Terms of Service

§ 1 Scope and Contracting Parties

(1) These Terms of Service (hereinafter “Terms”) apply to all contracts for the use of the software-as-a-service platform XICTRAQ (hereinafter “Service” or “Platform”) between XICTRON, Lennart Harmes, Glockruthenallee 16, 31185 Söhlde, Germany (hereinafter “Provider”) and the respective contracting party (hereinafter “Customer”).

(2) The Service is exclusively aimed at entrepreneurs within the meaning of § 14 BGB, legal entities under public law and special funds under public law. A contract with consumers within the meaning of § 13 BGB is excluded.

(3) Any deviating, conflicting or supplementary terms and conditions of the Customer shall only become part of the contract if and to the extent that the Provider has expressly agreed to their validity in writing.

§ 2 Registration and Contract Conclusion

(1) Use of the Platform requires the creation of a user account. The Customer must provide truthful information during registration and keep it up to date.

(2) The contract is concluded upon confirmation of registration or by selecting a paid plan and confirming it in the checkout process. The Customer receives an email confirmation.

(3) The Customer is obliged to treat access credentials confidentially and to protect them from third-party access. The Customer is liable for all activities carried out under their user account.

§ 3 Service Description and Nature of the Service

(1) The Provider makes available to the Customer, via the internet, a software-as-a-service platform for monitoring the technical and legal state of their own websites. The scope of functions includes in particular uptime monitoring, SSL and security header checks, GDPR and accessibility checks, Core Web Vitals, cookieless analytics, DNS/domain monitoring and multi-level alerting.

(2) The specific scope of services depends on the plan selected by the Customer (Free, Starter, Business or Agency). The plan description valid at the time of contract conclusion on www.xictraq.com/en/pricing shall be authoritative.

(3) The Provider is entitled to further develop the scope of services and individual features, provided that the core functions of the contractually owed plan are retained. Material changes are announced within a reasonable period prior to taking effect, by email or within the Platform.

(4) The Platform is a purely informational tool. The contract is a service contract within the meaning of §§ 611 et seq. BGB; a specific result — in particular the reliable, complete or correct detection, measurement or reporting of the state of the monitored website — is expressly not owed. All evaluations, scores, traffic-light ratings, reports, recommendations and notifications are non-binding indications based on automated checks and may contain errors, gaps, misinterpretations as well as false positives and false negatives.

(5) The Platform does not constitute legal, tax, data protection, security or accessibility advice and does not replace such advice by qualified professionals. In particular, any labelling of a website as “GDPR-compliant”, “accessibility-compliant”, “secure”, “error-free” or similar assessments within the Platform does not constitute a binding legal evaluation. The Customer is solely responsible for the legal, security-related and operational assessment of their websites and for all consequences resulting from them.

(6) The Platform is not a substitute for the Customer's own monitoring, backup, alerting and contingency strategies and is not intended for use in safety-critical environments or environments with high-availability requirements (e.g. medical, aerospace, energy supply, financial transactions). The Customer is obliged to maintain independent, redundant monitoring and alerting systems for critical infrastructure.

(7) The Provider renders the services according to the current state of the art and on a “best effort” basis. Uninterrupted availability of the Platform, the monitoring agents, the API, the dashboards, the report generation or the notification channels is not owed; the availability provisions of § 4 and the liability provisions of § 12 apply.

§ 4 Availability, Maintenance and Dependence on Third Parties

(1) The Provider aims, where possible, to provide the Platform with an availability of 99.5% on average per year, measured at the handover point to the internet of the data center. This is a non-binding target, not a warranted characteristic, a guarantee or a contractually owed service level agreement (SLA). No claims may be derived from falling short of the target unless § 12 provides otherwise.

(2) Scheduled maintenance, force majeure, failures of upstream providers (data center, network operator, DNS provider, upstream APIs such as Google Safe Browsing, RDAP registries, DNSBL lists, TLS libraries and similar), failures of notification channels (email providers, Slack, Microsoft Teams, Discord, Telegram, webhooks, on-call services and similar) and disruptions in the public internet are not included in the availability calculation.

