General Terms and Conditions

1. Definitions

1.1 The following definitions apply to these General Terms and Conditions:

Consulting Engagement

The contractual relationship for consulting services of the Contractor established on the basis of these GTC and an individual agreement.

Assignment

The specific, delimited service agreed within a Consulting Engagement, including objective, period and remuneration model.

Deliverable

A work result expressly agreed in the Assignment and provided in documented form (Section 7).

Project Result

The entirety of the Deliverables produced for the Client within one Assignment.

Business Data Strategy

The design of data landscapes, data accountability and data-driven decision-making capability of an organization, aligned with its business objectives.

AI System

A system within the meaning of Art. 3 (1) of Regulation (EU) 2024/1689 (EU AI Act), including large language models.

Agentic System

An AI System that performs sub-tasks autonomously across several steps and by using tools.

Confidential Information

All information designated in Section 16.1, in whatever form.

Client Material

All data, documents, systems, models and records provided by the Client (Section 15.4).

Documentation

The written record of approach, assumptions and results owed under Section 10.

1.2 Terms in the singular include the plural and vice versa, unless the context requires otherwise.

2. Scope of Application and Conclusion of Contract

2.1 These General Terms and Conditions (GTC) apply to all Consulting Engagements concluded between the Client and the Contractor incorporating these GTC.

2.2 The Contractor concludes contracts exclusively with entrepreneurs within the meaning of Section 14 of the German Civil Code (BGB), legal entities under public law and special funds under public law. Contracts with consumers are not concluded.

2.3 Where contractual documents other than these GTC have become part of the contract in text or written form, their provisions take precedence over these GTC in the event of a conflict.

2.4 The Contractor does not accept terms and conditions of the Client deviating from these GTC, subject to express consent in text form. This also applies if the Contractor renders services without reservation while aware of conflicting terms.

3. Subject of the Consulting Engagement

3.1 As an independent contractor, the Contractor provides consulting services in the following areas:

Business Data Strategy, Enterprise Data Architecture, Business Architecture, Decision Intelligence, Data Governance, AI Governance, Enterprise AI Enablement, Data Transformation, organizational and process consulting, migration and decommissioning strategies, audit and compliance support as well as Executive Advisory.

3.2 The engagement further comprises vendor-neutral advisory services regarding the Business Integration of process and system landscapes, delivery supervision, change management as well as training and accompanying professional support.

3.3 The specific scope of services, the objective, the period and the remuneration are subject to an individual agreement between the parties. These GTC alone do not establish any claim to services.

3.4 Services are performed remotely, on the Client's premises and from the Contractor's registered office in Aschaffenburg. Subject to a deviating agreement, the Contractor operates worldwide.

4. Advisory Nature of the Services

The services of the Contractor constitute independent consulting, analysis, architecture, strategy and delivery supervision services. Unless expressly agreed otherwise in text form, the Contractor does not owe any specific economic success and does not owe the development of any specific technical solution.

4.1 Unless expressly agreed otherwise, the Consulting Engagement constitutes a service contract within the meaning of Sections 611 et seq. BGB. The Contractor owes professional performance, not its success.

4.2 The Contractor does not sell software licenses, does not operate platforms on behalf of the Client and does not develop standard software for resale. Where third-party software is examined, assessed or recommended within the consulting work, this is done vendor-neutrally and without any remuneration interest toward the respective vendor.

4.3 Recommendations of the Contractor are a basis for decisions. The decision on their implementation rests with the Client (Section 12.3).

4.4 The Contractor does not provide legal, tax or statutory audit advice. Statements on regulatory requirements (Section 18) are professional assessments and do not replace legal review in the individual case.

5. Freedom of Method

5.1 The Contractor decides at its own discretion which analytical procedures, frameworks, models, tools and technologies it uses to perform the agreed services.

5.2 In performing its activities, the Contractor is not subject to instructions regarding the manner, place or time of service provision. It allocates working days and working time so that the objectives of the Assignment are achieved in an economically appropriate manner. Services are rendered in coordination with the Client.

5.3 Restrictions on the choice of methods or tools, for instance due to security, data protection or compliance requirements of the Client, require agreement in text form. Any additional effort arising from this is handled in accordance with Section 9.

5.4 The freedom of method does not affect the Contractor's obligations under Sections 16 to 19.

6. AI-Assisted Service Delivery and Ultimate Professional Responsibility

6.1 The Contractor uses modern AI Systems to deliver its services, in particular large language models, Agentic Systems and automation tools. They are used notably for research, analysis, structuring, documentation and quality review.

Professional responsibility remains with the Contractor at all times. Results of AI-assisted work steps are reviewed and validated in the project context before they become part of a Deliverable.

