security department, data protection auditor, quality auditor) or an appropriate certification in the form of an IT security audit or a data protection audit (e.g. baseline security according to the Federal Office for Information Security (BSI)).

1. Subcontracting
   • The commissioning of subcontractors in connection with the processing or use of Principal’s personal data shall be permissible to the extent
     • the Principal has been notified of such commissioning and has not immediately objected. An objection shall be made in writing and may only be based on important data protection reasons.
     • the Contractor drafts the contractual provisions of the subcontract in correspondence to the data protection provisions under the contractual relationship between Principal and Contractor.
     • the Principal is granted monitoring and inspection rights vis-à-vis the subcontractor pursuant to this agreement and Sec. 11 BDSG in connection with no. 6 of the Annex to Sec. 9 BDSG. This shall also include the Principal’s right to obtain, upon its written request, information from the Contractor on the essential content of the contract and the inclusion of relevant data protection obligations therein; if required, the Principal shall also have to right to inspect the respective contractual documents.
   • Incidental third-party services solicited by the Contractor in support of its performance under the order shall not constitute a subcontracting relationship pursuant to this provision. Such services include, e.g., telecommunications services, maintenance and user services, cleaning services, disposal of data carriers. To warrant the protection and security of the Principal’s data also in connection with third-party incidental services the Contractor shall, however, be obliged to draft adequate contractual provisions in compliance with statutory regulations and to implement respective monitoring measures.
2. Monitoring rights of the Principal
   • The Principal shall be entitled to exert itself or in individual cases instruct an auditor to exert on its behalf the order supervision with respect to the Contractors conduct pursuant to no. 6 of the Annex to Sec. 9 BDSG. It shall be entitled to verify compliance with this agreement by carrying out random controls at the Contractor’s premises, after a timely notification of the Contractor in advance. The Contractor undertakes to provide the Principal with all requested information required to fulfil its supervision obligations and to make available to it all related documentation.
   • With respect to the monitoring obligations of the Principal prior to commencement of the data processing and during the term of the order pursuant to Sec. 11 para. 2 sentence 4 BDSG, the Contractor shall ensure that the Principal is given the opportunity to verify compliance with the agreed technical and organisational measures. To this purpose, the Contractor shall, pursuant to Sec. 9 BDSG including Annexes, upon the Principal’s request provide proof that the technical and organisational measures have been implemented. Proof for the implementation of the respective measures – which are not limited to the individual order – may also be provided by submission of an up-to-date certificate, report or excerpt of a report by an independent institution (e.g. auditor, controller, data protection officer, IT security department, data protection auditor, quality auditor) or an appropriate certification in the form of an IT security audit or a data protection audit (e.g. baseline security according to the Federal Office for Information Security (BSI)).
3. Notification in case of infringements by the Contractor
   • The Contractor shall notify the Principal of all instances of infringement by the Contractor or its employees of the regulations on the protection of the Principal’s personal data or of the order stipulations.
   • The Parties are aware that information obligations may exist pursuant to Sec. 42a BDSG in case of loss or unauthorised transfer or knowledge of personal data. The Principal shall therefore immediately be notified of any similar occurrences, irrespective of its causes. This shall also apply with respect to serious operational disruptions, suspected other violations of data protection regulations, or other irregularities in the handling of the Principal’s personal data. In its conduct vis-à-vis the Principal, the Contractor shall implement adequate measures to secure the data and to minimise possible adverse consequences for the data subjects. The Contractor shall support the Principal in the fulfilment of any of its obligations pursuant to Sec. 42a BDSG.
4. Principal’s right to issue instructions
   • The data shall solely be used within the scope of the agreed provisions and in accordance with the Principal’s instructions (cf. Sec. 11 para. 3 sentence 1 BDSG). Within the scope of the order description under this agreement, the Principal reserves the right to issue comprehensive instructions regarding the type, scope and techniques of data processing, and to issue specific directives in individual cases. Any changes in the object or technique of processing shall be mutually agreed and documented accordingly. The Principal shall reimburse to the Contractor any costs incurred by the Contractor as a consequence of the Principal’s instructions. Any information provided by the Contractor to third parties or data subjects shall require the prior written consent of the Principal.
   • The Principal shall immediately confirm in writing or via email (in text form) any orally issued instructions. The Contractor is not permitted to use the data for any other purposes and shall in particular not be permitted to transfer the data to any third party. The Contractor shall not be entitled to make any copies or duplicates without the Principal’s knowledge, with the exception of backups required to ensure proper data processing and storage in compliance with statutory data retention obligations.
   • The Contractor shall immediately notify the Principal in accordance with Sec. 11 para. 3 sentence 2 BDSG if it deems that an instruction of the Principal infringes data protection regulations. The Contractor shall be entitled to suspend implementation of the respective instruction until it is either confirmed or amended by Principal’s responsible officer.
5. Deletion of data and restitution of data carriers
   • Upon termination of the contractual works or earlier if so requested by the Principal, but no later than upon termination of the performance agreement, the Contractor shall hand over to the Principal any and all documents provided to it, all processing and usage results produced by it, as well as data pools connected to the order relationship and concerning personal data, or destroy the foregoing with the approval of the Principal and in accordance with data protection regulations.
   • The Principal shall retain documentation evidencing that data processing was handled properly and in compliance with the order beyond termination of the contract according to the respective statutory retention periods.
6. Annexes

