General terms and conditions of secupay AG

secupay AG, Goethestr. 6, 01896 Pulsnitz (hereinafter referred to as „secupay“) is a payment transfer service provider licensed by the „Bundesanstalt für Finanzdienstleistungsaufsicht“ (BaFin).

These Terms and Conditions govern the rights and obligations of the Contractual Partner and secupay in the processing of payments within the meaning of

1 paragraph 2 no. 6 of the German Payment Services Supervision Act (Zahlungsdiensteaufsichtsgesetz - ZAG) and other contractual services. The following General Terms and Conditions are referred to in the main contract as „AGB“ and together with the main contract, the Special Terms and Conditions also in- cluded therein, its annexes (e.g. service certificates and any supplements) as „contract“. The contractual partner and secupay are jointly referred to as „the parties“.

These general terms and conditions of business including the special con- ditions apply:

1. For all legal relationships between secupay and the contractual partner.
2. To the exclusion of all conditions of the contractual partners.

Deviating agreements only apply if secupay has agreed to them in text form (§ 126b BGB). The silence of secupay or the unopposed performance of services offered by secupay shall not be deemed consent.

By signing and handing over or transmitting an order, offer or service agreement, the contractual partner first declares a binding contractual offer. secupay will check the contractual offer of the contractual partner immediately and communicate its decision at the latest 14 days after receipt or accept it by handing over the ordered goods or by activating the contractual partner in the secupay system. secupay reserves the right to reject the contractual offer.

The payment transactions to be processed in accordance with these Terms and Conditions shall be submitted electronically by the Contractual Partner using the interfaces provided by secupay (transaction creation). With the transaction creation, the Contractual Partner transfers its payment order to secupay, which executes this order after authorisation and capture of the transaction. Unless otherwise agreed in writing, the transaction shall be processed and invoiced in EUR. The contractual partner is only entitled to submit transactions denominated in EUR or in agreed foreign currencies.

If, apart from EUR, no other currency has been agreed in text form, EUR shall be deemed to have been agreed for all submitted transactions. The invoicing of deliveries and services rendered by secupay shall be made in EUR, subject to deviating textual agreements.

The payments are received in a secupay AG safeguarded account in the name of the Contractual Partner and paid out from there to the payees in accordance with the contract concluded between secupay and the contractual partner.

If no factoring is contractually agreed and secupay is unable to collect the payment amount submitted within seven days (non-payment by the payer) or if a chargeback occurs after secupay has collected the payment amount (e.g. due to a return debit note or a chargeback), secupay shall be fully released from its obligation to provide the payment transfer service to the payees. If the payment amount has already been paid out to the payee, the Contractual Partner shall reimburse secupay for the gross transaction amount paid out within seven days. secupay may choose to offset the refund amount against other claims of the Contractual Partner against secupay or collect it by direct debit.

As a rule, secupay pays out all released payments to the contractual partner once a week. When creating a transaction via the electronic interface, the contractual partner can mandate a payment split (specifying partial amount and recipient) between himself and/or third parties, provided that these have been created in advance as recipients in the secupay system and the contractual partner has a payment obligation to the third party arising from the underlying transaction.

In the event of a justified suspicion of culpable violation of the contractual obligations of the contractual partner, in particular in the event of increased complaints from debtors, chargebacks, multiple use of false account or card data in the business operations of the contractual partner, manual transactions, above-average acceptance of cards issued outside the European Economic Area (EEA), as well as the dispatch of goods to countries outside the EEA, secupay shall be entitled to impose acceptance conditions, withhold payments in full or in part or demand security services. If the parties do not reach an agreement on the measures to be taken, the parties have the right to terminate the contract extraordinarily.

