General Terms and Conditions

§ 1 Provider, Scope of Application, Customers

(1) The provider is IT Service Nietzsch, owner Jens Nietzsch, Borlinghausener Str. 11a, 34439 Willebadessen, Germany (hereinafter the “Provider”). These General Terms and Conditions (GTC) apply to all contracts between the Provider and its customers concerning

• the provision of the software “ITN Marina Management System” (Professional and QR System, with customer app and add-on modules) and other software of the Provider via the internet (Part B),
• services such as set-up, data migration, training, consulting and support, as well as the development and customisation of software on commission (Part C).

Part A applies to all contracts. Annexes 1 to 3 (data processing agreement) form part of every contract under which the Provider processes personal data on behalf of the Customer.

(2) The Provider concludes contracts only with entrepreneurs within the meaning of § 14 BGB (German Civil Code), legal entities under public law, special funds under public law, as well as associations and other organisations that use the services for their commercial, professional or statutory activities (hereinafter the “Customer”). No contracts are concluded with consumers (§ 13 BGB).

(3) Deviating, conflicting or supplementary terms and conditions of the Customer shall not become part of the contract, even if the Provider does not expressly object to them or performs services without reservation in the knowledge of such terms. They shall apply only if the Provider expressly agrees to them in text form (e.g. e-mail).

(4) These GTC, in the version valid at the time the contract is concluded, shall also apply to future contracts with the Customer concerning services of the same kind, without the Provider having to refer to them again.

§ 2 Conclusion of Contract, Contractual Components, Trial Access

(1) Presentations on the Provider’s websites, in brochures and in presentations do not constitute a binding offer. Offers made by the Provider are subject to change unless they are expressly designated as binding or contain a period for acceptance.

(2) The contract is concluded by the Customer’s acceptance of an offer from the Provider in text form (e.g. e-mail, signed offer, order in the customer portal), by an order confirmation from the Provider in text form, or by the Provider commencing performance, in particular by activating access to the software.

(3) In the event of contradictions, the contractual components shall apply in the following order of precedence: (a) the offer or the order confirmation with the individual agreements made therein, (b) the service description or price list of the booked package, (c) the data processing agreement (Annexes 1 to 3) in matters of data protection, (d) Part B or Part C of these GTC, (e) Part A of these GTC, (f) the statutory provisions.

(4) The Provider may grant free trial or demo access. There is no entitlement to such access. Trial access ends upon expiry of the notified trial period, otherwise at any time upon notice in text form. Data entered in the trial access may thereafter be deleted without further notice; trial access may not be used for live operation. For free trial access, the Provider shall be liable only in cases of intent, gross negligence, fraudulently concealed defects, and for damage resulting from injury to life, body or health.

§ 3 Performance, Cooperation, Subcontractors

(1) The Provider shall perform its services with due care in accordance with the generally recognised state of the art at the time the contract is concluded. Dates and deadlines are binding only if they have been expressly agreed as binding in text form.

(2) The Customer shall support the Provider to a reasonable extent and at its own expense, in particular by providing information, data, access and decisions in good time and in full, and by appointing a competent contact person. If the Customer fails to cooperate or fails to do so in good time, dates shall be postponed accordingly; any additional work resulting therefrom shall be remunerated on a time and materials basis at the rates applicable at the time.

(3) The Provider may use suitable subcontractors to perform its services (e.g. data centre, e-mail delivery). It shall remain responsible to the Customer for their performance. For subcontractors that process personal data on behalf of the Customer, Annex 1 § 6 shall additionally apply.

§ 4 Prices, Payment, Default

(1) The prices agreed in the offer shall apply, otherwise the Provider’s price list valid at the time the contract is concluded. All prices are exclusive of the applicable statutory value added tax (VAT).

(2) Recurring usage fees (Part B) are payable monthly in advance or – if so agreed – annually in advance. One-off fees (e.g. set-up) are payable upon performance; services charged on a time and materials basis are payable monthly in arrears. Invoices are payable without deduction within 14 days of the invoice date. The Provider may transmit invoices electronically (e.g. as a PDF or e-invoice).