6.2 Decisions within the Consulting Engagement are made exclusively by qualified employees of the Contractor. No AI System makes decisions concerning the Client, and no recommendation is issued without prior professional review by a human being.

6.3 Upon request by the Client, the Contractor discloses to an appropriate extent at which points of an Assignment AI Systems were used.

6.4 The use of AI Systems processing Client Material is governed by Section 17.

6.5 The provisions of this Section implement the transparency requirements of Art. 50 of Regulation (EU) 2024/1689 to the extent applicable to the provision of services.

7. Deliverables and Project Results

7.1 Deliverables are the work results expressly agreed in the Assignment. These may include in particular:

• reports and assessments
• strategies and roadmaps
• concepts and decision papers
• data models and business architectures
• governance frameworks and AI policies
• presentations and workshops
• audit documentation

7.2 Which Deliverables are owed, in what form, at what level of detail and by what date follows exclusively from the Assignment. Without an express agreement, there is no claim to any particular Deliverable.

7.3 Deliverables are handed over in electronic form. An obligation to deliver in a specific file format or to hand over source or intermediate versions exists only where expressly agreed.

7.4 Deliverables are based on the state of knowledge and the Client Material available at the time of their creation. There is no obligation to update them after completion of the Assignment.

8. Release of Deliverables

8.1 Deliverables are submitted to the Client for review. The Client communicates comments in text form within the period agreed in the Assignment, otherwise within a reasonable period.

8.2 If no feedback is provided within this period, the Deliverable is deemed acknowledged. For extensive Assignments, partial releases for individual Deliverables may be agreed.

The release under this Section serves the purpose of professional coordination. It does not constitute acceptance within the meaning of Section 640 BGB, unless the parties have expressly agreed on a contract for work and services.

8.3 Where the parties have expressly agreed on a contract for work and services for an Assignment, acceptance and warranty are governed by the statutory provisions of Sections 631 et seq. BGB and by the individual agreement.

9. Changes to the Scope of Services

9.1 Changes to the agreed scope of services are documented, assessed with regard to effort, deadlines and remuneration, and agreed separately in text form.

9.2 Until such an agreement takes effect, the Contractor continues to render services on the previous basis. There is no obligation to perform in advance of changes not yet agreed.

9.3 Delays arising from the processing of change requests postpone agreed deadlines by a reasonable period.

10. Documentation

10.1 The Contractor documents its approach, material assumptions and results to the extent agreed in the Assignment, and otherwise to an appropriate and comprehensible extent.

10.2 There is no obligation to document every individual activity without gaps. The benchmark is that the results are comprehensible to a knowledgeable third party.

10.3 Documentation going beyond this, in particular for purposes of internal audit, certification or submission to supervisory authorities, is agreed and remunerated separately.

11. Quality Assurance

11.1 The Contractor maintains procedures for assuring the quality of its services. These include in particular peer reviews, plausibility checks and validation of work results before they are handed over.

11.2 The Contractor renders its services in accordance with recognized standards, customary market practice and the state of science and technology, to the extent economically appropriate.

11.3 Results of AI-assisted work steps are subject to the review under Section 6.1.

12. Client Cooperation and Responsibility

12.1 The Client provides the information, data, records and system access required for service delivery completely, correctly and in good time, and designates decision-makers available for consultation.

12.2 The Contractor is not responsible for delays caused by late or incomplete cooperation on the part of the Client; Section 21 remains unaffected. Agreed deadlines are postponed accordingly.

Business and management decisions, compliance approvals and risk assessments rest exclusively with the Client. The Contractor prepares such decisions professionally but does not make them.

12.3 Before implementing them, the Client reviews recommendations and Deliverables for suitability for its purposes, its organization and its regulatory situation.

12.4 The Client ensures that it is entitled to provide the Client Material and that no third-party rights conflict with its processing.

13. Remote Collaboration

13.1 Collaboration regularly takes place independently of location using electronic communication and collaboration tools, in particular Microsoft Teams, Zoom, Google Meet, secured remote access (VPN) and remote workshops.

13.2 The Client grants the access required for this purpose. If the Client mandates specific tools or access procedures, this must be communicated in text form when the Assignment is placed.

13.3 Documents are exchanged electronically. Releases, coordination and declarations within a running Assignment may be made in text form, including by email and electronic signature, unless written form is prescribed by law or by contract.

13.4 On-site appointments are agreed separately. Travel time and travel expenses are remunerated in accordance with the individual agreement.

14. Remuneration

14.1 Remuneration is agreed individually.

14.2 Remuneration is payable after the services have been rendered. If it is measured by time periods, it is payable after expiry of the individual time periods (Section 614 BGB). In the case of effort-based billing, the Contractor is entitled, subject to a deviating agreement, to invoice monthly.

14.3 The Contractor issues the invoice by mail or email (e.g. as a PDF). Remuneration is due for payment within 14 days of receipt of the invoice.

