Our Terms

§ 1 General information and purpose of the contract

1.1 These General Terms and Conditions (hereinafter referred to as "GTC") apply to the use of the services offered by Varoli UG (based in Düsseldorf, registered in the commercial register of the Düsseldorf Local Court under HRB 101573) ("Varoli") by customers who are entrepreneurs within the meaning of § 14 BGB (the "Customer" and together with Varoli the "Parties").

1.2 In particular, Varoli offers the customer the opportunity to match supply and demand with regard to the sale or purchase of plastics, virgin material, plastic additives and/or non-hazardous plastic waste (within the meaning of the German Waste Catalogue Ordinance, AVV) (the "Material(s)") (the "Contractual Purpose"). All services of Varoli shall be provided at its own discretion via the website www.varoli.de (the "Platform") and/or by other means (in particular by e-mail, telephone and/or post).

1.3 Varoli's offers are aimed in particular at customers who wish to purchase (the "Buyers") or sell (the "Suppliers") materials. The use of Varoli's services by other intermediaries of materials (or comparable other products), agents of materials (or comparable other products) and/or other entrepreneurs and or other direct competitors of Varoli is not permitted.

1.4 Deviations from these GTC shall only be deemed agreed if they have been expressly confirmed in writing by Varoli. Any existing general terms and conditions of the customer are expressly not recognized by Varoli. In particular, the mere failure of Varoli to object to the customer's general terms and conditions shall not result in them being deemed agreed. This shall also apply if Varoli performs services without reservation in the knowledge of conflicting or deviating terms and conditions of the customer.

1.5 For good cause, in particular in the event of changes in statutory provisions, supreme court rulings or market conditions, Varoli may notify the customer of an amendment to these GTC, indicating the essential changes. The amended GTC shall be deemed agreed if the customer does not object to the amendment within one month after receipt of the notification and Varoli has expressly pointed out this consequence to the customer in the notification of amendment. Notwithstanding the above provisions, changes to the service contents agreed with the customer require the express consent of the customer.

§ 2 Registration of the company account; conclusion of the platform contract and onboarding emails

2.1 In order to be able to use certain services offered by Varoli via the Platform, the customer must register to use the Platform. When registering, the customer must provide all information marked as "mandatory". All information provided by the customer must be correct, complete and not misleading.

2.2 By confirming these GTC separately by ticking the corresponding box and confirming the registration button, the customer submits a binding offer to Varoli to conclude a contract of use with Varoli on the basis of these GTC and on the terms and conditions specified in the registration process (the "Platform Contract"). Registration on the platform without the inclusion of these GTC is not possible.

2.3 The Platform Contract is effectively concluded as soon as Varoli has accepted the customer's offer by e-mail. A mere confirmation e-mail from Varoli about the receipt of the customer's offer does not constitute acceptance of the customer's offer. Varoli is entitled to refuse the conclusion of a platform contract with the customer without giving reasons.

2.4 Varoli reserves the right to make the accessibility of the entire scope of services of the platform, in particular the offering of materials via the platform or contacting suppliers, dependent on a separate agreement with the customer, for example in the form of a subscription model.

2.5 The customer is obliged to treat the password received or chosen during registration as strictly confidential and not to disclose it to third parties. He must renew the password regularly. Should third parties gain access to the customer account using the password through the fault of the customer, the customer shall be responsible for the actions of the third party and shall be liable for them. However, the customer has the opportunity to prove that he has adequately protected the password from access by third parties and that the actions on the platform were carried out by a third party. If the customer has reason to believe that a third party is in possession of his password, he must change his password immediately and inform Varoli.

2.6 As part of the Platform Agreement, Varoli may send onboarding emails to each user with instructions and helpful information on the use of the Platform (e.g. on setting up the functional scope or functional extensions of the Platform, etc.).

§ 3 Use of the platform

3.1 Use of the Platform requires that the Customer has the technical means necessary for access via the Internet (computer, Internet access, e-mail address). In order to ensure optimal use of the platform, Varoli recommends using the latest version of Google Chrome, Mozilla Firefox or Safari browsers and allowing cookies in the settings of the browser used.