• Annex TOM: Technical and Organisational Measures
• Annex Performance Description Software as a Service Model
• Annex SLA: Service Level Agreement
• Annex TOM: Technical and Organisational Measures SaaS

Annex TOM
Technical and Organisational MeasuresThe following gives a detailed description of the measures regarding the implementation and observance of the provisions of Sec. 9 BDSG and the Annex to Sec. 9 BDSG.

1. Access control – unauthorised access

It shall be prevented that unauthorised persons gain access to data processing systems with which personal data are processed or used. To this purpose, the Contractor has implemented the following measures:

• chip card controlled / transponder controlled locking system
• identity check at entrance
• naming and listing of authorised persons

1. Access control – unauthorised use

It shall be prevented that data processing systems are being used without authorisation. To this purpose, the Contractor has implemented the following measures:

• assignment of user rights
• allocation of passwords
• authentication by user name / password
• implementation of anti-virus software
• implementation of a hardware firewall
• creation of user profiles
• implementation of VPN technology

1. Access control – unauthorised actions

It shall be ensured that persons authorised to use a data processing system only perform such actions they are entitled to perform in accordance with the authorisation granted to them, and that personal data cannot be read, copied, modified or removed without authorisation. To this purpose, the Contractor has implemented the following measures:

• authorisation concept
• minimisation of the number of administrators
• recording of access to applications, in particular with respect to the entering, modification and deletion of data
• use of file shredders and/or respective service providers
• administration of rights by system administrator
• password directives, including length and changes of passwords

1. Transmission control

It shall be ensured that personal data cannot be read, copied, modified or removed without authorisation during electronic transmission or transport or storage to data carriers and that it is possible to check and establish the target location of personal data being transferred by means of data transmission facilities. The Contractor has implemented the following measures with respect to transmission control:

• use of VNP tunnels
• transfer only via encrypted channels (https)

1. Input control

It shall be ensured that it is possible to check and establish whether and by whom personal data have been entered into, modified or removed from processing systems. The Contractor has implemented the following measures with respect to input control:

• recording of data input, modification and deletion
• traceability of data input, modification and deletion by allocation of individual user names
• assignment of rights to enter, modify or delete data on the basis of an authorisation concept

1. Job control

It shall be ensured that where data are being processed within the scope of a data processor agreement, such data are processed strictly in accordance with the Principal’s instructions. The Contractor has implemented the following measures with respect to job control:

Careful selection of data processor (in particular with view to data security)

1. Availability control

It shall be ensured that personal data are protected against accidental destruction or loss. The Contractor has implemented the following measures with respect to availability control:

• uninterrupted power supply (USV)
• devices monitoring the temperature and humidity in the server rooms
• fire and smoke detectors
• air conditioning in the server rooms
• protected multiple outlet strips in the server rooms
• backup- and recovery concepts
• no sanitary installations above the server rooms

1. Separation requirement

It shall be ensured that data collect for different purposes can be processed separately. To this purpose, the Contractor has implemented the following measures:

• authorisation concept
• stipulation of rights with respect to databases
• logical separation of clients (software-based)
• separation of productive system and testing system

Annex Performance Description Software as a Service model

1. Functionalities of the Software

The quality assurance suite aqua is designed to support the planning, implementation and quality assurance of IT- and software projects.

