Preamble: Oxolo, AI Functions and Their Limits

Oxolo GmbH, Bohnenstraße 2, 20457 Hamburg, commercial register number HRB 162 826 at the Local Court of Hamburg, VAT ID No. DE330771975, Managing Director Heiko Hubertz ("Oxolo" or "we") develops and operates a software-as-a-service solution for digital project, deployment, construction-site and field documentation, including accompanying project-communication and documentation workflows ("Oxolo", the "Software" or the "Product"). Oxolo is directed at companies in the construction trades and comparable sectors.

Oxolo enables customers and their users in particular to record or upload conversations and audio on site via the mobile app, web application or accompanying communication channels such as WhatsApp, to capture photo and video evidence, to obtain transcripts, to assign speakers, optionally to use voice profiles or voiceprints for speaker identification, to extract tasks, change orders and delays, to create reports and construction logs, to translate content, to use AI-supported chat functions over project-related content, and to implement teamwork, sharing and role management.

For these purposes, Oxolo employs technologies from the field of artificial intelligence, in particular for transcription, speaker diarization, voiceprint recognition, image analysis, translation, summarization and text generation. The output generated by Oxolo may in particular comprise transcripts, summaries, tasks, change orders, delays, translations, reports, logs, analyses, chat responses and other generated content.

AI-based output may be incomplete, inaccurate or erroneous. The output serves solely as a technical aid. The customer may not use output unchecked and, in particular, may not use it as the sole basis for legal, financial, safety-related, employment-law or other decisions that produce legal effect or are of significant importance for persons or companies.

1. Subject Matter, Scope, Contract Language and B2B Restriction

1.1 These General Terms and Conditions ("GTC") govern the provision and use of Oxolo vis-à-vis the respective customer. The contract for the use of Oxolo is hereinafter referred to as the "Contract".

1.2 These GTC apply exclusively vis-à-vis entrepreneurs within the meaning of Section 14 of the German Civil Code (BGB), freelancers, legal entities under public law and special funds under public law. Oxolo is not directed at consumers within the meaning of Section 13 BGB. The conclusion of a contract with consumers is excluded. Upon registration, Oxolo may require the provision of a valid value-added tax identification number or another suitable proof of entrepreneur status. Oxolo is entitled to refuse a registration or to block an existing account if entrepreneur status is not plausibly demonstrated.

1.3 If a natural person concludes the Contract or accepts these GTC, that person warrants that they are acting exclusively in the exercise of their commercial, self-employed professional or official activity and with authority to represent the customer. Oxolo is entitled at any time to require suitable proof of the authority to represent and of entrepreneur status.

1.4 The contracting party and customer is the organization, company, freelancer, public body or other commercially acting legal entity that holds the workspace, organization or customer account at Oxolo ("Customer"). Individual natural persons who use Oxolo for the customer are merely authorized users of the customer ("Users").

1.5 The contract language is German. This English version is solely a translation.

1.6 Oxolo expressly objects to any deviating, conflicting or supplementary general terms and conditions of the customer. Such terms become part of the Contract only if Oxolo expressly consents to their applicability in text form. This applies even if Oxolo performs the Contract without reservation while aware of such terms.

1.7 Individual agreements between Oxolo and the customer, in particular a quotation, order form, in-app purchase process or other expressly agreed commercial part of the contract (each an "Order Form"), take precedence over these GTC insofar as they contain expressly deviating provisions. For commissioned processing, the respectively incorporated data processing agreement ("DPA") additionally applies; in the event of conflicts concerning the processing of personal data, the DPA takes precedence over these GTC in that respect.

1.8 These GTC do not apply to contractual relationships between the customer, its users or third parties and providers of associated services, in particular the Apple App Store, Google Play Store, payment service providers or other third-party providers.

1.9 These GTC are available via oxolo.com or another product or contract page designated by Oxolo, in a form that can be saved and printed.

2. Scope of Services of Oxolo

2.1 Oxolo provides the customer with the respectively current version of Oxolo in accordance with the scope of services booked or agreed by the customer.