(3) Maintenance work is carried out whenever possible during off-peak hours and, where foreseeable, announced in advance. There is no claim to prior announcement; security-critical maintenance may also be carried out without prior notice.

(4) The Platform is technically and operationally dependent on a variety of third-party providers, open-source components and publicly accessible data sources. The Provider assumes no responsibility or liability for errors, interruptions, changes, discontinuations or erroneous responses from these third-party services.

§ 4a Express Disclaimer for Monitoring Results, Alerts and Evaluations

(1) The Provider expressly assumes no responsibility and no liability for the accuracy, completeness, timeliness, availability or deliverability of the monitoring results, evaluations, reports, scores, assessments, recommendations, forecasts and notifications (hereinafter collectively “Results”). All Results are provided to the Customer “as is” and “as available” without any warranty.

(2) In particular — but not exclusively — the Provider assumes no responsibility and no liability for:

• undetected or delayed detection of outages, disruptions, downtimes or performance drops of the monitored website;
• falsely reported outages (false positives), in particular due to network disruptions, geoblocking, rate limiting, firewall or bot protection measures on the part of the monitored website;
• non-delivery, delayed delivery, duplicate delivery or incorrect display of alerts via email, Slack, Teams, Discord, Telegram, webhooks, push notifications, on-call systems or any other notification channel;
• the classification of an SSL certificate as valid, expired, revoked or untrusted, as well as the assessment of the TLS version, cipher suites, chain or hostname match used;
• the assessment of HTTP security headers, content security policies, mixed-content detection, cookie flags or third-party scripts;
• the classification of a website or domain as GDPR-compliant, accessibility-compliant, legally safe, imprint-compliant or tracker-/cookie-free;
• interpretations or automated checks regarding pre-consent tracking, cookie scans, Google Fonts detection, imprint and privacy-policy matching;
• the measurement, calculation or presentation of Core Web Vitals, Lighthouse scores, load times, TTFB, DNS, TCP, TLS or download times, uptime percentages, SLA reports or availability statistics;
• the detection of defacements, content changes, broken links, sitemap/robots.txt changes, keyword presence, keyword rankings or structured-data validation;
• DNS record monitoring, WHOIS/RDAP lookups, domain expiry warnings, SPF/DKIM/DMARC checks, blacklist/DNSBL monitoring, Google Safe Browsing lookups and port/TCP checks;
• results of the cookieless analytics, in particular visitor counts, page views, session duration, scroll depth, bounce detection, geo/device attribution, bot detection, event or conversion tracking;
• the accuracy, completeness, delivery or archiving of generated reports (HTML, PDF, CSV, JSON, email), including SLA or compliance reports, as well as discrepancies between different display and export formats;
• heartbeats, cron/dead man's switch monitoring, maintenance window calculations and escalation logic;
• the accuracy of the unified scoring system (“A+” to “F”), the traffic-light colours or any other visual ratings;
• white-label features, branded reports, client portals, audit widgets and embed codes that the Customer passes on to its own end customers;
• conclusions, business decisions, marketing, SEO or legal measures that the Customer or third parties take on the basis of Results of the Service;
• damages resulting from loss of reputation, customers, rankings, revenue, profit, lost orders, fines, cease-and-desist letters, contractual penalties or SLA credits with third parties.

(3) The Customer is obliged to independently validate all Results prior to any use, to cross-check them against independent sources and — where legal consequences may arise — to have them reviewed by qualified professionals (lawyers, data protection officers, security auditors, tax advisers). Any forwarding of Results to third parties (e.g. end customers, supervisory authorities, insurers, litigation counterparties) is undertaken exclusively at the Customer's own risk.

(4) The Customer shall indemnify the Provider against all third-party claims — including claims of the Customer's own end customers in the Agency plan — arising from the Customer using or forwarding Results of the Service without prior verification, incompletely or for purposes other than those intended.

§ 5 Free Plan and Trial Period

(1) The Provider offers a permanently free plan (Free) with limited functionality. The free plan may be discontinued or modified in its scope at any time without giving reasons.

