General Terms and Conditions for Conformity Assessments (Inspection and Certification)

1. General Provisions / Scope of Application
1.1. These General Terms and Conditions (GTC) shall apply exclusively to all legal transactions between TRUSTIFAI GmbH (hereinafter referred to as the Contractor) and the client (hereinafter referred to as the Client). The version valid at the time the contract is concluded shall apply.
1.2. These GTC shall also apply to all future contractual relationships, including cases where they are not expressly referred to in supplementary agreements.
1.3. The Client’s purchasing terms and any other terms and conditions are hereby excluded for the entire business relationship unless expressly accepted by the Contractor in writing.

2. Scope of Services
2.1. Unless otherwise agreed in writing, offers made by the Contractor are subject to change and non-binding.
2.2. The Contractor provides conformity assessments in the fields of information security and data protection. These services include both inspection and certification activities relating to management systems (procedures, processes), services, IT systems and products in accordance with national or international regulations and standards or criteria developed by the Contractor.
2.3. The procedure, scope and validity of the inspection or certification shall comply with the applicable regulations, these GTC and any other contractual agreements between the Contractor and the Client, provided that such agreements do not conflict with the applicable regulations. In this context, the inspection or certification body shall not provide consulting services.
2.4. The scope of the specific inspection or certification shall be agreed in writing on a case-by-case basis. Amendments and supplements to the contract must be made in writing. This also applies to any agreement to waive the written-form requirement itself. Oral information, ancillary agreements and commitments made by officers or employees of the Contractor shall only be binding at any stage of contract performance if confirmed in writing.
2.5. The Contractor shall use qualified personnel who are bound by confidentiality obligations. The Contractor may use assessors in compliance with the applicable inspection and certification requirements. External assessors or other third parties may be engaged by the Contractor subject to the Client’s approval. Such approval shall be deemed granted unless the Client objects in writing within six calendar days. The remuneration of external assessors shall be the sole responsibility of the Contractor.
2.6. Any assignment or other disposal of rights or obligations arising from the contract shall require the prior written consent of the other contracting party. The Contractor shall, however, be entitled to transfer the contract to an affiliated company within its corporate group without the Client’s consent.
2.7. During the term of this contractual relationship and for three years following its termination, the Client undertakes not to enter into any form of business relationship with persons or companies used by the Contractor to fulfil its contractual obligations. In particular, the Client shall not commission such persons or companies to provide services that are identical or similar to those offered by the Contractor.
2.8. During the term of the contract and for one year following its termination, the Client shall neither directly nor through third parties solicit or recruit employees used by the Contractor to provide the services. For each breach of this obligation, the Client shall pay the Contractor a contractual penalty amounting to twelve times the gross monthly salary most recently paid by the Contractor to the employee concerned, but at least the applicable collective agreement salary for an employee of a company providing data processing and information technology services at the experience level for specialised activities (ST2). For contracts with consumers within the meaning of the Austrian Consumer Protection Act, the foregoing provision shall apply only insofar as mandatory provisions of the Consumer Protection Act do not provide otherwise.

3. Client’s Duty to Cooperate
3.1. The Client shall ensure that the Contractor is granted access to all information and assessment documentation required to fulfil the engagement. The Client is responsible for the accuracy of the assessment documentation provided to the Contractor. The Contractor may therefore rely on the accuracy of the information supplied by the Client.
3.2. The Client shall immediately notify the Contractor of any change that may affect the inspection or certification.

In particular, the Contractor shall be notified immediately of:

changes to the subject of the inspection or certification, the management system or other processes,
changes to the product,
changes to the legal or organisational form,
personnel or management changes insofar as these are relevant to the inspection or certification,
changes to locations involved in the assessment.

3.3. If the Client fails to comply with its duty to cooperate despite a deadline set by the Contractor, the contract shall be deemed terminated upon expiry of that deadline. The full agreed fee shall remain payable and the application for certification shall be rejected. Such breaches may also result in withdrawal of a certificate.
3.4. The Client shall implement the certification requirements specified in the applicable regulations.
3.5. The Client shall record all complaints relating to compliance with certification requirements and shall provide such records to the certification body upon request. Any measures taken by the Client in response to such complaints shall be documented.

4. Conformity Mark / Logo
4.1. Following successful review of the documentation and a positive on-site inspection (audit), the Client shall receive the corresponding certificate and, where applicable, the corresponding logo. The Client has no legal entitlement to a positive outcome or to certification being granted. The decision as to whether the requirements for certification have been met rests exclusively with the Contractor.
4.2. The certificate, related certification documents, certificates and logo shall remain the property of the Contractor. The Client is entitled to use the certificate and, where applicable, the logo for advertising purposes in accordance with the certification conditions. The scope and period of validity must be stated. The Client may not alter the certificate or logo, except for proportional resizing for advertising purposes, for example in electronic media.
4.3. In particular, the Client undertakes:

to present the certificate and, where applicable, the logo correctly and unambiguously,
to use the certificate and, where applicable, the logo only for purposes falling within the scope of certification,
not to make misleading statements regarding the certification,
in the event of withdrawal, termination, suspension or restriction of the scope of the certificate and, where applicable, the logo, to amend or discontinue its use in the relevant media accordingly.

