General Terms and Conditions for AI and Automation Services

1 Provider and Scope

1.1 These General Terms and Conditions apply to all contracts between MDJAMO LTD, registration number HE 474335, Tassou Papadopoulou 18, 8504 Mandria, Republic of Cyprus, hereinafter the Provider, and its business customers, hereinafter the Customer, concerning technology, software, AI, consulting and automation services.

1.2 The offering is intended exclusively for undertakings, legal entities and other organisations established in the European Union or the European Economic Area. Consumers are excluded from use. The Customer confirms that it enters into the Contract for business or professional purposes.

1.3 Any differing terms of the Customer apply only if the Provider expressly accepts them in Text Form. Performance of a service or acceptance of payment does not constitute acceptance of third-party terms.

1.4 These Terms also apply to follow-up orders, renewals and extensions unless the Parties agree otherwise.

2 Contract Documents and Order of Precedence

2.1 A Contract may consist in particular of a quotation, purchase order or order confirmation, a specification of services, a project plan, a Service Level Agreement, a personal data processing agreement, a security schedule and these Terms.

2.2 In the event of conflict, the following order of precedence applies: first, an individually negotiated agreement expressly designated as prevailing; second, the relevant Order and its specification of services; third, a data processing agreement insofar as it governs data protection matters; fourth, a Service Level Agreement; and fifth, these Terms.

2.3 Oral side agreements become effective only when confirmed in Text Form. This does not affect the precedence of individually negotiated agreements.

3 Formation of the Contract

3.1 Quotations by the Provider are non-binding unless expressly designated as binding. A Contract is formed by signature by both Parties, written order confirmation, activation of a paid account, or commencement of the agreed service at the Customer's request.

3.2 Any person acting for the Customer represents that they are authorised to represent it. The Provider may request suitable evidence.

3.3 Electronic declarations and signatures satisfy the agreed Text Form unless mandatory law requires a stricter form.

4 Services

4.1 The Provider supplies only the services described in the relevant Order. These may include software and AI development, AI agents, process automation, data analysis, interface integration, consulting, setup, training, hosting, maintenance, support and access to software as a service.

4.2 Specifications of services, schedules, volume assumptions, interfaces, supported formats, target systems and acceptance criteria are defined in the Order. Statements outside the Contract Documents, in particular presentations, demonstrations and non-binding forecasts, are not owed.

4.3 The Provider may replace components, models or subcontractors with technically equivalent alternatives if this does not materially impair agreed core functions, data protection, information security or mandatory regulatory requirements. The Provider will notify the Customer of material changes in due time.

4.4 AI systems generate probabilistic results. Identical inputs may produce different outputs. Any particular substantive accuracy, completeness or economic effect is owed only if expressly agreed in the Order as a verifiable acceptance criterion.

5 Projects and Changes

5.1 Project services are performed in accordance with the agreed scope. Dates are binding only if expressly designated as binding. Delays caused by the Customer's failure to cooperate extend deadlines as reasonably required and may result in additional effort.

5.2 Customer requests for changes are treated as Change Requests. Before implementation, the Provider will, where possible, state the effects on fees, deadlines, security and functionality. Unless agreement is reached, the existing Order remains unchanged.

5.3 Partial services may be accepted and invoiced if independently usable. The Customer shall inspect services capable of acceptance within ten Business Days after provision and notify the Provider in Text Form of specific material deviations. Productive use constitutes acceptance where the Customer uses the service in production knowing that it is capable of acceptance and has not notified any material Defects.

6 Subscriptions and Usage-Based Services

6.1 Subscriptions are concluded for the minimum term agreed in the Order. They renew for the same period, but by no more than twelve months at a time, unless terminated on 30 days' notice to the end of the applicable term.

6.2 Usage-based fees may be calculated in particular by API calls, tokens, messages, users, automation runs, storage, computing time or transactions. The Provider's technical usage records are authoritative unless the Customer substantiates an inaccuracy.

6.3 Usage allowances, caps and excess-use prices are set out in the Order. Upon reaching agreed security, cost or usage limits, the Provider may suspend further processing or require approval.

6.4 Unless the Order provides otherwise, confirmed and paid project orders, setup services, reserved capacity and purchased usage allowances are binding and may not be cancelled unilaterally by the Customer.

6.5 Fees are generally non-refundable. This applies in particular to deposits, setup fees, project services already commenced or performed, expired or unused subscription periods, consumed or provided allowances and usage-based fees.

6.6 A refund is due only where the Provider rejects an Order, definitively fails to provide a prepaid service, or mandatory law requires a refund. In the case of partial performance, any refund is limited to the prepaid portion definitively not performed. Services already performed and non-recoverable third-party costs specific to the Order will be deducted.

6.7 Refund requests must be made in Text Form within 30 calendar days after the Customer becomes aware of the basis for the refund and must identify the Order, invoice and specific reason. This period does not restrict mandatory statutory rights.

6.8 Temporary disruptions, maintenance periods, restrictions of third-party services and deviations from non-binding time estimates do not give rise to a refund. Where a Service Level Agreement applies, service credits expressly provided there are the exclusive financial remedy for the covered availability failure, to the extent permitted by law.

6.9 If the Provider terminates a prepaid continuing service without cause and without breach by the Customer, it will refund pro rata the fees for the period definitively not provided after termination takes effect.