2.2 The specific scope of functions, the booked plan, price, contract start, number of seats, any usage limits, trial period, term and other commercial details result from the respective Order Form, the self-service checkout, the app-store purchase process or the product and price description displayed at the time the Contract is concluded.

2.3 Oxolo may in particular provide the following functions, insofar as these are enabled, booked or technically available for the customer:

• Capture, upload and management of audio recordings;

• Transcription, speaker diarization and speaker identification, including voice profiles and voiceprints, insofar as activated or used;

• Photo and video evidence, including project-related metadata;

• Signatures, tasks, change orders, delays and other construction-site or project documentation;

• Reports, construction logs, PDF/DOCX outputs, translations and documentation-related output;

• AI chat over project context and project-related data;

• WhatsApp accompanying channel and other communication or input channels;

• Team, role, permission, invitation, sharing and collaboration functions;

• Billing, subscription, license, seat and administration functions.

2.4 Oxolo does not owe any particular economic success, any legal review, any technical freedom from defects or any suitability of the output for a particular purpose, unless this has been expressly individually agreed.

2.5 Oxolo is not intended as a backup or long-term storage solution for the customer. The customer remains responsible for keeping its own copies of input, output and business-critical documents.

2.6 To provide the service, Oxolo may use third-party providers and subprocessors, in particular hosting, infrastructure, analytics, payment, email, transcription, translation, AI, maps/location, app-store, communication and other product-supporting providers. Details of the data-protection classification and of subprocessors result from the DPA and the Privacy Policy.

2.7 Unless the customer has expressly activated an automation or a sharing/notification function that performs actions without further confirmation, Oxolo will not send any messages to third parties, will not publish any sharing links and will not send any invitation or sharing notifications without express confirmation in the user interface.

3. Availability, Maintenance, Support and No SLA Regime

3.1 Oxolo provides the service using commercially reasonable efforts and aims for an average annual availability of 95 percent, measured as an annual average and excluding the periods referred to in Section 3.2. This does not constitute any guarantee of quality or availability within the meaning of Section 18.1. Further service levels or service credits apply only in accordance with Section 3.5.

3.2 Periods during which the service is unavailable for reasons outside Oxolo's sphere of control do not count as unavailability, in particular force majeure, disruptions of telecommunications networks, internet or cloud infrastructure, failures of third-party providers, measures by app-store or platform operators, unlawful or contract-breaching use by the customer or users, as well as periods of planned or urgent maintenance.

3.3 Oxolo may temporarily restrict, suspend or maintain the service insofar as this is necessary for the security, integrity, stability, legal compliance or further development of the service.

3.4 Oxolo provides support using commercially reasonable efforts. Fixed response, restoration or resolution times are not promised unless expressly agreed in the Order Form.

3.5 Further service levels, service credits or contractual penalties apply only if they have been expressly agreed separately.

4. Product Changes and Technical Further Development

4.1 Oxolo is entitled to change, further develop, expand, restrict, supplement the security measures of, or adapt the functions of the service, insofar as this is necessary or appropriate for technical further development, improvement, security, legal compliance, abuse prevention, scaling, economic efficiency or adaptation to market or customer requirements.

4.2 Oxolo may change or discontinue functions if this is necessary or appropriate for legal, technical or security-related reasons, due to changes at third-party providers, platforms, app stores, APIs, AI providers or payment service providers, or due to a changed product strategy.

4.3 Changes may not substantially deprive the customer of the contractually agreed core benefit of the booked service without reasonable cause. Oxolo will inform the customer of material changes in an appropriate manner, in particular within the product, by email or via a contract page. Section 20 applies to changes to these GTC.

5. Conclusion of Contract, Registration, Trials, Self-Service and App Stores

5.1 A Contract may be concluded in particular by:

• acceptance of an offer or Order Form by the customer;

• mutual signing or electronic acceptance of an Order Form;

• completion of a self-service checkout via the Oxolo website or the product;

• completion of an in-app purchase or subscription via the Apple App Store or Google Play;

• activation of a customer account or workspace following registration, insofar as Oxolo accepts the registration.

5.2 Insofar as an Order Form exists, it governs the commercial details and takes precedence over conflicting information in the self-service or app-store process, insofar as this is technically and legally possible.