(2) The Provider may grant a trial period of up to 14 days for paid plans, during which the selected plan can be tested without payment obligation. After the trial period has ended, the selected plan automatically becomes chargeable unless the Customer cancels the contract before the end of the trial period.

§ 6 Fees and Payment Terms

(1) The prices shown on the Provider's website at the time of contract conclusion apply. The prices shown are gross prices and include statutory VAT (currently 19%). Where the Provider does not owe German VAT for the service — in particular where the Customer provides a valid VAT identification number from another member state of the European Union (reverse charge) or where the Customer is based in a third country — the invoice is issued without German VAT. In that case the subscription price is reduced by the VAT it contains; add-on packages are invoiced at the amount shown, without VAT.

(2) The fees are payable monthly in advance for monthly billing and annually in advance for annual billing. The billing period begins on the day the contract is concluded or after the end of any trial period.

(3) Online payments are processed by the payment service provider Stripe (Stripe Payments Europe Ltd., Dublin). The Customer accepts the Stripe terms of service. Payment data is processed exclusively by Stripe and not stored on the Provider's servers. Where payment by bank transfer has been agreed, the Customer transfers the invoice amount to the account stated on the invoice; Stripe is not involved.

(4) If the Customer is in default of payment, the Provider is entitled to suspend the user account after prior reminder. There is no claim to a refund of payments already made in the event of suspension due to default in payment.

(5) The Provider is entitled to adjust prices within a reasonable period prior to the start of a new billing period. In the event of a price increase, the Customer has a special right of termination effective at the end of the current billing period; refunds of fees already paid and any further claims are excluded. If no termination is given before the new prices take effect, they are deemed accepted.

(6) The Customer may only set off claims that are undisputed or have been finally and legally established. The Customer shall only have a right of retention insofar as it is based on the same contractual relationship.

§ 7 Customer Obligations

(1) The Customer may only monitor websites that they own or for which they have explicit permission from the operator. The Customer warrants that monitoring the websites they specify does not infringe any third-party rights.

(2) The Customer undertakes not to use the Service improperly, in particular not to overload third-party infrastructure (denial-of-service attacks), circumvent technical protection measures or for other illegal purposes.

(3) The Customer is obliged to comply with the quotas included in their plan (e.g. number of websites, number of checks, API calls). Exceeding these quotas entitles the Provider to invoice additional services or throttle the Service accordingly.

§ 8 Rights of Use

(1) The Provider grants the Customer, for the duration of the contract, a simple, non-transferable, non-sublicensable right to use the Platform to the extent contractually agreed.

(2) The Customer may only use the Platform for their own business purposes. In the Agency plan, the Customer may additionally use the Platform within the agreed white-label functionality to monitor websites of their own end customers.

(3) All copyrights, trademark rights and other property rights in the Platform and its documentation remain with the Provider or its licensors.

§ 9 Data Protection

(1) The Provider processes personal data in accordance with the privacy policy and in compliance with the provisions of the GDPR.

(2) The Platform and databases are primarily processed on servers controlled by us in data centers within the EU; the hosting processor is named in the privacy policy. Individual processors expressly listed in the privacy policy (in particular Anthropic, PBC for the optional AI chat assistant) process data in third countries; transfers are based on the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR with supplementary technical and organisational measures.

(3) To the extent that the Provider processes personal data on behalf of the Customer in the course of operating the Platform — in particular in connection with cookieless analytics, heatmaps, optional session recording, status-page subscriptions or form analytics on websites specified by the Customer, or with the optional order import from a shop connected by the Customer — the provisions of § 9a below form a binding part of these Terms. These provisions satisfy the requirements of Art. 28(3) GDPR; no separate agreement or additional signatures are required.

§ 9a Processing of Personal Data on Behalf of the Customer

1. Subject Matter, Duration, Nature and Purpose

(1) The subject matter of the processing is all personal data the Provider processes for the Customer in the course of delivering the services described in these Terms. Within the meaning of the GDPR, the Customer is the controller (Art. 4(7) GDPR) and the Provider is the processor (Art. 4(8) GDPR).

