Preamble: Oxolo, AI Functions and Their Limits

Oxolo GmbH, Bohnenstraße 2, 20457 Hamburg, commercial register number HRB 162 826 at the Local Court (Amtsgericht) of Hamburg, VAT ID no. DE330771975, Managing Director Heiko Hubertz ("Oxolo" or "we") develops and operates a software-as-a-service solution for digital project, deployment, construction-site and field documentation, including accompanying project communication and documentation workflows ("Oxolo", the "Software" or the "Product"). Oxolo is aimed at companies in the construction trades and comparable sectors.

Oxolo enables customers and their users, in particular, to record or upload conversations and audio on site via the mobile app, the web application or accompanying communication channels such as WhatsApp, to record online meetings in third-party conferencing services (e.g. Zoom, Microsoft Teams, Google Meet) by means of an automated recording participant ("Meeting Bot"), to capture photo and video evidence, to obtain transcripts, to assign speakers, optionally to use voice profiles or voiceprints for speaker identification, to extract tasks, variation orders and delays, to create reports and construction logs, to translate content, to use AI-supported chat functions on project-related content, and to implement teamwork, sharing and role management.

For these purposes, Oxolo uses artificial-intelligence technologies, in particular for transcription, speaker diarisation, voiceprint recognition, image analysis, translation, summarisation and text generation. The output generated by Oxolo may include, in particular, transcripts, summaries, tasks, variation orders, delays, translations, reports, logs, analyses, chat responses and other generated content.

AI-based output may be incomplete, inaccurate or erroneous. The output serves solely as a technical aid. The Customer may not use output unchecked and, in particular, may not use it as the sole basis for legal, financial, safety-related, employment-related or other decisions that have legal effect or are of significant importance for individuals or companies.

1. Subject Matter, Scope, Contract Language and B2B Restriction

1.1 These General Terms and Conditions ("GTC") govern the provision and use of Oxolo vis-à-vis the respective customer. The contract for the use of Oxolo is hereinafter referred to as the "Agreement".

1.2 These GTC apply exclusively vis-à-vis entrepreneurs within the meaning of § 14 BGB, members of the liberal professions, legal persons under public law and special funds under public law. Oxolo is not aimed at consumers within the meaning of § 13 BGB. The conclusion of a contract with consumers is excluded. Upon registration, Oxolo may require the provision of a valid VAT identification number or other suitable proof of entrepreneur status. Oxolo is entitled to refuse a registration or to block an existing account if entrepreneur status is not plausibly demonstrated.

1.3 If a natural person concludes the Agreement or accepts these GTC, that person warrants that they are acting exclusively in the exercise of their commercial, self-employed professional or official activity and with authority to represent the Customer. Oxolo is entitled to require suitable proof of the authority to represent and of entrepreneur status at any time.

1.4 The contracting party and customer is the organisation, company, freelancer, public body or other commercially acting legal entity that holds the workspace, organisation or customer account with Oxolo ("Customer"). Individual natural persons who use Oxolo for the Customer are merely authorised users of the Customer ("Users").

1.5 The contract language is German. This German version is solely authoritative, unless expressly agreed otherwise in an Order Form.

1.6 Oxolo expressly objects to any deviating, conflicting or supplementary general terms and conditions of the Customer. Such terms only become part of the contract if Oxolo expressly consents to their application in text form. This also applies where Oxolo performs the Agreement without reservation in the knowledge of such terms.

1.7 Individual agreements between Oxolo and the Customer, in particular a quote, order form, order document, purchase order, in-app purchase process or other expressly agreed commercial contract component (each an "Order Form"), take precedence over these GTC insofar as they contain expressly deviating provisions. For data processing, the data processing agreement ("DPA") concluded pursuant to Clause 7.7 additionally applies; in the event of conflicts concerning the processing of personal data, the DPA takes precedence over these GTC in that respect.

1.8 These GTC do not apply to contractual relationships between the Customer, its Users or third parties and providers of connected services, in particular the Apple App Store, Google Play Store, payment service providers or other third-party providers.

1.9 These GTC are available via oxolo.com or another product or contract page designated by Oxolo in a form that can be saved and printed.

2. Scope of Oxolo's Services

2.1 Oxolo provides the Customer with the respective current version of Oxolo in accordance with the scope of services booked or agreed by the Customer.

2.2 The specific range of functions, booked plan, price, contract start, number of seats, any usage limits, trial period, term and other commercial details result from the respective Order Form, the self-service checkout, the app-store purchase process or the product and price description displayed at the time the Agreement is concluded.