5.3 The use of Oxolo may require the registration and activation of a customer account, an organization, a workspace or a user account. Oxolo may refuse registrations, verify identity and authority to represent, and activate accounts only after verification.

5.4 An automatic confirmation of receipt does not yet constitute acceptance of an offer, but serves documentation and identity-verification purposes. Only the activation of the user account, the express acceptance by Oxolo or the countersignature of an Order Form leads to the conclusion of the Contract, unless the respective purchase process provides otherwise.

5.5 Free trial versions or trials are offered only if they are expressly granted within the framework of a sales process, an Order Form or a clearly designated trial process. There is no entitlement to a free trial version.

5.6 Free trial versions or trials do not automatically convert into a paid subscription. Upon expiry of the trial period, the trial ends or is blocked, unless the customer actively concludes or pays for a paid order, a subscription, an in-app purchase or an Order Form. The customer must therefore take an active step in order to transition to paid use.

5.7 Oxolo may change, restrict or terminate trials at any time. During a trial, there is no entitlement to particular functions, availability, support or continuation of the trial.

5.8 Insofar as the customer acquires services via the Apple App Store, Google Play or another platform operator, the terms of the respective platform operator additionally apply to the technical payment processing, cancellation mechanics, refunds and store administration. However, these requirements apply only to the respective processing and do not replace the B2B restriction and the terms of use governed by these GTC, insofar as this is legally and technically permissible.

6. Users, Organization, Seats and Access Rights

6.1 The customer is responsible for all users who use Oxolo via its customer account, its organization, its workspace, its seats or its access credentials.

6.2 Use is generally based on a booked or assigned license. Each user may use only their own individual access. Access credentials must be treated as confidential and may not be shared.

6.3 Additional users or seats may be booked subsequently, insofar as Oxolo offers this. Each additionally booked seat establishes its own paid annual subscription with its own term of twelve months from the time of booking, unless otherwise provided in the Order Form. Pro-rata billing aligned to an existing contract term occurs only if Oxolo expressly offers this or individually agrees to it.

6.4 The customer must ensure that only authorized persons obtain access to Oxolo and that internal roles, permissions, project access, invitations, shares and integrations are set up lawfully and in accordance with the customer's internal requirements.

6.5 The customer is responsible for the technical security of the devices, networks, access credentials and systems used by it and its users, in particular for appropriate passwords, access controls and, insofar as available, multi-factor authentication.

6.6 If the customer becomes aware of any unlawful use of its user account or of indications of such use, it must inform Oxolo without undue delay and cooperate in the investigation.

7. Input, Output, Data Sources, Third-Party Providers and DPA

7.1 "Input" means all data, content and information that the customer or its users enter, upload, record, generate, share, transmit, import into Oxolo or otherwise make accessible to Oxolo. This includes in particular audio, text, images, videos, signatures, project information, location data, metadata, transcripts, speaker information, voice profiles, reports, evidence, tasks, change orders, delays, communication content and data from third-party sources.

7.2 "Output" means all content generated by Oxolo or with the help of Oxolo, in particular transcripts, speaker assignments, summaries, tasks, change orders, delays, translations, reports, logs, analyses, chat responses and other generated content.

7.3 Oxolo processes input and output insofar as this is necessary for the provision, operation, securing, maintenance, troubleshooting, support, billing, abuse prevention, legal compliance and performance of the Contract.

7.4 If the customer activates integrations, external data sources, third-party tools, app-store functions, payment providers, WhatsApp, maps/location services, transcription, translation, AI or other technical interfaces, the customer is responsible for ensuring that it is entitled to use these services, data, content, accounts, APIs and access credentials and that it complies with their terms.

7.5 Oxolo assumes no responsibility for the availability, quality, accuracy, lawfulness, continued compatibility or functionality of third-party services, platforms, app stores, APIs, communication channels, payment services or external data sources.

7.6 The customer may not use Oxolo to circumvent access restrictions, technical protection measures, API limits, contractual terms or usage restrictions of third parties.

7.7 Insofar as input and output contain personal data and Oxolo processes such data on behalf of the customer, Oxolo acts as a processor within the meaning of Article 4(8) GDPR. In this case, the DPA respectively incorporated by Oxolo automatically forms part of the Contract.