(2) Duration: Processing takes place for the term of the main contract plus the deletion grace period regulated in § 10(4) (30 days), at the latest until fulfilment of the deletion or return obligations under section 9 of this addendum.

(3) Nature and purpose of processing: Provision of a software-as-a-service platform for monitoring the Customer's websites; collection, storage, evaluation and display of technical measurement and diagnostic data; cookieless visitor statistics, heatmaps, optional session recording and form analytics on websites selected by the Customer; delivery of alerts and reports; hosting of public status pages and management of their subscriptions; provision of API access; at the Customer's request, retrieval of the order status and, with the order import switched on, of the order data from a shop connected by the Customer via its interface, and their evaluation in the Customer's e-commerce reports.

(4) Type of data: in particular pseudonymous visitor and session identifiers, formed as a hash of the IP address and a random value (salt) generated anew each day and deleted once the day is over, so that no attribution to the IP address is possible afterwards (the IP address itself is not stored); pageview metadata (path, referrer, UTM parameters, device/browser type, language); location data from IP geodata (country, region, city, postal code, coordinates) as well as internet provider and network number (ASN); form interaction events (without plaintext input values); clicks as individual clicks with coordinates, element type and visible text of the clicked element (email addresses outside the website's own domain masked) as well as scroll depth; JavaScript error messages of the page (email addresses and access values in contained URLs, such as token= or key=, masked); for the tracker's customer recognition, the customer number and, where the shop provides them, name, company and customer group or type (no email addresses); optional session recordings (with input masking); email addresses of status-page subscribers and, with the order import switched on, order data from the connected shop (order number, time, amounts, tax, shipping costs, currency, payment and shipping method, status, order line items) with the first and last name, company and customer number of the person ordering; the email address, address, telephone number, comment of the person ordering and VAT ID are not fetched.

(5) Categories of data subjects: end visitors of the websites monitored by the Customer, subscribers of the Customer's status pages, where the order import is switched on the customers of the connected shop (including persons whose order was entered in the shop by telephone or by other means without a visit to the website), and any natural persons publicly named in the imprint/privacy section of the monitored website.

2. Instructions and Responsibility

(1) The Provider processes personal data only on the Customer's documented instructions; this also applies to transfers of personal data to a third country or an international organisation, unless the Provider is required to do so by Union or Member State law — in which case the Provider shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest (Art. 28(3)(a) GDPR). The configurations made by the Customer in the user account (adding/removing websites, enabling or disabling heatmaps, session recording, form analytics, status pages, alert channels, data export/deletion actions) and these Terms including this addendum are deemed documented instructions.

(2) If the Customer issues individual instructions beyond the Platform's functionality, the Provider is entitled to charge additional effort at its standard hourly rates, where legally permissible.

(3) The Provider shall inform the Customer if, in its opinion, an instruction infringes the GDPR or other data protection provisions; pending clarification, the Provider may suspend execution.

(4) The Customer remains solely responsible for the lawfulness of the processing, in particular for the legal basis (Art. 6, 9 GDPR), informing its data subjects (Art. 13/14 GDPR), obtaining and documenting any consents, cookie and TDDDG compliance management on its own websites, and for assessing the suitability of the Platform for its processing purposes (data protection impact assessment under Art. 35 GDPR).

3. Confidentiality

The Provider ensures that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and ensures that all employees are bound to data secrecy before commencing their activity (Art. 28(3)(b), Art. 32(4) GDPR).

4. Technical and Organisational Measures (TOMs)

(1) The Provider implements the technical and organisational measures required under Art. 32 GDPR to ensure a level of security appropriate to the risk. The current TOM description is available at www.xictraq.com/en/docs/security#toms and forms part of the contract.

(2) The Provider is entitled to further develop the measures, provided that the level of protection appropriate to the risk according to the current state of the art is maintained.

5. Sub-Processors

(1) The Customer hereby grants the Provider general written authorisation pursuant to Art. 28(2) sentence 2 GDPR to engage further processors (sub-processors). The sub-processors engaged at the time of conclusion of the contract are listed by name in the privacy policy.

