General Terms and Conditions for Software Products of Widas

Version 3 / As of 07.08.2026

1. Scope and Amendments

1.1.

The three applications Identity as a Service („cidaas“), Cloud Native Integration Platform Service („cnips“) and clavik Vault Service („clavik“) are software products offered as Software as a Service (hereinafter the „Products“) of Widas ID GmbH, Maybachstraße 2, D-71299 Wimsheim (hereinafter „Widas“).

1.2.

These General Terms and Conditions for Software Products of Widas (hereinafter the „Terms and Conditions“) apply to the provision of all Products obtained by the Customer, in each case in their then-current version, to enterprises (Section 14 of the German Civil Code („BGB“)), corporations or institutions under public law, or special funds under public law (hereinafter the „Customer“).

1.3.

Widas’s separate offer, or the subscription agreed by the Customer via the respective product website or the cSpace customer portal (also referred to as the „Plan“ or the „Service Description“), together with the product-specific service descriptions provided, the respective product-specific Service Level Agreement, and these Terms and Conditions, form the contractual basis between Widas and the Customer (all such contractual documents together hereinafter the „Agreement“ and each individually a „Schedule“). The contractual documents for the respective Products obtained by the Customer are available

  1. for cidaas at https://www.cidaas.com/contractual-documents/
  2. for cnips at https://cnips.io/contractual-documents/
  3. for clavik at https://clavik.io/contractual-documents/

Insofar as the separate offer provides for deviating contractual documents, such documents shall form part of the Agreement with priority.

1.4.

In the event of conflicts between the contractual documents, the following order of precedence shall apply, whereby the lower-numbered document takes precedence over the higher-numbered document:

  1. Widas’s separate offer
  2. the selected Plan
  3. the Service Level Agreement
  4. the product-specific service descriptions
  5. these Terms and Conditions
  6. the provisions of the Data Processing Agreement (Schedule 1 to these Terms and Conditions).
1.5.

Deviating, conflicting, or supplementary terms and conditions of the Customer shall not become part of the Agreement, even if Widas concludes the Agreement with knowledge of such terms and conditions. The application of any such terms and conditions is expressly objected to. The precedence of individual agreements (Section 305b BGB) between Widas and the Customer (hereinafter individually or jointly the „Party“ or the „Parties“) over these Terms and Conditions remains unaffected.

1.6.

Widas reserves the right to amend the Agreement, including these Terms and Conditions. Amendments to the Agreement shall become effective if the Customer does not object to the amendment within four (4) weeks of receipt of a notice of amendment in text form (Section 126b BGB), and Widas has informed the Customer, in the notice of amendment, of its right to object and the objection period. If the Customer objects to the amendment in text form (Section 126b BGB), the Agreement shall continue unchanged, and Widas shall be entitled to terminate the Agreement for cause, subject to one (1) month’s notice, effective at the end of the following calendar month. Excluded from this reservation of the right to amend are amendments relating to an obligation of a Party the performance of which is essential to the proper performance of the Agreement in the first place and on the observance of which the other Party regularly relies or may rely (hereinafter a “Material Contractual Obligation”).

1.7.

Section 312i(1) nos. 1, 2, and 3 BGB, as well as Section 312i(1) sentence 2 BGB, governing agreements concluded in electronic commerce, shall not apply.

1.8.

These Terms and Conditions are provided in the German language as well as in an English translation. In the event of any discrepancies between the German and the English versions, only the German version shall be authoritative.

2. Conclusion of the Agreement, Registration

2.1.

The Agreement may be concluded on a self-service basis via the cSpace customer portal or pursuant to a separate offer from Widas. In the former case, an agreement is concluded only once Widas has confirmed its conclusion.

2.2.

An agreement is concluded exclusively between the Customer and Widas. No contractual relationship exists between Widas and any users authorised by the Customer to use the Products, or any other third parties. Section 179 BGB remains unaffected.

2.3.

Use of the Products always requires registration and the creation of a user account (hereinafter the „Account“). Access to the services ordered is also managed through this Account.

3. Services under the Agreement

3.1.

The subject matter of the Agreement is the provision, as a Software as a Service offering, of the Products obtained by the Customer, as well as, where applicable, other related services, such as initial implementation support or Professional Services.

