I. General Terms and Conditions

1. Sale, Delivery and System Integration

1.1 Conclusion of Contract and Foreign Trade Law
All orders and quotations from the contracting party require written acceptance or an order confirmation from QGROUP to become effective. Deliveries are subject to the trade terms set out in the specific quotation in accordance with Incoterms 2020 (by default EXW from QGROUP’s delivery point, unless otherwise agreed). Performance of the contract is subject to the proviso that there are no obstacles to such performance arising from national or international foreign trade regulations, regulatory approval requirements, or any embargoes and/or other sanctions.
Quotations from QGROUP are subject to change and non-binding, unless they are expressly marked as binding. Orders only become effective upon written order confirmation by QGROUP. Electronic confirmations by email satisfy this written form requirement. All prices are exclusive of statutory value added tax. Unless a different price guarantee is provided in the quotation, prices are valid only for the period specified in the quotation. If the delivery date is postponed at the request of the contracting party, QGROUP reserves the right to adjust prices in line with any increases in material, production or labour costs that have occurred in the meantime. The prices agreed in the quotation shall apply; failing that, the QGROUP price list valid on the date of performance shall apply. QGROUP is entitled to make partial deliveries, provided that these are reasonable for the contracting party.

1.2 Prices and Taxes
1.2.1 All prices are quoted net ex works, plus the applicable statutory value added tax, customs duties or other statutory levies. Quoted prices are binding for the period specified in the relevant quotation. If a delivery or service date is postponed at the request of, or through the fault of, the contracting party, QGROUP reserves the right to make a reasonable price adjustment.
1.2.2 In the case of deliveries and services to contracting parties outside the Federal Republic of Germany, the contracting party is obliged to provide QGROUP with its valid VAT registration number (VAT No.) or proof of tax residence without delay. Where the reverse charge procedure applies, the contracting party shall be responsible for paying the applicable VAT in the relevant country of destination and shall indemnify QGROUP against any subsequent tax claims.

1.3 Delivery and ancillary costs / Public sector contracts
Unless expressly stated otherwise in the quotation, prices do not include costs for packaging, handling, transport and transport insurance. Prices in quotations for public sector clients are quoted as market prices in accordance with Regulation PR 30/53.

1.4 Retention of title and security interests
QGROUP retains title to all delivered products until the purchase price has been paid in full and until all claims arising from the ongoing business relationship with the contracting party have been settled in full (extended retention of title). Any processing or treatment of the goods subject to retention of title shall be carried out on behalf of QGROUP as the manufacturer. Where the contracting party incorporates the goods into third-party goods, QGROUP shall acquire co-ownership of the newly created composite item in the proportion of the invoice value of the goods subject to retention of title to the value of the other processed goods. The contracting party is entitled to resell the goods subject to retention of title in the ordinary course of business only subject to retention of title, provided that it is not in default of payment. Pledging or transfer by way of security is not permitted. The contracting party hereby assigns to QGROUP, by way of security, all claims against its customers arising from the resale or subletting of the goods subject to retention of title, in an amount equal to the QGROUP invoice value; QGROUP accepts this assignment. The contracting party remains revocably authorised to collect the claim. In the event of default in payment, QGROUP shall be entitled to revoke the authorisation to collect the claim and to demand the return of the goods subject to retention of title at the Contractual Partner’s expense. QGROUP shall, at the Contractual Partner’s request, release security held insofar as its realisable value exceeds the claims to be secured by more than 10 per cent.


1.5 Delivery, acceptance of products and obligation to give notice of defects (Section 377 of the German Commercial Code (HGB))
The contracting party is obliged to inspect delivered hardware and software products for completeness and obvious defects immediately upon receipt and to notify QGROUP in writing of any defects found without delay, at the latest within seven (7) working days of delivery (Section 377 of the German Commercial Code (HGB)). Defects that are not initially apparent upon proper inspection (hidden defects) must be reported to QGROUP in writing without delay, at the latest within seven (7) working days of their discovery. If the defect is not reported in good time, the goods shall be deemed to have been accepted in respect of the defect in question. If the installation of the products is not contractually included in the price, acceptance shall be deemed to have taken place upon delivery. If installation has been agreed, acceptance shall be deemed to have taken place as soon as the product has successfully undergone QGROUP’s installation and testing procedures, but no later than thirty (30) days after physical delivery.

1.6 Acceptance of System Solutions
Where QGROUP is responsible for delivering a customised system solution (comprising hardware, software and integration services) ready for operation, QGROUP shall notify the contracting party in writing or by email that the system is ready for operation. The contracting party is obliged to carry out a functional test immediately upon notification and to accept the system solution by means of a joint written report, provided there are no material defects. The entire system shall be deemed to have been accepted if the contracting party does not give written notice of specific, material defects within fourteen (14) working days of notification of readiness for operation, or if the contracting party uses the system in a live environment. Minor defects do not entitle the contracting party to refuse acceptance and shall be rectified under the terms of liability for defects.

1.7 Terms of payment, credit checks and refusal to perform
Invoices are due for payment without deduction within fourteen (14) days of the invoice date, unless a different due date is expressly stated in the quotation or the invoice. QGROUP is entitled to adjust the credit or payment terms or to demand advance payments if the contracting party’s previous payment history or objective evidence (e.g. a Creditreform report) demonstrably indicates a deterioration in the contracting party’s financial situation. QGROUP may refuse to perform the contract if the contracting party is in default of a payment due arising from the business relationship and fails to remedy this situation within ten (10) days of receiving a written reminder. QGROUP may also demand advance payment or the provision of suitable security and withhold outstanding services until such security has been provided.

1.8 Transfer of Risk and Set-off
Title and risk shall pass at the QGROUP dispatch point (EXW). Risk and transport costs shall pass to the contracting party upon handover to the carrier.
1.9 The contracting party is only entitled to set off undisputed or legally established claims or to exercise a right of retention. The contracting party may only assert a right of retention on the basis of counter-claims arising from the same contractual relationship.

2. Rights in the Event of Defects (Warranty)

2.1 Scope of liability for defects
QGROUP warrants that QGROUP hardware products are free from defects in materials and workmanship and comply with the agreed specifications. QGROUP further warrants that the standard software owned by QGROUP substantially complies with the specifications. The contracting party acknowledges that, given the current state of the art, it is not possible to develop software that is completely free of errors or free of malicious code for every conceivable area of application.

2.2 Warranty periods and rectification
The limitation period for claims for defects is – notwithstanding Section 438(1)(3) of the German Civil Code (BGB) – one year from the transfer of risk, unless mandatory statutory provisions provide for longer periods (e.g. Sections 438(1)(1)–(2) and 634a BGB). This also applies to the supply of spare parts or the performance of repair work. The performance of free rectification work or replacement deliveries to remedy defects does not trigger a general restart of the limitation period for the product as a whole, unless QGROUP acts in express acknowledgement of the defective nature of the product.

2.3 Rights in the event of failure of subsequent performance
The right to choose the form of subsequent performance (rectification of the defect or delivery of a defect-free item) rests exclusively with QGROUP. If subsequent performance ultimately fails after at least two (2) unsuccessful attempts within a reasonable period set by the contracting party, the contracting party is entitled to the statutory rights of withdrawal, reduction or compensation for damages
within the limits of liability set out in these terms and conditions. QGROUP shall not be required to bear the costs necessary for the purpose of subsequent performance, in particular transport, travel, labour and material costs, insofar as these are increased by the fact that the products have subsequently been moved to a location other than the contractual place of delivery, unless such movement is in accordance with the intended use.

2.4 Obligations of the contracting party to cooperate
The contracting party must report defects in writing without delay, providing all information relevant to the identification of the defect (where possible, using the reporting forms or ticket systems provided by QGROUP). A prerequisite for any claims for defects is that the defect is reproducible or can be demonstrated by machine-generated output. The contracting party must, within reasonable limits, assist QGROUP free of charge in rectifying faults, in particular by providing system logs, test data, machine time and temporary access to the affected hardware and software environment.

2.5 Warranty for software from third-party manufacturers (suppliers)
Where software from upstream suppliers is provided to the contracting party as a standalone third-party product, QGROUP assumes no independent obligation to modify the software code. However, QGROUP undertakes to forward any justified complaints regarding defects raised by the contracting party to the relevant supplier. Where the supplier provides bug fixes, patches or updates, QGROUP shall make these available to the contracting party; unless expressly agreed otherwise in the main contract, the installation or integration of these updates shall be subject to separate remuneration.
In the case of products from suppliers that are identified as such in the quotation or contract, QGROUP assigns its own claims for defects against the supplier to the contracting party. The contracting party is obliged to first make a sincere attempt to resolve the matter out of court with the supplier. QGROUP shall be liable for defects in these products only on a subordinate basis and within the limitation periods agreed in these General Terms and Conditions, provided that and to the extent that the upstream supplier definitively refuses to rectify the defect or provide a replacement, is unable to do so, or the enforcement of claims against the upstream supplier is unreasonable for the contracting party or fails.”

2.6 Minor defects and workarounds
The rectification of faults which do not seriously impair the contractual use of the product may, at QGROUP’s discretion, also be effected by the supply of an updated software version (update/upgrade) or by the provision of reasonable workarounds. Repair or replacement free of charge shall only constitute an acknowledgement of a defect if QGROUP expressly confirms this in writing.

2.7 Expiry of the warranty and reimbursement of expenses
Any liability for defects shall lapse in respect of products which the contracting party modifies or manipulates itself without QGROUP’s prior consent in writing (e.g. by email), or in respect of which the contracting party interferes with the source code or configuration, or uses components not approved by QGROUP, unless the contracting party proves that the defect is entirely unrelated to this. If an investigation into a notification of a defect reveals that no defect exists or that the fault is due to incorrect operation or an unsuitable system environment on the part of the contracting party, QGROUP shall be entitled to invoice the contracting party for the costs incurred for testing and labour in accordance with QGROUP’s standard hourly rates applicable at the time.

2.8 Agreement on Quality
The quality of the products shall be governed exclusively by the information contained in QGROUP’s specifications and data sheets. Any further guarantees or representations, in particular regarding specific commercial usability or suitability for a project intended by the contracting party but not expressly agreed, are excluded.