(2) The Provider shall inform the Customer of any intended engagement or replacement of a sub-processor at least 14 days before commissioning, in text form (e.g. by email to the account email or by publication in the privacy policy with an active in-app notice).

(3) The Customer may object to the engagement within this period for specific, fact-based data protection reasons in text form. If a legitimate objection is raised, the parties shall jointly seek a mutually agreeable solution. If no such solution can be reached, the Customer is entitled to terminate the main contract with effect at the end of the current billing period. Refunds of fees already paid and any further claims — in particular damages or reimbursement of expenses — are excluded. An objection on economic, strategic or other non-data-protection grounds shall be disregarded.

(4) The Provider shall bind each sub-processor by a written contract imposing substantially the same data protection obligations as set out in this addendum, including sufficient guarantees of appropriate TOMs. Where sub-processors are located in a third country, the Provider shall enter into EU Standard Contractual Clauses and take supplementary measures if necessary.

(5) Pure telecommunications services (e.g. internet access, spam and virus filtering, transmission-only routing services) as well as cleaning, security or postal services are not deemed sub-processing within the meaning of this addendum.

6. Support for Data Subject Rights

(1) The Provider supports the Customer, as far as possible, with appropriate technical and organisational measures in fulfilling its obligations to respond to data-subject requests (Art. 12 et seq. GDPR). The Platform provides self-service tools for most cases directly (data export, deletion tools in the account area).

(2) If a data subject contacts the Provider directly, the Provider shall promptly forward the request to the Customer and shall not respond itself, unless exceptionally required by law.

(3) Support beyond the self-service tools (in particular manual research, individual data exports, processing outside the Platform) shall be charged at the Provider's then-applicable hourly rates, where legally permissible.

7. Support for Security and Notification Obligations

(1) The Provider shall inform the Customer without undue delay, but no later than 72 hours after becoming aware, of any personal data breach within the meaning of Art. 33 GDPR that has occurred in its area of responsibility and concerns the Customer's data. The information shall contain the details required by Art. 33(3) GDPR insofar as known to the Provider.

(2) The Provider supports the Customer in fulfilling the obligations under Art. 32 to 36 GDPR, taking into account the nature of the processing and the information available to the Provider. Responsibility for notification to the supervisory authority and informing the data subjects lies with the Customer as the controller.

8. Audit and Inspection Rights

(1) The Provider primarily demonstrates compliance with the obligations under this addendum by means of appropriate evidence: current TOM description, internal or external audit reports, ISO/SOC/BSI certifications or comparable approved codes of conduct and certifications (Art. 28(5) GDPR).

(2) Where the evidence referred to in paragraph (1) is insufficient to fulfil the Customer's audit rights, the Customer may, at most once per calendar year, after prior reasonable notice (at least 30 days), at the Customer's own cost and respecting the Provider's trade and business secrets, conduct inspections during normal business hours. On-site inspections are only permitted as a subsidiary measure where document-based inspections are insufficient, and only by auditors bound to confidentiality who are not in a competitive relationship with the Provider.

(3) Where there is an assumption of a data protection breach by the Provider supported by specific, documented facts, or upon a corresponding final order of the competent supervisory authority, supplementary inspections are permitted; mere assumptions or references to third-party publications do not establish a right of inspection.

(4) The Provider's effort for audits exceeding the frequency referred to in paragraph (2) or going beyond providing the evidence referred to in paragraph (1) shall be reimbursed by the Customer at the Provider's then-applicable hourly rates.

9. Return and Deletion

(1) Upon termination of the provision of processing services, the Provider shall delete all personal data of the Customer within 30 days, unless the Customer has previously requested a data export in text form. Backup copies are overwritten in the course of the regular backup rotation.

(2) Data whose retention is required by law (in particular under commercial and tax law) shall remain unaffected and shall be retained for the respective period and subsequently deleted.