3.2 The customer may only use the platform for the purpose of the contract. The customer undertakes to grant access to the platform only to persons within its organization and to ensure that appropriate security precautions are taken to prevent unauthorized persons from accessing the platform. These security precautions include, in particular, the use of a secure password.

3.3 In order to ensure proper business processing, it is necessary that the customer informs Varoli immediately of any changes to its name/company name, legal form, registered office and legal representatives.

3.4 The customer may only post data, texts, images and other content on the platform which he is authorized to use and which do not violate applicable law or the rights of third parties. Varoli is entitled to block content posted by the customer if there is reasonable suspicion that this content is illegal, violates these GTC or infringes the rights of third parties.

§ 4 Role of Varoli and mediation

4.1 Unless Varoli expressly offers materials via its company account as a supplier, Varoli is not a party to purchase contracts concluded via the Platform. Varoli then merely provides the platform to the buyers and suppliers, which in particular enables customers to submit requests and offers for materials.

4.2 If Varoli has demonstrated the possibility of concluding a contract for the purchase or sale of a Material via or outside the Platform (Proof Broker) and such a contract has been concluded between the Buyer and the Supplier (the "Third Party Contract"), Varoli shall charge the Buyer a pro rata commission for the brokerage activity (the "Transaction Fee"). The amount of the Transaction Fee to be paid will be specified when the Third Party Contract is concluded. The amount is determined on a case-by-case basis and may depend in particular on the product, its quality and quantity.

4.3 The Buyer and the Supplier are independently obliged to inform Varoli immediately of any circumstances that affect the execution of the mediation. This applies in particular with regard to the abandonment or change of the purchase intention.

4.4 If Varoli provides evidence of an opportunity to conclude a contract already known to the buyer or supplier, the buyer or supplier shall be obliged to reject this evidence in writing.

4.5 The Buyer and the Supplier are independently obliged to notify Varoli immediately of the conclusion of a third party contract and to provide a complete copy of the contract upon first request.

4.6 The third-party agreement shall be concluded exclusively between the Buyer and the Supplier. Varoli shall have no obligations in connection with the Third Party Agreement, in particular with regard to the negotiation, conclusion and enforcement of the Third Party Agreement. Varoli does not owe any mediation or mediation success with regard to the conclusion of the third party contract. Whether a third-party contract is concluded is solely at the discretion of the respective parties to the third-party contract.

4.7 Varoli is entitled to offer the customer additional (chargeable) services on or outside the platform, which, however, require a separate contract between Varoli and the respective customer.

§ 5 Obligations of the customer

5.1 The customer warrants that the information provided during registration, in particular that relating to the entrepreneurial status and the company itself, is correct and that the platform is used exclusively by authorized persons.

5.2 The customer can use the platform both as a provider and as a buyer. If the Customer uses the Platform as a Provider, it is subject in particular to the following obligations:

a) The customer must inform Varoli immediately if a contract is concluded with a third party outside the Platform.

b) The customer must be authorized to offer the offered materials.

c) The customer must be able to transfer the legal ownership of the offered materials free of encumbrances of any kind.

d) The information about the offered materials that the customer communicates on the platform must be complete and accurate and must not be misleading.

e) The customer must ensure that the materials offered are packaged safely and properly in compliance with the applicable laws.

5.3 If the customer uses the platform as a buyer, he is subject in particular to the following obligations:

a) The customer must inform Varoli immediately if a contract is concluded with a third party outside the Platform.

b) The information provided by the customer when initiating the contract must be complete and correct and must not be misleading.

§ 6 Terms of payment; adjustment of the fee

If remuneration is to be paid to Varoli in connection with the use of the Platform, in the context of Varoli's brokerage activities or for other services provided by Varoli, the following shall apply:

6.1 All prices quoted by Varoli are net prices plus statutory value added tax.

6.2 Invoice amounts issued are payable without deduction within fourteen (14) days of receipt of the invoice by the customer.