3. Industrial Property Rights and Copyright

3.1 Compliance with Third-Party Licence Terms
The use of any software is subject to the respective licence terms of the copyright holder or manufacturer (e.g. EULA). The contracting party undertakes to strictly comply with these terms and shall contractually oblige its end users to do the same. It must immediately report to QGROUP any breach of contract by third parties of which it becomes aware.

3.2 Liability for Legal Defects (Infringements of Industrial Property Rights)
QGROUP warrants that the products developed by QGROUP itself are, at the time of the transfer of risk, free from any third-party industrial property rights or copyright that restrict or preclude use in accordance with the contract. The Contractual Partner shall notify QGROUP immediately in writing (e.g. by email) should third parties assert claims against it for infringement of intellectual property rights.
QGROUP is entitled, at its discretion, to modify or replace the product in such a way that the intellectual property right is no longer infringed, to secure the right of use for the contracting party by means of a licence, or, if this is not economically viable, to take back the product against reimbursement of the consideration (less reasonable compensation for use). QGROUP is also entitled to undertake the legal defence against the third party’s claims at its own expense; the contracting party may not make any statements acknowledging the claims without QGROUP’s prior consent. Any further claims for damages by the contracting party are limited in accordance with the limitations of liability set out in Clause 4.

3.3 Use of open-source software
(a) The Contracting Party acknowledges that QGROUP integrates or uses open-source software components (‘OSS’) in products, solutions or within the scope of individual project work (hereinafter collectively referred to as ‘Work Products’). The Contractual Partner’s rights and obligations in relation to these OSS components are governed exclusively by the terms of the applicable open-source licence(s). Provisions of these General Terms and Conditions or other contractual agreements do not restrict the rights granted under the OSS licences in any way.
(b) The restrictions on use agreed in these General Terms and Conditions or in the main contract (e.g. restrictions on redistribution or prohibitions on decompilation) apply primarily to QGROUP’s intellectual property that is not covered by such open-source licences (including, but not limited to, software modules developed by QGROUP itself, QGROUP’s trade marks, proprietary documentation and confidential information) and govern the specific commercial rights and obligations between the parties.
(c) Where, in the context of individual project work or services, the granting of exclusive rights of use to the deliverables has been agreed, this exclusivity expressly does not apply to the OSS components contained therein. The contracting party shall be granted rights to these in accordance with the applicable open-source licence.

3.4 Intellectual Property Notices and Documentation
The Contracting Party must not remove, alter or obscure any copyright, trade mark, serial number or other intellectual property notices on or in the products. These must be included in every authorised copy. The commercial translation, reproduction or distribution of the documentation supplied by QGROUP requires the prior consent of QGROUP in writing (e.g. by email).

3.5 Indemnification by the Contractual Partner
Where products have been manufactured or configured in accordance with the Contractual Partner’s designs, samples, specifications or express instructions, the Contractual Partner shall fully indemnify QGROUP against all claims, costs and damages asserted by third parties on the grounds of infringement of industrial property rights or copyright.

3.6 Exclusion of liability for modifications
Any liability on the part of QGROUP for infringements of intellectual property rights is excluded if the infringement is due to the Contractual Partner having modified the product, the product being operated with third-party components not supplied or approved by QGROUP, or the product being used in a manner that does not comply with the specifications or instructions for use.

4. Liability and Limitation of Liability

4.1 Statutory Minimum Liability
QGROUP shall be liable without limitation for damage resulting from loss of life, bodily injury or damage to health, as well as for damage arising from wilful misconduct or gross negligence on the part of QGROUP, its legal representatives or vicarious agents. The same shall apply in the event of liability under the Product Liability Act or in the case of guarantees expressly assumed in writing as such.

4.2 Liability for slight negligence (cardinal obligations)
In the event of a breach of essential contractual obligations (cardinal obligations) due to slight negligence, QGROUP’s liability shall be limited in amount to the damage typical of the contract and foreseeable at the time the contract was concluded. Essential contractual obligations are those the fulfilment of which is essential for the proper performance of the contract and on the observance of which the contracting party may regularly rely. In the event of a breach of non-essential contractual obligations due to slight negligence, QGROUP’s liability is entirely excluded.

4.3 Limitation of Consequential Damages and Third-Party Claims
Subject to the provision in clause 4.1, in the event of a breach of cardinal obligations by QGROUP due to slight negligence, liability for indirect damages, consequential damages arising from defects, business interruptions, loss of production, loss of profit, lost savings, and damages arising from third-party claims against the contracting party is limited to the foreseeable damage typical for this type of contract in accordance with clauses 4.2 and 4.5. In the event of a breach of non-essential contractual obligations due to slight negligence, liability for these types of damage is completely excluded.

4.4 Specific Risk Delimitations (IT Security & Managed Services)
The following additional allocation of risk and liability applies to specific service areas:
a) Third-party software & components (including open-source & threat intelligence): In the provision or MSSP operation of third-party software/appliances, as well as the provision of third-party cyber threat intelligence data, QGROUP is only liable for the careful selection and provision thereof, but not for the inherent freedom from defects or uninterrupted availability of these third-party systems. Liability for manufacturer-related security vulnerabilities unknown at the time of service provision (‘zero-day exploits’) or faulty data supplied by third parties is excluded in cases of slight negligence. The provider’s strict liability for initial defects pursuant to Section 536a(1) of the German Civil Code (BGB) is excluded.
b) OEM integration (embedded OS / hardware): In the case of OEM-integrated turnkey solutions, QGROUP accepts no liability for compatibility conflicts or security risks arising from subsequent updates to the operating system or hardware firmware not authorised by QGROUP, or from third-party components introduced by the contracting party.
c) Hosting & Data Loss: In the hosting of software, data and applications, QGROUP shall only be liable for data loss resulting from slight negligence if the contracting party can demonstrate that it has fulfilled its obligation to carry out regular data backups commensurate with the risk, and the data can be reconstructed with reasonable effort. No liability shall be accepted for hosting downtime caused by force majeure, large-scale cyber-attacks (e.g. widespread DDoS attacks), the exceeding of agreed volume and bandwidth limits, or necessary, pre-announced maintenance windows.
d) Penetration tests, vulnerability checks & audits: The contracting party is aware that penetration tests and vulnerability scans reflect the state of the IT infrastructure only at the time of the respective test. QGROUP shall not be liable for system instabilities, crashes or data loss resulting from the simulated attacks carried out in accordance with the agreement, unless these were caused intentionally or through gross negligence.
e) Incident Response & Threat Hunting: In the context of incident response and threat hunting, QGROUP is obliged to exercise professional, state-of-the-art diligence (Service Agreement), but does not guarantee success in terms of the complete detection or full remediation of damage caused by an advanced cyber attack (Advanced Persistent Threat – APT). Liability for business interruption losses arising during acute containment measures (e.g. isolation of systems, shutdown of servers) is excluded in cases of slight negligence.
f) Architecture consultancy & processes: In the case of IT consultancy services, QGROUP shall not be liable for the attainment of specific certifications (e.g. ISO 27001) or for the absolute security of the recommended structure against breaches, as the final implementation, allocation of rights and operational monitoring remain the sole responsibility of the contracting party.

4.5 Aggregate Liability Limit
In the event of property damage and financial loss, QGROUP’s liability for cases of slight negligence is limited per claim to the sums insured under the public liability insurance policy taken out by QGROUP. These amounts are EUR 1,000,000 for financial loss and EUR 5,000,000 for property damage. This limit on the sum insured does not apply to claims under clause 4.1.

4.6 Specific Obligations to Cooperate and Liability in the Event of Incident Response
a) Nature of the service contract: The contracting party is aware that there is no such thing as 100% security. The contracting party is also aware that incident response measures (urgent IT forensics, containment of cyber-attacks) and managed services (MSSP) are carried out under time pressure and with incomplete information. Success (e.g. the complete recovery of data or the comprehensive identification of all infected systems) is not guaranteed.
b) Risk associated with emergency measures: In order to prevent the spread of malware, QGROUP is entitled to initiate technical emergency measures without delay (e.g. the immediate disconnection of systems from the network, the freezing of virtual machines or the shutdown of servers). QGROUP shall not be liable for any resulting operational disruptions, data loss or damage to systems in cases of slight negligence.
c) Critical cooperation: To prevent the spread of malware as part of emergency measures, QGROUP is entitled to take immediate technical measures (e.g. disconnecting systems from the network, freezing virtual machines). The contracting party is obliged to provide the incident response team immediately with all necessary access rights (administrative rights), network diagrams and log data, and to designate decision-making contacts (24/7). QGROUP shall not be held liable for any delays or damage resulting from late, incomplete or incorrect cooperation on the part of the contracting party. The contracting party is obliged to provide the Incident Response Team immediately with all necessary access (administrative rights), network diagrams and log data, and to designate decision-making contacts (24/7). QGROUP shall not be held liable for any delays or damage resulting from late, incomplete or incorrect cooperation on the part of the contracting party.

4.7 Priority of specific service and liability agreements
For services whose performance necessarily requires technical interventions, system investigations, automated vulnerability scans, simulated attacks (penetration tests) or access to the contracting party’s potentially infected, compromised or unstable systems, the liability provisions and indemnity clauses set out in the relevant separate individual agreement (e.g. individual contract, project order, Scope of Work). Where more extensive limitations of liability, exclusions of liability or indemnity obligations on the part of the contracting party are agreed therein, these shall take precedence over the provisions of these General Terms and Conditions. The provisions of these General Terms and Conditions shall apply to such specialised services only subsequently and in a supplementary capacity.

4.8 Special Warranty and Cooperation in Relation to OEM Hardware & Appliances
a) Prohibition on Modifications & Intended Use: In the case of the supply of OEM-integrated turnkey solutions (software on a specific operating system or hardware appliances), liability for defects and liability for consequential damages is excluded for any faults attributable to the contracting party having opened the hardware without authorisation, installed unauthorised firmware or operating system updates, or altered the configuration outside the specifications, unless the contracting party can prove that the defect is entirely unrelated to these actions.
b) Environmental and operating conditions: The contracting party is responsible for complying with the operating conditions specified by QGROUP for physical appliances (e.g. power supply, surge protection, air conditioning, dust-free environment). Damage resulting from failure to comply with these conditions is excluded from liability for defects.

