General Terms and Conditions

Keppler IT-Systems GmbH
Version: 11 October 2026

Please note: This is a translation provided for convenience. The contractual language is German, and only the German version is legally binding. In case of any discrepancy, the German wording prevails. References to statutes are references to German law.

These terms apply to services of Keppler IT-Systems GmbH, Westerstr. 114-116, 28199 Bremen, Germany, registered with the local court of Bremen under HRB 20395, represented by its managing director Tobias Keppler (hereinafter „Keppler IT-Systems“).

These terms consist of a general part, special provisions for the individual types of service and the final provisions. The special provisions take precedence over the general part.

For orders offered under the name of our CloudFaktor division, the General Terms and Conditions at www.cloudfaktor.de/agb apply.

Part A · General provisions

§ 1 Scope and contractual partner

(1) These General Terms and Conditions apply to all contracts between Keppler IT-Systems and its customers for consulting and analysis services, project services, ongoing IT support, training, the delivery of hardware, the provision of third-party software, licences and cloud services, and the safekeeping of systems as part of the emergency storage service.

(2) Keppler IT-Systems provides services exclusively to entrepreneurs within the meaning of § 14 BGB (German Civil Code), legal entities under public law and special funds under public law. Contracts with consumers within the meaning of § 13 BGB are not concluded.

(3) Deviating, conflicting or supplementary terms and conditions of the customer do not become part of the contract, even if Keppler IT-Systems does not expressly object to them or renders performance without reservation while aware of them. They apply only insofar as Keppler IT-Systems has consented to their validity in text form.

(4) In the event of contradictions, the following order of precedence applies: individual agreements in text form, then the respective offer including the description of services, then the special provisions of Part B, then the general Part A. § 305b BGB remains unaffected.

(5) These terms, in the version valid at the time the contract is concluded, also apply to future contracts within an ongoing business relationship without the need for a renewed reference.

(6) The use of the vNOC42 and CAE42 portals is governed by their own General Terms and Conditions, which are published in the respective portal. Services that Keppler IT-Systems provides with the help of the portals, such as the support of monitored systems, are governed by these terms.

§ 2 Conclusion of contract

(1) Presentations of services on the website, in brochures or in other advertising material are non-binding and do not constitute a binding offer.

(2) Unless otherwise stated in the offer, offers from Keppler IT-Systems are binding for 30 days from the date of the offer. By way of derogation, offers for the delivery of hardware, software, licences and third-party cloud services are binding for seven days, because purchase prices are calculated daily.

(3) The contract is concluded when the customer places the order in text form and Keppler IT-Systems confirms it, at the latest when Keppler IT-Systems begins to render the service.

(4) Where these terms require text form, transmission by email is sufficient. A handwritten signature is required only where this has been expressly agreed.

§ 3 Scope of services, changes, subcontractors

(1) The nature and scope of the services follow from the respective offer including the description of services contained therein. Services not listed there are not owed.

(2) Public statements, promotional claims or advertising do not constitute an agreement on quality unless they have been expressly included in the description of services.

(3) Changes or extensions to the scope of services require an agreement in text form. Before implementation, Keppler IT-Systems informs the customer of the effects the requested change has on remuneration and dates.

(4) Keppler IT-Systems is entitled to engage qualified third parties to render the services. This does not affect Keppler IT-Systems's responsibility towards the customer.

§ 4 Customer's duties to cooperate

(1) The customer provides the information, documents, access rights and system environments required for rendering the services in good time, completely and free of charge. The customer names a technical contact person and a person authorised to make decisions.

(2) The customer ensures that it is entitled to grant the access provided and that the commissioned work does not infringe the rights of third parties.

(3) Before work on its systems begins, the customer ensures a complete, up-to-date and restorable backup of its data. This obligation also applies where Keppler IT-Systems has assisted in setting up or reviewing the backup, unless creating the backup has been expressly agreed as a service.