4.4. Upon expiry of the certificate’s validity, or if the certificate and/or, where applicable, the logo is used contrary to the obligations described above or in breach of the contract or applicable regulations, the right of use shall expire immediately.

5. Warranty
5.1. The Client shall inspect the Contractor’s work or service immediately after performance and shall notify the Contractor in writing of any defects identified or identifiable without delay and, in any event, no later than seven calendar days after performance. Failure to do so shall result in the exclusion of any liability of the Contractor. Hidden defects must be notified in writing immediately after discovery and within the warranty period. Any notice of defect shall not entitle the Client to withhold invoice amounts in whole or in part.
5.2. Irrespective of fault, the Contractor shall be entitled and obliged to correct any inaccuracies or defects in its services that become known. The Contractor shall inform the Client of such corrections without delay.
5.3. The Client’s warranty claims shall expire six months after the relevant service has been performed by the Contractor. The warranty period shall neither be extended nor interrupted by remediation or attempted remediation, particularly if such remediation takes place outside the agreed warranty period.
5.4. If the Client fails to submit a timely notice of defects in accordance with Clause 5.1, all warranty claims, claims for damages arising from the defect itself and claims based on error regarding the absence of defects shall be expressly excluded, unless employees of the Contractor caused such claims intentionally or through gross negligence.

6. Liability / Damages
6.1. If the Client asserts claims for damages against the Contractor, the Client shall bear the burden of proof with regard to causation, unlawfulness, fault and the degree of fault. The assignment of warranty claims and claims for damages to third parties or similar arrangements shall not be permitted.
6.2. If the Client suffers damage due to a delay in a bindingly agreed performance deadline for which the Contractor is responsible, the maximum amount recoverable shall be 5% of the portion of the engagement affected by the delay.
6.3. The exclusions and limitations of liability set out below shall also apply to tort claims insofar as such claims compete with contractual claims.
6.4. The Contractor shall not be liable for property damage or financial loss caused by slight negligence. In cases of ordinary gross negligence, the Contractor’s liability shall be limited to EUR 7,500,000 for property damage and EUR 3,000,000 for pure financial loss. This exclusion shall not apply to property damage or financial loss caused by particularly gross negligence or intent on the part of the Contractor.
6.5. The exclusions and limitations of liability shall not apply to personal injury.
6.6. With the exception of personal injury, the Contractor’s liability shall in all cases also be limited to the type of damage typical for the contract and foreseeable by the Contractor at the time the contract was concluded or the breach of duty occurred.
6.7. The exclusions and limitations of liability set out in Clauses 6.1 to 6.6 shall also apply to the Contractor’s liability for its officers and employees, as well as to the personal liability of the Contractor’s officers, employees and other vicarious agents.
6.8. Claims for damages by the Client may only be brought before a court within six months from the date on which the Client became aware of the damage and the party responsible for it, but in any event no later than three years after the event giving rise to the claim.
6.9. Where the Contractor performs the work with the assistance of third parties and warranty and/or liability claims arise against such third parties, the Contractor shall assign such claims to the Client. In such cases, the Client shall primarily pursue its claims against those third parties.
6.10. If the Contractor is liable to the Client for intentional conduct or particularly gross negligence on the part of its officers, employees or vicarious agents, the Contractor may require the Client to assign any claim for damages against the relevant officer, employee or vicarious agent to the Contractor.
6.11. Liability for consequential loss arising from defects, including in particular loss of profit, loss of anticipated savings, loss of earnings, other financial loss, interest losses and similar damages, is expressly excluded. Any statutory liability that may nevertheless exist shall in all cases be subject to all limitations set out in this section on liability and damages.

7. Secrecy / Confidentiality / Data Protection
7.1. The Contractor undertakes to treat all business and trade secrets disclosed to it by the Client in connection with this contract and its performance as confidential and not to make them accessible to third parties, insofar as such information:

is not generally known,
was not already known to the Contractor without an obligation of confidentiality,
was not disclosed or provided to the Contractor by a third party without an obligation of confidentiality,
was not demonstrably developed independently by the Contractor, or
is not required to be disclosed pursuant to a final decision of an authority or court.