4.9 Use of the customer’s internal artificial intelligence (AI) systems
a) Personal responsibility: If the Contracting Party uses its own or third-party artificial intelligence systems (e.g. LLMs, automated decision-making models – hereinafter “Contracting Party AI”) in connection with the performance of the contractual services or for the internal processing of data, this is done exclusively at the Contracting Party’s own risk.
b) Liability for Contracting Party AI: The Contracting Party shall be fully liable for all results, actions or omissions arising from the use of such Contracting Party AI. This applies in particular where the Contracting Party AI produces erroneous analyses, causes security breaches or infringes data protection regulations (GDPR) and the rights of third parties.
c) Attribution and Indemnification: The actions or results of a Contractual Partner’s AI shall be legally attributed to the Contractual Partner in the same way as the conduct of its own employees. The Contractual Partner shall indemnify QGROUP against all claims by third parties arising from the Contractual Partner’s use of Contractual Partner AI tools.
d) No warranty: QGROUP accepts no responsibility for the compatibility, accuracy or security of AI systems that do not originate from QGROUP itself but are integrated into the service process by the Contracting Party.

4.10 Force Majeure
a) Exclusion of liability: Neither party shall be liable for any delays or for the total or partial non-performance of its obligations under this contract if these are attributable to an event of force majeure.
b) Definition: Force majeure shall be deemed to include all unforeseeable, unavoidable events beyond the control of the affected party. These include, in particular: natural disasters, earthquakes, floods, extreme weather conditions; war, war-like conditions, acts of terrorism, civil unrest, revolutions, sabotage; strikes, lawful lockouts, official orders or embargoes; epidemics, pandemics and statutory or official quarantine measures; widespread, unforeseeable failures of internet and telecommunications infrastructure, power supply failures and state-imposed network shutdowns (e.g. ‘kill switches’).
c) Supply bottlenecks: Serious and widespread supply bottlenecks or transport delays affecting semiconductors, microchips or specific hardware components from OEM suppliers, through no fault of QGROUP, shall be deemed an event of force majeure, provided that QGROUP has concluded a corresponding hedging transaction in good time and is not being supplied by its own suppliers.
d) Duty to notify and extension: The affected party shall inform the other party without delay of the occurrence of the event of force majeure, its expected duration and the performance obligations affected. The performance deadlines shall be automatically extended by the duration of the event of force majeure plus a reasonable start-up period.
e) Right of termination: If the event of force majeure continues uninterrupted for more than eight (8) weeks, both contracting parties shall be entitled to terminate the contract in whole or in part without notice in writing with regard to the services not yet rendered. Partial services already rendered shall be invoiced. Further claims for this period are excluded.

5. Protection of Confidentiality and Non-Disclosure

5.1 Customer Protection and Non-Solicitation
a) Active non-solicitation clause: The contracting party acknowledges that QGROUP relies on the continuously updated expertise of qualified staff to provide highly specialised IT security services. The contracting party therefore undertakes, during the term of the contract and for a period of eighteen (18) months following its termination, not to actively poach, either directly or indirectly, any employees or specialised subcontractors of QGROUP who worked for the contracting party within the scope of this contractual relationship, nor to enter into a direct or indirect employment, service or consultancy relationship with them without QGROUP’s prior written consent.
b) Exception for unsolicited applications: This expressly does not apply to recruitments or engagements that can be proven to be based on an unsolicited application from the employee or on general job advertisements not specifically targeted at QGROUP employees. The burden of proof for the existence of this exception lies with the contracting party.
c) Contractual penalty: For every culpable breach by the contracting party of this active non-solicitation clause, the contracting party shall pay QGROUP a contractual penalty. The amount of this contractual penalty shall be determined by QGROUP at its reasonable discretion on a case-by-case basis and, in the event of a dispute, reviewed by the competent court as to its reasonableness. As a guideline for the calculation, an amount equivalent to half (0.5) of the affected employee’s gross annual salary (based on their last basic salary at QGROUP prior to the breach) shall apply. The right to claim any actual damages in excess of this amount is reserved; the forfeited contractual penalty shall be set off against such damages.

5.2 Mutual Confidentiality and Data Protection
a) Definition of Confidential Information: ‘Confidential Information’ for the purposes of this Agreement means all commercial, technical, organisational and legal information, data, reports (in particular penetration test reports, audit results, forensic analyses), source codes, passwords, network topologies, vulnerability reports and personal data which the parties make available to one another in the course of performing this Agreement.
b) Duty of Confidentiality: Both parties undertake to keep all confidential information of the other party strictly confidential, to use it exclusively for the contractually agreed purpose, and not to disclose it to any third party without the prior written consent of the disclosing party. The parties shall protect this information from unauthorised access by means of appropriate, state-of-the-art technical and organisational measures (TOM).
c) Permitted disclosure: Disclosure is permitted only to those employees, subcontractors or legal representatives who absolutely require this information for the performance of the services (the ‘need-to-know’ principle) and who have previously been bound by a confidentiality obligation of at least the same scope.
d) Exceptions: The duty of confidentiality shall not apply to information which (1) is generally known or becomes generally known through no fault of the receiving party; (2) was demonstrably known to the receiving party prior to disclosure; (3) was lawfully disclosed by a third party without breaching any duty of confidentiality; (4) was developed independently and without use of the confidential information; or (5) must be disclosed due to statutory obligations, an official order or a court order.
e) Return and deletion: Upon termination of the contract, all confidential information and any copies thereof shall, at the discretion of the disclosing party, either be returned or irrevocably deleted. Excluded from this are any information which the party is legally obliged to retain or which has been stored as part of proper, automated data backups, provided that deletion would require a disproportionately high level of technical effort and the data remains subject to this confidentiality.
f) Cyber Threat Intelligence and Reservation Regarding Anonymisation: Permission to use: The contracting party acknowledges and expressly agrees that QGROUP may, without restriction, analyse, use and disclose to third parties purely technical findings regarding cyber threats obtained in the course of incident response, threat hunting, penetration testing and MSSP services. Purpose: This includes the sharing of indicators of compromise (IoCs), malware samples, attacker tactics (TTPs) and vulnerability information with cyber security authorities (e.g. BSI), CERTs, industry associations (ISACs) and other contracting parties for the purpose of general cyber defence. Anonymisation guarantee: QGROUP guarantees that complete and irrevocable anonymisation will take place prior to any disclosure. It must not be possible to draw any conclusions regarding the identity of the contracting party, its employees, its specific IT infrastructure or any personal data. The client relationship itself shall remain strictly confidential.
g) Term: The confidentiality obligations under this Agreement shall continue to apply for a period of five (5) years following the termination of the contractual relationship.

6. Final Provisions and Order of Precendence

6.1 Data Protection and IT Security
QGROUP’s current data protection provisions and the documentation of its Technical and Organisational Measures (TOM) form an integral part of the security concept and may be requested at any time at backoffice@QGROUP.de.

6.2 Contractual Components and Order of Precedence (Principle of Speciality)
a) Modular structure: In addition to these General Terms and Conditions (GTC), the General Terms of Service (GTS) for project and support transactions (Part II) and the General Licence Terms (EULA) for software use (Part III) or specific service-related Service Level Agreements (SLAs) shall apply to specific offers, licence grants and services. Depending on the scope of services, these modules may also be agreed separately.
b) Rule of precedence (order of precedence of documents):
With regard to the relationship between the contractual documents, the parties expressly agree on the following order of precedence (in the event of any conflict, the provision appearing first shall take precedence over the subsequent one):
a) Individually negotiated agreements (e.g. in the main contract, quotation or in written special agreements) between the contracting parties.
b) The specific module terms and conditions (General Terms and Conditions of Service [ADB] or Licence Terms and Conditions [EULA]) as the provisions that are more specific and more relevant to the service in question.
c) These General Terms and Conditions (GTC) as the overarching framework. The GTC remain fully applicable in all areas not regulated, or not regulated differently, by the aforementioned documents (clauses 1 and 2) (e.g. place of jurisdiction, severability clause, general export controls).

6.3 Compliance with the Law and Right of Suspension
The parties undertake to comply with all applicable laws and regulations. QGROUP is entitled to temporarily suspend the performance of the contract or access to systems if the contracting party is proven to have committed a serious breach of applicable legal provisions.

6.4 Export Control and Foreign Trade Law
a) Compliance with regulations: The contracting party acknowledges that the products supplied by QGROUP (in particular software, source codes, physical appliances, OEM-integrated systems, threat intelligence data and documentation) are subject to national, European and international export control, sanctions and embargo regulations. The Contractual Partner undertakes to strictly comply with all applicable foreign trade regulations in the event of the disclosure, (re-)export, transfer or other conveyance of the products to third parties. This applies in particular to the regulations of the Federal Republic of Germany, the European Union and the United States of America (e.g. EAR, ITAR).
b) Sole responsibility: If the products are delivered within the Federal Republic of Germany or the European Union and the contracting party subsequently transports or exports these products to third countries, the contracting party shall bear sole civil and criminal liability. The contracting party is solely responsible for verifying and complying with all embargoes, country-specific and individual sanctions lists (e.g. EU sanctions lists, US Denial Lists, the Bureau of Industry and Security’s Consolidated Screening List), as well as for obtaining the necessary export licences (e.g. from the BAFA).
c) End-use and application checks: The contracting party shall take appropriate measures to ensure that the products are not used for purposes related to chemical, biological or nuclear weapons or military delivery systems and missile technology.
d) Indemnification obligation: The contracting party shall, upon first request, fully indemnify QGROUP, its legal representatives and vicarious agents against all claims, damages, fines and costs (including reasonable legal costs) incurred by QGROUP directly or indirectly as a result of a culpable breach by the contracting party of the applicable export control regulations.
e) Reservation regarding performance: QGROUP’s performance of the contract is subject to the proviso that there are no obstacles to such performance arising from foreign trade law or sanctions. If, after the conclusion of the contract, it transpires that a service would contravene applicable export control legislation, QGROUP shall be entitled to withdraw from the contract without liability for damages.