(4) If the customer fails to fulfil its duties to cooperate in good time, agreed deadlines are extended appropriately. The customer remunerates the resulting additional effort at the agreed rates.

§ 5 Dates, deadlines and cancellations

(1) Dates and deadlines are binding only if they are expressly designated as binding in text form. Otherwise they are estimates.

(2) If the customer cancels or reschedules an agreed appointment later than 24 hours before it begins, Keppler IT-Systems charges 50 % of the effort attributable to that appointment. The customer remains free to prove that no effort or a lower amount of effort was incurred.

§ 6 Remuneration, payment and default

(1) All prices are net amounts in euros plus statutory value added tax at the applicable rate.

(2) A fixed price applies only where the offer expressly designates it as such. Otherwise, billing is based on actual effort at the agreed rates, in increments of 15 minutes.

(3) Invoices are payable within 14 days of receipt without deduction. In the case of continuing obligations, remuneration is invoiced monthly in advance.

(4) Travel expenses and disbursements are charged separately after prior agreement with the customer.

(5) If the customer is in default of payment, the statutory provisions apply; default interest is calculated in accordance with § 288 (2) BGB. The right to claim further damages remains reserved.

(6) In the case of continuing obligations, Keppler IT-Systems is entitled to adjust the remuneration with six weeks' notice with effect from the beginning of a calendar month, but no earlier than twelve months after the start of the contract and thereafter at intervals of twelve months. In this case the customer may terminate the contract in text form with effect from the date the adjustment takes effect.

§ 7 Set-off and right of retention

The customer may set off only against claims that are undisputed or have been established with final legal effect. The customer is entitled to a right of retention only insofar as it is based on the same contractual relationship.

§ 8 Confidentiality and use as a reference

(1) Both parties treat all confidential information of the other party obtained in the course of the cooperation as confidential and use it only for the purposes of the contract. This obligation applies for the term of the contract and for three years beyond its termination.

(2) Excluded is information that is publicly known or becomes known without breach of a confidentiality obligation, that was already known to the receiving party, that it developed independently, or whose disclosure is required by law or by an authority.

(3) Keppler IT-Systems provides a separate non-disclosure agreement before the start of the project on request.

(4) Naming the customer as a reference and using its name or logo for advertising purposes require the customer's prior consent in text form. Consent may be revoked with effect for the future.

§ 9 Data protection

(1) Both parties comply with the applicable data protection provisions, in particular the GDPR and the BDSG (German Federal Data Protection Act). Details of processing by Keppler IT-Systems are set out in the privacy policy.

(2) Insofar as Keppler IT-Systems obtains access to personal data on behalf of the customer, the parties conclude a data processing agreement pursuant to Art. 28 GDPR before processing begins.

(3) Customer data is processed and stored exclusively on systems within the European Union, unless expressly agreed otherwise.

§ 10 Work results, rights of use, open source software

(1) Upon full payment of the agreed remuneration, the customer receives a simple, non-exclusive right, unlimited in time and territory, to use the work results created for it, in particular concepts, evaluations, documentation and result reports, for its own internal purposes.

(2) Passing work results on to third parties or publishing them requires Keppler IT-Systems's prior consent in text form. Disclosure to the customer's legal, tax or auditing advisers and to supervisory authorities is permitted without separate consent.

(3) Pre-existing know-how, methods, assessment frameworks, templates and tools of Keppler IT-Systems remain its property. Keppler IT-Systems remains entitled to make free use of the general experience gained during the project, provided that no confidential information of the customer is disclosed.

(4) Insofar as services include open source software, the licence terms of the respective rights holders take precedence. Keppler IT-Systems does not supply such software in its own name and owes no warranty for it beyond the respective licence. Keppler IT-Systems's responsibility for its own setup, configuration and consulting services remains unaffected.

§ 11 Non-solicitation

The parties undertake not to actively solicit employees of the other party who were involved in rendering the services, for the duration of the cooperation and for twelve months thereafter. General job advertisements and applications made without prompting by the other party remain permissible.