6.3 If the Customer is in default with the payment of remuneration claims, default interest shall be charged at a rate of nine (9) percentage points above the respective base interest rate.

6.4 Varoli shall be entitled to adjust the agreed remuneration for the use of the Platform annually by a reasonable amount for future payment periods in order to compensate for personnel and other cost increases by third parties in which Varoli is not responsible. Varoli shall notify the customer of such price adjustments and the effective date of the price adjustment in writing at least four (4) weeks before the price adjustment takes effect, stating the reasons. If the price increase amounts to more than seven percent (7%) of the previous price, the customer may object to this price increase within a period of two (2) weeks from receipt of the written notification. If the customer objects to a change within the meaning of this § 6.4 in due form and time, the contractual relationship shall continue under the previous conditions. In this case, Varoli reserves the right to terminate the contractual relationship extraordinarily with one month's notice to the end of the month.

§ 7 Availability of the platform

7.1 During the term of the Platform Contract, Varoli shall make the Platform available to the customer with an annual average availability of 97% during operating hours. This means the availability of the services at the transfer point at which the system is connected to the Internet. The operating hours are Monday to Friday (except on public holidays in Hamburg) between 9:00 a.m. and 6:00 p.m.

7.2 Availability means the ability to use all essential functions of the platform. Times of insignificant disruptions are not considered downtime. The measuring devices of Varoli are decisive for the proof of availability.

7.3 Furthermore, times of non-availability that (1) are due to scheduled maintenance work on the platform, (2) are due to technical or other problems for which Varoli is not responsible (force majeure, fault of third parties, errors in the customer's IT systems, etc.) or (3) are due to a breach of the customer's obligation to cooperate, in particular due to delayed or incomplete transmission of an error message, shall not be considered downtime.

§ 8 Platform operation and changes

8.1 Varoli shall endeavor to keep the Platform up to date at all times. Varoli is entitled to make and/or introduce regular updates, new versions or upgrades of the Platform (hereinafter uniformly referred to as "Updates"), in particular to adapt the Platform to new technical or business requirements, to respond to user behavior, to implement new functions, to make changes to existing functionalities of the Platform or to comply with legal requirements.

8.2 In order to adapt the Platform to new or changed legal, technical (including cyber security) or business requirements or for any other valid reason, Varoli may also make updates that significantly restrict the customer's use of the Platform for the purpose of the contract, including the termination of the relevant functionalities or services (such an update is hereinafter referred to as a "material change"). In the event of a Material Change, Varoli shall notify customers who pay a fee to Varoli for the use of the Platform or for other services provided by Varoli (the "Paying Customer") in writing of the introduction of the features and the timing of the Material Change (a "Change Notice") within a reasonable period of time before the Material Change takes effect.

8.3 The Customer shall be entitled to terminate the Platform Contract free of charge within 30 days of Varoli's receipt of the Notice or the date of the Platform Change, whichever is later, if the Material Change impairs the Customer's access to or use of the Platform, unless the impairment is only minor. Varoli shall notify the paying customer of its rights under this Section 8.3 with each notification of change, in particular (i) the right to terminate the Platform Contract, (ii) the deadline set for this and (iii) the legal consequences of not objecting to the material change within the deadline.

8.4 The customer's right to terminate the Platform Contract pursuant to Section 8.2 shall not apply if Varoli has enabled the customer to continue using the Platform without the material change at no additional cost and the Platform continues to be compliant.

§ 9 Non-compliant use by the customer, compensation by Varoli

9.1 The customer may only use the platform for the purposes provided for in this contract. The customer is also not entitled (i) to have the platform or data of Varoli used by third parties, (ii) to make it accessible to third parties or (iii) to use it in any other way outside the purpose of the contract.

9.2 For each case of unauthorized use of a contractual service within the customer's area of responsibility, the customer shall pay damages in the amount of the remuneration that would have been incurred for the contractual use within the minimum contract term applicable to this service.