2.3 Oxolo may provide, in particular, the following functions, insofar as they are enabled, booked or technically available for the Customer:

• capture, upload and management of audio recordings;

• recording and transcription of online meetings in third-party conferencing services by means of an automated recording participant (Meeting Bot);

• transcription, speaker diarisation and speaker identification, including voice profiles and voiceprints, insofar as activated or used;

• photo and video evidence including project-related metadata;

• signatures, tasks, variation orders, delays and other construction-site or project documentation;

• reports, construction logs, PDF/DOCX outputs, translations and documentation-related output;

• AI chat over project context and project-related data;

• WhatsApp companion channel and other communication or input channels;

• registration and login by means of a one-time password (OTP) via SMS to a stored mobile number or by means of a login link sent by email;

• push notifications to Users' registered devices;

• team, role, permission, invitation, sharing and collaboration functions;

• billing, subscription, licence, seat and administration functions.

2.4 Oxolo does not owe any particular economic success, any legal review, any technical freedom from defects or any suitability of the output for a particular purpose, unless this has been expressly individually agreed.

2.5 Oxolo is not intended as a backup or long-term storage solution for the Customer. The Customer remains responsible for keeping its own copies of input, output and business-critical documents.

2.6 Oxolo may use third-party providers and subcontractors to provide the service, in particular hosting, infrastructure, analytics, payment, email, SMS and telephony, push-notification, meeting-recording, transcription, translation, AI, map/location, app-store, CRM, communication and other product-supporting providers. Details of the data-protection classification and of subprocessors result from the DPA and the Privacy Policy.

2.7 Unless the Customer has expressly activated an automation or a sharing/notification function that carries out actions without further confirmation, Oxolo will not send any messages to third parties, will not publish any sharing links and will not send any invitation or sharing notifications without express confirmation in the user interface. A Meeting Bot joins an online meeting solely at the instigation of the Customer or one of its Users; Oxolo does not initiate such a join on its own.

2.8 Oxolo may transmit operational and contract-related communications, in particular security, availability, billing, support and product notices, via the Product, by email, by SMS and by push notification, to the contact details stored by the Customer and its Users and to registered devices. Users can deactivate push notifications at any time via the system settings of their device.

3. Availability, Maintenance, Support and No SLA Regime

3.1 Oxolo provides the service using commercially reasonable efforts and aims for an average annual availability of 95 per cent, measured as an annual average and excluding the periods referred to in Clause 3.2. This does not constitute any guarantee of quality or availability within the meaning of Clause 18.1. More extensive service levels or service credits apply only in accordance with Clause 3.5.

3.2 Periods in which the service is unavailable for reasons outside Oxolo's sphere of influence do not count as unavailability, in particular force majeure, disruptions to telecommunications networks, internet or cloud infrastructure, failures of third-party providers, measures by app-store or platform operators, unlawful or contract-breaching use by the Customer or Users, as well as periods of planned or urgent maintenance.

3.3 Oxolo may temporarily restrict, suspend or maintain the service insofar as this is necessary for the security, integrity, stability, legal compliance or further development of the service.

3.4 Oxolo provides support using commercially reasonable efforts. Fixed response, restoration or resolution times are not promised unless expressly agreed in the Order Form.

3.5 More extensive service levels, service credits or contractual penalties apply only if they have been expressly agreed separately.

4. Product Changes and Technical Further Development

4.1 Oxolo is entitled to change, further develop, extend or restrict the service, to add security measures or to adapt functions, insofar as this is necessary or reasonable for technical further development, improvement, security, legal compliance, abuse prevention, scaling, economic efficiency or adaptation to market or customer requirements.

4.2 Oxolo may change or discontinue functions where this is necessary or reasonable for legal, technical or security-related reasons, due to changes at third-party providers, platforms, app stores, APIs, AI providers or payment service providers, or due to a changed product strategy.

4.3 Changes may not, without reasonable cause, materially withdraw the contractually agreed core benefit of the booked service. Oxolo will inform the Customer of material changes in an appropriate manner, in particular in the Product, by email or via a contract page. Clause 20 applies to changes to these GTC.

5. Conclusion of Contract, Registration, Trials, Self-Service and App Stores

5.1 A contract may come into existence, in particular, through:

• the Customer's acceptance of a quote or Order Form;

• mutual signature or electronic acceptance of an Order Form;

• completion of a self-service checkout via the Oxolo website or the Product;

• completion of an in-app purchase or subscription via the Apple App Store or Google Play;

• activation of a customer account or workspace following registration, insofar as Oxolo accepts the registration.

5.2 Insofar as an Order Form exists, it governs the commercial details and takes precedence over conflicting information in the self-service or app-store process, insofar as this is technically and legally possible.

5.3 The use of Oxolo may require registration and activation of a customer account, an organisation, a workspace or a user account. Oxolo may refuse registrations, verify identity and authority to represent, and activate accounts only after verification.