3.2.

Widas owes only the performance of the services specified in the Agreement. Widas does not owe any characteristics of the services beyond those set out in the respective service description and the respective Service Level Agreement.

3.3.

The interoperability of the services to be provided by Widas under the Agreement with IT systems or other hardware, software, or services used by the Customer does not form part of the owed characteristics of the services, unless the respective Product is expressly designated in text form as compatible therewith.

3.4.

Where the Agreement refers to a Schedule, this shall mean the version of the respective Schedule in effect at the time the service is ordered. Widas shall keep amended Schedules available for retrieval via the internet free of charge, as set out in Section 1.3 hereof. The Customer is obligated to inform itself, before ordering new services, of the versions of the Schedules in effect at that time. Services already ordered prior to notice of any amendments shall remain unaffected by amendments to the Schedules.

3.5.

In addition, the following applies on a product-specific basis:

cidaas: In addition to the fee-based version of cidaas as a Software-as-a-Service product, “cidaas Free” may also be the subject of the Agreement as a free version; Section 4 applies in this regard.

cnips: cnips is provided to the Customer as a fee-based Integration-Platform-as-a-Service solution, enabling the Customer to implement integrations between different systems.

clavik: clavik is provided to the Customer as a fee-based Vault Service for the centralised management of secrets, API keys, certificates, and cryptographic keys across SaaS platforms, cloud environments, and CI/CD pipelines.

3.6.

Which Product, and which scope of functionality, use, and availability, forms part of the services under the Agreement, follows from the provisions of the Agreement, in particular the offer, the selected subscription, the service descriptions, the Service Level Agreements, the service descriptions, and these Terms and Conditions. Section 10 additionally applies to the provision of Interfaces. Section 11 additionally applies to the provision of AI Functions.

3.7.

Widas has no influence over the availability, stability, and functionality of the internet as a whole, or of the infrastructure required to establish a connection to the respective Product at the premises of the Customer or third parties (e.g., access providers, backbones, DNS servers, etc.); services in this respect are not part of the Agreement.

3.8.

The creation, by Widas, of backups of the content processed in and by the Products (including data and information) does not form part of the services, subject to a separate agreement between the Parties.

4. Nature and Scope of Free Services Provided by Widas

4.1.

Insofar as the Products are expressly made available free of charge (hereinafter “Free Services”), the following provisions shall apply with priority:

4.2.

The Customer has no claim to any particular functionalities or usage options. Free Services are provided “as is.” The usage options and functionalities may be adjusted by Widas at any time without notice, and may be discontinued in whole or in part.

4.3.

No particular availability is warranted for Free Services.

4.4.

Deviating provisions apply with respect to liability (Section 13) and data protection (Section 15).

5. Subcontractors of Widas

5.1.

Widas is entitled to render its services, in whole or in part, through subcontractors. In doing so, Widas shall structure its agreement with the subcontractor such that, with respect to the services to be rendered by the subcontractor, it corresponds to Widas’s obligations towards the Customer.

5.2.

Widas shall be responsible for the fault of its subcontractors to the same extent as for its own fault. Services rendered by a subcontractor shall, in relation to the Customer, be deemed services of Widas.

5.3.

Widas will, at the Customer’s request, inform the Customer in text form (Section 126b BGB) of the engagement of subcontractors by naming the subcontractor and the services to be rendered by it. The provisions on subcontractors set out in the Data Processing Agreement pursuant to Article 28(3) GDPR remain unaffected by this Section 5 hereof.

6. Customer’s Rights of Use in the Products

6.1.

Upon provision, the Customer receives the non-exclusive, revocable right, limited in time to the term of the Agreement and non-transferable, to use the respective Product, taking into account any quantitative metrics provided for in the Agreement, such as the maximum number of users or volume. Use includes the right to temporarily store, load, display, and run the respective Product, insofar as this is necessary for the intended use of the respective Product. This shall also apply insofar as reproductions of the respective Product are necessary for this purpose.

6.2.