(3) If the Customer is in default, the Provider may claim default interest of 9 percentage points above the base interest rate as well as the lump sum of 40 euros pursuant to § 288 (5) BGB. The right to claim further damages is reserved.

(4) The Customer may only set off claims that are undisputed or have been finally determined by a court. The Customer may only assert a right of retention on the basis of claims arising from the same contractual relationship.

§ 5 Price Adjustment for Ongoing Contracts

(1) The Provider may adjust the recurring usage fees (Part B) no earlier than 12 months after the start of provision and thereafter no more than once in any 12-month period in order to compensate for increased costs for data centre, licences, personnel, energy and further development.

(2) The Provider shall notify the Customer of an increase in text form at least 6 weeks before it takes effect. The Customer may then, notwithstanding any agreed term, terminate the contract with 2 weeks’ notice with effect from the date on which the increase takes effect. The Provider shall draw attention to this right of termination in the notification. If the Customer does not terminate, the contract shall continue at the new price from the date on which the increase takes effect.

(3) If the statutory VAT rate changes, the gross price shall change accordingly without any right of termination. The Provider shall pass on price reductions at any time without a notice period.

§ 6 Liability

(1) The Provider shall be liable without limitation

• in cases of intent and gross negligence,
• for damage resulting from injury to life, body or health,
• in cases of fraudulent concealment of a defect and to the extent of an expressly assumed guarantee,
• under the Produkthaftungsgesetz (German Product Liability Act) and to the extent otherwise mandatorily prescribed by law.

(2) In cases of slight negligence, the Provider shall be liable only for breach of a material contractual obligation, i.e. an obligation the fulfilment of which makes the proper performance of the contract possible in the first place and on the observance of which the Customer may regularly rely (cardinal obligation). In this case, liability shall be limited to the foreseeable damage typical for the contract at the time the contract was concluded. The parties mutually assume that this damage per contract year will not, as a rule, exceed the amount of the remuneration paid by the Customer in the 12 months preceding the event giving rise to the damage.

(3) Otherwise, liability for slight negligence is excluded; this applies in particular to loss of profit and other indirect damage.

(4) For the loss of or damage to data, the Provider shall be liable within the scope of paragraphs 1 to 3 only in the amount of the effort required for restoration from the data backups pursuant to Part B § 13 or – insofar as the Provider does not owe a backup – from backups duly made by the Customer.

(5) Claims against the Provider for damages or reimbursement of expenses shall become time-barred one year after the commencement of the statutory limitation period; the statutory periods shall apply to claims under paragraph 1.

(6) The above limitations shall also apply in favour of the Provider’s employees, representatives and vicarious agents.

§ 7 Force Majeure

Neither party shall be liable for the non-performance or delayed performance of its obligations insofar as this is due to circumstances for which it is not responsible and which it could not avert despite exercising reasonable care, in particular natural events, war, terrorism, pandemics, official orders, strikes, large-scale power or network failures, failures of internet exchange points, and attacks by third parties on IT systems despite appropriate protective measures. Payment obligations remain unaffected. If such an event lasts longer than 2 months, either party may terminate the affected contract for cause (extraordinary termination).

§ 8 Confidentiality, References

(1) Both parties shall treat as confidential all information of the other party that is not publicly known and that they receive within the scope of the contract, in particular business and trade secrets, prices and access data, and shall use it only for the performance of the contract. This obligation shall continue for 3 years after the end of the contract; for trade secrets within the meaning of the Geschäftsgeheimnisgesetz (German Trade Secrets Act) it shall continue without limitation in time.

(2) The Provider may name the Customer with its name and logo as a reference customer (e.g. on its websites, in presentations and at trade fairs). The Customer may object to this at any time in text form; the Provider shall then remove the reference from its digital media within a reasonable period. Any further details (e.g. quotations, case studies) shall be published only with the Customer’s consent.

§ 9 Data Protection

(1) The parties shall comply with the applicable data protection provisions, in particular the General Data Protection Regulation (GDPR) and the BDSG (German Federal Data Protection Act). Information on the processing of the personal data of the Customer and its contact persons by the Provider as controller is contained in the Provider’s privacy policy.