5.4 An automatic acknowledgement of receipt does not yet constitute acceptance of an offer, but serves the purposes of documentation and identity verification. Only the activation of the user account, express acceptance by Oxolo or the counter-signature of an Order Form leads to the conclusion of the contract, unless the respective purchase process provides otherwise.

5.5 Free trial versions or trials are only offered where they are expressly granted as part of a sales process, an Order Form or a clearly designated trial process. There is no entitlement to a free trial version.

5.6 Free trial versions or trials do not automatically convert into a paid subscription. Upon expiry of the trial period, the trial ends or is blocked, unless the Customer actively concludes or pays for a paid order, a subscription, an in-app purchase or an Order Form. The Customer must therefore take an active step to transition to paid use.

5.7 Oxolo may change, restrict or terminate trials at any time. During a trial there is no entitlement to particular functions, availability, support or continuation of the trial.

5.8 Insofar as the Customer acquires services via the Apple App Store, Google Play or another platform operator, the terms of the respective platform operator additionally apply to the technical payment processing, cancellation mechanism, refund and store administration. These requirements, however, apply only to the respective processing and do not replace the B2B restriction and the terms of use governed in these GTC, insofar as this is legally and technically permissible.

6. Users, Organisation, Seats and Access Rights

6.1 The Customer is responsible for all Users who use Oxolo via its customer account, its organisation, its workspace, its seats or its access credentials.

6.2 Use is generally on the basis of a booked or assigned licence. Each User may only use their own individual access. Access credentials must be treated confidentially and may not be shared.

6.3 Additional Users or seats may be booked subsequently, insofar as Oxolo offers this. Each additionally booked seat establishes its own paid annual subscription with its own term of twelve months from the time of booking, unless otherwise provided in the Order Form. Pro-rata billing aligned to an existing contract term takes place only if Oxolo expressly offers this or agrees it individually.

6.4 The Customer must ensure that only authorised persons obtain access to Oxolo and that internal roles, permissions, project access rights, invitations, shares and integrations are set up lawfully and in accordance with the Customer's internal requirements.

6.5 The Customer is responsible for the technical security of the devices, networks, access credentials and systems used by it and its Users, in particular for appropriate passwords, access controls and, where available, multi-factor authentication. If login takes place via a one-time password (OTP) sent by SMS or via a login link sent by email, the Customer is additionally responsible for ensuring that the stored mobile numbers and email mailboxes are assigned exclusively to the respective authorised Users, are secured against unauthorised access, and that the devices used are protected by a screen lock.

6.6 If the Customer becomes aware of unlawful use of its user account or of indications of such use, it must inform Oxolo without undue delay and cooperate in the investigation.

6.7 If login takes place via a one-time password (OTP) sent by SMS, the Customer ensures that the change, surrender, return or loss of a User's stored mobile number is updated without undue delay in the Product, or that the affected user access is blocked without undue delay. The Customer acknowledges that mobile numbers may be reassigned by network operators and that a number that has not been updated may enable third parties to access the user account. The same applies to stored email mailboxes where login takes place via a login link sent by email.

7. Input, Output, Data Sources, Third-Party Providers and DPA

7.1 "Input" means all data, content and information that the Customer or its Users enter, upload, record, generate, share, transmit or import into Oxolo or otherwise make accessible to Oxolo. This includes, in particular, audio, text, images, videos, signatures, project information, location data, metadata, transcripts, speaker information, voice profiles, reports, evidence, tasks, variation orders, delays, defects, plans and plan markings, notes, recordings of online meetings, contact and telephone-number data, communication content and data from third-party sources.

7.2 "Output" means all content generated by Oxolo or with the aid of Oxolo, in particular transcripts, speaker assignments, summaries, tasks, variation orders, delays, translations, reports, logs, analyses, chat responses and other generated content.

7.3 Oxolo processes Input and Output insofar as this is necessary for the provision, operation, safeguarding, maintenance, error correction, support, billing, abuse prevention, legal compliance and performance of the Agreement.

7.4 If the Customer activates integrations, external data sources, third-party tools, app-store functions, payment providers, WhatsApp, map/location services, transcription, translation, AI or other technical interfaces, the Customer is responsible for ensuring that it is entitled to use these services, data, content, accounts, APIs and access credentials and that it complies with their terms.

7.5 Oxolo assumes no responsibility for the availability, quality, accuracy, lawfulness, ongoing compatibility or functionality of third-party services, platforms, app stores, APIs, communication channels, payment services or external data sources.

7.6 The Customer may not use Oxolo to circumvent access restrictions, technical protection measures, API limits, contractual terms or usage restrictions of third parties.

7.7 Insofar as Input and Output contain personal data and Oxolo processes such data on behalf of the Customer, Oxolo acts as a processor within the meaning of Art. 4(8) GDPR. In this case, the parties conclude the DPA provided by Oxolo in each case. The DPA comes into existence through acceptance of the DPA as part of the registration, order or checkout process, or through a separate agreement, and is a component of the Agreement from that point in time. Oxolo documents the acceptance of the DPA, including the respective document version.