6.5 U.S. Government Restricted Rights
Any use, reproduction or disclosure of the commercial off-the-shelf software and technical documentation by or for the Government of the United States of America is subject exclusively to the restrictions set out in FAR 12.212 (for civil agencies) and DFARS 227.7202-1 and DFARS 227.7202-3 (for the Department of Defence), as well as the provisions of FAR 52.227-19 or DFARS 252.227-7015, in their currently applicable versions.

6.6 Governing Law and Jurisdiction
Disputes arising out of or in connection with these terms and conditions and the contracts concluded hereunder shall be governed exclusively by the law of the Federal Republic of Germany, to the exclusion of the United Nations Convention on Contracts for the International Sale of Goods (CISG) and international private law. The exclusive place of jurisdiction for all claims is Frankfurt am Main.

6.7 Nuclear Exclusion
The products have not been designed or manufactured as components for the planning, construction or maintenance of a nuclear facility, nor for direct, fail-safe operation within such a facility. Use in these areas constitutes a breach of contract; QGROUP shall not be liable for any damage arising as a result of such unauthorised use.

6.8 Completeness and Written Form
Any amendments or additions to this agreement must be made in writing (e.g. by email or confirmation via QGROUP’s electronic ticketing system) and require the express consent of both contracting parties to be valid. Unilateral amendment of the contract is excluded. This also applies to any amendment or waiver of this formal requirement itself. The statutory requirement for written notice of termination remains unaffected.

6.9 Group Transfer (QGROUP)
QGROUP is entitled to transfer its rights and obligations under this contract to an affiliated company or a permissible legal successor in connection with a merger, restructuring, spin-off or the sale of product lines.

6.10 Assignment by the contracting party
Any assignment of rights and obligations by the contracting party requires the prior consent of QGROUP in writing (e.g. by email).

6.11 Severability clause
Should any individual provisions of these terms and conditions be or become wholly or partially invalid, unenforceable or incomplete, this shall not affect the validity of the remaining provisions. In place of the invalid provision, a legally valid provision shall be deemed to have been agreed which most closely approximates the economic purpose of the invalid clause. Section 139 of the German Civil Code (BGB) shall not apply.

II. General Terms and Conditions of Service

1. Subject Matter of the Contract and Scope of Application

1.1 Scope
These General Terms and Conditions for Services (hereinafter “GTC”) apply to all managed services (MSSP), consultancy, design, programming, implementation, commissioning, support and training services provided by QGROUP to the contracting party. Any deviating, conflicting or supplementary terms and conditions of the contracting party shall not form part of the contract unless QGROUP expressly agrees to their validity in writing.

1.2 Distinction from Software Licences
The provision and use of standard software (whether on a permanent or temporary basis) are governed primarily by QGROUP’s General Licence Terms and Conditions (EULA) (Part III). These ADB govern exclusively the services and support provided in connection with the software.

1.3 Individual Contracts and Service Descriptions
The nature, scope and specific parameters of the services shall be agreed in separate individual contracts (e.g. project order, Scope of Work, SLA). Detailed service specifications such as high-level and detailed concepts or requirements specifications may be incorporated into these.

1.4 Classification as a Service Contract
Unless a specific, measurable and deliverable work product has been expressly agreed in writing in the individual contract as the result of the service, QGROUP is obliged to provide services in accordance with the law governing service contracts (Sections 611 et seq. of the German Civil Code (BGB)). QGROUP guarantees professional endeavour in line with the state of the art, but does not guarantee any specific economic or technical success.

1.5 Contract for Work
Where QGROUP is obliged to perform a specific work, this shall be made available for acceptance upon completion. The contracting party must carry out acceptance within two (2) weeks of the work being made available. The work shall be deemed to have been accepted if the contracting party does not refuse acceptance in writing (e.g. by email) within this period, specifying at least one specific, material defect, and QGROUP has specifically drawn the contracting party’s attention to this consequence at the start of the period. Acceptance may not be refused on the grounds of minor defects; such defects shall be rectified under the terms of the standard liability for defects. In the event of the Contractual Partner putting the Work into productive operation or using it without reservation in live operation, the Work shall be deemed to have been accepted after ten (10) working days at the latest.

2. Remuneration, Travel Expenses and Default

2.1 Remuneration on a time-and-materials basis
Unless a fixed price has been expressly agreed in the individual contract, remuneration for QGROUP’s services shall be based on the actual time spent, in accordance with QGROUP’s service price list valid at the time the order was placed.

2.2 Index-linked price adjustments
In the case of continuing contractual relationships (e.g. ongoing MSSP or support contracts), QGROUP is entitled to adjust the remuneration rates appropriately, subject to a notice period of three (3) months, in order to offset changes in personnel or infrastructure costs. If a price increase exceeds ten per cent (10%) within a calendar year, the contracting party is entitled to terminate the relevant individual contract extraordinarily in writing with effect from the date on which the increase takes effect.

2.3 Billing Frequency
One person-day (man-day) corresponds to eight (8) hours. Time spent is recorded and invoiced in increments of fifteen (15) minutes or part thereof.

2.4 Travel expenses and travel times
Travel expenses are calculated on the basis of actual costs incurred (economy class flights, second-class rail travel, taxis). Where a motor vehicle is used, a rate of EUR 0.65 per kilometre travelled will be charged. Travel time is deemed to be working time and is invoiced at fifty per cent (50 per cent) of the agreed hourly service rate. Accommodation costs are charged on a cost basis; daily allowances are calculated in accordance with the applicable tax rates.

2.5 Taxes
All prices are net prices plus the applicable statutory value added tax.

2.6 Time sheets and hourly allowances
QGROUP shall invoice the costs incurred on a monthly basis in arrears, either on the basis of electronic time sheets, ticket logs or activity reports, which specify the nature, scope and date of the services provided. Prepaid hourly allowances (allowance contracts) may, subject to written agreement, be carried over to the immediately following month up to a maximum of twenty per cent (20%) of the monthly allowance; thereafter, they lapse. Hours exceeding the allowance will be invoiced separately on a time-and-materials basis.

2.7 Payment term and due date
Invoices are due for payment without deduction within fourteen (14) days of the invoice date, unless a longer payment term is specified in the individual contract or on the invoice.

2.8 B2B Late Payment
In the event of late payment by the contracting party, QGROUP shall charge interest on arrears at the statutory rate for payment claims in B2B transactions (9 percentage points above the applicable base rate p.a.) as well as the statutory flat-rate reminder fee of 40.00 euros (Section 288(5) of the German Civil Code (BGB)). We reserve the right to claim higher damages for late payment.

2.9 Credit Risks
QGROUP is entitled to demand advance payments or security deposits if the contracting party defaults on payments or if circumstances arise that indicate a significant reduction in their creditworthiness (in particular, if an application is made to open insolvency proceedings or if payments are suspended).

2.10 Temporary suspension of services (Service Suspension)
If the contracting party falls more than thirty-one (31) days in arrears with a payment due for ongoing Managed Services (MSSP) or hosting services, QGROUP shall be entitled, following prior written notice and the expiry of a final period of seven (7) days, to temporarily suspend the provision of services (in particular active security monitoring or the provision of systems) (suspension). QGROUP’s entitlement to remuneration shall continue during the suspension. QGROUP shall not be liable for security incidents, data loss or damage arising during the period of the justified suspension as a result of the suspended monitoring.

3. Obligations to Cooperate and Infrastructure Indemnity

3.1 Project Contact Persons
Both parties shall appoint a qualified contact person at the start of the work. The contracting party’s contact person must be authorised to make binding technical and organisational decisions or to ensure that such decisions are implemented without delay. They shall ensure communication with the contracting party’s internal specialist departments and coordinate appointments.

3.2 Provision of Work Equipment
The contracting party shall support QGROUP’s work free of charge to the extent necessary. In particular, it shall provide suitable premises, organisational and technical IT resources, network access, interface specifications and error-free test data. The contracting party shall be responsible for ensuring that the materials and specifications it provides are technically feasible and free from third-party rights.

3.3 Ownership and Indemnity against Criminal Liability
The Contracting Party expressly warrants that it is the unrestricted owner of the IT infrastructure to be audited or processed, or that it has the express, written consent of the owner authorising QGROUP to perform the agreed services (in particular penetration tests, scans and incident response).

The Contracting Party shall fully indemnify QGROUP, its directors and employees, upon first request, against all claims by third parties and against any liability under criminal, civil or administrative law arising from the Contracting Party having unauthorisedly commissioned services on infrastructure that does not belong to it or for which it has not been granted authorisation.

4. Grant of Rights Use

With regard to the work products created specifically for the Contractual Partner within the scope of the services (e.g. bespoke concepts, reports, specific scripts), in respect of which copyright or other intellectual property rights arise, QGROUP grants the Contractual Partner a non-exclusive, geographically unlimited, non-transferable right of use for its own internal business purposes. This right of use shall only be irrevocably granted upon full payment for the relevant service. Until full payment has been made, QGROUP is entitled to provisionally prohibit the use of the deliverables.

5. Special Provisions Regarding Consultancy Work

5.1 Project Description
Before the consultancy services commence, the parties shall define the specific content of the consultancy, the scope of services and the strategic approach by means of a written project description (e.g. quotation, service specification or scope of work).

5.2 Estimated cost framework and unforeseeable additional costs
On the basis of the project description, QGROUP shall estimate a non-binding cost framework based on general experience. The contracting party acknowledges that this estimate cannot take into account specific conditions in the contracting party’s operating environment that were unknown to QGROUP in advance. Should significant additional work become apparent during the course of the project that exceeds the original budget by more than ten per cent (10%), QGROUP shall notify the contracting party of this in writing or by email. If the contracting party does not respond to such a notification within five (5) working days of receipt, the additional expenditure shall be deemed to have been approved, provided that QGROUP has expressly drawn the contracting party’s attention to this deadline and the legal consequences of failing to respond in the notification.

5.3 Phase Confirmation
The contracting party is obliged, upon request by QGROUP, to confirm in writing or by email the successful completion of individual consultancy phases defined in the project description within five (5) working days in each instance.