Insofar as secupay acts as trustee for the Contractual Partner as trustor, the Contractual Partner cedes and assigns his future payment claims resulting from the funding process to secupay. In its capacity as trustee, secupay will pay all payment sums it receives into one or more safeguarded accounts held with one or more credit institutions, on behalf of the Contractual Partner as trustor. These safeguarded accounts will be held in the name of secupay as open collective safeguarded accounts as defined in § 17 Para. 1 Sentence 2 No. 1b ZAG (Zahlungsdiensteaufsichtsgesetz). secupay will notify the credit institutes who provide the open safeguarded accounts of the trust relationship. secupay will ensure that the payment sums laid out in Sentence 1 must be able to be allocated, in terms of accounting, to the Contractual Partner at all times and at no time may they be mixed with monetary sums belonging to natural or legal persons other than the payment service user for whom they are being held, and this applies in particular private monetary sums. secupay is authorised to offset and withdraw sums from safeguarded accounts in the amount of undisputed or legally established claims that exist against the Contractual Partner in favour of secupay from the safeguarded account. secupay must notify the Contractual Partner on request as to the credit institution and into which safeguarded account the respective payment sums laid out in Sentence 1 are deposited, and whether the credit institution with which the payment sums laid out in Sentence 1 are deposited is a member of an institution for the securing of claims of depositors and investors and whereby the scope of these payment sums is secured by this institution.

The contractual utilisation of the services offered by secupay requires that the hardware and software (IT system) used by the customer meets the minimum technical requirements for the use of secupay services (cf. the respective service-related agreements and descriptions). The configuration of the customer's IT system required for the use of the services is the customer's responsibility. The secupay shall inform the contracting party in good time if there are any changes to the minimum technical requirements for the use of the secupay services. In order to avert any possible consequential damage (e.g. in the event of security gaps or other IT vulnerabilities), secupay may also make these changes without delay subject to subsequent notification to the contractual partner (within 24 hours on working days).

If secupay provides the contractual partner with software for the services offered, secupay grants the contractual partner a non-exclusive license to use the respective software for the duration of the contract, limited to the duration of the contract. secupay assures the contractual partner that it is entitled to grant the simple right of use in the above-mentioned sense; opposing rights of third parties do not exist in this respect. Any duplication, reworking or decompiling shall only be permitted according to the specific relevant provisions of §§ 69a ff. German Copyright Act (UrhG). Responsibility for communication via the interface lies solely with the contractual partner, unless secupay has caused an error in the interface through at least gross negligence . This shall also apply in cases where secupay provides modules or script examples.

The contracting party shall be responsible for the accuracy of all transaction data transmitted to secupay from its sphere. In this respect, the contracting party shall be obliged to check the data. Any discrepancies between the information provided by the contracting party to and that intended by the contracting party shall be borne by the contracting party.

secupay is entitled to use the services of third parties for the performance of its duties. secupay shall exercise reasonable care in the selection of these service providers and will only commission companies that hold the necessary permits and who have undertaken to strictly adhere to the contractual and statutory data protection provisions, of which it shall notify secupay in writing.

secupay offers its services year-round and daily between 0:00 and 24:00. However, for technical reasons, it cannot be ruled out that functions may be unavailable for certain periods of time. Insofar as routine maintenance work is concerned, secupay endeavours to provide advance notification of this by e-mail. secupay does not accept any liability for limited performance or availability of IT systems (e.g. system failures, non-accessibility, unavailability or data loss) that secupay is not responsible for. This also includes all events and their consequences that are due to reasons beyond the control of secupay (e.g. due to force majeure, natural disasters, pandemics, fault or third-party responsibility, securing the infrastructure against network attacks, closing security gaps, including restrictive measures due to execution of law and order). Furthermore, secupay shall not be liable if these are due to technical or operational reasons for which secupay is responsible but which do not fall below an availability of 99% of the hours in a calendar year. Announced maintenance work outside of normal business hours, as well as on weekends and on public holidays, shall not be deemed to be a failure or defective performance. secupay shall be fully liable for damages resulting from injury to life, limb or health that are due to a breach of duty by secupay, its legal representatives or vicarious agents. In addition, secupay is also liable for other damages that are based on an intentional or grossly negligent breach of duty by secupay, its legal representatives or vicarious agents. If, however, other damages are due to simple negligence, secupay shall be liable for the breach of a material contractual obligation, but the amount shall be limited to the damages foreseeable at the time of the conclusion of the respective contract and typical for the contract. Material contractual obligations are those obligations whose fulfilment is essential to the proper performance of the agreement and on whose compliance the respective company relies and may rely and a breach of which jeopardises the achievement of the purpose of the agreement. secupay shall not be liable for lost profits. Liability under product liability law and for fraudulent intent and/or guarantees remains unaffected.