(2) Insofar as the Customer processes personal data with the software – e.g. data of its berth customers, guests, tenants, members or employees – the Customer is the controller under data protection law and the Provider is its processor. The data processing agreement pursuant to Art. 28 GDPR in Annexes 1 to 3, which is concluded upon conclusion of the main contract, applies to this. The same applies accordingly to support and maintenance access to the Customer’s systems.

(3) For the Provider’s central services – in particular the central user account for boaters, the harbour guide marina.direct, the Boat pass, the navigation service bootsnavi.de and the harbour radio “Pontoon radio (Stegfunk)” – the Provider itself is the controller (Part B § 16). To that extent, there is no data processing on behalf.

§ 10 Amendments to these GTC

(1) The Provider may amend these GTC with effect for existing contracts insofar as the amendment is necessary to adapt them to changes in legislation, case law or regulatory requirements, to changed technical conditions (e.g. security requirements, discontinuation of third-party services) or to new functions, and the Customer is not unreasonably disadvantaged as a result. The agreed main services, the remuneration and the term shall not be changed in this way; price changes are governed exclusively by § 5.

(2) The Provider shall notify the Customer of the amendments in text form at least 6 weeks before they take effect and shall make the amended text available. If the Customer does not object in text form by the time the amendments take effect, the amendments shall be deemed accepted. The Provider shall specifically draw attention to the objection period and the consequences of silence in the notification.

(3) If the Customer objects, the contract shall continue on the previous terms. Both parties may then, notwithstanding any agreed minimum term, terminate it with one month’s notice to the end of a calendar month.

§ 11 Final Provisions

(1) The law of the Federal Republic of Germany shall apply, to the exclusion of the UN Convention on Contracts for the International Sale of Goods (CISG) and the conflict-of-laws rules of private international law.

(2) The exclusive place of jurisdiction for all disputes arising from and in connection with the contract shall be the Provider’s registered place of business (Willebadessen) if the Customer is a merchant, a legal entity under public law or a special fund under public law, or has no general place of jurisdiction in Germany. The Provider may also sue the Customer at the Customer’s general place of jurisdiction. Mandatory statutory places of jurisdiction remain unaffected.

(3) Declarations relating to the contract, in particular notices of termination, require text form (e.g. e-mail), unless a stricter form is prescribed by law. Individual agreements shall always take precedence over these GTC; the content of such agreements shall be determined by an agreement in text form or by the Provider’s confirmation in text form.

(4) The language of the contract is German. Translations of these GTC are provided for information purposes only; in the event of discrepancies, the German version shall prevail.

(5) The Customer may transfer rights and obligations under the contract to third parties only with the Provider’s consent in text form; § 354a HGB (German Commercial Code) remains unaffected. The Provider may transfer the contract to a successor in the course of a transfer of its business operations or of the business unit concerned; it shall notify the Customer of this in advance in text form, and the Customer may then terminate the contract with effect from the date of the transfer.

(6) Should individual provisions be invalid or unenforceable, the remainder of the contract shall remain valid. The invalid provision shall be replaced by the statutory provision.

§ 12 Scope of Services

(1) The Provider shall make the software available to the Customer for use via the internet for the term of the contract (Software as a Service). The software runs on servers in data centres in Germany; the Customer receives its own installation with its own database, accessible at an address provided by the Provider or at an agreed address. The scope of functions results from the booked package (e.g. QR System, Professional, Enterprise) and the booked modules in accordance with the offer and the service description. The usage fee includes operation, data backup pursuant to § 13, updates and support to the agreed extent.

(2) Insofar as booked, the scope of services includes the customer app, with which the Customer’s customers and guests (“end users”) can, for example, book berths, view and pay invoices and communicate with the Customer.

(3) The Provider owes the provision of the software at the transfer point, which is the internet connection of the data centre. The Provider is not responsible for the internet connection, end devices and browsers on the part of the Customer and the end users. The current versions of the common browsers are supported in each case.