9.3 § 9.2 also includes the case that Varoli's opportunity to earn the transaction fee is thwarted by culpable behavior of the debtor of the transaction fee (e.g. if buyer and supplier come together via the platform regarding a material, but then conclude the third-party contract outside the platform and do not inform Varoli of this). In this case, Varoli remains entitled to demand the transaction fee.

9.4 In any case, the customer reserves the right to prove that he is not responsible for the unauthorized use or that no or significantly less damage has occurred.

9.5 In any case, Varoli shall remain entitled to claim further damages.

§ 10 Confidentiality

10.1 The parties undertake to keep secret for an indefinite period of time all confidential information that becomes known to them in the course of the contractual relationship and not to pass it on or exploit it in any other way - unless this is necessary to achieve the purpose of the contract. Confidential information is all information and documents of the parties that are marked as confidential or are to be regarded as confidential under the circumstances, in particular information about operational processes, business relationships, other trade and business secrets, know-how, Varoli's business model and all work results of Varoli.

10.2 Excluded from this obligation is such information

a) which was demonstrably already known to the other party when the contract was initiated or which subsequently became known to it from a third party without violating a confidentiality agreement, statutory provisions or official orders;

b) which were publicly known, unless this is due to a breach of contract;

c) that must be disclosed due to legal obligations or by order of a court or authority. To the extent permissible and possible, the party obliged to disclose shall in this case inform the other party in advance and give it the opportunity to oppose the disclosure.

10.3 Any disclosure of confidential information to third parties, with the exception of disclosure to third-party service providers, requires the express written consent of the other party.

10.4 The parties shall ensure through appropriate contractual agreements that the employees and contractors working for them also refrain from any use or disclosure of confidential information for themselves for an unlimited period of time. The parties shall only disclose confidential information to employees and contractors to the extent that they need to know the information in order to perform this contract.

10.5 The Customer undertakes not to grant third parties access to the Platform.

§ 11 Liability

11.1 The liability of Varoli, its legal representatives and vicarious agents for damages caused by slight negligence is excluded.

11.2 The limitation of liability according to § 11.1 shall not apply to claims for damages arising from

a) the loss of life;

b) mandatory statutory liability (e.g. product liability law);

c) the assumption of a guarantee; and/or

d) the breach of material contractual obligations (so-called cardinal obligations). Essential contractual obligations are those whose fulfillment is essential for the proper execution of a contract and on whose compliance the contracting parties may regularly rely. In the event of a slightly negligent breach of material contractual obligations, Varoli, its legal representatives and vicarious agents shall only be liable for the foreseeable damage typical for the contract, unless it concerns claims for damages arising from injury to life.

11.3 Any contributory negligence of the customer shall be taken into account. In particular, Varoli shall only be liable for the recovery of data insofar as the customer has taken all necessary and reasonable data backup measures and ensured that the data can be reconstructed from data material kept in machine-readable form with reasonable effort.

11.4 The customer is obliged to notify Varoli immediately in writing of any damage within the meaning of the above liability provisions or to have it recorded by Varoli so that Varoli is informed as early as possible and can mitigate the damage together with the customer if necessary.

11.5 The strict liability according to § 536 a Abs. 1 of the German Civil Code (BGB) for errors in the platform that already existed at the time the contract was concluded is excluded, unless the error relates to a feature of the platform that is essential for the purpose of the contract.

§ 12 Statute of limitations

12.1 Claims of the customer due to a breach of duty that does not consist of a defect shall become statute-barred within one year of the claim arising, except in cases of intent or gross negligence. This shall not apply if the damage suffered by the customer in question is an injury to life. Claims for personal injury shall become time-barred within the statutory limitation periods.

12.2 Withdrawal from the contract or a reduction in remuneration is excluded if the claim for performance or subsequent performance by the customer is time-barred.

§ 13 No non-competition and no exclusivity obligation on the part of Varoli

Varoli is not subject to any non-competition or exclusivity obligation and is entitled to provide services for other customers at home and abroad.