7.8 The Customer remains the controller for the lawfulness of Input, recordings, transcripts, project content, speaker-identification data, voiceprints, evidence, signatures, user and permission data and other personal data, insofar as it decides on the purposes and means of the processing.

7.9 Oxolo acts as an independent controller insofar as Oxolo processes data for its own purposes, in particular for contract administration, customer communication, billing, product security, abuse prevention, legal defence, aggregated or anonymised usage analysis and legally required retention.

7.10 Processing of personal data outside the European Economic Area takes place only insofar as this is set out in the Privacy Policy and the DPA and is based on a suitable transfer basis.

7.11 Subprocessors, notifications of changes, the Customer's options to object and any consequences of an objection are governed by the DPA. These GTC refer to the DPA in this respect without naming individual providers.

8. Recordings, Voiceprints, Speaker Identification and Consents

8.1 If the Customer uses Oxolo for the recording, transcription, speaker identification, creation or use of voice profiles or voiceprints, processing of audio, capture of signatures, photo/video evidence or other personal data of third parties, the Customer is responsible for the lawfulness of this use.

8.2 Before any recording or processing, the Customer must ensure that all required notices have been given and that all required consents, legal bases, employment-law prerequisites, works-constitution-law prerequisites and other statutory requirements are in place. This includes, in particular, requirements relating to the recording of the non-publicly spoken word and the processing of special categories of personal data, insofar as applicable.

8.3 This applies in particular to voice profiles / voiceprints, which are biometric data for the unique identification of a natural person and thus special categories of personal data within the meaning of Art. 9(1) GDPR, insofar as they are used or can be used for unique identification. This may further apply to audio recordings, photos, videos, transcripts, signatures or project content, insofar as these contain or reveal special categories of personal data. A notice displayed in the Product or a technical consent function does not release the Customer from its own responsibility.

8.4 Voice-profile-based speaker identification is activated by default at the organisation level (opt-out). The organisation owner and administrators appointed by them can deactivate and reactivate this default setting in the organisation settings at any time. Recognised speakers or voices are initially displayed with an anonymised label, e.g. 'Speaker b74bj73', for as long as no authorised User of the Customer assigns a real name or other specific identity. The subsequent naming, merging or correction of a speaker identity is an assignment for which the Customer is responsible. The Customer is responsible for limiting the group of persons with administrator rights to the necessary extent.

8.5 The Customer is responsible for configuring and using Oxolo in such a way that secret, impermissible or unlawful recordings, speaker identifications, voice-profile processing or naming of speakers do not occur.

8.6 Insofar as a User creates or manages their own voiceprint, Oxolo may provide additional notice, consent or deletion processes in the Product. Such product processes do not alter the Customer's responsibility for the lawfulness of use in the respective work, project or construction-site context.

8.7 Voiceprints are isolated on an organisation-specific basis. No use, assignment or matching of voiceprints across organisational boundaries takes place.

8.8 The deletion of voiceprints, biometric templates, associated source audio files and existing transcripts is governed by the functions available in the Product, the DPA and the Privacy Policy. Deletion takes place in particular where the User deletes their own voiceprint via the app, a User is removed from an organisation (with respect to their own voice profile, insofar as one has been created), an account is deleted or archived, the organisation owner or an administrator deletes an identity via the settings, or a speaker is marked as "noise". The deletion of a voiceprint does not automatically lead to the deletion of already existing textual transcripts or reports; these may continue to contain the name assigned at the time of creation or the speaker label used at that time, insofar as no separate deletion or correction takes place.

8.9 Images uploaded by the Customer may contain metadata, in particular EXIF/GPS data, device information or timestamps. Oxolo does not automatically remove such metadata unless expressly stated otherwise in the Product. The Customer takes this into account when selecting and uploading images and takes its own precautionary measures where necessary.

8.10 Oxolo may restrict, suspend or deactivate individual functions, in particular recording, transcription, speaker-identification, voiceprint, sharing or communication functions, where Oxolo reasonably assumes that they are being used unlawfully, abusively or in breach of contract, or that they give rise to significant data-protection, security-related or legal risks.

8.11 If the Customer uses the function for recording online meetings, an automated recording participant used by Oxolo ("Meeting Bot") joins the respective online meeting and records audio and, where applicable, video content of all participants; this content is subsequently transcribed, diarised, subjected to speaker identification and further processed like other recordings. The Customer is responsible for informing all participants in the meeting, before the recording begins, about the recording, its purpose, scope and duration, as well as about any speaker identification and voice-profile processing, and for obtaining all consents and other legal bases required for this. Clauses 8.1 to 8.3 apply accordingly and without restriction, including to participants who do not belong to the Customer. Insofar as the conferencing service or the Meeting Bot itself displays a notice of the recording, this does not release the Customer from its responsibility under this Clause.