(4) Unless separately agreed, the following are not owed: the migration of legacy data, individual customisations, on-site training, interfaces to third-party systems, hardware (e.g. electricity and water meters, barriers, card readers) and the services of payment, telecommunications and other third-party providers.

§ 13 Availability, Maintenance, Data Backup, Support

(1) The Provider guarantees an availability of the software at the transfer point of 98.5 % on an annual average. The following shall not be deemed downtime: (a) announced maintenance work, which the Provider carries out, as far as possible, between 8 p.m. and 7 a.m. or at weekends, (b) urgent security updates, (c) disruptions for which the Provider is not responsible, in particular pursuant to Part A § 7, as well as failures of third-party networks and services outside the Provider’s sphere of influence, (d) disruptions caused by the Customer or end users, e.g. through operating errors, interventions or overload.

(2) The Provider backs up the Customer’s databases daily and the uploaded files regularly on storage separate from the production system. The data backup serves to restore the system after a failure. Restoration of individual data records at the Customer’s request (e.g. after accidental deletion) shall be carried out, insofar as technically possible, against remuneration on a time and materials basis.

(3) The Customer is itself responsible for regularly backing up and retaining documents that it is required to retain for legal reasons (e.g. invoices, accounting vouchers, exports for financial accounting) using the export functions of the software. The software does not replace an audit-proof archive unless this has been expressly agreed.

(4) Support is provided by e-mail and telephone on working days (Monday to Friday, excluding public holidays in North Rhine-Westphalia) from 9 a.m. to 5 p.m. The Customer shall report disruptions without undue delay in text form with a comprehensible description. The Provider shall handle disruptions according to their urgency; disruptions that prevent use of the software as a whole shall have priority. Binding response or resolution times apply only if they have been agreed in the offer.

§ 14 Further Development

(1) The Provider continuously develops the software and may change it, extend it and adapt it to the state of the art, to legislation and to security requirements. The Provider installs updates itself.

(2) If, as a result, functions that are essential for the Customer cease to exist or are substantially restricted, the Provider shall give notice of this in text form at least 6 weeks in advance. The Customer may then terminate the contract for cause (extraordinary termination) with effect from the date of the change. Changes that are necessary for mandatory legal reasons or because of an acute security risk may also be made by the Provider at short notice.

(3) Functions that use third-party services (e.g. payment providers, map services, weather and water level data, calendar interfaces of booking portals) are available only as long as and to the extent that the respective third party offers them.

§ 15 Rights of Use

(1) For the term of the contract, the Customer receives the simple (non-exclusive), non-transferable and non-sublicensable right to use the software as intended for its own business purposes to the booked extent (e.g. number of harbours, locations and modules). The Customer may set up user accounts for its employees and agents and make the customer app available to its end users.

(2) All rights to the software, its further developments, documentation and trademarks remain with the Provider. The Customer has no claim to be provided with the source code.

(3) The Customer may not make the software available to third parties for use, rent it out or offer it as its own service, may not decompile it, replicate it or circumvent its protection mechanisms (unless mandatorily permitted under §§ 69d, 69e UrhG (German Copyright Act)), may not carry out automated mass queries, load tests or security tests without the Provider’s consent, and may not remove any identifying marks, copyright or trademark notices.

(4) If the Customer materially breaches these rules, the Provider may, after an unsuccessful warning, block the access concerned and terminate the contract for cause (extraordinary termination).

§ 16 Central Services: marina.direct, Harbour Guide, Boat Pass, bootsnavi.de, Pontoon Radio

(1) The Provider operates, under its own responsibility, central services for boaters, in particular the central user account with which boaters can log in at all connected harbours, the harbour guide marina.direct, the Boat pass, the navigation service bootsnavi.de and the harbour radio “Pontoon radio”. These services are not part of the Customer’s software; the Provider may individually enable or disable them for the customer app. There is an entitlement to specific central services only insofar as this has been expressly agreed.