§ 12 No legal or tax advice

(1) Keppler IT-Systems renders technical and organisational services. These do not constitute legal services within the meaning of the RDG (German Legal Services Act) and do not constitute tax advice.

(2) Insofar as services touch upon regulatory requirements, for example arising from NIS2, the BSIG, KRITIS regulations or the GDPR, they serve the structured collection of facts and technical preparation. Legal assessment, self-assessments required by law and their documentation are the responsibility of the customer; the responsibility of its management remains unaffected.

(3) In cases of doubt and borderline cases, Keppler IT-Systems recommends involving a specialised law firm. Keppler IT-Systems makes the collected facts available in prepared form for this purpose.

§ 13 Liability

(1) Keppler IT-Systems is liable without limitation in cases of intent and gross negligence, for injury to life, body or health, for fraudulent concealment of a defect, to the extent of a guarantee given, and under the German Product Liability Act.

(2) In cases of simple negligence, Keppler IT-Systems is liable only for breach of a material contractual obligation, that is, an obligation whose fulfilment makes the proper performance of the contract possible in the first place and on whose observance the customer may regularly rely. In this case liability is limited to the foreseeable damage typical for the contract at the time it was concluded.

(3) Liability under paragraph 2 is limited in amount, per instance of damage, to the net remuneration agreed for the relevant order, and in the case of continuing obligations to the net remuneration payable for twelve months.

(4) For the loss of data, Keppler IT-Systems is liable under the preceding paragraphs only up to the effort that would have been required for restoration had the customer maintained proper data backups (§ 4 (3)).

(5) Liability for indirect damage and loss of profit is excluded, to the extent permitted by law and unless a case under paragraph 1 applies.

(6) The above provisions also apply for the benefit of Keppler IT-Systems's legal representatives, employees and vicarious agents. They do not entail any change in the burden of proof to the customer's detriment.

§ 14 Force majeure

(1) Events of force majeure that make performance substantially more difficult or impossible for Keppler IT-Systems release it from its obligation to perform for the duration of the disruption. These include in particular natural events, failures of power and network infrastructure, attacks on the information technology of third parties, orders by authorities, epidemics and industrial action not brought about by Keppler IT-Systems.

(2) The parties inform each other without undue delay of the occurrence and the expected end of such an event. If the disruption lasts longer than three months, either party may terminate the affected contract in text form; services already rendered are invoiced.

§ 15 Termination for cause

The right of both parties to terminate for cause remains unaffected. Good cause exists for Keppler IT-Systems in particular if the customer is in default of a due payment for more than 30 days after a reminder, or if insolvency proceedings are applied for in respect of its assets. Notice of termination must be given in text form.

Part B · Special provisions

§ 16 Consulting and analysis services

(1) This section applies to consulting, analysis and review services, in particular IT consulting and the planning of IT solutions, cloud consulting, IT security consulting, purchasing advice and impact and gap analyses regarding regulatory requirements.

(2) Consulting services are services within the meaning of § 611 BGB. No particular economic success is owed. Where a result report or comparable deliverable has been expressly agreed, § 17 (3) applies accordingly to its acceptance.

(3) Results are based on the information provided by the customer and on the facts and legal situation applicable at the time of the assessment. An obligation to verify the customer's information for accuracy and completeness exists only where expressly agreed.

(4) If the customer's circumstances or the legal situation change, a renewed assessment may become necessary. There is no obligation to update results after they have been handed over.

(5) § 12 applies.

§ 17 Project services

(1) This section applies to clearly defined project services with an agreed result, in particular the setup of IT systems, networks, security solutions and cloud environments, and migrations. Such services are contracts for work within the meaning of § 631 BGB.

(2) Where the service consists of distinct parts, these may be accepted separately.

(3) The customer accepts the service as soon as it has been rendered substantially in accordance with the contract; immaterial defects do not entitle the customer to refuse acceptance. The service is deemed accepted if the customer does not raise substantiated objections in text form within ten working days of handover or provision. The same applies if the customer puts the service into productive use. Keppler IT-Systems informs the customer of the significance of its conduct upon handover.