8.12 The Customer ensures, in particular, that (i) the recording of the non-publicly spoken word does not take place without the required consents, (ii) the use of the Meeting Bot is compatible with the terms of use of the respective conferencing service and the requirements of the respective meeting host, (iii) any co-determination and employment-law requirements are met, and (iv) the Meeting Bot does not participate in meetings whose recording is impermissible under professional, confidentiality or supervisory law. Oxolo does not owe any review of permissibility in the individual case. Clause 8.10 applies accordingly.

9. Organisation, Roles, Sharing of Content, Templates and Reports

9.1 Oxolo is operated on a multi-tenant basis. Each Customer is represented as a separate organisation. Within an organisation, roles and permissions can be assigned to individual persons, e.g. owner, administrators or users, as well as project-related roles.

9.2 The Customer acknowledges that content within an organisation may generally be visible to the members of the respective organisation and, depending on configuration, to the members of individual projects. Organisation owners or administrators can view and manage the organisation's content and configurations. The Customer is responsible for setting up roles and permissions in such a way that the organisation-internal visibility complies with the applicable requirements.

9.3 Insofar as the Customer uses functions for the internal or external sharing of content, in particular signed sharing links, email dispatch or project-related shares, the Customer is responsible for ensuring that the recipients are authorised to access and that the required consents, confidentiality clearances or other legal bases are in place. Oxolo may log accesses to such sharing links for security, compliance and audit purposes.

9.4 The Customer retains ownership of, or the rights to, the templates it uploads for construction logs. The Customer grants Oxolo a non-exclusive, limited right to process these templates solely for the provision of the agreed services, in particular for processing by AI components and for the creation of reports.

9.5 Reports and construction logs that Oxolo creates from the Input at the Customer's instigation are treated as the Customer's content. The rights to the Output result from Clause 15.

10. Product Improvement, AI Training and Error Access

10.1 Oxolo may analyse technical usage, diagnostic, security, performance, log and interaction data in aggregated or anonymised form in order to operate, safeguard, improve and further develop Oxolo.

10.2 The Customer's Input and Output are used for product improvement, quality assurance or the further development of algorithms only if the Customer or the User authorised for this purpose has expressly activated the corresponding system setting. This activation can, insofar as technically available, be deactivated at any time with effect for the future.

10.3 Oxolo does not use Input and Output to train its own general AI models. Oxolo also does not use Input and Output to train the AI models provided by third-party providers, in particular large language models and the transcription and speaker-recognition models used in Oxolo, insofar as this has been contractually excluded with the respective third-party providers. The AI subprocessors used are named in Annex 3 of the DPA; Oxolo communicates the respective contractual restrictions to the Customer on request in text form. This applies regardless of whether the system setting for product improvement pursuant to Clause 10.2 is activated.

10.4 Oxolo is entitled to access Input and Output insofar as this is necessary for error correction, security, support provision, abuse review or compliance with legal obligations. Such access takes place only to the extent necessary and in accordance with internal authorisation and confidentiality requirements.

11. Paid Subscriptions, Payment Channels and App Stores

11.1 Paid services are provided as a subscription or in accordance with the respective Order Form. By default, the contract term for paid subscriptions is twelve (12) months, unless otherwise provided in the Order Form.

11.2 The number of booked seats, enabled functions, minimum term, usage limits, price and any special agreements result from the Order Form, the online checkout or the product and price description displayed in the respective acquisition process.

11.3 Fees are payable annually in advance at the beginning of the respective term and of each renewal term, unless otherwise provided in the Order Form. All prices are, unless expressly stated otherwise, net plus statutory VAT.

11.4 Oxolo may provide invoices electronically, e.g. by email or as a download in the customer account. The Customer consents to electronic invoicing.

11.5 Payments may be processed via invoice, Stripe, the Apple App Store, Google Play or other payment channels supported by Oxolo.

11.6 The commercial provisions of these GTC, in particular term, renewal, notice period, fee maturity and exclusion of refunds, apply irrespective of the payment channel. Insofar as Apple, Google or another platform or payment provider imposes mandatory or technically non-waivable requirements for payment processing, cancellation mechanism, invoicing, taxes, the refund process or other processing matters, these requirements apply exclusively to the respective processing.

11.7 Insofar as payments are made via the Apple App Store or Google Play, the technical cancellation or management of the subscription may additionally be required via the respective store account. The Customer remains responsible for taking the respective necessary steps in good time.