7.8 The customer remains the controller for the lawfulness of input, recordings, transcripts, project content, speaker-identification data, voiceprints, evidence, signatures, user and permission data, and other personal data, insofar as it decides on the purposes and means of the processing.

7.9 Oxolo acts as an independent controller insofar as Oxolo processes data for its own purposes, in particular for contract administration, customer communication, billing, product security, abuse prevention, legal defense, aggregated or anonymized usage analysis and legally required retention.

7.10 Processing of personal data outside the European Economic Area takes place only insofar as this is set out in the Privacy Policy and the DPA and is based on an appropriate transfer mechanism.

7.11 Subprocessors, notifications of changes, the customer's objection options and any consequences of an objection are governed by the DPA. These GTC refer in this respect to the DPA without naming individual providers.

8. Recordings, Voiceprints, Speaker Identification and Consents

8.1 If the customer uses Oxolo for the recording, transcription, speaker identification, creation or use of voice profiles or voiceprints, processing of audio, capture of signatures, photo/video evidence or other personal data of third parties, the customer is responsible for the lawfulness of such use.

8.2 Before any recording or processing, the customer must ensure that all required notices have been given and that all required consents, legal bases, employment-law prerequisites, works council law (Betriebsverfassungsrecht) prerequisites and other legal requirements are in place. This includes, in particular, requirements relating to the recording of the non-publicly spoken word and the processing of special categories of personal data, insofar as applicable.

8.3 This applies in particular to voice profiles / voiceprints, which are biometric data for the unique identification of a natural person and thus special categories of personal data within the meaning of Article 9(1) GDPR, insofar as they are or can be used for unique identification. This may further apply to audio recordings, photos, videos, transcripts, signatures or project content, insofar as these contain or reveal special categories of personal data. A notice displayed within the product or a technical consent function does not release the customer from its own responsibility.

8.4 Voice-profile-based speaker identification is activated by default on the organization side (opt-out). The organization owner can deactivate this default setting at any time in the organization settings. Recognized speakers or voices are initially displayed with an anonymized label, e.g. 'Speaker b74bj73', as long as no authorized user of the customer assigns a real name or other concrete identity. The subsequent naming, merging or correction of a speaker identity is an assignment for which the customer is responsible.

8.5 The customer is responsible for configuring and using Oxolo in such a way that covert, impermissible or unlawful recordings, speaker identifications, voice-profile processing or naming of speakers do not occur.

8.6 Insofar as a user creates or manages their own voiceprint, Oxolo may provide additional notice, consent or deletion processes within the product. Such product processes do not change the customer's responsibility for the lawfulness of use in the respective work, project or construction-site context.

8.7 Voiceprints are isolated on an organization-specific basis. No use, assignment or matching of voiceprints across organizational boundaries takes place.

8.8 The deletion of voiceprints, biometric templates, associated source audio files and existing transcripts is governed by the functions available within the product, the DPA and the Privacy Policy. Deletion occurs in particular when the user deletes their own voiceprint via the app, a user is removed from an organization (with regard to their own voice profile, insofar as one has been created), an account is deleted or archived, the organization owner deletes an identity via the settings, or a speaker is marked as "noise". The deletion of a voiceprint does not automatically result in the deletion of already existing textual transcripts or reports; these may continue to contain the name assigned at the time of creation or the speaker label used at that time, insofar as no separate deletion or correction takes place.

8.9 Images uploaded by the customer may contain metadata, in particular EXIF/GPS data, device information or timestamps. Oxolo does not remove such metadata automatically, unless expressly stated otherwise within the product. The customer takes this into account when selecting and uploading images and, where necessary, takes its own preliminary measures.

8.10 Oxolo may restrict, suspend or deactivate individual functions, in particular recording, transcription, speaker-identification, voiceprint, sharing or communication functions, if Oxolo reasonably assumes that they are being used unlawfully, abusively or in breach of contract, or that they give rise to significant data-protection, security-related or legal risks.

9. Organization, Roles, Sharing of Content, Templates and Reports

9.1 Oxolo is operated on a multi-tenant basis. Each customer is represented as an independent organization. Within an organization, roles and permissions can be assigned to individual persons, e.g. owner, administrators or users, as well as project-related roles.