(4) In the event of defects, Keppler IT-Systems has the right to remedy them. If remedial action fails twice, the customer may reduce the remuneration or withdraw from the contract; claims for damages are governed by § 13.

(5) Claims for defects become time-barred twelve months after acceptance. This does not apply in the cases of § 13 (1) nor where the law mandatorily prescribes longer periods under § 634a (1) no. 2 BGB.

§ 18 Ongoing IT support

(1) Ongoing IT support is a service contract with the character of a continuing obligation. Scope, supported systems and remuneration follow from the respective agreement.

(2) Unless an express agreement on response or restoration times has been made, requests are processed during normal business hours from Monday to Friday, 9:00 to 17:00, excluding public holidays at Keppler IT-Systems's registered office. Specific response times or uninterrupted availability are not owed without a separate agreement.

(3) The contract runs for an indefinite period and may be terminated by either party in text form giving one month's notice to the end of a month, unless agreed otherwise.

(4) Agreed service quotas relate to the respective billing period and expire at the end of that period, unless agreed otherwise.

(5) The support of systems monitored via the vNOC42 portal is ongoing IT support within the meaning of this section. The use of the portal itself is governed by § 1 (6).

§ 19 Training

(1) Training courses are services. No particular learning outcome is owed.

(2) § 5 (2) applies to the cancellation of training dates. Instead, the customer may nominate substitute participants up to the start of the training.

(3) If a training course cannot take place for reasons for which Keppler IT-Systems is responsible, Keppler IT-Systems offers an alternative date. If no alternative date is agreed, remuneration already paid is refunded; further claims are governed by § 13.

(4) The customer receives a simple right to use the training materials internally through the persons trained. Reproduction and disclosure to third parties are not permitted without consent in text form.

§ 20 Supply of hardware

(1) Sales law applies to the supply of hardware. Where pre-configuration or setup has additionally been agreed, § 17 applies to that part.

(2) Risk passes to the customer upon handover, or in the case of dispatch upon handover to the carrier.

(3) Delivery times are non-binding unless expressly agreed as binding in text form. If Keppler IT-Systems is not supplied by an upstream supplier despite a congruent covering transaction, the obligation to deliver lapses; Keppler IT-Systems informs the customer without undue delay and refunds payments already made.

(4) The hardware supplied remains the property of Keppler IT-Systems until all claims arising from the business relationship have been paid in full. The customer is entitled to resell the goods in the ordinary course of business; it hereby assigns the resulting claims to Keppler IT-Systems in the amount of the invoice value, and Keppler IT-Systems accepts this assignment.

(5) The customer must examine the goods without undue delay after delivery. Obvious defects must be notified in text form within seven working days of delivery, hidden defects without undue delay after their discovery. § 377 HGB (German Commercial Code) remains unaffected.

(6) Claims for defects in new hardware become time-barred twelve months after delivery. For used hardware, claims for defects are excluded to the extent permitted by law. The cases of § 13 (1) remain unaffected.

(7) Independent manufacturer guarantees remain unaffected and exist independently of the above provisions.

(8) Goods free of defects can only be taken back by prior agreement in text form and in accordance with the return conditions of the respective supplier. The customer bears the costs incurred.

§ 21 Third-party software, licences and cloud services

(1) This section applies to standard software, licences, software subscriptions and cloud services of other manufacturers and providers that Keppler IT-Systems procures for the customer, for example through distributors.

(2) Their use is additionally governed by the licence and usage terms of the respective manufacturer or provider. Keppler IT-Systems refers to these terms in the offer and makes them available on request; the customer undertakes to comply with them.

(3) Keppler IT-Systems owes the procurement of the agreed rights of use. The scope of functions, availability and further development of the software and services are determined by the information provided by the manufacturer or provider. Keppler IT-Systems only gives commitments regarding the availability of cloud services to the extent that they are expressly assumed in the offer.