10. Liability

The Provider's liability for damages arising from the processing of personal data is governed by the general liability provisions of § 12 of these Terms. Art. 82 GDPR remains unaffected; in the internal relationship between the parties, damages attributed to a party shall be borne in proportion to their respective responsibility (Art. 82(5) GDPR).

11. Order of Precedence and Final Provisions

(1) In the event of conflicts between this addendum and other provisions of these Terms, the provisions of this addendum shall prevail insofar as the matter concerns the processing of personal data.

(2) Should a provision of this addendum be or become invalid, the validity of the remaining provisions shall remain unaffected; the invalid provision shall be replaced by a regulation that comes closest to what was economically intended and to data protection requirements.

§ 10 Term and Termination

(1) The contract for a paid plan is concluded for an indefinite period. The minimum contract term corresponds to the selected billing period (monthly or annual).

(2) The contract may be terminated by either party with effect at the end of the current billing period. Termination by the Customer can be carried out directly in the user account under “Billing & Invoice”.

(3) The right to extraordinary termination for good cause remains unaffected. Good cause exists for the Provider in particular in the event of serious breaches of § 7 of these Terms or payment delays of more than 30 days.

(4) After termination of the contract, customer data remains stored to the previous extent for a further 30 days (deletion grace period). Within this period the Customer may export their data themselves or continue the contract; upon request in text form, the Provider will make an export available within the period. After the deletion grace period expires, customer data will be irrevocably deleted or anonymised as part of our deletion concept, unless statutory retention obligations prevent this. Switching to the free plan does not terminate the contract and the account remains in place; sentences 1 to 3 apply accordingly to data exceeding the retention periods of the free plan. Statutory data subject rights, in particular to access and data portability under Art. 15 and Art. 20 GDPR, remain unaffected.

§ 10a Right of Withdrawal

(1) Pursuant to § 1 (2), the Service is aimed exclusively at entrepreneurs within the meaning of § 14 BGB, legal entities under public law and special funds under public law. The statutory right of withdrawal for distance contracts under §§ 312g, 355 BGB is available to consumers within the meaning of § 13 BGB only. There is therefore no right of withdrawal for contracts under these Terms.

(2) Instead, the Service can be evaluated without any payment obligation: the free plan under § 5 requires no payment details, and a paid plan can be terminated with effect at the end of the current billing period under § 10 (2) — with monthly billing, the commitment therefore never exceeds one month.

(3) Should a contract with a consumer nevertheless come about in an individual case contrary to § 1 (2), that consumer’s statutory rights remain unaffected. In that case, a declaration of withdrawal must be sent in text form to XICTRON, Lennart Harmes, Glockruthenallee 16, 31185 Söhlde, Germany, or to mail@xictraq.com; no reasons need to be given.

§ 11 Warranty

(1) The Provider warrants that the Platform will be provided in accordance with the contract and the applicable service description. Insignificant impairments of the suitability for contractual use shall be disregarded.

(2) The Customer is obliged to report recognizable defects without undue delay, but at the latest within 14 days after discovery, in text form to mail@xictraq.com. The notice must describe the defect with sufficient specificity (in particular affected function, time, steps to reproduce). Hidden defects must be reported without undue delay after discovery. If the Customer fails to provide timely notice, the services shall be deemed approved; claims based on that defect are excluded.

(3) Strict liability for defects that existed at the time of contract conclusion pursuant to § 536a (1) var. 1 BGB is excluded.

§ 12 Liability and Limitation of Liability

(1) The Provider is liable without limitation for damages resulting from injury to life, body or health, for damages based on intent or gross negligence, as well as for fraudulently concealed defects or for the assumption of a guarantee. Liability under the Product Liability Act remains unaffected.

(2) In the case of slightly negligent breach of an essential contractual obligation, the fulfilment of which enables the proper performance of the contract in the first place and on the observance of which the Customer may regularly rely (cardinal obligation), the Provider's liability is limited to the foreseeable damage typical for the contract at the time of its conclusion. Otherwise, the Provider's liability for slight negligence is excluded.