9.2 The customer acknowledges that content within an organization can generally be visible to the members of the respective organization and, depending on the configuration, to members of individual projects. Organization owners or administrators can view and manage the content and configurations of the organization. The customer is responsible for setting up roles and permissions in such a way that the visibility within the organization complies with the applicable requirements.

9.3 Insofar as the customer uses functions for the internal or external sharing of content, in particular signed sharing links, email dispatch or project-related shares, the customer is responsible for ensuring that the recipients are authorized to access and that the required consents, confidentiality clearances or other legal bases are in place. Oxolo may log accesses of such sharing links for security, compliance and audit purposes.

9.4 The customer retains ownership of, or the rights to, the templates it uploads for construction logs. The customer grants Oxolo a non-exclusive, limited right to process these templates solely for the provision of the agreed services, in particular for processing by AI components and for the creation of reports.

9.5 Reports and construction logs that Oxolo creates from the input at the customer's instigation are treated as the customer's content. The rights to the output result from Section 15.

10. Product Improvement, AI Training and Error Access

10.1 Oxolo may analyze technical usage, diagnostic, security, performance, log and interaction data in aggregated or anonymized form in order to operate, secure, improve and further develop Oxolo.

10.2 The customer's input and output are used for product improvement, quality assurance or the further development of algorithms only if the customer or the user authorized for this purpose has expressly activated the corresponding system setting. This activation can, insofar as technically available, be deactivated at any time with effect for the future.

10.3 Oxolo does not use input and output to train its own general AI models. Oxolo furthermore does not use input and output to train the large language models provided by third parties that are deployed in Oxolo, insofar as this has been contractually excluded with the respective third-party providers. Details of the AI third-party providers deployed and the respective contractual restrictions result from the DPA. This applies irrespective of whether the system setting for product improvement under Section 10.2 is activated.

10.4 Oxolo is entitled to access input and output insofar as this is necessary for troubleshooting, security, support provision, abuse review or the fulfillment of legal obligations. Such access takes place only to the extent necessary and in accordance with internal authorization and confidentiality requirements.

11. Paid Subscriptions, Payment Channels and App Stores

11.1 Paid services are provided as a subscription or in accordance with the respective Order Form. By default, the contract term for paid subscriptions is twelve (12) months, unless otherwise provided in the Order Form.

11.2 The number of seats booked, functions enabled, minimum term, usage limits, price and any special agreements result from the Order Form, the online checkout or the product and price description displayed in the respective acquisition process.

11.3 Fees are due annually in advance at the beginning of the respective term and of each renewal term, unless otherwise provided in the Order Form. Unless expressly stated otherwise, all prices are net plus statutory value-added tax.

11.4 Oxolo may provide invoices electronically, e.g. by email or as a download in the customer account. The customer consents to electronic invoicing.

11.5 Payments may be processed via invoice, Stripe, the Apple App Store, Google Play or other payment channels supported by Oxolo.

11.6 The commercial provisions of these GTC, in particular term, renewal, notice period, due date of fees and exclusion of refunds, apply irrespective of the payment channel. Insofar as Apple, Google or another platform or payment provider imposes mandatory or technically non-waivable requirements for payment processing, cancellation mechanics, invoicing, taxes, the refund process or other processing matters, these requirements apply exclusively to the respective processing.

11.7 Insofar as payments are made via the Apple App Store or Google Play, the technical cancellation or management of the subscription may additionally be required via the respective store account. The customer remains responsible for taking the respectively required steps in good time.

11.8 Fees already paid are not refunded, unless a refund is mandatorily prescribed by law or expressly agreed in the Order Form.

11.9 Prices may be changed for the next contract renewal with reasonable advance notice, but at least six (6) weeks before the beginning of the respective renewal term, unless otherwise agreed in the Order Form. If the customer does not accept the change, it may terminate the subscription in accordance with Section 12.

11.10 If the customer is in default with payments, a payment fails or an unlawful chargeback occurs, Oxolo may debit again, demand statutory default interest, assert further statutory or contractual rights, and suspend access under the conditions of Section 14.