The contractual partner undertakes to provide secupay with an e-mail address, which is checked regularly (at least once per day on work days). Should this email address change, the contractual partner undertakes to provide immediate notification of this.

For the proper processing of business transactions it is necessary that the contractual partner immediately notify secupay of changes to the company, its business purpose, the economic beneficiaries, any significant decrease in its assets, changes to contact details (postal address, email, telephone) and changes to its bank details. The recording of the changes in or their deletion from a public register does not waive the contractual partner of this duty to notify secupay. Furthermore, further legal reporting obligations, in particular those pursuant to the German Anti Money Laundering Act (Geldwäschegesetz), apply.

secupay reserves the right to use all e-mail addresses provided in the course of the business relationship to send information letters with direct advertising for the same and similar goods and services. You can restrict this use at any time by sending an e-mail to [email protected] or at the end of each information letter via a link.

The dates, deadlines and periods of time specified by secupay are non-binding, unless otherwise expressly agreed in writing (text form § 126b BGB, German Civil Code). Incidentally, secupay shall only be in default if the Contractual Partner has set secupay a grace period of at least two weeks in writing. All fees are net prices plus the applicable statutory value added tax (Umsatzsteuer USt) applicable at the time of performance.

The contractual partner shall receive the invoice for the current services by e-mail in PDF format. The invoice amounts are due immediately. Postal invoices can be sent on request for a fee of EUR 3.75 per invoice.

The Contractual Partner is obliged to check all issued invoices, submitted payment transactions and bank transfers for content accuracy immediately, but no later than two weeks from receipt of the invoice or the submission of the transaction and must notify secupay of any objections immediately and in writing. In the event of late complaints, secupay shall not be liable for any damages resulting therefrom and shall be entitled to demand reasonable compensation for
expenses incurred in processing the late complaint.

For the collection of the due fees, the contractual partner secupay issues a SEPA company direct debit mandate. For each return debit note for which the contractual partner is responsible, a fee in the amount of EUR 8.00 plus the arising bank charges incurred in each case becomes due. If the contractual partner is more than 14 days in late payment of an invoice, secupay is entitled to terminate the contract for good cause after a
single written formal warning.

secupay is entitled and will attempt to settle claims and liabilities against the contractual partner within the scope of current business activities as far as possible. In addition, secupay has the right to collect open items of the contractual partner by debiting the bank account of the contractual partner disclosed to secupay.

Payment claims of the contractual partner against secupay may neither be assigned nor pledged without express written consent. The contracting party may not set off counterclaims if these have not been legally established by judgment or court order or remain undisputed by secupay, unless the counterclaim and the set-off main claim are synallagmatically linked.