6. Special Provisions Regarding Programming and Configuration Work

6.1 Requirements Specification, Detailed Design and AI Inputs
In the context of specific programming, configuration and parameterisation work, the Contracting Party is obliged to provide a detailed detailed design or requirements specification prior to the start of implementation, unless the preparation of this design is an explicitly agreed part of QGROUP’s services. The Contracting Party bears sole responsibility for ensuring that its specifications and system information are complete, error-free and technically accurate. Insofar as the Contracting Party uses artificial intelligence (AI) systems to produce these specifications, it shall be fully liable for ensuring that the results are technically error-free and do not infringe any third-party rights. Before programming work commences, the contracting party shall carry out a final review of the specifications drawn up by QGROUP and approve them as binding work instructions.

6.2 Estimation of the scope of work
The budget and approval provisions set out in clause 5.2 shall apply mutatis mutandis to the scope of work for programming and configuration tasks.

6.3 Source code and ownership of rights
Unless expressly agreed otherwise in the individual contract, software, updates, scripts or configurations shall be delivered exclusively in object code (executable format). Copyright and all industrial property rights in the programming, configurations, development tools and base libraries shall remain exclusively with QGROUP. If the source code is made available to the contracting party on the basis of an individual agreement, the right of use shall be limited to ensuring interoperability with other programmes and to rectifying errors for the contracting party’s own internal operations.

6.4 Rights to amend, edit and reproduce
The contracting party is entitled to make changes to, decompile and edit the programmes exclusively within the mandatory legal limits set out in Sections 69d and 69e of the German Copyright Act (UrhG). Any unauthorised modification of the code shall result in the expiry of any liability for defects on the part of QGROUP.

6.5 Prohibition on the Disclosure of Customised Programming
As the programmes and configurations created under these General Terms and Conditions of Business (ADB) are tailored specifically to the Contracting Party’s IT infrastructure , the disclosure, letting or sale of these deliverables to third parties is strictly prohibited, unless QGROUP gives its prior written consent.

6.6 Backup Copies and Access Protection
The contracting party is entitled, and is obliged as part of its duty of care regarding IT, to create a backup copy of each programming step provided. It must protect the programmes and configurations from unauthorised access by third parties by means of appropriate access controls.

6.7 Third-Party Intellectual Property Rights in Materials Provided
The contracting party bears sole responsibility for ensuring that the software, licences, data and technical specifications provided by it to QGROUP in the course of programming work are free from third-party rights and do not result in any infringement of intellectual property rights.

7. Acceptance Procedure for Work Products

7.1 Definition of Acceptance Criteria
Where a specific deliverable is contractually owed (contract for work and services), the acceptance criteria, milestones and test procedures must be described in detail in the requirements specification (detailed concept). The acceptance procedure, including any trial operation, may last for a maximum of four (4) weeks from the date of QGROUP’s written notification of readiness.

7.2 Joint Acceptance Report
Upon successful completion of the acceptance tests described in the specifications, both parties are obliged to sign a joint acceptance report without delay. Minor defects do not entitle the contracting party to refuse acceptance.

7.3 Rectification of Defects and Independent Liability Clause
If material defects are identified during the acceptance procedure, the contracting party shall document these in the report. QGROUP shall rectify the defects within a reasonable period, after which the acceptance test shall be repeated. If the second attempt at rectification by the manufacturer also fails, the contracting party may set QGROUP a final reasonable grace period for rectifying the defects. If this period also elapses without result, the contracting party shall be entitled to the statutory rights to a reduction in price or to withdraw from the relevant individual contract.
The following liability provisions apply to any claims for damages by the contracting party arising from the non-completion or termination of the work:
a) Where these ADB apply in conjunction with QGROUP’s General Terms and Conditions (GTC), liability is limited to the sums insured and limits specified in Section 4 thereof.
b) If these ADB are agreed between the parties as a separate, independent contract (without incorporating the GTC), QGROUP’s liability in cases of slight negligence is limited, per loss event, to the total remuneration agreed for the individual order in question (net order value). Liability for loss of profit and indirect consequential damages is completely excluded in cases of slight negligence. Liability for wilful misconduct, gross negligence and personal injury remains unaffected.

8. Breaches of Contract and Defects in Services

8.1 Distinction between types of service
Where QGROUP provides pure services (e.g. IT consultancy, incident response, threat hunting, MSSP operations), QGROUP is obliged to exercise professional diligence in accordance with the state of the art, as set out in the service contract, but is not obliged to achieve a specific result under a contract for work and materials. Where the service involves the creation of a customised work ready for acceptance (e.g. the preparation of a specific penetration test or forensic report; hereinafter referred to as the ‘Result’), the following provisions shall apply.

8.2 Restrictions on modifications by the contracting party
Claims for defects relating to a deliverable are subject to the condition that the contracting party uses the deliverable unaltered and within the intended system environment. Insofar as the contracting party modifies the deliverable or the underlying systems itself, has them modified by third parties, or combines them with unauthorised products, QGROUP shall not be liable for any defects, unless the contracting party can prove that any defect that has arisen is not attributable to these circumstances and that this does not impair QGROUP’s fault analysis.

8.3 Limitation period and legally valid deemed acceptance
Claims for defects in respect of results under a contract for work and services shall become time-barred within twelve (12) months of acceptance. The work shall be deemed to have been accepted by operation of law if the contracting party does not refuse acceptance in writing, specifying at least one specific, material defect, within two (2) weeks of QGROUP making the work available and notifying the contracting party of its completion, provided that QGROUP has expressly drawn the contracting party’s attention in writing, in its notification of completion, to this time limit and the legal consequences of the time limit expiring without response. In cases of wilful misconduct, gross negligence or fraud, the statutory limitation periods shall apply.

8.4 Duty to give notice of defects
The contracting party must notify QGROUP in writing of any defects or disruptions to performance that have arisen, in a comprehensible manner, immediately upon discovery.

8.5 Performance of remedial action
8.5.1 Nature of rectification: In the event of justified and timely notifications of defects relating to a deliverable, rectification shall be carried out, at QGROUP’s discretion, by repair or re-creation. Repair may also be effected by the provision of updates, patches or documented instructions (workarounds) via remote data transmission.
8.5.2 Service hours: Unless otherwise agreed in the Service Level Agreement (SLA), QGROUP shall provide services and carry out rectification work exclusively during normal business hours (Monday to Friday from 09:00 to 18:00, excluding public holidays in Hesse, Germany).
8.5.3 Subcontractors: QGROUP is entitled to have the work carried out by qualified third parties (subcontractors). Responsibility under data protection law remains with QGROUP.
8.5.4 Exclusion of additional costs: Any additional costs arising from rectification work due to the service or the result having been taken by the contracting party to a destination other than that contractually agreed shall be borne by the contracting party.
8.5.5 Costs arising from false reports: If it transpires that a problem reported by the contracting party is not attributable to a defect in QGROUP’s service (e.g. in the event of faults in the contracting party’s infrastructure or pre-existing damage caused by cyber-attacks), QGROUP is entitled to invoice the costs incurred for analysing and rectifying the problem in accordance with QGROUP’s current service rates.

8.6 Further rights in the event of failure and self-contained liability clause
If the subsequent performance of a result under a contract for work and materials ultimately fails, the contracting party may, following the fruitless expiry of a reasonable grace period, withdraw from the specific sub-contract or reduce the price.
The following provision applies to claims for damages and reimbursement of wasted expenditure:
a) In conjunction: Where these ADB apply in conjunction with QGROUP’s General Terms and Conditions (GTC), liability shall be governed exclusively by Section 4 (Liability) of the GTC.
b) When used on their own: If these ADB are agreed as a separate, stand-alone contract (without incorporating the GTC), QGROUP’s liability for cases of slight negligence is limited, per incident, to the total remuneration agreed for the individual order in question (net order value). Liability for loss of profit, indirect consequential damages and business interruption losses suffered by the contracting party is completely excluded in cases of slight negligence. Liability for wilful misconduct, gross negligence and for damages resulting from injury to life, limb or health remains unaffected.

8.7 Compensation for use
In the event of withdrawal from a software- or appliance-based service contract, QGROUP is entitled to claim reasonable compensation for the benefit derived by the contracting party. This shall be calculated on the basis of a linear, four-year total period of use, less a reasonable reduction for the period during which the specific defect was present.

9. Return and Deletion of Data upon Termination of the Contract (Offboarding)

9.1 Retention period
Upon termination of the relevant service, QGROUP shall retain the data generated by the contracting party or stored on its behalf (e.g. log files, forensic images, reports) in the system for a maximum period of thirty (30) days. Within this period, the contracting party may request the return of the data.

9.2 Costs of Export
The data shall be made available and exported in a standard, unencrypted format customary in the market. The associated costs and technical infrastructure expenses shall be paid for separately by the Contracting Party in accordance with QGROUP’s current service rates.

9.3 Permanent deletion
Upon expiry of the 30-day period, QGROUP is entitled and – subject to any statutory or regulatory retention obligations – obliged to delete all of the Contracting Party’s data irrevocably and in compliance with data protection regulations. QGROUP shall not be liable for any loss of data after the expiry of this period.

10. Final Provisions

10.1 Choice of law
Contracts between QGROUP and the contracting party shall be governed exclusively by the law of the Federal Republic of Germany, to the exclusion of the UN Convention on Contracts for the International Sale of Goods (CISG) and international private law.

10.2 Jurisdiction
Where the contracting party is a trader, a legal person governed by public law or a special fund under public law, or does not have a general place of jurisdiction in Germany, the exclusive place of jurisdiction for all disputes arising from or in connection with this contract shall be Frankfurt am Main.

10.3 Requirement for written form
Any amendments or additions to this agreement must be made in writing (e.g. by email or via confirmation through a QGROUP electronic ticketing system) and require the express consent of both contracting parties to be valid. Unilateral amendments to the contract are excluded. This also applies to any amendment or waiver of this written form requirement itself. The statutory requirement for written notice of termination remains unaffected.

10.4 Severability clause
Should any individual provisions of this contract be or become wholly or partially invalid or unenforceable, this shall not affect the validity of the remainder of the contract. In place of the invalid or unenforceable provision, a legally valid provision shall be deemed to have been agreed which most closely approximates the economic purpose of the invalid clause. The above provisions shall apply mutatis mutandis in the event that the contract proves to contain any omissions. Section 139 of the German Civil Code (BGB) shall not apply.