11.8 Fees already paid are not refunded, unless a refund is mandatorily required by law or expressly agreed in the Order Form. If the Customer effectively terminates the Agreement for good cause for which Oxolo is responsible, Oxolo refunds fees paid in advance on a pro-rata basis for the unused period. Statutory rights to reduction and reclaim under Clause 18.11 remain unaffected.

11.9 Prices may be changed for the next contract renewal with reasonable advance notice, but at least six (6) weeks before the beginning of the respective renewal term, unless otherwise agreed in the Order Form. If the Customer does not accept the change, it may cancel the subscription in accordance with Clause 12.

11.10 If the Customer is in default with payments, a payment fails or an unlawful chargeback occurs, Oxolo may debit again, demand statutory default interest, assert further statutory or contractual rights and suspend access under the conditions of Clause 14.

12. Term, Automatic Renewal and Ordinary Termination

12.1 The Agreement begins upon conclusion of the contract pursuant to Clause 5 or on the date specified in the Order Form.

12.2 Paid subscriptions run for the term agreed in the Order Form. If no term is agreed, a term of twelve (12) months applies.

12.3 The subscription renews automatically for the original term in each case, unless it is cancelled no later than one (1) calendar day before the expiry of the respective current term.

12.4 The decisive factor is receipt of the cancellation by Oxolo or by the respective competent platform or payment provider, insofar as the cancellation must technically be made via that provider.

12.5 Cancellation can be made via the cancellation function provided in the Product, via the respective store or payment channel, or in text form by email to team@oxolo.com, unless another contact route is specified in the Order Form.

12.6 If the Customer requests that Oxolo delete the user account or the organisation, the Customer thereby simultaneously declares the cancellation of all associated subscriptions, in each case as at the end of the term running for the respective subscription; for seats booked separately pursuant to Clause 6.3, this point in time may deviate from the term of the main subscription. This does not apply insofar as an extraordinary termination is expressly declared.

12.7 The right to extraordinary termination for good cause remains unaffected.

13. Obligations and Prohibited Use

13.1 The Customer may use Oxolo only lawfully, in accordance with the contract and in accordance with the documentation, product description and enabled functions.

13.2 The Customer may not process any data, content or materials in Oxolo where their processing is unlawful, infringes third-party rights or breaches contractual obligations towards third parties.

13.3 The Customer may not use Oxolo abusively, in particular not for unlawful recording, surveillance, deception, circumvention of technical protection measures, impairment of the security or integrity of the service, unlawful disclosure of content, unauthorised use of third-party data sources, or infringement of data-protection, confidentiality, copyright, personality or other rights of third parties.

13.4 The Customer may not decompile, disassemble, reverse-engineer, modify without authorisation, copy, replicate, query in an excessively automated manner, scrape, test or attack the service, or use it to build a competing service, insofar as this is not mandatorily permitted by law.

13.5 The Customer may not use Output as the sole basis for legal, financial, safety-related, employment-related or other decisions with significant effect. The Customer must appropriately review Output before internal or external use.

13.6 The Customer cooperates, to a reasonable extent, with requests from Oxolo that serve the provision of the service, the verification of identity and authority to represent, error correction, security or compliance with legal obligations.

13.7 Insofar as the Customer uses, publishes or distributes to third parties Output that has been generated or altered by artificial intelligence, the Customer is responsible for compliance with the labelling, transparency and disclosure obligations legally required in this respect. This includes, in particular, any obligations under Art. 50 of Regulation (EU) 2024/1689 (AI Act) as amended by Regulation (EU) 2026/1744, insofar as these apply to the Customer's specific use. Oxolo fulfils the obligations incumbent on it as a provider under Art. 50(1) and (2) of the AI Act, in particular the notice that users are interacting with an AI system, as well as the machine-readable labelling of AI-generated content. The Customer may not remove, alter or render unrecognisable any labelling, watermarks or metadata applied by Oxolo and is itself responsible, as a deployer, for the obligations incumbent on it.

14. Blocking, Suspension and Extraordinary Termination

14.1 If the Customer or a User breaches these GTC, applicable law or third-party rights, Oxolo may suspend access in whole or in part, block or remove affected content, deactivate functions or terminate the Agreement extraordinarily, insofar as this is appropriate.

14.2 In the case of payment default, a failed payment, a minor breach of duty or other remediable breaches of contract, Oxolo will, as a rule, warn the Customer before a blocking or termination and give it a reasonable opportunity to remedy. A warning may be given, in particular, via the Product, in-app notices, email or the respective payment channel.

14.3 An immediate blocking, deactivation of functions or extraordinary termination without a prior remedy period is permissible where this is necessary to avert significant risks, in particular in the case of security incidents, abuse, legal violations, unauthorised access, breach of data-protection or confidentiality obligations, unlawful recordings, unlawful voiceprint use, fraudulent payment details, or where Oxolo cannot reasonably be expected to adhere to the Agreement.