The suite includes the following modules and functionalities:

• Requirement management: Administration of requirements, hierarchic organisation, connection to further objects; creation of flowcharts for each requirement via the integrated UML Editor.
• Error management: Registration and administration of errors and bugs.
• Test case administration: Registration, administration and execution of test cases. Automatic generation of test cases from valid UML flowcharts.
• Project planner: Generation of project plans, including existing requirements, errors, or test cases.
• Email messenger: Information of users on changed requirements, errors, test cases and test scenarios via automatically generated emails.
• Traceability: Creation of relations between requirements, errors, test cases and test scenarios, graphic representation of these relations and use for navigation.
• Reporting: Generation of configurable reports on the requirements, errors, test cases and test scenarios of the project.
• Dashboards: Visualisation of project information via pie charts, bar charts, or tables.
• User administration: Creation of users, user allocation to projects, access restrictions for users.
• Project configuration: Configuration of graphic surfaces and administrated arrays of the requirements, errors, test cases and test scenarios of each project.
• Export & import: Export of requirements, errors, test cases and test scenarios to format .XLS.
• Export & import: Import of requirements, errors, test cases and test scenarios from .XLS format.
• Views: Definition of views on lists of requirements, errors, test cases and test scenarios.

1. Rights of access

Pursuant to clause 32.1 of the Framework Agreement, the Contractor shall provide the Principal with the client software aqua Client. The Principal shall receive the access data and the address of the aqua server for login to the Software on the date of provision.

The Principal shall be entitled to use the Software pursuant to clause 34 of the Framework Agreement. It shall name an administrator responsible for the administration of the aqua users. If provided for accordingly in the usage model of the Individual Contract, the Principal itself shall be entitled to create new aqua users. Furthermore, the Principal shall be responsible for the activation and deactivation of aqua users. If an aqua user is deactivated, it may no longer log in to the Software. The user’s data will not be affected by the deactivation.

1. Data security

Several measures are implemented to ensure secure operations and that the data created via the aqua quality suite and secure operations are protected as comprehensively as possible. The following data security concept of the Contractor exists independently of Principal’s obligation to regularly secure its data (clause 38.5 of the Framework Agreement).

• Data security concept
  • Type and scope of the data to be secured

Backups shall be created for the data administrated via aqua as well as the data required for the operation of the aqua server.

• Securing of Principal’s data

Backups shall be created of the data base on which the aqua system is operated. Such data base comprises all usage data generated via aqua. This includes all elements imported or created by the Principal (requirements, errors test cases, test scenarios, and scripts) as well as reports, user accounts, filter and test runs.

Automated backups of the data base shall be created on a daily basis. Regular controls shall verify the success of such backups.

The backups of the data bank shall be retained for at least five (5) days to be able to restore a certain backup if required.

• Securing of the Software and configuration

The second component of the backup comprises the basic aqua configuration as well as all files pertaining to the aqua installation. These shall, like the data base, be

A backup of the configuration and these files shall be created each night and be retained in the processing history of the past five (5) days. Regular controls shall verify the success of the backups.

• Backup security

Each of the backup components shall be stored in a server-independent location. An additional backup at an external location may be created against extra charge.

• Online and offline times

The backup of the data base and the aqua configuration files can be created during operations with no risk to availability.

• Deletion date of backups

After expiry of the retention period (5 days) the data shall automatically be overwritten. If required, an additional deletion may be effected via Support.

• NDA/access

Our Support will at all times have access to the operating system and the basic aqua configuration files.

An access to the data base is technically feasible, but shall be subject to secrecy pursuant to clause 9 of the Framework Agreement. In general, data shall only be accessed if this is required to resolve support issues and if the Principal has given its approval.