The payment services are provided by secupay as the responsible entity ("controller") as the contractual partner is involved in the use of external specialist services. The legal basis for the processing of personal data is the legal transaction between the provider and the payer or payee (affected persons) and the resulting use of the payment transfer service according to Payment Services Supervision Act (ZAG) pursuant to Art. 6 litt. b, c and f GDPR. In case of a different judgement because of a supervisory or judicial decision about the need of a processing agreement, secupay and the contractual partner commit to conclude an processing contract according to Art. 28 GDPR. secupay and the contracting party mutually undertake to use all information provided to them for the purpose of performing the agreed services only for the purposes of this agreement and to treat it confidentially during the term of and after termination of the contract and to disclose it to third parties only to the extent permitted by the contract. All data is protected against unauthorised access and regular backups are made in accordance with legal requirements and to the extent necessary for secupay. secupay is obliged to oblige commissioned third parties in writing to comply with the legal and contractual data protection provisions. The contractual partner is obliged to disclose to its customers the storage of personal data in the secupay system and, if necessary, to obtain the necessary consent for this. Insofar as secupay processes data within the meaning of the GDPR, this data will be deleted after the processing purpose no longer applies in such a way that a personal reference can no longer be established. Deletion is equivalent to anonymisation.

The contractual partner is obliged to cooperate with secupay and the responsible criminal prosecution authorities in the event of serious payment security incidents, including breaches of data protection.

If the contractual partner violates the provisions of this contract, secupay is entitled, at its own discretion, to either charge a contractual penalty of EUR 50.00 per case or transaction concerned or the average fee of the past 3 months before the breach of contract for the duration of the violation or to terminate the contract for continued or serious violations for good cause.

Should secupay fail to react with regard to a breach or a breach of duty by the contractual partner or third parties, this shall not constitute a waiver of the right to take measures in the event of subsequent or comparable breaches.

The contractual partner undertakes to indemnify and hold harmless secupay against all claims (including ancillary claims and costs of reasonable legal proceedings) asserted against secupay by a third party due to a breach of this contract, due to an infringement of rights or due to the use of the services offered by secupay in breach of contract by the contractual partner, its employees or representatives. secupay undertakes to inform the contractual partner immediately of any claims made by a third party in the above sense and at the same time to give the contractual partner the opportunity to decide on further action within a reasonable period of time.

If no contract term has been agreed, the contract may be terminated by the contracting party at any time with a notice period of one (1) month and by secupay with a notice period of two (2) months. The contract may be terminated by either party at any time with a notice period of four weeks to the end of a calendar month. If a minimum contract term has been agreed, the contract shall be extended by a further twelfth (12) months in each case, unless it is cancelled with a notice period of three (3) months to the end of the respective term. The contractual partner may terminate the contract with a notice period of one (1) month to the end of the month in the event of proven cessation of business. The right to terminate the contract for good cause remains unaffected.

In the event of unjustified extraordinary termination by the contractual partner prior to the expiry of the contract term and in the event of justified extraordinary termination by the secupay due to a culpable breach of contract by the contractual partner, the contractual partner shall be obliged to pay damages for the period up to the next possible ordinary termination date. The damages to be paid shall be calculated as a lump sum for each month of the hypothetical remaining term according to the average remuneration excluding VAT of the last three calendar months preceding the month of termination. The contractual partner may prove to secupay that secupay has suffered less damage.

secupay has the right to adapt its general terms and conditions including the Special Conditions to changed requirements. The adjustment will be announced in writing at least two weeks before it comes into effect. If the contractual partner does not object until the amended terms and conditions come into effect, they shall be deemed to have been approved. The objection must be in text form in accordance with § 126b German Civil Code (BGB) in order to become effective. If the objection is raised in due time and in due form, the original terms and conditions continue to apply. secupay reserves the right, however, to terminate the contract extraordinarily for good cause, but without any claim for damages against the contractual partner.

Should one or more provisions of these general terms and conditions be or become invalid, this shall not affect the validity of the remaining provisions.

The place of business of secupay in Pulsnitz is the place of performance. The contractual relationship is subject to German law with the exception of the conflict of laws provisions and the United Nations Convention on Contracts for the International Sale of Goods (CISG).

The place of jurisdiction is, subject to a deviating exclusive place of jurisdiction, the place of business of secupay; secupay is, however, also entitled to sue the contractual partner at the court of his place of business.