14.4 Oxolo is entitled to extraordinary termination for good cause, in particular, where the Customer culpably breaches laws or these GTC and, despite a warning, repeatedly acts in the same or a similar manner in breach of contract, or where the Customer is in default with fees due and, despite a reminder and the expiry of a reasonable grace period of at least seven days, does not settle the arrears.

14.5 Blocking or termination leaves payment claims for fees already incurred unaffected.

15. Rights to Oxolo, Input and Output

15.1 Oxolo and its licensors retain all rights to Oxolo, the Software, the models, workflows, user interfaces, documentation, trade marks, databases, systems, technical components and other protected subject matter of Oxolo.

15.2 Oxolo grants the Customer, for the term of the Agreement, a simple, non-exclusive, non-transferable, non-sub-licensable right to use Oxolo exclusively for its own business purposes and in accordance with the booked scope of services.

15.3 The Customer retains its rights to Input. The Customer grants Oxolo a non-exclusive, limited, worldwide right to host, store, reproduce, transmit, convert, evaluate, display and otherwise process Input solely for the purpose of the provision, operation, safeguarding, maintenance, error correction, billing and support of Oxolo.

15.4 Insofar as rights arise in Output, these belong, as between Oxolo and the Customer, to the Customer. Oxolo receives the rights to it that are necessary to provide, operate, safeguard, maintain and bill the service, provide support and, only where the system setting under Clause 10.2 is activated, make product improvements.

15.5 The Customer warrants that it holds all rights to the Input provided or uploaded by it that are necessary for granting the above licence, and that the Input and the use of Output do not infringe third-party rights and take place in compliance with the law.

15.6 If Oxolo provides new versions, updates, upgrades or other new deliveries during the term of the Agreement, the above usage rights and restrictions also apply to these.

16. Data Export and Data Deletion after End of Contract

16.1 The Customer is obliged to use the export, download or backup functions available in Oxolo before the end of the contract, insofar as it continues to require Input, Output, reports, transcripts, evidence, recordings or other data after the end of the contract.

16.2 Upon expiry or termination of the Agreement, the Customer's access to Oxolo ends, unless otherwise provided in the Order Form. By way of derogation from this, access to the export and download functions available in the Product remains in place for the period referred to in Clause 16.3 and to the extent described there.

16.3 Upon termination or expiry of the Agreement, Oxolo provides the Customer, for at least thirty (30) days after the termination or expiry takes effect, with a reasonable opportunity to export essential data via the export functions available in Oxolo, insofar as this is technically available, legally permissible and justifiable for security reasons. In addition, the Customer may, within this period, request an export in text form to team@oxolo.com or the contact point named in the Order Form. Thereafter, personal data may in principle be deleted or returned in accordance with the DPA, insofar as no statutory retention obligations, legitimate interests in evidence or backup cycles conflict with this.

16.4 After expiry of the export period, Oxolo may delete or anonymise Input and Output or block access to it, unless statutory retention obligations, legitimate interests in legal defence, billing requirements, backup cycles or provisions of the DPA conflict with this.

16.5 The Customer acknowledges that data may remain in backup and archival systems for a short period. Statutory retention obligations remain unaffected.

16.6 For personal data that Oxolo processes on behalf of the Customer, the return and deletion provisions of the DPA additionally apply.

17. Security and Compliance Documents; Audit Requests

17.1 Oxolo maintains appropriate technical and organisational measures to protect the service and the data processed within the framework of the service. Details result, insofar as personal data are affected, from the DPA and its annexes.

17.2 At the Customer's request, Oxolo makes available, to a reasonable extent, available security and compliance documents, insofar as this is necessary to assess the security of Oxolo and legitimate confidentiality, security or secrecy interests of Oxolo or third parties do not conflict with this. These may include, in particular, the respective current SOC 2 report, internal security documentation in appropriately summarised or redacted form, technical and organisational measures, standardised security questionnaires, and other available audit or certification documents. Disclosure may be made conditional on an appropriate confidentiality agreement.

17.3 A right of the Customer to an on-site audit, penetration test, source-code review or direct access to systems, logs, infrastructure or documents of subcontractors exists only insofar as this is expressly governed in the DPA, an enterprise agreement or a separate agreement.

17.4 Insofar as the Customer requires more extensive review, certification or audit documents, the parties may govern this additionally in an enterprise Order Form, a security addendum or the DPA.

18. Liability

18.1 Oxolo is liable without limitation in cases of intent and gross negligence, for injury to life, body or health, under the Product Liability Act (Produkthaftungsgesetz), where an express guarantee has been assumed, and in all cases of mandatory statutory liability.

18.2 In cases of slight negligence, Oxolo is liable only for the breach of material contractual obligations. Material contractual obligations are obligations whose fulfilment makes the proper performance of the Agreement possible in the first place and on whose compliance the Customer may regularly rely. In this case, liability is limited to the foreseeable damage typical for the contract.