(2) The Customer agrees that the Provider may display the public information on its harbour or business (e.g. name, location, contact details, facilities, berths offered, prices, opening hours, photos and – where enabled – vacant berths) in the harbour guide and in the central services and may use it for enquiries from boaters. For this purpose, the Customer grants the Provider a simple (non-exclusive), royalty-free right of use, unlimited in territory, to the content provided by the Customer and ensures that it holds the rights necessary for this (in particular to photos). The Customer may end the display of individual details at any time via marina.direct or by notification in text form. After the end of the contract, the Provider may continue to display generally accessible information on the harbour (name, location, contact), but not photos and texts provided by the Customer whose deletion the Customer requests.

(3) Berth enquiries that boaters address to the Customer via the central services shall be forwarded by the Provider to the Customer. The Customer decides on acceptance itself; a contract for a berth is concluded solely between the Customer and the boater.

(4) If the Customer moderates its own channel in Pontoon radio or publishes content there, it is responsible for that content. The Provider may remove content that is unlawful or violates the rules of use.

§ 17 Obligations of the Customer

(1) The Customer shall keep its access data and those of its users secret, shall grant rights only to the extent necessary and shall inform the Provider without undue delay of any suspected misuse. The Customer is responsible for actions carried out via its access credentials, insofar as it is responsible for the misuse.

(2) The Customer is responsible for the content and data that it and its users enter into the software or send via it, in particular for their lawfulness, for newsletters and other advertising (e.g. required consents) and for the information provided to its end users (e.g. the harbour’s own legal notice, privacy policy, terms and conditions and cancellation policy in the customer app). The Customer shall indemnify the Provider against third-party claims based on unlawful use by the Customer or its users, insofar as the Customer is responsible for this, including reasonable costs of legal defence.

(3) The software supports the Customer with invoicing, accounting, tourist tax, statistics and other tasks. The Customer alone is responsible for the professional and legal correctness of its settings and results – in particular prices, tax rates, tourist tax and levy rates, invoice details, number ranges, payment reminders, retention and procedural documentation in accordance with the GoBD (German principles for the proper keeping and storage of books, records and documents in electronic form and for data access) and reports to authorities. The software does not replace tax or legal advice.

(4) If the Customer uses online payments (e.g. Mollie, Stripe, PayPal), it concludes the contract with the payment provider itself. The Provider is not a party to this contract, does not accept any payments on behalf of the Customer and is not responsible for services, fees, payouts, chargebacks and account suspensions of the payment provider. The Customer itself stores the payment provider’s access keys and keeps them up to date.

(5) If the Customer connects third-party devices (e.g. meters, power outlets, barriers), it is responsible for their selection, installation, calibration and operation. The software adopts the values supplied by the devices; the Customer shall check them for plausibility before billing.

(6) The Customer shall refrain from anything that impairs the security or availability of the software, in particular uploading malware and use that places a disproportionate load on the systems.

§ 18 Defects

(1) The provisions of German tenancy law (rental law) apply to defects in the software, subject to the following provisions. The Provider shall remedy reported defects within a reasonable period. It may also remedy a defect by providing a reasonable workaround.

(2) The Provider’s no-fault liability for defects that already existed at the time the contract was concluded (§ 536a (1), first alternative BGB) is excluded. Otherwise, Part A § 6 applies.

(3) The Customer may not reduce the usage fee on account of a defect by making deductions from ongoing payments; the right to reclaim fees paid in excess under the provisions on unjust enrichment remains unaffected. Termination on the grounds of failure to grant use (§ 543 (2) sentence 1 no. 1 BGB) is permissible only once the Provider has been given sufficient opportunity to remedy the defect and such remedy has failed.

(4) Deviations attributable to operating errors, changes made by the Customer, incorrect data of the Customer, third-party devices or services, or use not in accordance with the contract do not constitute defects.

§ 19 Suspension

(1) If the Customer is more than 30 days in default with a due amount of at least two monthly fees, the Provider may, after a reminder and notice in text form with a period of 14 days, block the Customer’s access in whole or in part until the arrears have been paid. The obligation to pay remuneration continues during the suspension.

(2) The Provider may immediately and temporarily block individual access accounts or functions if there are concrete indications that they pose a risk to the security of the systems or data or that they are being used unlawfully. It shall inform the Customer without undue delay and lift the suspension as soon as the reason for it no longer exists.