The right of use exists worldwide, except in those countries in which Widas, due to governmental measures (e.g., export restrictions), does not generally offer the Products in whole or in part, and access thereto is accordingly not intended to be possible. Access is accordingly not possible where, upon accurate geolocation, access is blocked for all customers in the relevant country due to governmental measures. Widas will, upon request, inform the Customer of the countries in which the Products are, in whole or in part, unavailable pursuant to the foregoing rule.

6.3.

Use of the Products is permitted for all of the Customer’s business purposes, insofar as they do not conflict with the intended purpose of use. Use of the Products for purposes other than those specified in the Agreement is prohibited. This applies in particular to any processing or commercial exploitation of the Products by way of the gratuitous or paid, permanent or temporary transfer to third parties; for these purposes, and subject to any deviating provision in the Agreement, companies affiliated with the Customer within the meaning of Sections 15 et seq. of the German Stock Corporation Act (AktG) shall also be deemed third parties. The Customer shall not use the Products to develop or improve, directly or indirectly, a comparable service or a comparable product, whether itself or through third parties.

6.4.

Subject to any statutory limitations (e.g., under copyright law), the provisions of Sections 6.1 to 6.3 shall also apply to all individual components and parts of the Products, unless the part, taken on its own, enjoys no copyright or other statutory protection.

6.5.

The Customer has no claim to the delivery of the source code of the Products. Decompilation of the Products is prohibited. The Customer’s mandatory rights under Sections 69d and 69e of the German Copyright Act (UrhG) remain unaffected.

6.6.

All rights in trade symbols, rights in business designations, rights of name, trademark rights, copyrights, related rights, and other rights in the Products themselves, in the individual graphic and textual elements, and in the functionalities and services, belong solely to Widas and may not, outside the scope permitted under the Agreement, be used, distributed, copied, reproduced, made publicly available, performed, transmitted, or otherwise exploited without Widas’s prior consent in text form.

7. Fees, Payment Terms

7.1.

The fees for the agreed services shall be as set out in the Agreement or, otherwise, in accordance with Widas’s price list in effect at the time the services are rendered, insofar as the Agreement contains no provision in this respect. All prices are exclusive of value-added tax at the statutory rate.

7.2.

Widas is entitled to adjust the fees, subject to four weeks’ advance notice in text form, to the extent that the purchase price charged to Widas by its upstream suppliers changes. Widas is further entitled to increase the fees, subject to eight weeks’ advance notice in text form, by up to five percentage points per year, for the first time, however, upon the expiry of 12 months after the commencement of the Agreement. If the price increase exceeds ten percent within a period of three years, the Customer is entitled to terminate the Agreement for cause. Such termination shall become effective at the time the price increase was to take effect. If Widas withdraws the price increase in response to the Customer’s termination, the Agreement shall continue without the price increase. In that case, the Customer’s termination shall be treated as if it had never been declared.

7.3.

Fees fall due upon receipt of the invoice and are payable within 14 days. Invoices are issued and transmitted electronically. In the case of recurring fees, Widas is entitled to issue a single standing invoice, for as long as the fees remain unchanged. Payment is made using one of the payment methods offered by Widas from time to time (e.g., bank transfer, credit card, SEPA direct debit, payment service provider). The use of payment service providers (e.g., PayPal) is governed exclusively by their respective terms.

7.4.

The Customer must raise any objections to an invoice with Widas in text form within eight (8) weeks of receipt of the invoice. Upon expiry of the aforementioned period, the invoice shall be deemed approved by the Customer. Widas will notify the Customer of this when sending the invoice. The Customer bears the burden of presentation and proof for any objections raised after expiry of that period.

7.5.

If the Customer fails to meet, or fails to meet in a timely manner, its payment obligations, Widas is entitled to suspend the access of the Customer and its users to the respective Product in accordance with Section 12.

8. Customer Obligations and Cooperation, Technical Requirements, Content

8.1.

The registration of the Customer required to make use of the services is carried out by entering the information required for performance of the Agreement, as well as any optional information, by the Customer or the users authorised by it. The information provided must be complete and accurate, and must be updated without delay in the event of subsequent changes. Widas is entitled to suspend or delete Accounts in accordance with Section 12 if data material to the provision and performance of the services should prove to be untrue or incomplete.

8.2.