18.3 Oxolo's liability pursuant to Clause 18.2 is limited, per damaging event and in total per contract year, to an amount corresponding to the fees paid by the Customer to Oxolo in the twelve (12) months immediately preceding the occurrence of the damaging event. If, at the time of the damaging event, the Agreement had not yet existed for twelve (12) months, twelve times the average monthly fees paid shall be decisive.

18.4 Oxolo is not liable, to the extent legally permissible, for indirect damage, consequential damage, lost profit, missed savings, reputational damage, business interruptions or damage arising from the use of erroneous Output, unless such damage was caused by intent or gross negligence on the part of Oxolo or liability cannot be excluded by law. Clause 18.6 applies to the loss of data.

18.5 For free trials, trial versions and services provided free of charge, Oxolo is liable, to the extent legally permissible, only for intent and gross negligence.

18.6 Oxolo's liability for the loss of data is limited to the recovery effort that would have been incurred had the Customer carried out proper and regular data backups.

18.7 With regard to the output of Oxolo's AI components, Oxolo does not owe any substantive accuracy, completeness or suitability for a particular purpose. Liability for damage based on the Customer relying on Output unchecked is excluded within the framework of the above provisions, unless mandatory statutory provisions require otherwise.

18.8 The limitations of liability also apply for the benefit of the legal representatives, bodies, employees, vicarious agents and subcontractors of Oxolo.

18.9 The above limitations of liability do not alter the statutory allocation of the burden of proof.

18.10 Oxolo's strict (no-fault) liability for defects already present at the time the contract was concluded (§ 536a(1) Alt. 1 BGB) is excluded. Clause 18.1 remains unaffected.

18.11 The Customer notifies defects without undue delay in text form to team@oxolo.com and gives Oxolo a reasonable period to remedy them. The Customer's right to remedy a defect itself and to demand reimbursement of the necessary expenses (§ 536a(2) BGB) is excluded. A reduction by deduction from the fee is excluded; the Customer may assert claims for reduction by way of reclaim.

19. Indemnification by the Customer

19.1 The Customer indemnifies Oxolo against third-party claims arising from the Customer or its Users culpably breaching these GTC, applicable law, third-party rights, data-protection obligations, consent or information obligations, third-party providers' terms, or obligations in connection with recordings, speaker identification, voiceprints, Input or Output.

19.2 The indemnification includes reasonable costs of legal defence. It does not apply insofar as the claim is based on a breach of duty by Oxolo.

19.3 Oxolo will inform the Customer of claims asserted and give it the opportunity to cooperate, insofar as this is legally and practically possible and legitimate interests of Oxolo do not conflict with this.

20. Amendment of these GTC

20.1 Oxolo may amend these GTC with effect for the future, insofar as this is necessary or reasonable due to technical, legal, economic or product-related developments and does not unreasonably disadvantage the Customer.

20.2 Oxolo will inform the Customer at least six (6) weeks before the amendment takes effect, in text form or via the Product, and give it the opportunity to object to the amendment within six (6) weeks of receipt of the notification.

20.3 If the Customer does not object in good time and continues to use Oxolo after the amendment takes effect, the amended GTC are deemed to be accepted, insofar as Oxolo has drawn the Customer's attention to this consequence in the amendment notification.

20.4 If the Customer objects in good time, the previous GTC initially continue to apply. In this case, Oxolo is entitled to terminate the Agreement ordinarily as at the end of the current contract term or, where continuation on the previous terms is unreasonable for legal, technical or economic reasons, at reasonable notice.

20.5 Individually agreed Order Forms remain paramount insofar as they contain expressly deviating provisions.

21. Final Provisions

21.1 The Agreement is governed by the law of the Federal Republic of Germany, excluding the UN Convention on Contracts for the International Sale of Goods and the rules of private international law.

21.2 The exclusive place of jurisdiction for all disputes arising from or in connection with the Agreement is Hamburg, Germany, insofar as the Customer is a merchant, a legal person under public law or a special fund under public law, or insofar as an agreement on jurisdiction is legally permissible. Oxolo is also entitled to sue the Customer at its general place of jurisdiction.

21.3 Should individual provisions of these GTC be or become invalid or unenforceable, the validity of the remaining provisions remains unaffected. The statutory provision shall take the place of the invalid or unenforceable provision. The same applies to any contractual gaps.

21.4 Amendments and supplements to this Agreement require text form, unless a stricter form is prescribed by law. This also applies to the amendment of this text-form clause.

21.5 Rights and obligations under the Agreement may only be transferred by the Customer with the prior consent of Oxolo. Oxolo may transfer the Agreement to affiliated companies or legal successors, insofar as this does not unreasonably disadvantage the Customer.