§ 20 Term and Termination

(1) The contract begins with the activation of access and has a minimum term of 12 months unless otherwise agreed in the offer. After expiry of the minimum term, it continues for an indefinite period and may be terminated by either party with one month’s notice to the end of a calendar month.

(2) If annual payment in advance has been agreed, the contract may only be terminated with effect from the end of a paid contract year; the notice period is then one month to the end of the contract year.

(3) Additionally booked modules or services may be terminated separately with the same notice period; no separate minimum term applies to them unless otherwise agreed.

(4) The right of both parties to extraordinary termination for good cause remains unaffected. Good cause exists for the Provider in particular if the Customer is in default with payment of the fee or a not insignificant part thereof for two consecutive due dates, or is in default with an amount equal to two monthly fees over a period extending over more than two due dates, or if the Customer materially breaches § 15 or § 17 despite a warning.

(5) If the Provider terminates for good cause for which the Customer is responsible, it may claim, as liquidated damages, 75 % of the fees that would have accrued until the expiry of the minimum term or until the next ordinary termination date. The Customer reserves the right to prove that no damage or substantially lower damage has been incurred; the Provider reserves the right to prove higher damage.

§ 21 Data upon Termination of the Contract

(1) During the term, the Customer may download its data at any time using the export functions of the software. Upon request in text form, which must be received no later than 30 days after the end of the contract, the Provider shall provide the Customer once and free of charge with a complete export of its database and the uploaded files in a common machine-readable format (e.g. CSV or SQL). Further exports, data preparation or migration to other systems shall be carried out against remuneration on a time and materials basis.

(2) 30 days after the end of the contract – or after provision of an export requested in good time – the Provider shall delete the Customer’s installation with all data, unless it is legally obliged to retain it further. Data in backups are overwritten within the regular backup cycle. Upon request, chargeable read access to the archive may be agreed separately.

(3) The Customer is itself responsible for backing up, before the end of the contract, all data that it requires for its own retention obligations. Data of the central services (§ 16), in particular the central user accounts of boaters, are not part of the Customer’s installation and shall continue to exist.

§ 22 Services

(1) The Provider performs set-up, data migration, training, consulting, support beyond the agreed scope and other services on the basis of a contract for services; a specific result is owed only if it has been expressly agreed. Unless a fixed price has been agreed, they are invoiced on a time and materials basis at the rates set out in the offer or the applicable price list; commenced quarter-hours are charged pro rata. Travel time, travel and accommodation costs are invoiced separately as agreed.

(2) In the case of data migration, the Customer is responsible for the completeness, correctness and lawfulness of the legacy data and for checking the migrated data. The cleansing of incorrect legacy data is owed only if it has been agreed.

(3) If the Customer cancels an agreed on-site appointment less than 3 working days in advance, the Provider may claim travel costs already incurred and 50 % of the agreed daily rate, provided that it was unable to use the time otherwise. The Customer reserves the right to prove lower damage.

§ 23 Development and Customisation of Software

(1) For the development and customisation of software on commission (contract for work), the agreed service description or functional specification is decisive. The parties shall agree on change requests made by the Customer after conclusion of the contract in text form; they shall be remunerated additionally, and dates shall be postponed accordingly.

(2) The Provider shall make the deliverable available for acceptance. The Customer shall examine it within 14 days and declare acceptance or give notice of material defects in text form. The deliverable shall be deemed accepted if the Customer does not give notice of any material defects within this period, provided that the Provider has drawn the Customer’s attention to this consequence when making the deliverable available, or if the Customer uses the deliverable productively after expiry of the examination period without having given notice of material defects. Immaterial defects do not entitle the Customer to refuse acceptance.

(3) In the event of defects, the Provider shall, at its discretion, provide subsequent performance by remedying the defect or by producing a new deliverable. If subsequent performance fails at least twice after a reasonable period, the Customer may reduce the remuneration or, in the case of material defects, withdraw from the contract. Damages are governed by Part A § 6. Claims for defects become time-barred 12 months after acceptance; this does not apply in the cases of Part A § 6 (1).