III. General Licence Terms (EULA)

1. Grant of License and Rights of Use

1.1 Licence Types and Scope
QGROUP grants the Licensee the use of the software covered by this contract either on a permanent basis in return for a one-off payment (purchase/on-premise) or for a limited period in return for ongoing remuneration (subscription/rental/SaaS). Subject to the terms of this EULA, QGROUP grants the Licensee in both cases a simple, non-exclusive licence, without the right to grant sub-licences, to use, exclusively during the licence term, (i) the software and (ii) any updates made available under the subscription or a software maintenance agreement, up to the maximum number of licence units purchased, for the Licensee’s own business purposes. This applies to original software licences and licences for QGROUP platform products (embedded software licences and associated feature set licences).
In the case of temporary licence grants, the licence is non-transferable; in the case of permanent licence grants (purchase), transferability is governed by mandatory statutory provisions. Each update is subject to the same terms and conditions as the software. In the case of temporary licence grants, the right of use is limited to the term of the contract. In the case of permanent licence grants, the right of use is valid for an unlimited period.

1.2 Hardware-Bound Use
Provided that use of the software does not exceed the number of licence units purchased, the software may be used on any of the licensee’s supported hardware. This does not apply to software covered by an embedded software licence (OEM/Embedded) or where an express written agreement (e.g. SLA or project contract) precludes such use.

1.3 Copies and Instances
Copies of the software may only be made within the strict limits set out in Section 69d of the German Copyright Act (UrhG). The licensee may make a backup copy if this is necessary to safeguard future use. The consolidation of licences onto a single instance of the software is permitted, provided that the software and QGROUP’s licence management technology technically support this and the maximum number of licence units corresponds to the sum of all licences assigned to this instance.

1.4 Trial and Evaluation Licences (Non-commercial Use)
Software licensed for classroom, laboratory, trial, demonstration or other non-commercial applications must not be used in a production environment, but exclusively for the testing and evaluation purposes defined in the SKU or the associated individual agreement.

1.5 Operating System Licences
In the event that the QGROUP platform does not include an integrated software licence, a separate, compatible software licence must be purchased in order to use the underlying operating system software lawfully.

1.6 Integration of Open-Source Software (OSS)
The software may contain third-party software components that are subject to open-source software licences (‘OSS’). Where OSS components are integrated, the respective OSS licence terms of the rights holder shall take precedence over the provisions of this EULA, provided that this EULA grants the licensee more restrictive rights than the applicable OSS licence. QGROUP shall make the relevant licence texts available to the licensee within the software, in the documentation or on request.

2. Licence Entitlement and Activation

2.1 Registration and Activation
When installing the software, the licensee is obliged to register with QGROUP as an end user, provided that the software strictly requires this for technical activation or licence validation. We reserve the right to apply special provisions for isolated or state-classified high-security environments (e.g. VS-NfD). QGROUP will send the licence entitlement to the licence holder by email to the email address specified in the order.

2.2 Purchase via authorised resellers
If the licence has been purchased through an authorised reseller, QGROUP shall not be liable for the reseller’s independent acts or omissions, unless the reseller acted as a direct vicarious agent of QGROUP. The licence entitlement authorises the licencee to retrieve the licence keys required to activate the software product. Should the licence entitlement not have been duly received by the licencee, it may be requested in writing from QGROUP or the authorised reseller, provided that the licence was lawfully purchased. This does not apply to embedded software licences.

2.3 Third-party software
For third-party products and/or services that are not marketed under the QGROUP brand but are supplied in connection with this agreement, the licence terms of the respective third-party manufacturer shall apply in the first instance. The Licensee’s statutory warranty claims against QGROUP in respect of the entire scope of supply remain unaffected by this.

3. Ownership and Intellectual Property Rights

The software and documentation are the intellectual property of QGROUP or its suppliers and are protected by copyright. The licence does not confer ownership or title to the software, but merely a contractual right of use. Suppliers and authors of integrated third-party components are entitled to assert their rights in respect of the software independently in the event of a copyright infringement by the licensee.

4. Copies, Modifications and Logistics

4.1 Processing for Specific Purposes
The licensee may only make copies or adaptations of the software to the extent that this is strictly necessary for use in accordance with the contract or for archiving and backup purposes in accordance with Section 69d of the German Copyright Act (UrhG).

4.2 Copyright Notices
The Licensee must reproduce all copyright notices, trade marks and ownership notices from the original software unchanged on all copies or adaptations.

4.3 Network Restriction
The reproduction or making available of the software on a public or freely accessible network is prohibited. Installation on an access-restricted, company-owned or closed network dedicated to the Licensee (e.g. a private cloud) is permitted, provided that use remains strictly limited to the licence units purchased.

5. Prohibition on Reverse Engineering and Decompilation

5.1 Legal Restrictions
The licensee is prohibited from disassembling, decompiling, modifying or decrypting the software, or from creating derivative works based on the software, unless this is expressly permitted below or by mandatory law.

5.2 Mandatory Copyright Law
Decompilation, reverse engineering or reproduction of the software is permitted exclusively within the narrow and mandatory limits set out in the statutory provisions (Sections 69d and 69e of the German Copyright Act (UrhG)).

5.3 Obligation to cooperate regarding interoperability
If the Licensee intends to carry out decompilation to achieve interoperability in accordance with Section 69e of the German Copyright Act (UrhG), they shall inform QGROUP in writing in advance and give QGROUP the opportunity to provide the necessary interoperability information within a reasonable period of time, so that decompilation becomes unnecessary for the Licensee.

6. Termination and Withdrawal

In the case of contracts for the temporary provision of software (hire/subscription), QGROUP may terminate the contract extraordinarily without notice for good cause if the Licensee breaches a material obligation under these licence terms and fails to remedy the breach within a reasonable period despite a written warning and the setting of a deadline. In the case of contracts for the permanent transfer of software (purchase), termination of the right of use is excluded; the statutory rights to rescind the contract in the event of serious breaches of obligation remain unaffected. Following effective termination or withdrawal, the licensee is obliged to cease use, to delete or destroy the software and all copies without delay, and to confirm the complete deletion to QGROUP in writing upon request.

7. Export Regulations

Software may be subject to export and import restrictions. In particular, licensing requirements may apply, or the use of the software or associated technological processes abroad may be subject to restrictions. The applicable export and import control regulations of the Federal Republic of Germany, the European Union and the United States of America, as well as all other relevant regulations, must be strictly complied with.

8. U.S. Government Restricted Rights

The Standard Software purchased and the accompanying documentation were developed entirely at private expense. They are supplied and licensed as commercial computer software (‘Commercial Computer Software’) or as a commercial product (‘Commercial Product’) within the meaning of FAR 2.101. Licensing to US government agencies is granted exclusively with the rights that are routinely granted to the public, in accordance with the provisions of FAR 12.212 (for civilian agencies) and DFARS 227.7202-1 and DFARS 227.7202-3 (for the Department of Defense). Where applicable, the provisions of FAR 52.227-19 (Commercial Computer Software Licence) or DFARS 252.227-7015 (Technical Data – Commercial Products and Commercial Services) shall apply in the version in force at the time the contract is concluded. Any use, reproduction or disclosure by the US Government shall be subject exclusively to the terms and conditions set out in this licence agreement.

9. Other Licence Restrictions

9.1 Compliance with Licence Units
The Licensee’s use of the Software must not at any time exceed the contractually agreed number of licence units purchased.

9.2 Use by Contractors (Service Providers)
The Licensee may grant third parties (contractors/service providers) engaged by it access to the Software solely for the purpose of providing services to the Licensee and for the benefit of the Licensee. This is only permitted if the relevant contractor has previously undertaken in writing to comply with the provisions of this Agreement. The Licensee remains fully and primarily liable to QGROUP for compliance with all contractual provisions by its contractors. Furthermore, the transfer or use of the software by any other third parties (in particular the granting of rights to third parties) is excluded.

9.3 Exclusion of third-party benefits
This Agreement does not constitute a contract for the benefit of third parties. Unless expressly provided otherwise in this Agreement, this Agreement does not confer any rights, licences or claims on natural or legal persons who are not parties to this Agreement.

9.4 Interface Information, Software Bundles and Trademarks
a) Should the Licensee require information to ensure the interoperability of the Software with other independently developed programmes, they shall request this from QGROUP in advance. QGROUP shall make the necessary interface information available to the Licensee within a reasonable period and in accordance with the statutory provisions of Section 69e of the German Copyright Act (UrhG), provided that such information is not already otherwise available to the Licensee. QGROUP is entitled to make the provision of this information conditional upon the signing of an appropriate non-disclosure agreement (NDA).
b) Where several software products are provided together as a single licence (package/bundle), the individual components of this bundle may not be used separately as individual products or in combination with other products.
c) Copyright notices, readme files, trademark labels, disclaimers or other proprietary notices contained in or on the software or a QGROUP platform must not be altered or removed. They must be included in every lawfully made copy of the software.

9.5 Lawful Use
The Licensee is not authorised to use the software, or to allow it to be used, in breach of applicable laws or regulatory requirements. Any support for or facilitation of illegal activities through the use of the software is strictly prohibited.

10. Non-commercial Purposes (Evaluation and Demo)

In addition to the restrictions on use set out in clause 1.4, software licensed for non-commercial purposes, including demonstration, training, laboratory or internal testing purposes (‘non-commercial purposes’), is subject to a limited licence term of no more than thirty (30) calendar days from the date of provision. This shall not apply unless QGROUP has expressly agreed in writing in advance to a different term or has configured such a term as part of the technical licence key generation process. QGROUP is under no obligation to renew expired trial or evaluation licences.

11. Subscription Terms and Price Adjustments

11.1 Commencement of Licence
If the software is licensed on a subscription basis, the contract term and the right of use (licence start date) shall commence on the date expressly defined as the licence start date or commencement date in QGROUP’s written order confirmation. The licence start date shall take effect irrespective of actual technical access or the time at which the licence keys are transmitted.

11.2 Exclusion of Cancellation
In B2B transactions, subscriptions cannot be cancelled under normal circumstances for the agreed fixed term and are non-refundable. In the event of early termination for reasons attributable to the licensee, no (pro rata) refund of subscription fees already paid will be made.

11.3 Term and Automatic Renewal
Contracts for software subscriptions are concluded for a minimum term of twelve (12) months or three (3) years. The contract term is automatically extended by a further twelve (12) months in each instance unless the contract is terminated in writing by either party with three (3) months’ notice prior to the expiry of the current licence term. Upon expiry of the subscription, the right to use the software ceases in full.