§ 14 Offsetting, retention, reduction

14.1 The customer shall only be entitled to set-off, reduction and/or a right of retention vis-à-vis Varoli if its counterclaims have been legally established, are undisputed or have been recognized by Varoli.

14.2 In addition, the customer shall only be entitled to exercise a right of retention to the extent that his counterclaim is based on the same contractual relationship.

14.3 The right of the Customer to reclaim remuneration not owed shall remain unaffected by the restriction of § 14.1.

§ 15 Commissioning of third parties

Varoli shall be entitled at any time to commission third parties with the provision of services (the "Third Party Service Providers"). Insofar as Varoli uses third parties for support, these are exclusively in a contractual relationship with Varoli.

§ 16 Indemnification

16.1 The customer shall indemnify Varoli against all claims asserted by other customers or other third parties against Varoli due to the infringement of their rights in connection with the use of Varoli services by the customer. The customer shall bear the costs of Varoli's necessary legal defense, including all court and attorney's fees in the statutory amount. This shall not apply if the customer is not responsible for the infringement.

16.2 In the event of a claim by other customers or third parties, the customer is obliged to provide Varoli immediately, truthfully and completely with all information necessary for the examination of the claims and a defense.

§ 17 Intellectual property, rights of use

17.3 The Platform is protected by copyright. The sole owner of all intellectual and industrial property rights is Varoli (or its licensor).

17.4 Varoli shall not grant the customer any rights of use unless these are necessary for the use of Varoli's services within the scope of the agreed contractual purpose. The rights granted in this respect are (i) non-exclusive, (ii) non-transferable, (iii) non-sublicensable and (iv) limited in time to the duration of the platform contract between Varoli and the customer. In particular, the Customer is not entitled to disassemble, reverse engineer or reverse compile the Platform in whole or in part, except as permitted by applicable law; (iv) modify, adapt, alter or create derivative works from the Platform; (v) merge the Platform with other software, except as permitted by applicable law; (vi) remove proprietary notices from the Platform; (v) copy, distribute or publicly reproduce any content of the Platform.

17.5 Insofar as the customer provides Varoli with protected content (e.g. graphics, trademarks or other content protected by copyright or trademark law), the customer shall grant Varoli all rights necessary for the execution of the contractual relationship. This includes in particular the right to make the relevant content publicly accessible. In this context, the customer assures that he has all necessary rights to the materials provided in order to grant Varoli the corresponding rights.

§ 18 Data protection, data use, advertising consent

18.1 The use of the services offered by Varoli by the customer may require the processing of personal data. Insofar as Varoli processes personal data as a processor on behalf of the customer, the provisions of Annex 1 (Data Protection Addendum) shall apply to this processing. Further details of the relevant processing activities for which Varoli acts as processor are set out in the Appendix to Annex 1. In the event of any conflict or inconsistency between Appendix 1 and other provisions in these GTC, the provisions of Appendix 1 shall prevail.

18.2 In relation to certain processing activities (in particular in connection with fraud prevention, compliance controls, financial management, legal compliance, operation of the Varoli business and marketing), Varoli may process the relevant personal data as controller.

18.3 Customer and Varoli shall each comply with applicable data protection laws in relation to the processing of personal data in connection with these GTC and the related processing activities. Customer shall not by any act or omission cause Varoli to be in breach of applicable Data Protection Laws.

18.4 Varoli shall be entitled to use the data entered into the Platform by Customer in anonymized or aggregated form for the purposes of the contractual relationship of Customer in relation to the Third Party Contract. Varoli will do this in particular to improve existing functions of the Platform or to provide new functions of the Platform.

§ 19 Term

19.1 Unless otherwise agreed in the Platform Contract, the term of the Platform Contract shall be one (1) year and shall be extended by one (1) year in each case if the contract is not terminated with two weeks' notice to the end of the respective term.