12. Term, Automatic Renewal and Ordinary Termination

12.1 The Contract begins upon the conclusion of the Contract pursuant to Section 5 or on the date specified in the Order Form.

12.2 Paid subscriptions run for the term agreed in the Order Form. If no term is agreed, a term of twelve (12) months applies.

12.3 The subscription automatically renews for the original term in each case, unless it is terminated no later than one (1) calendar day before the expiry of the respective current term.

12.4 Decisive is the receipt of the termination by Oxolo or by the respectively responsible platform or payment provider, insofar as the termination must technically be effected via that provider.

12.5 Termination may be effected via the cancellation function provided within the product, via the respective store or payment channel, or in text form by email to team@oxolo.com, unless another contact route is specified in the Order Form.

12.6 If the customer requests Oxolo to delete the user account or the organization, the customer thereby simultaneously declares the termination of all associated subscriptions as of the end of the current term, unless an extraordinary termination is expressly declared.

12.7 The right to extraordinary termination for good cause remains unaffected.

13. Obligations and Prohibited Use

13.1 The customer may use Oxolo only lawfully, in accordance with the Contract and in accordance with the documentation, product description and enabled functions.

13.2 The customer may not process any data, content or materials in Oxolo if their processing is unlawful, infringes the rights of third parties or breaches contractual obligations toward third parties.

13.3 The customer may not use Oxolo abusively, in particular not for unlawful recording, surveillance, deception, circumvention of technical protection measures, impairment of the security or integrity of the service, unlawful disclosure of content, unauthorized use of third-party data sources, or infringement of data-protection, confidentiality, copyright, personality or other rights of third parties.

13.4 The customer may not decompile, disassemble, reverse-engineer, modify without authorization, copy, reconstruct, query in an excessively automated manner, scrape, test or attack the service, or use it to build a competing service, insofar as this is not mandatorily permitted by law.

13.5 The customer may not use output as the sole basis for legal, financial, safety-related, employment-law or other decisions with significant effect. The customer must appropriately review output before internal or external use.

13.6 The customer cooperates to a reasonable extent with requests from Oxolo that serve the provision of the service, identity and representation verification, troubleshooting, security or the fulfillment of legal obligations.

13.7 Insofar as the customer uses, publishes or distributes vis-à-vis third parties output that has been generated or altered by artificial intelligence, the customer is responsible for compliance with the labeling, transparency and disclosure obligations legally required in this regard. This includes, in particular, any obligations under Article 50 of Regulation (EU) 2024/1689 (AI Act), insofar as these apply to the customer's specific use.

14. Blocking, Suspension and Extraordinary Termination

14.1 If the customer or a user breaches these GTC, applicable law or the rights of third parties, Oxolo may suspend access in whole or in part, block or remove the affected content, deactivate functions or terminate the Contract extraordinarily, insofar as this is appropriate.

14.2 In the case of payment default, a failed payment, a minor breach of obligations or other remediable breaches of contract, Oxolo will generally warn the customer before a blocking or termination and give the customer a reasonable opportunity to remedy the matter. A warning may be given in particular within the product, via in-app notices, by email or via the respective payment channel.

14.3 An immediate blocking, deactivation of functions or extraordinary termination without a prior remedy period is permissible if this is necessary to avert significant risks, in particular in the case of security incidents, abuse, legal violations, unauthorized access, breach of data-protection or confidentiality obligations, unlawful recordings, unlawful voiceprint use, fraudulent payment details or where Oxolo cannot reasonably be expected to adhere to the Contract.

14.4 Oxolo is, in particular, entitled to extraordinary termination for good cause if the customer culpably breaches laws or these GTC and, despite a warning notice, repeatedly acts in the same or a similar manner in breach of contract, or if the customer falls into default with fees due and fails to settle the arrears despite a reminder and the expiry of a reasonable grace period of at least seven days.

14.5 Blocking or termination leaves payment claims for fees already incurred unaffected.

15. Rights in Oxolo, Input and Output

15.1 Oxolo and its licensors retain all rights in Oxolo, the Software, the models, workflows, user interfaces, documentation, trademarks, databases, systems, technical components and other protectable subject matter of Oxolo.