14.4 All prices are exclusive of statutory value added tax at the applicable rate.

15. Intellectual Property, Rights of Use and Client Material

15.1 The Contractor remains the owner of all rights in the methods, frameworks, templates, libraries, reference architectures, data models, analytical procedures, AI agents and prompt libraries contributed or developed by it, as well as in the know-how embodied therein. This applies irrespective of whether they were further developed within an Assignment.

15.2 Upon full payment of the agreed remuneration, the Client receives a simple, non-exclusive right to use the Project Results, unlimited in territory and time, for its own internal purposes including affiliated companies within the meaning of Sections 15 et seq. of the German Stock Corporation Act (AktG).

15.3 Passing the Project Results on to third parties, publishing them or exploiting them for distribution purposes requires the Contractor's prior consent in text form. Disclosure to the Client's auditors, supervisory authorities and legal advisors is exempt from this.

Ownership of and all rights in the Client Material, in particular data, documents, source systems, models, processes and internal records of the Client, remain exclusively with the Client.

15.4 The Contractor uses Client Material exclusively to perform the respective Assignment. It is not used to train AI models.

15.5 Where the Contractor uses open source components, the respective license terms apply to them. Upon request, the Contractor discloses the components used and their licenses.

15.6 The Contractor's right to make unrestricted use of the general knowledge, experience and skills acquired in performing the Assignment remains unaffected. Section 16 remains unaffected.

16. Confidentiality

16.1 The Contractor treats all information that becomes known to it in connection with the Consulting Engagement as strictly confidential. This includes in particular trade secrets within the meaning of the German Trade Secrets Act (GeschGehG), information marked as confidential, source code, data models, AI configurations, prompt libraries as well as strategy and organizational records.

16.2 The Contractor imposes corresponding obligations on all employees and third parties who gain access to confidential information. The confidentiality obligation applies without time limit beyond the term of the contract.

16.3 The confidentiality obligation does not apply to information that is or becomes publicly known without breach of these GTC, that was already known to the Contractor before disclosure, that was lawfully made available to it by third parties, or whose disclosure is required by law or by an order of a public authority or court. In the latter case, the Contractor informs the Client without undue delay to the extent legally permissible.

16.4 The confidentiality obligation applies reciprocally to information of the Contractor that becomes accessible to the Client within the Consulting Engagement, in particular to the items listed in Section 15.1.

17. Data Protection and Use of Cloud and AI Services

17.1 In performing the Assignment, the Contractor complies with data protection law, in particular Regulation (EU) 2016/679 (GDPR) and the German Federal Data Protection Act.

17.2 Where personal data are processed on behalf of the Client, the parties conclude a data processing agreement pursuant to Art. 28 GDPR before processing begins.

17.3 Cloud-based AI services processing Client Material are used only to the extent permissible under data protection law and agreed with the Client in text form. Without such an agreement, the Contractor processes Client Material exclusively in environments operated by itself or by a processor within the European Union.

17.4 The Contractor applies pseudonymization and anonymization procedures where these are suitable and economically appropriate to preserve purpose limitation and data minimization.

17.5 The Client remains the controller within the meaning of Art. 4 (7) GDPR.

18. Regulatory Requirements

18.1 The Contractor takes regulatory requirements into account in performing its services to the extent that these have expressly become part of the contract. These may include in particular:

• Regulation (EU) 2016/679 (GDPR)
• Regulation (EU) 2022/2554 (DORA)
• Regulation (EU) 2024/1689 (EU AI Act)
• BAIT and VAIT issued by BaFin
• BCBS 239
• ISO/IEC 27001
• Directive (EU) 2022/2555 (NIS2) as transposed into national law

18.2 Which requirements apply in detail and to what depth they are to be considered is set out in the Assignment. Without an express agreement, the Contractor does not owe any review of the Client's regulatory compliance.

18.3 Responsibility for complying with the regulatory requirements applicable to the Client remains with the Client. Section 4.4 remains unaffected.

19. Information Security

19.1 The Contractor takes technical and organizational measures corresponding to the state of the art to protect Client Material and confidential information. These include in particular:

• secured data transmission exclusively via encrypted connections
• encryption of data at rest on the systems used
• access controls with multi-factor authentication
• assignment of permissions following the principle of least privilege
• segregated and secured development and analysis environments

19.2 The Contractor informs the Client without undue delay about security incidents affecting Client Material. Notification obligations under Art. 33 GDPR remain unaffected.

19.3 Security requirements of the Client going beyond this are agreed separately; Section 5.3 applies accordingly.

20. Subcontractors

20.1 The Contractor is entitled to assign services to subcontractors in its own name and for its own account. The Contractor remains the sole contractual partner of the Client and is liable for its subcontractors as for its own conduct.