19.2 The right to extraordinary termination shall remain unaffected. Varoli shall be entitled to extraordinary termination in particular if

a) the customer uses the services of Varoli for illegal purposes;

b) the customer uses Varoli's services primarily to obtain market and/or competitive information;

c) the customer is more than two (2) months in arrears with a payment due, even after the expiry of a reasonable period set by Varoli to remedy the situation;

d) the customer is in serious breach of its contractual obligations and Varoli can therefore no longer be reasonably expected to adhere to the contract;

e) insolvency proceedings are applied for, opened or dismissed against the customer's assets in whole or in part;

f) the customer has a reason for insolvency within the meaning of § 17 - 19 InsO; or

g) the client's financial circumstances deteriorate to such an extent that proper fulfillment of the contract can no longer be expected, even if there is no reason for insolvency within the meaning of §§ 17 - 19 InsO;

19.3 Any termination requires at least text form by email.

19.4 Varoli points out to the customer that it is his responsibility to back up his data in good time before termination of the contract. For technical reasons, Varoli cannot guarantee that the customer will be able to access its data after termination of the contract. During the term of the contract with the customer, Varoli will not delete the data entered by the customer in the platform, unless Varoli is legally obliged to do so (e.g. due to legal violations caused by the data entered by the customer).

§ 20 Marketing

20.1 The customer agrees that Varoli may disclose the cooperation between Varoli and the customer for marketing purposes and also use the customer's company logo and brand in this context.

20.2 The customer further agrees to act as a testimonial for Varoli. As such, the customer shall submit a publishable statement in which it describes the customer's use of the platform and the associated benefits and successes in a clear and meaningful way.

20.3 The customer may revoke the consents granted under this Section 20 at any time with effect for the future by means of a declaration in text form (e.g. by email to info@varoli.de).

§ 21 Final provisions

21.1 Amendments, supplements or rescissions of these GTC must be made in text form to be effective, unless a stricter form is required by law. This also applies to the amendment or revocation of this text form clause.

21.2 None of the provisions of these GTC shall create rights in favor of third parties who are not party to these GTC.

21.3 Insofar as these GTC refer to the written form or notification, the sending of an e-mail shall also be sufficient in each case. E-mails to Varoli must always be sent to the following e-mail address: info@varoli.de

21.4 Should individual provisions of these GTC be or become invalid or unenforceable in whole or in part, or should the GTC not contain a necessary provision, this shall not affect the validity of the remaining provisions of the GTC. In place of the invalid or unenforceable provision or to fill the gap, the legally permissible provision that comes closest to what the parties would have wanted or what the parties would have agreed according to the meaning and purpose of the GTC if they had considered the invalidity or unenforceability of the provision in question or the gap shall be deemed to have been subsequently agreed. This also applies if the invalidity or unenforceability is based on a performance or time measure prescribed in the GTC. In this case, the measure of performance or time prescribed in the GTC shall be replaced by a legally permissible measure of performance or time that comes as close as possible to what was intended.

21.5 The GTC shall be governed by the laws of the Federal Republic of Germany to the exclusion of the German conflict of laws rules and the United Nations Convention on Contracts for the International Sale of Goods.

21.6 For all disputes arising out of or in connection with the contract, including the validity of the GTC, the Düsseldorf Regional Court shall have exclusive jurisdiction, to the extent permitted by law.

Addendum on data protection

§ 1 Purpose and scope

1.1 The Parties agree that this Data Protection Addendum ("DPA") sets out their obligations in relation to the processing of personal data by Varoli as processor ("Processor") of the Customer ("Controller") in connection with the provision of the relevant Services.

1.2 This DPA applies to the Processing of Personal Data as set out in the Appendix. For the avoidance of doubt, this DPA does not apply to the Processing of Personal Data by Varoli as Controller.

1.3 The purpose of this GDPR is to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data ("GDPR").

1.4 This GDPR shall not affect the obligations to which the controller is subject under the GDPR.

§ 2 Interpretation

2.1 Terms used but not defined in this GDPR shall have the meanings given to them in the GTC, and where terms defined in the GDPR are used in this GDPR, those terms shall have the same meaning as in the GDPR.