(4) Upon payment in full, the Provider grants the Customer a simple (non-exclusive) right, unlimited in time, to use the work results created for it for its own business purposes. If the results are incorporated into the Provider’s standard software, Part B applies to their use. All other rights, in particular to the source code, to tools and to general know-how, remain with the Provider; the Provider may also use the results – without confidential information and data of the Customer – for other customers and incorporate them into its standard software. Exclusive rights or the surrender of the source code require a separate agreement.

§ 1 Subject Matter and Duration

(1) This agreement specifies the obligations of the parties under data protection law where the Provider (processor), in performing the services under Part B and Part C, processes personal data on behalf of the Customer (controller). It applies for the duration of the main contract and beyond, for as long as the Provider processes data of the Customer.

(2) The subject matter of the processing is the operation of the software for the Customer (hosting, data storage, data backup, sending of e-mails and notifications of the software, provision of the customer app) as well as support, maintenance, troubleshooting, data migration and exports.

§ 2 Nature, Purpose, Data and Data Subjects

(1) Nature and purpose: storage, provision and processing of the data that the Customer enters into the software or receives via it for the management of its harbour or business, exclusively for the performance of the contractual services.

(2) Types of data, depending on the modules used: master and contact data (name, address, telephone, e-mail, language); boat, berth, winter storage, crane, camping and charter data; contract, booking and reservation data; invoicing, payment and accounting data (bank details; no complete card data, which are processed solely by the payment provider); consumption and meter data; membership data of associations; communication content (messages, e-mails, newsletters, documents); user, authorisation and log data; working time and cost data of employees, insofar as the corresponding module is used.

(3) Data subjects: customers, guests, tenants, berth holders and prospective customers of the Customer; members of associations; employees and other users of the Customer; contact persons of suppliers and business partners of the Customer.

(4) Special categories of personal data (Art. 9 GDPR) are not the subject matter of the processing. The Customer shall not enter such data into the software.

§ 3 Instructions

(1) The Provider processes the data only on documented instructions from the Customer, unless it is required to process them by Union law or German law; in such a case, it shall inform the Customer of that legal requirement before processing, unless that law prohibits such information. Instructions are the main contract, this agreement and the Customer’s settings and operation of the software. The Customer shall issue further instructions in text form.

(2) The Provider shall inform the Customer without undue delay if, in its opinion, an instruction infringes data protection provisions. It may suspend the execution of the instruction until the Customer confirms or amends it.

(3) Instructions that go beyond the contractual scope of services shall be treated as a change request and remunerated on a time and materials basis.

§ 4 Obligations of the Provider

(1) The Provider shall only deploy persons who have committed themselves to confidentiality or are under a statutory obligation of confidentiality.

(2) The Provider shall take the technical and organisational measures pursuant to Art. 32 GDPR described in Annex 2. It may adapt them to technical developments, provided that the level of protection is not reduced.

(3) The Provider shall assist the Customer by appropriate technical and organisational measures in responding to requests from data subjects (Art. 12 to 22 GDPR) and in complying with the obligations pursuant to Art. 32 to 36 GDPR. For this purpose, the software provides functions for exporting information for access requests and for rectification, restriction and erasure or anonymisation. If a data subject contacts the Provider directly, the Provider shall forward the request to the Customer without undue delay. The Customer shall remunerate on a time and materials basis any assistance that goes beyond the functions of the software and is not based on a breach by the Provider.

(4) The Provider shall notify the Customer without undue delay, if possible within 48 hours, of any personal data breach within its area of responsibility that has come to its knowledge, with the information pursuant to Art. 33(3) GDPR insofar as available to it, and shall take the necessary measures to contain it.

(5) The processing takes place exclusively in the European Union or the European Economic Area. Any transfer to a third country shall take place only after prior notification of the Customer and if the requirements of Art. 44 et seq. GDPR are met.

(6) As a sole proprietorship, the Provider is not obliged to appoint a data protection officer. The contact person for data protection is Jens Nietzsch, contact details as in the legal notice.