(3) Maximum liability: Without prejudice to paragraph (1), the Provider's liability for all damages within a contract year is limited in total to the lower of the following amounts: (i) the net fees the Customer has actually paid to the Provider for the specifically affected service in the immediately preceding twelve months, or (ii) EUR 1,500.00. This cap applies both as an aggregate cap per contract year and as a per-incident cap. For the free plan, liability is — with the exception of the cases referred to in paragraph (1) — entirely excluded as no fees are paid.

(4) Excluded types of damage: Liability of the Provider for indirect damages, consequential damages, lost profits, lost savings, lost use, business interruption, damage to image, damage to reputation, loss of business opportunities, loss or deterioration of search engine rankings, fines, cease-and-desist costs, contractual penalties, litigation costs, SLA credits, damage claims of third parties (in particular the Customer's end customers) and any other financial losses is — outside the cases referred to in paragraph (1) — excluded.

(5) Exclusion for monitoring, alerts and evaluations: Without prejudice to paragraph (1), the Provider is not liable for damages arising because

• outages, dips or other states of the monitored website were not detected or reported, were detected incompletely, late, incorrectly or multiple times;
• notifications (alerts) were not delivered, were delivered late, incompletely, multiple times, to the wrong recipient or with incorrect content, in particular due to failures or delays at email providers, Slack, Microsoft Teams, Discord, Telegram, webhooks, push services or other notification channels;
• Results of the Platform (scores, traffic lights, recommendations, reports, analytics data) were incorrect, incomplete, misleading or outdated, or were misinterpreted by the Customer or third parties;
• the Customer, relying on an assessment as “GDPR-compliant”, “accessibility-compliant”, “secure” or similar, failed to take or took measures and as a result suffered cease-and-desist letters, fines, damage claims or other disadvantages;
• monitored websites, their infrastructure, interfaces, APIs or databases were impaired by the Provider's checks, provided that the Customer has not exhausted the available controls (check intervals, maintenance windows, exclusions);
• heartbeats, cron/dead man's switch monitors, maintenance windows or escalation levels were not triggered, paused, forwarded or re-activated as expected;
• reports, CSV/JSON/PDF exports or API responses contained different values or other presentations that led to decisions that subsequently proved to be disadvantageous;
• analytics data (visitor numbers, events, conversions) deviates from the numbers of other measurement systems or is incomplete;
• integrations and forwarding to third-party systems (e.g. via webhooks, white-label portals, client exports, audit widgets) were faulty, delayed or did not function at all;
• the Service was not rendered or not rendered in full due to force majeure, cyber attacks against the Provider or third parties, failures of the public internet, of power suppliers, data centers, DNS or cloud providers.

(6) For the loss or damage of customer or monitoring data, the Provider is only liable up to the amount that would have been required to restore the data if the Customer had carried out proper daily data backups. The Customer is obliged to regularly back up their own data and to regularly export reports and historical data.

(7) Limitation period: Damage claims of the Customer against the Provider — with the exception of the cases referred to in paragraph (1) — shall lapse after twelve months from the time at which the Customer became aware of the damage or should have become aware without gross negligence.

(8) The above limitations of liability also apply in favour of the legal representatives, vicarious agents and subcontractors of the Provider and apply accordingly to their personal liability.

§ 13 Confidentiality and Reference Naming

(1) The parties undertake to keep confidential all confidential information of the other party that becomes known in the course of contract performance and to use it only for the purposes of contract performance.

(2) The Provider is entitled to name the Customer as a reference customer on its own websites or in other media, unless the Customer objects to this for legitimate reasons.

§ 14 Final Provisions

(1) German law applies, excluding the UN Convention on Contracts for the International Sale of Goods.

(2) The exclusive place of jurisdiction for all disputes arising from or in connection with this contractual relationship shall, to the extent legally permissible, be the Provider's place of business.

(3) Should individual provisions of these Terms be or become invalid in whole or in part, the validity of the remaining provisions shall remain unaffected. The invalid provision shall be replaced by a regulation that comes closest to what was economically intended.

(4) Changes or additions to this contract and ancillary agreements must be made in text form. This also applies to the waiver of this text form requirement.