2.2 This GDPR shall be read and interpreted in the light of the General Data Protection Regulation.

2.3 This GDPR shall not be interpreted in a manner inconsistent with the rights and obligations provided for in the GDPR or in a manner that adversely affects the fundamental rights or freedoms of data subjects.

§ 3 Hierarchy

In the event of a conflict between this GDPR and the provisions of the main part of the GTC or related agreements between the parties existing at the time of the agreement of this GDPR or concluded thereafter, this GDPR shall prevail.

§ 4 Description of the processing(s)

The details of the processing operations, in particular the categories of personal data and the purposes of the processing for which the personal data are processed on behalf of the controller, are set out in the Annex to this GDPR.

§ 5 Instructions

5.1 The processor shall process personal data only on documented instructions from the controller, unless the processor is obliged to do so under European Union law or the law of the Member States to which the processor is subject. In this case, the processor shall inform the controller of this legal requirement prior to processing, unless the law prohibits this for important reasons of public interest. This GDPR and the related agreements between the parties are the final instructions of the controller at the time of signing this GDPR for the processing of personal data. Any subsequent instruction must be agreed in accordance with the procedure for amending the T&Cs.

5.2 The Processor shall inform the Controller without undue delay if it considers that an instruction given by it infringes the GDPR or the applicable law of the European Union or the data protection provisions of a Member State.

§ 6 Purpose limitation

The processor shall process the personal data only for the purpose(s) of the processing specified in the Annex, unless it receives further instructions from the controller.

§ 7 Duration of the processing of personal data

Processing by the Processor shall only take place for the duration specified in the Annex to this Privacy Policy.

§ 8 Security of processing

8.1 The Processor shall take appropriate technical and organizational measures as required by Art. 32 GDPR. This includes the protection of data against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, the data (personal data breach). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing and the risks for the data subjects.

8.2 The Processor shall only grant its employees access to the Personal Data that is the subject of the Processing to the extent strictly necessary for the performance, management and monitoring of the Contract. The Processor shall ensure that the persons authorized to process the personal data received have committed themselves to confidentiality or are subject to a corresponding statutory duty of confidentiality.

§ 9 Sensitive data

Where the processing involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person's sex life or sexual orientation, or data relating to criminal convictions and offenses ("sensitive data"), the processor shall apply specific restrictions and/or additional safeguards.

§ 10 Documentation and compliance

10.1 The parties must be able to demonstrate compliance with this GDPR

10.2 The Processor shall be obliged to respond promptly and appropriately to requests from the Controller regarding the processing of data in accordance with this GDPR.

10.3 At the written and reasonable request of the Controller, the Processor shall cooperate with audits or inspections by providing the Controller with audit reports that are confidential information of the Processor. If, in the opinion of the controller, the information provided is not sufficient to fulfill its obligations under the GDPR, the controller may request additional information. In addition, if required by a supervisory authority, a court or applicable law, the controller may engage an independent auditor to conduct an audit of the personal data processed for the purposes of this GDPR.

10.4 The Parties shall make the information referred to in this Clause 10, including the results of any audit, available to the relevant Supervisory Authority(ies) upon request.

§ 11 Use of sub-processors

11.1 The Processor shall have the Controller's general authorization to engage subprocessors. The Processor shall inform the Controller at least 14 calendar days in advance of any intended addition or replacement of sub-processors, so that the Controller has sufficient time to reasonably object to such changes prior to the engagement of the relevant sub-processor(s). The Controller may object to a change on reasonable grounds within 7 calendar days of receipt of the change notice. The Controller acknowledges that the Processor's sub-processors are essential for the provision of the Services in question and that if the Processor objects to the Processor engaging a sub-processor, the Processor shall not be obliged to provide the Controller with the Services for which the Processor engages such sub-processor, notwithstanding anything to the contrary in the Agreement or any related agreement.

11.2 Where the Processor engages a Sub-Processor to carry out specific Processing Activities (on behalf of the Controller), it must do so by way of a contract that imposes data protection obligations on the Sub-Processor that are similar to those imposed on the Processor under this GDPR.