Upon request, the backups of the database may be encrypted to ensure that even in case of theft the data base cannot be accessed.

• Archiving duties

Archiving duties, e.g. long-term backups pursuant to commercial or tax provisions, shall not be included in the contractual scope of performance and shall, where applicable, fall under the Principal’s responsibility.

Annex SLA
Service Level Agreement

1. Availability of the Server Software
   • The Contractor shall provide to the Principal the Server Software at an average monthly availability of 99%.
   • Availability shall not be deemed limited, if it is impaired due to

• malfunctions of customer-owned systems connected to the SaaS system,
• scheduled maintenance works. Scheduled maintenance works shall be notified at least 72 hours in advance. In case of urgent maintenance works – in particular due to security-related defects – shorter notification periods may apply.
• non-scheduled maintenance periods not attributable to a culpable violation of andagon’s legal obligations. A non-scheduled maintenance period shall be the time in which maintenance works are carried out that are required to guarantee proper functioning of the Software and the server or that become necessary due to current security gaps that impair or could impair the andagon services, and which have to be carried out without delay. andagon shall use its best efforts to minimise the necessity of such non-scheduled maintenance works by means of regular maintenance and care.
  • The Principal shall be responsible to ensure its connectivity to the internet, including required data transmission rates. Point of handover of the Software shall be the Contractor’s external firewall, which is connected to the internet. The Principal shall be responsible to establish the system requirements as described in clause 8.
  • Reference period for the scheduled availability shall be a calendar month. Availability of the SaaS system shall be measured by means of a regular call-up of a self-test from an external monitoring system, to which the SaaS system must respond within a specified period of time with a specified message. Upon Principal’s request, the Contractor shall make available to it the respective test reports.
  • The Principal shall be notified via email or telephone of any envisaged unavailability due to maintenance works. The Contractor shall at all times endeavour to avoid unavailability. The Principal shall not unreasonably withhold its consent if important reasons exist.

1. Reduction and damages
   • Should the agreed scheduled availability pursuant to clause 1 not be achieved in a given month, the Principal shall be entitled to reduce the agreed remuneration for the respective month as follows:

• 5% for availability of less than 99% and up to 98.5%;
• 10% for availability of less than 98.5% and up to 98%;
• 25% for availability of less than 98% and up to 95%.

Should availability be less than 95% in a given month, the resulting diminished serviceability of the Server Software shall be evaluated in the individual case and the agreed remuneration shall be reduced proportionally.

• In case of immaterial defects pursuant to the error classes 2 and 3 as described in clauses 1 and 4.3 a reduction shall be excluded.
• If the Contractor culpably violates the agreed Service Level, the Principal shall be entitled to claim compensation for any resulting verifiable damage.

1. Error reporting

It shall be the Principal’s responsibility to immediately notify the Contractor of any shortfall with respect to the scheduled availability. The Contractor shall accept the respective error notices by email or telephone:

• telephone: +49 (0)221 – 474410120
• email: aqua-support@andagon.com
  • Error notices regarding other defects shall be received by email (aqua-support@andagon.com). All properly submitted notices shall be documented in a help desk system together with the complete processing history and tagged with a ticket.
  • The Contractor shall respond to servicing requests in accordance with the response times stated under clause 1 within the following maintenance times: Monday to Friday from 9. a.m. to 5 p.m., except on public holidays in North Rhine-Westphalia, Carnival Monday, and 24 and 31 December of each year (hereinafter “Maintenance Times”).

1. Error recovery
   • The Contractor undertakes to respond to error notices within the below stated response times and to inform the Principal about the preliminary error analysis and possible workaround steps for emergency relief.

category of error class of error* response time category 1 serious error 12 hours category 2 moderate error 40 hours category 3 slight error no guarantee * the error classes used in this table are defined below in clause 4.3.