§ 5 Evidence and Inspections

(1) Upon request, the Provider shall make available to the Customer the information necessary to demonstrate compliance with this agreement, in particular a current description of the measures pursuant to Annex 2.

(2) If this information is insufficient in an individual case, the Customer or an auditor commissioned by the Customer who is bound to confidentiality and is not a competitor of the Provider may carry out inspections after giving at least 4 weeks’ notice, during normal business hours and without disrupting operations, as a rule no more than once per calendar year, and more frequently where there is justified cause. Inspections of sub-processors shall be carried out by presentation of their evidence. The Provider’s effort for inspections shall be remunerated on a time and materials basis, unless the inspection reveals a material breach by the Provider.

§ 6 Sub-processors

(1) The Customer grants general authorisation for the engagement of sub-processors. The sub-processors engaged at the time the contract is concluded (Annex 3) shall be deemed approved. The Provider shall name them to the Customer in text form at any time upon request.

(2) The Provider shall inform the Customer in text form at least 4 weeks before the addition or replacement of a sub-processor. The Customer may object to the change in text form within this period for good cause relating to data protection. If the parties cannot reach agreement, either party may terminate the affected contract for cause (extraordinary termination) with effect from the date of the change.

(3) The Provider shall contractually impose on each sub-processor the data protection obligations of this agreement, in particular sufficient guarantees of appropriate technical and organisational measures.

(4) Ancillary services such as telecommunications services, postal and transport services, as well as services that the Customer itself agrees with third parties, in particular payment providers, booking portals and manufacturers of connected devices, do not constitute sub-processing.

§ 7 Deletion and Return

After the end of the main contract, the Provider shall, at the Customer’s choice, hand over the data in accordance with Part B § 21 and subsequently delete them, unless there is a legal obligation to store them. Copies in data backups are overwritten within the regular backup cycle, at the latest after 3 months. Upon request, the Provider shall confirm the deletion in text form.

§ 8 Liability, Order of Precedence

(1) Art. 82 GDPR applies to liability towards data subjects. In the relationship between the parties, Part A § 6 of the GTC applies.

(2) In the event of contradictions, this agreement shall take precedence over the other contractual components in matters of data protection.

Confidentiality

• Physical access: The servers are located in data centres of the hosting service provider in Germany with access control, video surveillance and visitor rules. The Provider does not operate any servers containing customer data on its own premises.
• System access: personal user accounts; passwords are stored only as irreversible, salted hash values; limitation of failed login attempts; administrative access to the servers only for the Provider, with strong, individual passwords.
• Data access: role and authorisation concept in the software (e.g. administrator, user, rights per area), managed by the Customer itself; access by the Provider to the Customer’s data only insofar as necessary for operation, support or troubleshooting.
• Separation: each installation has its own database; test and demo systems are separated from the live systems and do not contain any live data of the Customer.
• Protection against attacks: protection against cross-site request forgery and code injection, protection of non-public directories, security headers, regular security reviews of the software.

Integrity

• Transfer: transmission between browser or app and server exclusively in encrypted form (HTTPS/TLS); encrypted connections between the Provider’s services.
• Input: logging of material changes and logins in the software; unalterable invoice number ranges and cancellation instead of deletion of issued invoices.

Availability and Resilience

• daily backup of the databases and regular backup of the files on storage separate from the production system;
• data centre with uninterruptible power supply, fire protection, air conditioning and redundant network connection (service of the hosting service provider);
• monitoring of security certificates; prompt installation of security updates.

Procedures for Regular Review

• changes to the software are tested in a separate test environment before release;
• regular review of the measures and adaptation to the state of the art;
• control of processing on behalf: sub-processors only with an agreement pursuant to Art. 28 GDPR; instructions and notifications handled by the owner personally.

Sub-processors Engaged

The Provider engages sub-processors for the following services: hosting of the software and the databases in data centres in Germany, data backup and sending of e-mails of the software. The processing takes place exclusively in Germany.

The Provider shall notify the Customer in text form of the name and address of the sub-processors engaged at any time upon request. The Provider shall inform the Customer of intended changes in accordance with Annex 1 § 6 (2).