11.3 If a Sub-Processor fails to comply with its data protection obligations under this Agreement, the Processor shall be liable to the Controller for the acts and omissions of its Sub-Processor to the same extent that the Processor would be liable if it were carrying out the relevant Processing of Personal Data directly under this GDPR.

§ 12 International transfers

12.1 Any transfer of data to a third country or to an international organization by the Processor shall be made only on the basis of documented instructions from the Controller or to meet a specific requirement under European Union law or the law of a Member State to which the Processor is subject and shall be in accordance with Chapter V of the GDPR. For the avoidance of doubt, the authorization to engage sub-processors included in the list of sub-processors shall also constitute an instruction by the controller to transfer the personal data concerned to those sub-processors.

12. 2 The Controller agrees that where the Processor engages a Sub-Processor pursuant to Clause 11 to carry out certain Processing Activities (on behalf of the Controller) and such Processing Activities involve a transfer of Personal Data within the meaning of Chapter V of the GDPR, the Processor and the Sub-Processor may ensure compliance with Chapter V of the GDPR by using standard contractual clauses adopted by the Commission pursuant to Article 46(2) of the GDPR, provided that the conditions for the use of such standard contractual clauses are met.

§ 13 Support for the controller

13.1 To the extent required by applicable data protection laws, the Processor shall inform the Controller without undue delay of any request received from the Data Subject. It may not respond to the request itself unless it has been authorized to do so by the controller.

13.2 The Processor shall provide reasonable assistance to the Controller, at the Controller's expense, in fulfilling its obligations to respond to requests from Data Subjects to exercise their rights, taking into account the nature of the Processing.

13.3 In addition to the Processor's obligation to assist the Controller under Clause 13.2, the Processor shall provide reasonable assistance to the Controller, at the Controller's expense, in complying with the following obligations, taking into account the nature of the data processing and the information available to the Processor:

a) the obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (a "data protection impact assessment") where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons;

b) the obligation to consult the competent supervisory authority or authorities prior to processing where a data protection impact assessment indicates that the processing would result in a high risk if the controller does not take measures to mitigate the risk;

c) the obligation to ensure the accuracy and timeliness of the personal data by informing the controller without undue delay if the processor becomes aware that the personal data it is processing is inaccurate or out of date;

d) the obligations pursuant to Art. 32 GDPR;

§ 14 Notification of personal data breaches

14.1 In the event of a personal data breach, the processor shall cooperate with and provide reasonable assistance to the controller, at the controller's expense, to enable the controller to comply with its obligations under Articles 33 and 34 of the GDPR, taking into account the nature of the processing and the information available to the processor.

14.2 In the event of a personal data breach concerning data processed by the controller, the processor shall provide reasonable assistance to the controller at the controller's expense:

a) to notify the personal data breach to the competent supervisory authority or authorities, where appropriate, without undue delay after having become aware of it (unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons);

b) when obtaining information pursuant to Art. 33(3) GDPR;

c) when complying with the obligation pursuant to Art. 34 GDPR to communicate a personal data breach to the data subject without undue delay where the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons;

14.3 In the event of a personal data breach involving data processed by the Processor, the Processor shall notify the Controller without undue delay after becoming aware of the personal data breach. This notification shall include at least the following

a) a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects and data sets concerned);

b) the details of a contact point from which further information about the personal data breach can be obtained;

c) the likely consequences of the breach and the measures taken or planned to address the breach, including the mitigation of its possible adverse effects;

If and to the extent that it is not possible to provide all such information at the same time, the first notification shall contain the information available at that time and further information shall be provided as soon as it becomes available, without undue delay.

§ 15 Termination

15.1 The term of this DPA shall commence on the effective date of the Platform Contract and shall end on the date on which the Platform Contract is terminated or expires.

15.2 Upon termination of the provision of services under the Platform Agreement, the Processor shall, at the Controller's option, delete or return all Personal Data to the Controller and delete any existing copies, unless the Processor is required or authorized by applicable law to retain Personal Data for a longer period of time.