In order to use the Products, the Customer requires, in addition to a suitable internet connection and a standard, commercially available browser, the use of the web API of the respective Products, where applicable.

8.3.

The Customer alone is responsible for the use of the Products. The Customer is liable for the actions of any users authorised by it as if they were its own actions. The Customer shall ensure that users of the Products make use of them only within the scope agreed under the Agreement.

8.4.

The Customer must comply with applicable law and respect the rights of third parties when using the Products. The Customer is itself responsible for compliance with statutory provisions in respect of the content (including data and information, hereinafter referred to only as „Customer Content“) uploaded or transmitted by the Customer or its users via the Products, as well as in respect of services made available thereby.

8.5.

With the hosted software, Widas merely provides the technical and organisational platform for the Customer Content. Such Customer Content is external to Widas and is merely stored by Widas and, where applicable, processed in an automated manner in connection with the use of the hosted software on the respective instructions of the Customer. Widas does not select such Customer Content, nor does it otherwise exercise control over it. Widas does not adopt such content as its own by making the hosted software available or by processing the data through the hosted software. Nor does Widas supervise the Customer or its users in their use of the hosted software, or give them instructions.

8.6.

The Customer is obligated to prevent unauthorised third-party access to the Products by suitable precautions, and to check Customer Content for viruses or other harmful components prior to input, using state-of-the-art programs to protect against malware.

8.7.

The Customer and its users are obligated to keep the “User ID” secret and not to make it accessible to third parties. The Customer shall choose a secure, state-of-the-art password, keep it secret from third parties, protect it against misuse, and change it as necessary. In the event of misuse, or suspected misuse, the Customer must inform Widas without delay in text form. In the event of misuse, the Customer alone shall be liable; this shall not apply where Widas is solely or predominantly responsible for the misuse.

8.8.

The Customer is obligated to notify Widas of identifiable defects without delay.

8.9.

The creation, by Widas, of backups of Customer Content processed in and by the Products does not form part of the services, subject to a separate agreement between the Parties. It is therefore the Customer’s own responsibility to take appropriate precautions against the loss of Customer Content (e.g., regular backups).

9. Customer’s Rights in the Event of Defects

Widas must make the agreed service available to the Customer in conformity with the Agreement throughout the term of the Agreement. For the period during which the usability of the service is reduced due to a defect or deficient performance, the Customer is only required to pay an appropriately reduced fee for the service, insofar as no other compensation, such as a service credit or a contractual penalty, has been agreed for such deficient performance. Other statutory claims of the Customer for defects or deficient performance remain unaffected; other compensation paid must be credited against such claims. Strict (no-fault) liability for defects already present at the time the Products are provided is excluded. Section 10 takes precedence in relation to Interfaces.

10. Interfaces

10.1.

Certain functions of the Products make use of technical connections implemented within the Products to services or systems provided by third-party providers, which enable interaction and data exchange with such external services or systems during the runtime of the Product (hereinafter „Interfaces“). Use of an Interface presupposes that the respective service or system of the third-party provider is available and properly provided. Widas does not warrant the uninterrupted or continuous availability of the services or systems of third-party providers, or of the information and data made available by third-party providers thereby; this does not form part of the services.

10.2.

If a third-party provider changes the functionalities on its side of an Interface such that interaction with the Product via the Interface is no longer possible, or is only possible with errors, this shall not give rise to any performance obligations on the part of Widas. If the provider changes the licence or usage terms for the system or service, in particular if it demands a fee for a service that had previously been provided free of charge as between the third-party provider and Widas, or as between Widas and the Customer, Widas is entitled to discontinue the functionality of the Interface, even where it otherwise remains technically available.

11. AI Functions

11.1.

The Products may provide functions that fall within the definition of an “AI system” within the meaning of Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (the “AI Act”) (hereinafter „AI Functions“), including AI services connected via an Interface that are based on a separate contractual relationship between the Customer and a third party (hereinafter „External AI Services“).

11.2.

Insofar as the Customer integrates External AI Services into the Products (in particular cnips) via the Interfaces provided, or has Widas integrate them, the Customer remains solely responsible for compliance with the requirements of the AI Act applicable to it, as well as other relevant provisions (in particular relating to data protection, protection of professional secrets, and protection of trade secrets). This also applies with respect to the transmission of data to External AI Services by means of the Interfaces.