11.4 Index-linked fee adjustment
In the event of an automatic renewal, the fee for the renewal period shall be based on QGROUP’s current price list valid at the time of renewal. Price adjustments reflect general cost trends in the IT sector, based on the Producer Price Index for Information Technology Services (IT Services) published by the Federal Statistical Office, as well as functional product enhancements.

11.5 Duty to Inform and Right to Renew
QGROUP shall inform the licensee in writing of any forthcoming price increase resulting from a list price adjustment no later than four (4) months before the expiry of the current term. QGROUP is under no obligation to renew a licence or subscription term. Upon termination of the subscription, the Licensee is obliged to cease use immediately and to verifiably delete all copies of the software.

11.6 Technical requirements (internet connection)
The Licensee acknowledges that a temporary or permanent internet connection may be required for the ongoing use, licence validation and administration of the software provided under a subscription. Without this connection, the software’s functionality may be restricted; such restrictions do not constitute a defect. Special provisions for isolated environments (Clause 20.6) remain unaffected.

12. Invoicing and Terms of Payment

12.1 Billing Methods
Where the Licensee purchases software licences, subscriptions or services directly from QGROUP, invoicing shall be based on the invoice issued by QGROUP. Where products or services have been purchased via an authorised reseller, invoicing and payment shall be governed exclusively by the contractual agreements with the respective reseller.

12.2 Payment Terms for Subscriptions
Unless expressly agreed otherwise in writing, fees for time-limited licences (subscriptions, hire, SaaS) are payable in advance for one (1) contractual year at a time.

12.3 Payment term
Invoices from QGROUP are due for payment without deduction within fourteen (14) days of the invoice date. Any longer payment term or later due date specified on the invoice shall take precedence over this provision. A reduction in the contractually agreed payment term by means of a unilateral note printed on the invoice is excluded.

12.4 B2B Late Payment
In the event of late payment by the licensee, QGROUP is entitled to charge interest on arrears at the statutory rate for payment claims in B2B transactions (9 percentage points above the respective base rate p.a.) as well as the statutory flat-rate reminder fee of 40.00 euros (Section 288(5) of the German Civil Code (BGB)). We expressly reserve the right to claim any demonstrably higher damages resulting from the delay.

12.5 Credit risks and advance payments
QGROUP is entitled to make the provision of further services or deliveries conditional upon a reasonable advance payment or the provision of security if the Licensee falls into arrears with QGROUP or if, after the conclusion of the contract, circumstances come to light which significantly impair the Licensee’s creditworthiness and thereby jeopardise QGROUP’s claim for payment. This applies in particular if an application has been made to open insolvency proceedings in respect of the Licensee’s assets, the Licensee suspends payments or is over-indebted.

13. Software Maintenance Services and Updates

13.1 Scope of Software Maintenance
During the term of a valid subscription licence, QGROUP shall provide software maintenance services at no additional cost. These maintenance services comprise exclusively the rectification of programme errors (bugs) and the provision of standard updates. Any services beyond this scope (e.g. on-site support, custom configurations) must be agreed under a separate, chargeable service agreement (ADB, Part II).

13.2 Expiry of previous rights upon updates
Where updates or upgrades are made available, the right to use the old, superseded software version shall expire immediately upon the installation and productive use of the updated version.

14. Integration of Third-Party Service Providers (TPSP)

Where software maintenance and support services are provided directly by a third-party service provider (“TPSP”), including a partner authorised by QGROUP, the parties agree as follows:
14.1 Legal Independence: The TPSP shall provide its services as an independent entity and not as a partner, joint venture or employee of QGROUP. It shall have no authority to bind QGROUP contractually or to make representations on behalf of QGROUP.
14.2 Rights in respect of defects in third-party support: Any claims by the Licensee arising from poor performance, breaches of duty or damage in connection with the operational provision of support by the TPSP shall be directed primarily against the relevant TPSP. QGROUP’s liability for wilful misconduct or gross negligence in the selection and authorisation of the TPSP remains unaffected.
14.3 Distribution of Updates: Provided that QGROUP has granted these rights to the TPSP in writing, the TPSP is entitled to pass on updates to the Licensee. All updates are subject in full to the terms of this EULA.
14.4 Distinction from Hardware Maintenance: Software maintenance services for embedded software (embedded OS), bundled software and integrated third-party products are governed by the specific terms of the QGROUP Hardware Maintenance and Software Maintenance Agreement. Separate third-party products provided by the licensee are not maintained by QGROUP.
14.5 Lifecycle Management: All software maintenance services provided directly by QGROUP are subject to QGROUP’s current End-of-Life (EOL) policy, which specifies the date from which support for obsolete software versions will be discontinued.

15. Managed Security Services Provider (MSSP) Licences

15.1 Provision and Terms for Third-Party Providers
Where QGROUP provides the Licensee with software licences or services from third-party manufacturers as a Managed Security Services Provider (MSSP) as part of the Services, QGROUP grants the Licensee a simple, non-transferable right to use these services for its own business purposes during the term of the contract. QGROUP provides MSSP services exclusively as services. The Licensee undertakes to comply with the supplementary licence and service terms and conditions of the respective third-party provider, which shall be made available to the Licensee prior to or at the time of provision. QGROUP is the Licensee’s sole point of contact for support in connection with the MSSP licences. Support enquiries to the provider shall be made exclusively by QGROUP following prior review and validation.

15.2 Access in the Context of Operation and in the Event of Security Incidents
For the provision, maintenance and ongoing optimisation of the system solution, the manufacturer is permitted technical access to the infrastructure used by the licensee to the extent necessary. In the event of an acute cyber-attack against the Licensee, the Licensee agrees to the Manufacturer’s reactive access to its systems, provided that such access takes place within the framework of a separately concluded Incident Response (IR) or APT contract and serves exclusively to mitigate the damage or ensure data integrity. QGROUP shall inform the Licensee’s crisis team in advance of the impending access and the purpose of the measure, insofar as this is technically and temporally feasible within the context of emergency response. The parties shall ensure that the necessary data protection agreements (in particular data processing agreements) are in place for this purpose.

15.3 Evaluation and use in security emergencies (PoC / emergency licences)
Where MSSP licences are provided for evaluation purposes (Proof of Concept – PoC) or as part of urgent emergency assistance in the event of a security incident, QGROUP grants the licensee a right of use limited to a maximum of thirty (30) days. This provision is made in conjunction with a separate evaluation or incident response contract.

15.3.1 Licensee’s obligation to remove the software: Upon expiry of the evaluation period or upon completion of the emergency response (but no later than 30 days), the licensee is obliged to completely uninstall and delete all software components and agents provided from its endpoints and systems, unless the parties agree, prior to the expiry of this period, to a transition to a regular licence agreement subject to a fee.

15.3.2 Compensation for failure to uninstall: If the endpoint components are not fully uninstalled by the end of the 30-day period for reasons for which the Licensee is responsible, QGROUP shall be entitled to invoice the Licensee for the use of the endpoints that remain active from the 31st day onwards on a monthly basis at QGROUP’s current standard list prices. QGROUP shall notify the Licensee in writing or by email seven (7) days before the expiry of the period of this legal consequence and the applicable fees.

16. Commercial Cloud Services

16.1 Applicability of Third-Party Terms and Conditions
In the event that the software is operated on the Licensee’s own independent basis (i.e. separately and without a physical connection to a QGROUP-owned platform) within a commercial cloud infrastructure, the right to access and use the software is subject to the continued validity of and compliance with the terms of use of the relevant commercial cloud service provider (e.g. AWS, Microsoft Azure, Google Cloud). The Licensee is solely responsible for complying with these third-party terms and conditions.

16.2 Restriction to the client component
Insofar as the software functions as a client for commercial cloud services to be purchased separately, only the software client component provided by QGROUP is subject to the provisions of this Agreement.

16.3 Risk of cloud availability
Any termination, suspension or unavailability of the commercial cloud service is at the Licensee’s own risk. QGROUP accepts no liability for damage or business interruptions attributable solely to disruptions, maintenance work, service suspensions or the misconduct of the cloud service provider. This does not affect QGROUP’s statutory liability for defects relating to the functionality of its own software.

16.4 Compatibility and Third-Party Software
The Licensee acknowledges that, in order to operate the software within a commercial cloud service environment, they may need to purchase and install additional licences for third-party software (e.g. operating systems, databases). The procurement and licensing of such third-party software is the sole responsibility of the Licensee.

16.5 Exclusion of Liability for Third-Party Software
QGROUP accepts no warranty or liability for the freedom from defects, availability or suitability of third-party software used by the Licensee in connection with the cloud services. The Licensee’s right to assert claims for defects in the QGROUP software itself (including warranted compatibility) remains unaffected.

16.6 System Access by Cloud Providers
The Licensee acknowledges and agrees that the infrastructure providers responsible for the cloud services and hosting must, in the course of fulfilling their contractual obligations, access the systems, information and infrastructure components maintained by them. The parties undertake to conclude the necessary data processing agreements (DPAs) with the respective providers for this purpose, insofar as required under data protection law.

17. Supplementary QGroup Operating System (OS) End-User Licence Agreement

(Applies where the operating system and the QGROUP product are provided as an integrated complete solution)

17.1 Export controls and licence restrictions
The Licensee undertakes to use the operating system components, parts thereof, and any processes or services that are the direct product of the operating system components and, where applicable, the extended or hardened operating system (Trusted Operating System) (hereinafter ‘controlled components’) only in strict compliance with all applicable national and international export control and sanctions regulations. Export or re-export to countries or regions subject to export restrictions, sanctions or embargo provisions of the United States of America (USA), the European Union (EU) or the Licensee’s home country is prohibited.

17.2 Specific Prohibitions and Undertakings
The Licensee expressly agrees not to:
a) to export or re-export to a country or to a national of a country, insofar as this is prohibited or subject to authorisation under the applicable regulations of the USA, the EU or the Licensee’s home country;
b) to sell, transfer or make available to natural or legal persons if the Licensee has knowledge or reasonable grounds to suspect that these components will be used in the design, development, manufacture, maintenance or operation of nuclear, chemical or biological weapons or military delivery technologies; or
c) to supply to natural or legal persons listed on official sanctions, terrorism or prohibition lists maintained by the US Government, the EU or national authorities (e.g. the Denied Persons List, Entity List, SDN List).
The licensee warrants that its export rights have not been suspended, revoked or denied by any competent national or international authority.