7.2. The Contractor further undertakes to maintain confidentiality vis-à-vis third parties regarding the entire content of the work as well as all information and circumstances made known to it in connection with the preparation of the work, including in particular data relating to the Client’s customers.
7.3. The Contractor shall be released from its confidentiality obligation vis-à-vis any assistants and representatives used by it, provided that the Contractor fully transfers the confidentiality obligation to such persons.
7.4. The Contractor shall require its employees to maintain confidentiality regarding all facts made known to them in connection with the engagement.
7.5. The Client permits the Contractor to make copies for its files of written documents provided to the Contractor for inspection and required for performance of the contract.
7.6. The confidentiality and secrecy obligations shall continue indefinitely beyond the end of the contractual relationship. Exceptions shall apply where disclosure is required by law.
7.7. When processing personal data, the Contractor shall comply with the Austrian Data Protection Act (DSG), the General Data Protection Regulation (GDPR) and the Telecommunications Act (TKG) and shall implement the technical and organisational measures required for data protection within the Contractor’s area of responsibility.
7.8. In particular, the Contractor shall instruct its employees to comply with the provisions of Section 6 DSG.
7.9. The privacy notice pursuant to Articles 13 and 14 GDPR and, where required, the data processing agreement pursuant to Article 28(3) GDPR shall be attached to the engagement.
7.10. Information or data of the Client shall only be disclosed to third parties where such disclosure is required by law or ordered by an authority or court.

8. Fees
8.1. Upon completion of the agreed work, the Contractor shall receive the fee agreed between the Client and the Contractor. The Contractor shall be entitled to issue interim invoices in line with the progress of the work and to request advance payments corresponding to such progress. The fee shall become due upon invoicing by the Contractor.
8.2. The scope of the engagement shall be defined in writing when the order is placed. If changes or overruns of the agreed scope become necessary in the proper performance of the engagement, the Contractor shall be entitled, on the basis of these GTC, to carry them out without a separate written order, provided that the most recently agreed fee is not exceeded by more than 10%. If the modification exceeds 10%, it must be agreed in writing before the additional service is performed. If the modification of the scope increases the most recently agreed fee by more than 50%, the Client shall be entitled to withdraw from the contract within three days of notification of the new fee. The Client shall, however, pay the agreed remuneration for the services already performed.
8.3. The Contractor shall issue an invoice entitling the Client to deduct input VAT and containing all legally required information.
8.4. Any cash expenses, out-of-pocket expenses, travel costs and similar expenses incurred shall be reimbursed separately by the Client upon invoicing by the Contractor.
8.5. Any objections to invoices must be communicated to the Contractor in writing and with sufficient detail within two weeks of receipt of the invoice; otherwise, the invoice shall be deemed accepted.
8.6. The Client shall not be entitled to set off claims of any kind unless such claims have been finally established by a court or acknowledged in writing by the Contractor.
8.7. If the agreed work is not performed for reasons attributable to the Client, or due to justified early termination of the contractual relationship by the Contractor, the Contractor shall retain the right to payment of the full agreed fee less any expenses saved. If an hourly fee has been agreed, the fee shall be payable for the number of hours that would have been expected for completion of the entire agreed work, less expenses saved. The expenses saved shall be deemed to amount to 30% of the fee for those services not yet performed by the Contractor as of the date of termination of the contractual relationship.
8.8. In the event of default in payment, even in respect of only one due claim, all outstanding claims, including those arising from other engagements and regardless of any differing payment arrangement, shall become immediately due. The Contractor may, at its discretion, either demand immediate payment of all outstanding claims and suspend performance until payment is made, or terminate the contract without notice and claim damages for non-performance. In the event of default, the Contractor shall be entitled to charge default interest of 9.2 percentage points per annum above the base interest rate of the Austrian National Bank and to charge its own reminder fees of EUR 4.00 per reminder.
8.9. The Client further undertakes to reimburse the Contractor for all costs and expenses actually incurred as a result of the Client’s default and necessary for appropriate legal enforcement. Without prejudice to any procedural entitlement to reimbursement of costs, this shall include in particular extrajudicial costs, reminder fees, costs of debt collection agencies and legal fees insofar as they were appropriate and necessary.

9. Electronic Invoicing
The Contractor shall be entitled to send invoices to the Client electronically. The Client expressly agrees to receive invoices from the Contractor in electronic form.

10. Term of the Contract
10.1. As a general rule, the contract shall end upon completion of the project.
10.2. Notwithstanding the above, either party may terminate the contract at any time for good cause without observing a notice period. Good cause shall include, in particular:

a contracting party materially breaching its contractual obligations,
a contracting party failing to comply with material contractual provisions,
a contracting party falling into payment default after insolvency proceedings have been opened,
justified concerns regarding the creditworthiness of a contracting party against whom no insolvency proceedings have been opened, where that party fails, upon the Contractor’s request, either to make advance payments or provide suitable security before the Contractor performs its services, provided that the other contracting party was not aware of the adverse financial circumstances when the contract was concluded.

11. Final Provisions
11.1. Unless otherwise agreed, the statutory provisions applicable between businesses shall apply exclusively under Austrian law, even where the engagement is performed abroad. Any disputes shall be subject exclusively to the local jurisdiction of the court having subject-matter jurisdiction at the Contractor’s registered office. For sales to consumers within the meaning of the Austrian Consumer Protection Act, the foregoing provisions shall apply only insofar as mandatory provisions of the Consumer Protection Act do not provide otherwise.
11.2. If one or more provisions of the contract are or become wholly or partly invalid or unenforceable, the validity of the remaining provisions shall not be affected. The invalid or unenforceable provision shall be replaced by a valid provision that most closely reflects the economic purpose of the invalid or unenforceable provision.