11.3.

The subject matter of Widas’s services with respect to External AI Services is limited to the technical provision of the Interface within Widas’s sphere of influence and, insofar as separately agreed, the basic technical configuration and implementation of AI Workflows. The provisions on Interfaces (in particular Section 10) shall apply to AI Functions made available via an Interface, regardless of whether these are based on an External AI Service or are implemented in a Product without a separate contractual relationship between the Customer and a third party.

11.4.

Sequences of processing steps created by the Customer itself (including prompt configuration), by means of which input data is processed by AI Functions and the results are displayed or further processed within the Product („AI Workflows“), must be reviewed by the Customer, prior to productive use, for their suitability and legal permissibility in the specific use case, and adjusted where necessary.

11.5.

AI Functions are designed as tools to support the Customer and its users and do not replace an independent assessment, in particular with respect to decisions of legal, economic, or technical significance. The Customer shall ensure that all results generated by AI Functions are reviewed, evaluated, and approved by a sufficiently qualified natural person prior to any further use, and are not implemented in an automated manner or passed on to third parties without such human oversight. The Customer is furthermore solely responsible for the substantive design, content configuration, and ongoing adjustment of the AI Workflows and prompts.

11.6.

The Customer is aware that AI Functions may produce incorrect, incomplete, or inconsistent results. Widas gives no warranty as to the accuracy, completeness, or any particular quality of the content of outputs generated by AI Functions, or their suitability for a particular purpose. Widas does not owe any particular economic outcome or freedom from error of the generated content.

11.7.

The Customer shall ensure that the content and other data entered by it or its users into AI Functions is lawful, does not infringe any third-party rights (in particular, that it holds the necessary rights of use), and that entering such content does not violate any confidentiality or professional secrecy obligations.

11.8.

The Customer is solely responsible for fulfilling any obligations it has towards users of the Products or other third parties under the AI Act. Insofar as Widas is obligated to do so under the AI Act, Widas will, upon the Customer’s request and against reasonable remuneration, support the Customer in fulfilling such obligations. The Customer shall not obstruct Widas in fulfilling the obligations imposed on Widas under the AI Act.

11.9.

In Widas’s view, none of the Products is, per se, a high-risk AI system within the meaning of the AI Act. This does not relieve the Customer of the need to conduct its own assessment in light of the specific purpose for which the respective Product is used. The Customer shall, on its own responsibility, ensure that the respective Product is not used by the Customer in a manner that results in its classification as a high-risk AI system.

12. Suspension or Deletion of Access by Widas

12.1.

Widas is entitled to temporarily suspend, in whole or in part, the access of the Customer or its users to the Products if

  1. there is a reasonable suspicion that the Customer or its users are unlawfully processing third-party data or infringing third-party rights by means of the Products; such reasonable suspicion exists in particular where courts, authorities, or other third parties notify Widas thereof,
  2. the Customer or its users exceed the rights of use in the hosted software granted under the Agreement,
  3. the Customer or its users have enabled third parties to use or exploit the hosted software, or parts thereof, without authorisation, or
  4. the Customer fails to meet, or fails to meet in a timely manner, its payment obligations under this Agreement and, even upon subsequent receipt of a proper reminder, does not effect payment within 14 days at the latest.
12.2.

In deciding on any such suspension and its duration and scope, Widas will duly take into account the Customer’s legitimate interests and, where possible, inform the Customer of the suspension in advance, giving it the opportunity to clarify the matter and to remedy it. The suspension must be lifted as soon as none of the aforementioned grounds continue to exist.

12.3.

Widas may delete the affected access if the Customer or its users do not remedy the breach of obligation without delay, or fail, despite being requested to do so, to cooperate in clarifying the matter. In the request for comment required beforehand, Widas will advise the Customer that the affected access is at risk of deletion if the Customer fails to cooperate in clarifying the matter or fails to remedy the breach of obligation or infringement of rights without delay.

12.4.

Irrespective of its right to suspend or delete access, Widas remains entitled to terminate the Agreement with the Customer in its entirety, or to assert further claims, in particular claims for damages.