• The response time commences upon receipt of the error notice by the Contractor. The error notice shall at least include the affected programme component, the entered data, the current Environment Software and the reaction of the Software and has to be submitted in accordance with clause 3. The response time shall only run during Maintenance Times; Messages received outside Maintenance Times shall be deemed received at the beginning of the next maintenance period. The response time shall end upon Contractor’s response to the Principal.
• The classification of errors under the error categories shall be as follows:
  • “Serious error” shall mean that an important functionality of a programme component or the overall system is significantly impaired, so that the essential functionalities or the overall system can only be used exerting undue efforts, or cannot be used at all.
  • “Moderate error” shall mean that the functionality of a programme component is impaired but the overall system may still be used without undue efforts being required in the day-to-day operations to work around the error.
  • “Slight error” shall mean that the error merely affects the layout or does not substantially affect the functionality of a programme component, so that the programme component and the overall system can be used as intended.
  • Should the Contractor and the Principal disagree with respect to the classification of an error, or if in doubt, the error shall be classified under the less serious category.
• The Principal shall name two contact persons through whom all errors and bugs shall be reported to the Contractor. Error notices shall exclusively and immediately be submitted by these members of the Principal’s inhouse support. They shall describe the occurred error or bugs as precisely as possible and shall, upon request of the Contractor and within the scope of the given operational, technical and personnel capabilities, provide the Principal with respective system error notifications, test results and other documentation apt to illustrate the defect, and be available for further information.

1. Help desk

User support shall be available at a help desk hotline (+49 (0)221 – 474410190). Support rendered via the help desk, including the handling of user errors, is always fee-based. EUR 32.50 shall be payable for each commenced quarter of an hour. The help desk is available Mondays to Fridays from 9 a.m. until 5 p.m., except for public holidays in North Rhine-Westphalia, Carnival Monday, and 24 and 31 December.

Incurred help desk fees shall be invoiced on a monthly basis. The respective invoice shall include a statement of services rendered.

1. Limitation of support
   • The Contractor shall not be responsible for support services in connection with the recovery of errors pursuant to this Annex that are not attributable to malfunctions of the Software, e.g.

• disruptions in the system of the Principal or of a third party with adverse effects on the Software, e.g. unavailability or too long response times of servers that provide contents to be processed via the Software;
• disruptions in the network infrastructure of the internet;
• user errors on the part of the Principal.
  • If Contractor provides services pursuant to clause 6.1 due to a wrong error message Contractor shall be free to purchase the services as in clause 5 (Help Desk).

1. Principal’s responsibilities and duties to cooperate
   • The Principal shall be obliged to make the contents of this Service Level Agreement known to all persons involved within its business and shall ensure compliance with its provisions, in particular with respect to proper error notices.
   • Furthermore, the Principal shall immediately notify the Contractor of any changes or modifications that have or might have an impact on the Contractor’s performance under this Service Level Agreement.
   • The Principal shall fully support the Contractor with respect to error recovery.
2. Customer requirements for performance of services
   • Network requirements

Access to the Server Software is effected via the internet. Prerequisite for the use of the Server Software is an error-free connectivity of the protocols TCP/IP as well as http and https to the aqua Server. The Principal shall be responsible to ensure its connectivity to the internet, including required data transmission rates

• Client Software aqua Client

The installation and operation of aqua Client requires the system prerequisites described on the Contractor’s website (http://aquawiki.andagon.com/system_requirements.html ).

Annex TOM
Technical and Organisational Measures for SaaS

The following gives a detailed description of the measures regarding the implementation and observance of the provisions of Sec. 9 BDSG and the Annex to Sec. 9 BDSG.

1. Access control – unauthorised access

It shall be prevented that unauthorised persons gain access to data processing systems with which personal data are processed or used. To this purpose, the Contractor has implemented the following measures:

• Measures implemented at andagon

• chip card controlled / transponder controlled locking system
• identity check at entrance
• naming and listing of authorised persons
  • Measures implemented at datacentre
• establishment of security zones
• implementation of effective access protection
• naming and listing of authorised persons
• access protocols
• administration and documentation of personalised access authorisations for life
• escorting of visitors and external personnel
• surveillance of facilities outside hours of operation

1. Access control – unauthorised use

It shall be prevented that data processing systems are being used without authorisation. To this purpose, the Contractor has implemented the following measures:

• Measures implemented at andagon

• assignment of user rights
• allocation of passwords
• authentication by user name / password
• implementation of anti-virus software
• implementation of a hardware firewall
• creation of user profiles
• implementation of VPN technology
  • Measures implemented at datacentre
• stipulation of required protection
• stipulation of authorised persons
• access protection (authentication)
• implementation of secure access procedures, strong or simple authentication according to required protection
• access protocols
• secure transmission of authentication secrets (credentials) within the network
• administration and documentation of personalised authentication mediums and access authorisation
• automatic or manual access barrier
• data encryption on laptops

1. Access control – unauthorised actions

It shall be ensured that persons authorised to use a data processing system only perform such actions they are entitled to perform in accordance with the authorisation granted to them, and that personal data cannot be read, copied, modified or removed without authorisation. To this purpose, the Contractor has implemented the following measures:

• Measures implemented at andagon

• authorisation concept
• minimisation of the number of administrators
• recording of access to applications, in particular with respect to the entering, modification and deletion of data
• use of file shredders and/or respective service providers
• administration of rights by system administrator
• password directives, including length and changes of passwords
  • Measures implemented at datacentre
• authorisation concepts
• application of access restrictions
• allocation of minimal authorisations
• administration and documentation of personalised access authorisations
• avoid aggregation of functions

1. Transmission control

It shall be ensured that personal data cannot be read, copied, modified or removed without authorisation during electronic transmission or transport or storage to data carriers and that it is possible to check and establish the target location of personal data being transferred by means of data transmission facilities. The Contractor has implemented the following measures with respect to transmission control:

• Measures implemented at andagon

• use of VNP tunnels
• transfer only via encrypted channels (https)
  • Measures implemented at datacentre
• stipulation of entities/persons authorised to receive/transmit data
• review permissibility of transfer to foreign countries
• secure data transfer between server and client
• risk minimisation by net separation
• implementation of security gateways at network transfer points
• hardening of backend systems
• description of all interfaces and the transferred personal data arrays
• realisation of a machine-to-machine authentication
• secure storage of data, including backups
• procedures for collection and disposal
• introduction of deletion and destruction procedures in compliance with data protection maxims
• deletion protocols

1. Input control

It shall be ensured that it is possible to check and establish whether and by whom personal data have been entered into, modified or removed from processing systems. The Contractor has implemented the following measures with respect to input control:

• Measures implemented at andagon

• recording of data input, modification and deletion
• traceability of data input, modification and deletion by allocation of individual user names
• assignment of rights to enter, modify or delete data on the basis of an authorisation concept
  • Measures implemented at data centre
• recording of data input
• documentation of input authorisations

1. Job control

It shall be ensured that where data are being processed within the scope of a data processor agreement, such data are processed strictly in accordance with the Principal’s instructions. The Contractor has implemented the following measures with respect to job control:

• Measures implemented at andagon

Careful selection of data processor (in particular with view to data security)

• Measures implemented at datacentre

• conclusion of data processing agreement
• recording of contractual performances by Contractor

1. Availability control

It shall be ensured that personal data are protected against accidental destruction or loss. The Contractor has implemented the following measures with respect to availability control:

• Measures implemented at andagon

• uninterrupted power supply (USV)
• devices monitoring the temperature and humidity in the server rooms
• fire and smoke detectors
• air conditioning in the server rooms
• protected multiple outlet strips in the server rooms
• backup- and recovery concepts
• no sanitary installations above the server rooms
  • Measures implemented at datacentre
• existence and implementation of a concept regarding regular backups
• existence and regular checks of emergency power aggregates and overvoltage protection devices
• monitoring of operational parameters of datacentres
• existence of an emergency concept
• regulations on onset of crisis and emergency management

1. Separation requirement

It shall be ensured that data collect for different purposes can be processed separately. To this purpose, the Contractor has implemented the following measures:

• Measures implemented at andagon

• authorisation concept
• stipulation of rights with respect to databases
• logical separation of clients (software-based)
• separation of productive system and testing system
  • Measures implemented at datacentre
• existence of guidelines and work instructions
• existence of procedures documentation
• implementation of regulations on programming
• regulations regarding system and programme checks
• implementation of a synchronisation and monitoring system