15.2 Oxolo grants the customer, for the duration of the Contract, a non-exclusive, non-transferable, non-sublicensable right to use Oxolo solely for its own business purposes and in accordance with the booked scope of services.

15.3 The customer retains its rights in input. The customer grants Oxolo a non-exclusive, limited, worldwide right to host, store, reproduce, transmit, convert, evaluate, display and otherwise process input solely for the purpose of providing, operating, securing, maintaining, troubleshooting, billing and supporting Oxolo.

15.4 Insofar as rights arise in output, these belong, in the relationship between Oxolo and the customer, to the customer. Oxolo receives in respect thereof the rights necessary to provide, operate, secure, maintain, bill and support the service and, only where the system setting under Section 10.2 is activated, to carry out product improvements.

15.5 The customer warrants that it holds all rights in the input it provides or uploads that are necessary for the granting of the foregoing license, and that the input and the use of output do not infringe the rights of third parties and are carried out in compliance with the law.

15.6 If Oxolo provides new versions, updates, upgrades or other new deliveries during the term of the Contract, the foregoing usage rights and restrictions also apply to these.

16. Data Export and Data Deletion After the End of the Contract

16.1 The customer is obliged to use the export, download or backup functions available in Oxolo before the end of the Contract, insofar as it continues to require input, output, reports, transcripts, evidence, recordings or other data after the end of the Contract.

16.2 Upon the expiry or termination of the Contract, the customer's access to Oxolo ends, unless otherwise provided in the Order Form.

16.3 Upon termination or expiry of the Contract, Oxolo will, at the customer's request in text form, provide the customer for at least thirty (30) days after the termination or expiry takes effect with a reasonable opportunity to export essential data, insofar as this is technically available, legally permissible and justifiable for security reasons. The request must be addressed within this period to team@oxolo.com or the contact point named in the Order Form. Thereafter, personal data may, in accordance with the DPA, generally be deleted or returned, insofar as no statutory retention obligations, legitimate interests in evidence or backup cycles conflict therewith. 

16.4 After expiry of the export period, Oxolo may delete, anonymize or block access to input and output, unless statutory retention obligations, legitimate interests in legal defense, billing requirements, backup cycles or provisions of the DPA conflict therewith.

16.5 The customer acknowledges that data may remain in security and backup systems for a short period. Statutory retention obligations remain unaffected.

16.6 For personal data that Oxolo processes on behalf of the customer, the return and deletion provisions of the DPA apply additionally.

17. Security and Compliance Documentation; Audit Requests

17.1 Oxolo maintains appropriate technical and organizational measures to protect the service and the data processed within the scope of the service. Where personal data are concerned, details result from the DPA and its annexes.

17.2 At the customer's request, Oxolo provides, to a reasonable extent, available security and compliance documentation, insofar as this is necessary to assess the security of Oxolo and insofar as legitimate secrecy, security or confidentiality interests of Oxolo or third parties do not conflict therewith. This may include, in particular, the respectively current SOC 2 report, internal security documentation in appropriately summarized or redacted form, technical and organizational measures, standardized security questionnaires, and other available audit or certification documentation. Disclosure may be made conditional on an appropriate confidentiality agreement.

17.3 A right of the customer to an on-site audit, penetration test, source-code review or direct access to the systems, logs, infrastructure or documentation of subprocessors exists only insofar as this is expressly provided for in the DPA, an enterprise contract or a separate agreement.

17.4 Insofar as the customer requires further inspection, certification or audit documentation, the parties may regulate this additionally in an enterprise Order Form, a security addendum or the DPA.

18. Liability

18.1 Oxolo is liable without limitation in cases of intent and gross negligence, in cases of injury to life, body or health, under the German Product Liability Act (Produkthaftungsgesetz), in the case of the assumption of an express guarantee, and in all cases of mandatory statutory liability.

18.2 In cases of slight negligence, Oxolo is liable only for the breach of material contractual obligations. Material contractual obligations are obligations whose fulfillment makes the proper performance of the Contract possible in the first place and on whose compliance the customer may regularly rely. In this case, liability is limited to the foreseeable damage typical of the Contract.