13. Liability

13.1.

Subject to the following provisions, the statutory provisions shall apply to the liability of Widas and its legal representatives, vicarious agents, or subcontractors.

13.2.

When providing Free Services, Widas is liable only for injury to life, body, or health, or for other damages resulting from an intentional, grossly negligent, or fraudulent breach of duty by Widas. Widas’s liability is otherwise excluded. Claims under the German Product Liability Act (ProdHaftG) remain unaffected.

13.3.

In connection with the rendering of fee-based services, Widas’s liability for ordinary negligence in the breach of Material Contractual Obligations is limited to the damage typical for the type of agreement and foreseeable by the Customer. Material Contractual Obligations within the meaning of this Section are such obligations the breach of which jeopardises the achievement of the purpose of the Agreement, the fulfilment of which is essential to the proper performance of the Agreement in the first place, and on the observance of which the Customer regularly relies. Outside of any breach of Material Contractual Obligations by Widas, liability towards the Customer for indirect damages, in particular loss of profit, is fully excluded in the case of ordinary negligence.

13.4.

The Parties agree that the sum of the damages of the Customer typical for the type of agreement and foreseeable within the meaning of Section 13.3 shall, as a rule, not exceed the amount of the fees for the past 12 calendar months, but no less than EUR 250,000.00, and the Parties agree to treat this amount as the cap on liability for these purposes. The Customer will notify Widas prior to conclusion of the Agreement if it considers this cap on liability to be inappropriate.

13.5.

Widas is not liable for the loss of data to the extent that the damage results from the Customer having failed to carry out backups and thereby ensure that lost data can be restored with reasonable effort.

13.6.

The limitations of liability do not apply to claims arising from intent or gross negligence, injury to life, body, or health, fraud, claims under the German Product Liability Act (ProdHaftG), or warranty commitments. Widas assumes warranties only where these are expressly designated by Widas itself as a “warranty” or as being “warranted.” All other terms, such as “assure” or “ensure,” do not constitute warranties, but merely describe Widas’s general performance obligation.

14. Term, Termination, Deletion of Access

14.1.

Subject to any deviating provision in the offer or other agreements between the Parties, the Agreement is concluded for a minimum term of one (1) year from the commencement date of the Agreement specified therein or, failing that, from the time the Agreement is concluded.

14.2.

Subject to any deviating provision in the offer or other agreement, the Agreement may be terminated subject to three months’ notice, effective at the end of a calendar month, but not before the expiry of the minimum term specified in Section 14.1 hereof, or of the minimum term specified in the offer or other agreement.

14.3.

The Agreement may be terminated by either Party, in whole or in part, for good cause, without observing a notice period, within a reasonable time of becoming aware of the grounds for termination. Good cause exists where facts are present on the basis of which, taking into account all the circumstances of the individual case and weighing the interests of the other Party, the terminating Party cannot reasonably be expected to continue the Agreement.

14.4.

Where the good cause consists of a breach of a contractual obligation, termination is only permissible after the unsuccessful expiry of a grace period set for remedy, or following an unsuccessful warning notice, unless the setting of such a period is dispensable pursuant to Section 314 in conjunction with Section 323(2) BGB. Good cause exists for Widas in particular where the Customer is in default of payment of the fees for more than one month and has failed to pay despite a reminder and the setting of an additional grace period issued after the default occurred.

14.5.

In the event of termination for cause, Widas is entitled to the contractually agreed fees up to the point in time at which an ordinary termination, had it been hypothetically declared by the Customer at the time Widas declared the termination, would have become effective. This shall not apply insofar as the Customer proves that Widas has suffered no damage, or only a lesser amount of damage.

14.6.

Upon termination of the Agreement, Widas will first suspend the access of the Customer and its users and will delete it after one month.

15. Data Protection

15.1.

Both Parties shall process personal data solely in accordance with the requirements of applicable data protection law. Upon conclusion of the Agreement, the data processing agreement attached as Schedule 1, pursuant to Article 28 GDPR, shall become effective.

15.2.