(4) The term and termination of subscriptions are governed by the offer and otherwise by the terms of the manufacturer or provider. A reduction in the number of licences or early termination during the term is only possible to the extent that the manufacturer or provider permits this; otherwise the remuneration for the agreed term remains payable.

(5) If the manufacturer, provider or distributor raises its prices during the term of a subscription, Keppler IT-Systems may adjust the remuneration to the same extent. Keppler IT-Systems gives notice of the adjustment in text form at least four weeks before it takes effect; in this case the customer may terminate the affected subscription in text form as of the date the adjustment takes effect.

(6) For defects in standard software provided, § 20 (5) and (6) apply accordingly. In the event of faults in subscriptions and cloud services, Keppler IT-Systems forwards the report to the manufacturer or provider and supports the customer in enforcing its claims. Claims for damages are governed by § 13.

(7) If the customer chooses a cloud service whose provider processes data outside the European Union, § 9 (3) does not apply to that service; in that case the provider’s data protection and data processing terms are decisive.

§ 22 Emergency storage

(1) The subject of the emergency storage service is the safekeeping of the systems and data carriers provided by the customer in an access-protected storage facility, together with the agreed inspection services. §§ 688 et seq. BGB apply to the safekeeping.

(2) The customer warrants that it is entitled to dispose of the stored items. Dangerous or prohibited items, or items unsuitable for storage, may not be handed over.

(3) The extent of cover follows from the description of services. It covers the current value of the stored systems up to the maximum amount stated there. If the current value exceeds that amount, the customer must inform Keppler IT-Systems in text form before storage; cover beyond that requires a separate agreement.

(4) An agreed operational readiness test is carried out once a year and documented in a report. It verifies that the stored systems start up and replaces neither the customer's own data backup nor a review of the substantive accuracy of the stored data.

(5) The customer is responsible for encrypting the data stored on the systems held in safekeeping. Keppler IT-Systems does not access the content unless this is necessary to carry out agreed inspection services.

(6) The customer may demand the return of the stored items at any time. Return takes place within five working days of a request in text form, and without undue delay in an emergency notified by the customer. Items are handed over only to the customer or to persons named by it in text form, subject to identification.

(7) The contract runs for an indefinite period and may be terminated by either party in text form giving three months' notice to the end of a month, unless agreed otherwise. The remuneration owed up to the end of the contract remains payable even if the customer collects the items earlier.

(8) After the contract ends, the customer collects the stored items within 20 working days. Thereafter Keppler IT-Systems may charge reasonable storage fees. If the customer fails to collect the items despite a request and a one-month deadline, Keppler IT-Systems is entitled, after prior notice in text form, to dispose of or destroy them in a manner compliant with data protection law.

Part C · Final provisions

§ 23 Amendments to these terms

(1) For a contract already concluded, the version of these terms incorporated at the time of conclusion applies.

(2) In the case of continuing obligations, Keppler IT-Systems may amend these terms giving six weeks' notice in text form. If the customer objects in text form within four weeks of receiving the notification, the previous version continues to apply; in this case Keppler IT-Systems may terminate the contract with effect from the date the amendment was to take effect. Keppler IT-Systems draws attention to the right to object and the consequences of an objection in the notification.

§ 24 Final provisions

(1) The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods.

(2) The exclusive place of jurisdiction for all disputes arising from or in connection with the contractual relationship is Bremen, provided the customer is a merchant, a legal entity under public law or a special fund under public law. Keppler IT-Systems is also entitled to bring proceedings at the customer's general place of jurisdiction.

(3) The place of performance for all services is Bremen, unless agreed otherwise.

(4) Amendments and supplements to the contract require text form. This also applies to any waiver of this text form requirement.

(5) The contractual and negotiating language is German. Where these terms are translated into other languages, the German version prevails in case of doubt.

(6) Should any provision of these terms be or become invalid, the validity of the remaining provisions remains unaffected.