20.2 Before they commence work, the Contractor binds subcontractors to confidentiality (Section 16), data protection (Section 17), information security (Section 19) and compliance with the quality requirements under Section 11, at least to the extent to which the Contractor itself is bound toward the Client. Conclusion of a non-disclosure agreement is a prerequisite for their engagement.

20.3 Subcontractors are not engaged if it is apparent to the Contractor that their engagement conflicts with the legitimate interests of the Client. The Client may object to the engagement of a specifically named subcontractor for good cause.

20.4 Where subcontractors process personal data, Section 17.2 applies with the proviso that sub-processing is agreed in accordance with Art. 28 (2) and (4) GDPR.

21. Liability and Indemnification

21.1 The Contractor is liable without limitation in cases of intent and gross negligence, for intentional or negligent injury to life, body or health, on the basis of a guarantee, and within the scope of mandatory statutory liability, in particular under the German Product Liability Act.

21.2 If the Contractor negligently breaches a material contractual obligation, liability is limited to the damage typical for this type of contract and foreseeable at the time of conclusion. Material contractual obligations are obligations whose fulfilment makes the proper performance of the contract possible in the first place and on whose observance the Client may regularly rely.

21.3 Liability under Section 21.2 is limited in amount per incident to the value of the affected Assignment, and in the case of continuing obligations to the annual remuneration agreed for the contract year concerned. This limitation does not apply to the extent that it falls below the damage typical for this type of contract and foreseeable at the time of conclusion.

21.4 Any further liability of the Contractor is excluded. The above liability provisions also apply to the Contractor's liability for its vicarious agents, subcontractors and legal representatives.

21.5 The Contractor is not liable for damage resulting from the Client implementing recommendations without the own review required under Section 12.3, or from Client Material having been incomplete or incorrect.

21.6 The Client indemnifies the Contractor against claims by third parties asserted against the Contractor due to breaches by the Client of these GTC or of applicable law.

21.7 The above provisions do not entail any change in the burden of proof to the detriment of the Client.

22. Force Majeure

22.1 Events of force majeure that substantially impede or prevent the provision of services release the affected party from its obligation to perform for the duration of the disruption. Force majeure includes in particular natural events, epidemics and pandemics, orders by public authorities, industrial action, war, acts of terrorism, large-scale power or internet outages as well as unforeseeable, prolonged disruptions at providers of cloud infrastructure.

22.2 The affected party informs the other party without undue delay of the occurrence and expected duration of the disruption. Agreed deadlines are postponed by the duration of the disruption plus a reasonable start-up period.

22.3 If the disruption lasts longer than three months, either party is entitled to terminate the affected Assignment. Services already rendered are to be remunerated.

23. Term and Termination

23.1 The term and the periods for ordinary termination are agreed individually by the parties.

23.2 The right of both parties to terminate extraordinarily for good cause remains unaffected. Termination requires text form.

23.3 Upon termination, the Contractor returns or destroys all Client Material provided to it without undue delay, at the Client's choice; electronic data are to be deleted completely. Any right of retention thereto is excluded. Exempt from this are records and data subject to a statutory retention obligation, until the end of the respective period. The Contractor confirms deletion in text form upon request.

23.4 Sections 15.1, 15.6 and 16 survive termination of the contract.

24. Reference Naming

24.1 The Contractor may name the Client as a reference, and use its company name and logo for that purpose, only with the Client's prior consent in text form.

24.2 Consent may be revoked at any time with effect for the future. Following revocation, the Contractor removes the reference within a reasonable period.

24.3 An anonymized presentation of project experience that does not permit any conclusion as to the Client remains permissible. Section 16 remains unaffected.

25. Final Provisions

25.1 The law of the Federal Republic of Germany applies to the exclusion of the United Nations Convention on Contracts for the International Sale of Goods (CISG).

25.2 Should any provision of these GTC be or become invalid, the validity of the remaining provisions remains unaffected.

25.3 If the Client is a merchant, a legal entity under public law or a special fund under public law, or has no general place of jurisdiction in Germany, the place of jurisdiction for all disputes arising from this contractual relationship is the registered office of the Contractor; exclusive places of jurisdiction remain unaffected.

25.4 Amendments and supplements to these GTC require text form. This also applies to any amendment of this clause.

25.5 The Contractor is entitled to amend these GTC for objectively justified reasons (e.g. changes in case law, the legal situation, market conditions or corporate strategy), subject to a reasonable period of notice. Existing clients are notified by email at least two weeks before the amendment takes effect. If the existing client does not object within the period set in the notification, consent is deemed granted. If the client objects, the amendments do not take effect; in this case the Contractor is entitled to terminate the contract extraordinarily as of the date the amendment takes effect. The notification indicates the deadline and the consequences of objecting or failing to object.