As controller, in the case of processing on its behalf by Widas, the Customer shall independently assess whether the information disclosed by it to Widas in connection with the use of the Products constitutes personal data, and whether the processing of such personal data is lawful.

16. Confidentiality and Non-Disclosure

16.1.

The Parties undertake to maintain confidentiality regarding all confidential matters that come to their knowledge in the course of preparing, performing, and fulfilling the Agreement, in particular trade secrets of the other Party, respectively, and neither to disclose nor otherwise exploit such matters other than for the performance of the Agreement. Where necessary, the Parties shall enter into a separate confidentiality agreement, which shall take precedence.

16.2.

Absent a separate agreement between the Parties, the Products are not intended to also process data that is subject to special professional confidentiality obligations within the meaning of Section 203 of the German Criminal Code (StGB) (“breach of private secrets”) (such data hereinafter „Professional Secrets“). Absent a separate agreement, concluded at least in text form, containing an undertaking of professional confidentiality (hereinafter a „Confidentiality Agreement under Section 203 StGB“), Widas objects in its entirety to any such processing.

16.3.

Unless expressly agreed otherwise, any Confidentiality Agreement under Section 203 StGB that may be concluded between the Parties does not extend to the processing of Professional Secrets by the “Sherpa” AI system within the Product cidaas. The use of Sherpa with Professional Secrets remains prohibited in this case as well.

16.4.

Insofar as the Customer transmits data to third parties via the Interfaces provided within the Products, and such use is, or is to be, based on a separate contractual relationship between the Customer and the respective third party, it is the Customer’s sole responsibility to conclude any necessary Confidentiality Agreements under Section 203 StGB with the third parties it engages and to monitor compliance therewith. Widas is not obligated to enter into separate Confidentiality Agreements under Section 203 StGB with third parties selected by the Customer, or to review their level of secrecy protection or any other data protection agreements or standards.

17. Final Provisions

17.1.

The exclusive place of jurisdiction, including for international disputes, for all disputes arising directly or indirectly in connection with the Agreement or the use of the Products, is the registered seat of Widas. Widas is also entitled to bring proceedings against the Customer at the Customer’s general place of jurisdiction. This Section shall not apply where the dispute concerns claims other than those of a proprietary nature, or where an exclusive place of jurisdiction is established therefor by law.

17.2.

The Agreement is governed by the laws of the Federal Republic of Germany, to the exclusion of the United Nations Convention on Contracts for the International Sale of Goods (CISG) and of conflict-of-laws rules; Article 3(3) and (4) of the Rome I Regulation remain unaffected.

17.3.

Widas is not subject to any obligations under Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector (“DORA”), unless the Parties have entered into a separate agreement in this respect.

17.4.

No oral collateral agreements have been made. Amendments and supplements to the Agreement must be made in text form. This also applies to any waiver of this form requirement.

17.5.

Should one or more provisions of the Agreement be, in whole or in part, invalid, the remaining provisions shall remain unaffected. The Parties undertake to replace any invalid provision with one that comes economically as close as possible to what the Parties intended when concluding the Agreement. The same shall apply in the case of a gap in the Agreement not contemplated by the Parties. Until such replacement, the statutory provisions shall apply where the invalid or incomplete provision cannot be replaced or supplemented by way of supplementary interpretation of the Agreement (Sections 133 and 157 BGB).

17.6.

The Customer is entitled to assign claims only with Widas’s prior consent in text form. Widas will refuse such consent only for good cause.

17.7.

Widas may transfer the Agreement to a company affiliated with it within the meaning of Sections 15 et seq. AktG. Widas will inform the Customer of this in advance in good time. Otherwise, the transfer of the Agreement by a Party requires the other Party’s prior consent in text form.

Schedule 1: Data Processing Agreement

The Parties agree that the Standard Contractual Clauses set out in Commission Implementing Decision (EU) 2021/915 of 4 June 2021 on standard contractual clauses between controllers and processors under Article 28(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council and Article 29(7) of Regulation (EU) 2018/1725 of the European Parliament and of the Council shall apply.

The Implementing Decision is available at the following link: eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX%3A32021D0915

This Agreement ensures compliance with the Regulation (EU) 2016/679 of the European Parliament and of the Council.