17.3 Warranty for QGROUP’s own operating system products
Insofar as the integrated operating system is an original product of QGROUP or one of its wholly-owned subsidiaries, the warranty and liability for defects shall be governed exclusively by the general provisions of the underlying main contract or the specific OS product EULA. This supplementary EULA neither extends nor shortens the statutory or contractually agreed warranty period.

17.4 Liability for defects in integrated third-party operating systems
If the integrated operating system is provided by a third-party supplier, the following applies to liability for defects:
a) QGROUP provides the licensee with the third-party operating system in the condition it was in at the time the contract was concluded. No guarantee is given for the third-party operating system beyond the contractually warranted system compatibility and functionality of the overall system.
b) Insofar as the third-party operating system exhibits material or legal defects that impair the contractual use of the overall QGROUP product, QGROUP’s primary obligation under liability for defects is to remedy the defect by providing a patch, update or workaround from the third-party manufacturer.
c) Any further no-fault guarantee or liability on the part of QGROUP for the freedom from defects of the third-party operating system (in particular for the subsequent occurrence of zero-day exploits or security vulnerabilities in the third-party manufacturer’s unmodified code) is excluded, unless QGROUP has fraudulently concealed the defect or acted with gross negligence. The Provider’s strict liability for initial defects pursuant to Section 536a(1) of the German Civil Code (BGB) is excluded. Liability for wilful misconduct, gross negligence and for damage resulting from injury to life, limb or health remains unaffected.

18. Open-Source Software (OSS)

18.1 Precedence of OSS licence terms
The software may contain third-party software components that are subject to open-source software licences (‘OSS’). Where OSS components are included, the relevant OSS licence terms of the rights holder shall take precedence over the provisions of this EULA, provided that this EULA grants the licensee more restrictive rights than the applicable OSS licence.

18.2 Provision of licence texts
Upon request – or, where required by the relevant OSS licence, within the software or the documentation – QGROUP shall provide the licensee with a list of the OSS components used and the associated licence texts.

18.3 Disclaimer of Liability for OSS Authors
The Licensee acknowledges that the OSS authors and rights holders exclude any warranty or liability in respect of OSS components. QGROUP’s liability for defects in the overall product provided by QGROUP remains unaffected in accordance with the contractual agreements, provided that the defect is not solely attributable to an unmodified OSS component for which any liability is excluded under the OSS terms and conditions.

19. QGroup-hosted Software

19.1 Cloud Provision and Restrictions on Use
In the case of software hosted by QGROUP, QGROUP makes the software available for use via the internet on a server infrastructure operated by itself or a subcontractor. Where applicable, additional and differing terms and conditions shall apply, as well as, in all cases, volume and/or bandwidth restrictions, which can be found in QGROUP’s offer (e.g. regarding the exceeding of agreed volumes, the consequences thereof, etc.).

19.2 Billing Cycle and Availability
The Licensee shall not receive the software in physical form. The service shall therefore be invoiced on a monthly basis from the date of provision or in accordance with QGROUP’s specific offer. QGROUP undertakes to ensure an average annual availability of 99.5% for the hosted software; this excludes announced and necessary maintenance windows.

19.3 Data Protection and Data Processing (DPA)
The parties shall conclude a separate Data Processing Agreement (DPA) in accordance with Article 28 of the GDPR for the processing of personal data within the scope of the hosted systems.

19.4 Data offboarding upon termination of the contract
Upon termination of the hosting contract, QGROUP shall make the Licensee’s data available for download in a standard, machine-readable format (e.g. SQL, CSV). Thirty (30) days after the end of the contract, the Licensee’s data shall be irrevocably deleted from the hosting infrastructures.

20. Use of the Software in High-Risk Areas (High-Risk Activities)

20.1 Not Intended for Use in High-Risk Areas
QGROUP’s software and system solutions are standard IT security products. They are not designed, licensed or intended for use in environments that require error-free, fail-safe continuous operation and in which a failure of the software could directly result in a danger to life, limb or health, or in catastrophic damage to property or the environment (‘high-risk activities’). These include, in particular, the direct operation or control of nuclear power plants, air navigation or air traffic communication systems, air traffic control systems, life-support systems or Class III medical devices, as well as the direct control of weapon systems.

20.2 Licensee’s Discretion in High-Risk Use
Should the Licensee nevertheless use the software in high-risk areas or within critical infrastructure, this shall be at the Licensee’s own risk and under the Licensee’s sole responsibility. In this case, the Licensee is obliged to ensure, by means of its own protective and redundancy measures independent of the QGROUP product (e.g. physical separation, mechanical emergency systems, hardware-based failover structures), that a failure or malfunction of the software cannot cause any damage within the meaning of clause 20.1.

20.3 Limitation of Liability
QGROUP accepts no warranty, guarantee or liability for damage resulting from the Licensee operating the software contrary to the intended purpose set out in clause 20.1 without sufficient additional and effective risk mitigation measures. QGROUP’s liability for damages arising from injury to life, limb or health, as well as under the Product Liability Act, remains unaffected, provided that QGROUP is found to have acted with intent or gross negligence.

20.4 System Environment and Data Backup
The establishment and maintenance of a functional hardware and software environment that meets the Licensee’s specific security and protection requirements is the sole responsibility of the Licensee. The Licensee is also obliged to implement an overarching risk management system appropriate to the risks of its operations, as well as a regular, state-of-the-art data backup strategy.

21. Licence Verification and Audits (Right to Audit)

21.1 Right to Information and Self-Declaration
The Licensee undertakes, upon written request from QGROUP, but no more frequently than once per calendar year, to submit within thirty (30) days a complete and truthful self-declaration regarding the actual use of the software. This information must include the number of installed instances, endpoints in use and licensed units, and must be confirmed in writing by an authorised representative of the Licensee.

21.2 Conduct of On-Site or Remote Audits
Where there are reasonable doubts as to the accuracy of the self-declaration or where the Licensee refuses to provide the information, QGROUP shall be entitled, subject to the provision in Clause 21.6, to verify compliance with this EULA by means of an audit. The audit may, at QGROUP’s discretion, be carried out remotely (by electronically retrieving the licence data, where technically feasible) or on-site at the Licensee’s business premises during normal business hours. QGROUP shall give at least fourteen (14) days’ prior notice of the audit in writing.

21.3 Protection of Trade Secrets and Data Protection
QGROUP is entitled to have the audit carried out by an independent auditor or IT expert who is bound by professional confidentiality. The Licensee is obliged to grant the auditor the access to the relevant systems, servers and documents required for the audit. The Licensee has the right to refuse access to sensitive systems if this would demonstrably jeopardise trade secrets or breach statutory data protection obligations (e.g. the GDPR), provided that the Licensee provides evidence of compliance with the licence in another manner (e.g. through redacted system logs).

21.4 Costs of the audit
The costs of the audit shall generally be borne by QGROUP. However, if the audit reveals unauthorised excess usage of the contractually agreed licence units exceeding five per cent (5%) or if the Licensee unjustifiably refuses to cooperate with the audit, the Licensee shall bear the full reasonable costs of the audit and of the external auditors.

21.5 Legal consequences of sub-licensing
If sub-licensing is detected, the licensee is obliged to purchase the missing licence units within fourteen (14) days of such detection. The additional charge shall be calculated retrospectively from the date on which the excess usage commenced, or alternatively from the date of the last error-free audit or the date of conclusion of the contract, at QGROUP’s current standard list prices. QGROUP expressly reserves the right to make further claims for damages arising from copyright infringement.

21.6 Special provision for VS-NfD and isolated high-security environments
In the event that the software is operated in an isolated environment that is physically or logically disconnected from the internet (air-gapped) or in an environment authorised for state-classified information (VS-NfD – Classified Information – For Official Use Only), the written security or confidentiality agreements individually concluded between the parties shall take precedence. If no such individual agreement exists, standard remote audits or unmonitored on-site audits by QGROUP are excluded. In this case, the licensee is obliged to provide evidence of compliance with the licence every six months using an alternative procedure approved by the Security Protection Authority (e.g. by providing cryptographically signed, anonymised extracts from the licence logs or by obtaining confirmation from a security officer of the licensee who has been vetted by the authorities or in accordance with the Security Vetting Act (SÜG)).

22. EULA Final Provisions ans Serverability Clause

22.1 Governing Law
This EULA and all contractual relationships between QGROUP and the Licensee arising therefrom shall be governed exclusively by the laws of the Federal Republic of Germany, to the exclusion of the United Nations Convention on Contracts for the International Sale of Goods (CISG) and international private law.

22.2 Jurisdiction and Place of Performance
The place of performance for all obligations arising from this contract is the registered office of QGroup GmbH in Wehrheim. Where the Licensee is a trader, a legal person governed by public law or a special fund under public law, or does not have a general place of jurisdiction in the Federal Republic of Germany, the exclusive place of jurisdiction for all disputes arising from or in connection with this EULA shall be the court having jurisdiction over Wehrheim. QGROUP retains the right to bring legal proceedings against the Licensee at the Licensee’s general place of jurisdiction.

22.3 Requirement for written form and reservation of consent
Amendments and additions to this agreement must be made in writing (e.g. by email or confirmation via a QGROUP electronic ticketing system) and require the express consent of both contracting parties to be valid. Unilateral amendment of the licence agreement is excluded. This also applies to any amendment or waiver of this written form requirement itself. The statutory requirement for written notice of termination remains unaffected.

22.4 Severability clause
Should any individual provisions of this EULA be or become wholly or partially invalid, unenforceable or incomplete, this shall not affect the validity of the remaining provisions. In place of the invalid or unenforceable provision, or to fill the gap, the parties shall be deemed to have agreed, in B2B transactions, on a legally valid and enforceable provision which most closely approximates the meaning and economic purpose of the invalid or unenforceable provision and corresponds to the presumed intention of the parties. Section 139 of the German Civil Code (BGB) shall not apply.