18.3 Oxolo's liability pursuant to Section 18.2 is limited, per damage event and in total per contract year, to an amount corresponding to the fees paid by the customer to Oxolo in the twelve (12) months immediately prior to the occurrence of the damage event. If, at the time of the damage event, the Contract had not yet existed for twelve (12) months, twelve times the average monthly fees paid shall be decisive.

18.4 Oxolo is not liable, to the extent legally permissible, for indirect damages, consequential damages, lost profit, lost savings, reputational damage, business interruptions, data loss or damages arising from the use of erroneous output, unless such damages were caused by intent or gross negligence on the part of Oxolo or liability cannot be excluded by law.

18.5 For free trials, trial versions and gratuitous services, Oxolo is liable, to the extent legally permissible, only for intent and gross negligence.

18.6 Oxolo's liability for the loss of data is limited to that restoration effort which would have arisen had the customer carried out proper and regular data backups.

18.7 With regard to the output of Oxolo's AI components, Oxolo does not owe any substantive accuracy, completeness or suitability for a particular purpose. Liability for damages based on the customer having relied on output unchecked is excluded within the framework of the foregoing provisions, unless mandatory statutory provisions prescribe otherwise.

18.8 The limitations of liability also apply in favor of the legal representatives, governing bodies, employees, vicarious agents and subcontractors of Oxolo.

18.9 The foregoing limitations of liability do not change the statutory allocation of the burden of proof.

19. Indemnification by the Customer

19.1 The customer indemnifies Oxolo against claims of third parties arising from the customer or its users culpably breaching these GTC, applicable law, the rights of third parties, data-protection obligations, consent or information obligations, terms of third-party providers, or obligations in connection with recordings, speaker identification, voiceprints, input or output.

19.2 The indemnification includes reasonable costs of legal defense. It does not apply insofar as the claim is based on a breach of obligation by Oxolo.

19.3 Oxolo will inform the customer of asserted claims and give the customer the opportunity to cooperate, insofar as this is legally and practically possible and legitimate interests of Oxolo do not conflict therewith.

20. Amendment of These GTC

20.1 Oxolo may amend these GTC with effect for the future, insofar as this is necessary or appropriate due to technical, legal, economic or product-related developments and does not unreasonably disadvantage the customer.

20.2 Oxolo will inform the customer at least six (6) weeks before the amendment takes effect, in text form or via the product, and will give the customer the opportunity to object to the amendment within six (6) weeks of receipt of the notification.

20.3 If the customer does not object in good time and continues to use Oxolo after the amendment takes effect, the amended GTC are deemed accepted, insofar as Oxolo has pointed out this consequence to the customer in the amendment notification.

20.4 If the customer objects in good time, the previous GTC initially continue to apply. In this case, Oxolo is entitled to terminate the Contract by ordinary termination as of the end of the current contract term or, if continuation under the previous terms is unreasonable for legal, technical or economic reasons, with reasonable notice.

20.5 Individually agreed Order Forms remain paramount, insofar as they contain expressly deviating provisions.

21. Final Provisions

21.1 The Contract is governed by the law of the Federal Republic of Germany, excluding the UN Convention on Contracts for the International Sale of Goods (CISG) and the rules of private international law.

21.2 The exclusive place of jurisdiction for all disputes arising out of or in connection with the Contract is Hamburg, Germany, insofar as the customer is a merchant (Kaufmann), a legal entity under public law or a special fund under public law, or insofar as an agreement on jurisdiction is legally permissible. Oxolo is also entitled to sue the customer at its general place of jurisdiction.

21.3 Should individual provisions of these GTC be or become invalid or unenforceable, the validity of the remaining provisions remains unaffected. The statutory provision shall take the place of the invalid or unenforceable provision. The same applies to any gaps in the Contract.

21.4 Amendments and supplements to this Contract require text form, unless a stricter form is prescribed by law. This also applies to the amendment of this text-form clause.

21.5 Rights and obligations under the Contract may be transferred by the customer only with the prior consent of Oxolo. Oxolo may transfer the Contract to affiliated companies or legal successors, insofar as this does not unreasonably disadvantage the customer.