The optional docking clause (Clause 5) shall become part of the Agreement.

With respect to Clause 7.7, the Parties have agreed that a general written authorisation (Option 2) is granted for the engagement of sub-processors. The processor shall inform the controller, at least in text form, of any intended changes to this list by way of the addition or replacement of sub-processors, at least four weeks in advance.

Annex I – List of the Parties

The Parties are as set out in the principal agreement.

Annex II – Description of the Processing

The Customer determines and controls, on its own responsibility, which personal data it processes in connection with its use of the Products.

Provided that the provision of cidaas is an agreed part of the services:

Categories of personal data that may be processed:

  • Master personal data (e.g., name, form of address, date of birth)
  • Contact and communication data (e.g., email address, telephone number, address)
  • User account and profile data (e.g., user ID, username, profile attributes, group and role assignments, consent status)
  • Authentication data (e.g., password hashes, MFA factors, passkeys/FIDO credentials)
  • Technical usage and log data (e.g., IP address, device and browser information, login history, audit logs)
  • If the cidaas ID validator forms part of the services under cidaas: identity document and identification data as well as biometric data (e.g., photograph, video recording for identity verification) (Article 9 GDPR data)

Categories of data subjects whose personal data may be processed:

  • End users of the Customer’s applications (in particular customers and prospective customers)
  • Employees of the Customer
  • Business partners, suppliers, and service providers of the Customer, as well as their employees
  • Other individuals registered by the Customer as users

Provided that the provision of cnips is an agreed part of the services:

Categories of personal data that may be processed:

  • User account data of platform users (e.g., name, email address, roles)
  • Connection and configuration data of the connected systems (e.g., access credentials, API keys)
  • Protocol and log data of the executed integrations and workflows
  • Payload data processed within the integrations; the Customer determines the categories of such data on its own responsibility through the configuration of the connected applications and data sources (master personal data, communication data, contract and transaction data)

Categories of data subjects whose personal data may be processed:

  • Employees of the Customer as users of the platform
  • Individuals whose data is contained in the applications and data sources connected by the Customer (typically customers, prospective customers, employees, suppliers, service providers)

Provided that the provision of clavik is an agreed part of the services:

Categories of personal data that are processed:

  • User account data of platform users (e.g., name, email address, roles)
  • Access and audit log data (e.g., user ID, timestamp, IP address)
  • Personal data contained in secrets, access credentials, or certificates stored by the Customer (e.g., person-specific identifiers); the Customer determines the content thereof on its own responsibility

Categories of data subjects whose personal data are processed:

  • Employees of the Customer and service providers engaged by it, as users of the platform
  • Individuals to whom person-specific access credentials or identifiers relate

Nature of the processing:

Provision of the respective Product as Software as a Service.

Purpose(s) for which the personal data is processed on behalf of the controller:

Widas’s activity serves to provide the services agreed in the principal agreement.

Duration of the processing:

The duration of the processing corresponds to the term of the principal agreement.

Subject matter and nature of the processing by the (sub-)processor:

Provision of IT services.

Duration of the processing by the (sub-)processor:

The duration of the processing by the (sub-)processor corresponds to the duration of the processing by Widas.

Annex III – Technical and Organisational Measures, including to Ensure the Security of the Data

The list of technical and organisational measures pursuant to Article 28(3)(c) of Regulation (EU) 2016/679 is available on Widas’s website.

Annex IV – List of Sub-Processors

The controller has authorised the engagement of the following sub-processors:

  • WidasConcepts GmbH, Maybachstrasse 2, 71299 Wimsheim, Germany
  • Widas Technologie Services GmbH, Maybachstrasse 2, 71299 Wimsheim, Germany
  • Telekom Deutschland GmbH, Landgrabenweg 151, 53227 Bonn, Germany
  • S-IT Informationstechnologie GmbH & Co. KG, Marktstraße 7-11, 75365 Calw, Germany
  • Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (with Data Localization Suite – EU)
  • Medialine Security GmbH, Weissacher Straße 11, 70499 Stuttgart, Germany
  • Nebius B.V., Schiphol Boulevard 165, 1118 BG Schiphol, Netherlands (Nebius Group N.V. headquarters)