7 Customer Accounts and Credentials

7.1 The Customer shall keep contact details and authorised users current. It shall protect passwords, API keys, tokens and other means of access against unauthorised access and notify the Provider without undue delay of suspected misuse.

7.2 Actions performed through a Customer account are attributable to the Customer insofar as they are performed by its users or result from a breach of security requirements for which the Customer is responsible.

7.3 The Provider may suspend access where there are specific indications of misuse, a material security risk, a breach of law or a material payment default. It shall notify the Customer without undue delay to the extent legally and technically permissible.

8 Customer Systems and Permissions

8.1 Access to Customer Systems occurs exclusively within the scope of the relevant Order and the permissions matrix in Schedule 1. The Customer shall provide only those permissions required for the service and, where possible, use separate, revocable service accounts applying the principle of least privilege.

8.2 The Customer is responsible for the lawfulness of connecting its systems, obtaining internal and external approvals, and creating complete backups before production changes, unless the Order assigns those obligations to the Provider.

8.3 Production write access, external communications, bookings and transactions are permitted only if expressly activated in the Order and subject to approval rules, authorised recipient groups, limits and shutdown options.

8.4 The Customer may revoke permissions at any time. If revocation prevents performance, the Provider may suspend the affected service; agreed fees remain payable for services already performed and resources kept available.

8.5 For external messages, bookings or transactions, the Order shall define authorised systems, recipients, accounts, templates, amount and frequency limits, approving persons, authentication procedures, logging and revocation routes. The function remains disabled unless these matters are fully defined.

8.6 Changes to payment recipients, bank details, approving persons or transaction limits must not be made solely on the basis of an unconfirmed electronic message or AI output. The Customer shall use independent verification and, where specified in the Order, multi-person approval.

8.7 The Customer shall inspect logs of executed external actions and transactions without undue delay and report anomalies. If an action cannot be reversed after execution, or can be reversed only at a cost, the Customer bears that risk where the action was performed within the permissions and rules approved by it.

8.8 The Provider is not liable for losses caused by incorrect approvals, recipients or limits defined by the Customer, compromised Customer-side credentials, erroneous Customer Data or automation activated contrary to the Documentation. Clause 23 and mandatory liability remain unaffected.

8.9 Both Parties shall maintain an accessible emergency contact. The Provider may suspend write and transaction functions without prior notice where fraud is suspected, transaction patterns are unusual, security alerts arise or traceability is lacking.

9 AI Outputs and Human Review

9.1 AI outputs may contain, in particular, factual errors, omissions, incorrect conclusions, bias or content resembling third-party protected material. Before use, the Customer shall review outputs in accordance with their purpose, risk and intended use.

9.2 Assessments, rankings, forecasts and recommendations support decision-making. The Customer must not use them, without appropriate human review, as the sole basis for decisions that produce legal or similarly significant effects on natural persons.

9.3 The Customer shall designate professionally qualified persons to conduct the review. They must have the authority and genuine ability to question, change or reject outputs and to stop the automation.

9.4 The Provider does not provide legal, tax, investment, credit, medical or other regulated professional advice unless such a service is separately and expressly agreed and delivered by appropriately authorised persons.

10 Sensitive and Regulated Use Cases

10.1 Applications in human resources and candidate selection, health or medicine, legal or compliance, finance, payments or accounting, and critical infrastructure require a separate Order before production use. It must specify the intended purpose, affected persons, data categories, decision impact, roles of the Parties, human oversight, quality criteria, logging and incident processes.

10.2 Without such an Order, services in these areas may be used only for general organisation of information, summarisation, drafting or internal testing with non-production or appropriately protected data.

10.3 The Customer remains responsible for the professional decision. Without an express separate agreement, prohibited uses include automated decisions concerning recruitment, dismissal, treatment, diagnosis, credit, insurance, payment approval, legal enforcement or safety-critical control.

10.4 Where an AI system is classified as a high-risk system or as a component of a regulated product, production use shall begin only after documented assessment of roles and conformity. No Contract clause relieves either Party of mandatory statutory obligations.

11 Roles under the EU AI Act

11.1 For each relevant use case, the Parties shall determine whether they act, in particular, as a provider, deployer, authorised representative, importer or distributor within the meaning of the Artificial Intelligence Act. Merely designating a Party as a technical service provider is not determinative of its legal classification.

11.2 Before entering into the Contract, the Customer shall fully inform the Provider of the intended purpose, users, affected groups of persons, consequences of decisions, deployment environment and planned changes. A material change of purpose or modification of the system may be implemented only after renewed assessment.

11.3 Each Party shall comply with the obligations allocated to it by law. Required support, documentation, logs, assessments and costs shall be allocated in the Order. The Customer shall refrain from prohibited AI practices and use the service only for the agreed purpose.

11.4 The Customer shall ensure that its employees and other users possess AI literacy appropriate to the use. The Provider shall supply the agreed technical documentation and instructions for use.

12 Prohibited Use

12.1 The Customer must not use the services unlawfully, deceptively, discriminatorily or to infringe third-party rights.

12.2 Prohibited uses include in particular malware, unauthorised system access, phishing, impersonation, circumvention of safeguards, unlawful surveillance, unauthorised biometric categorisation, impermissible social scoring, prohibited manipulation, and the creation or dissemination of unlawful synthetic content.

12.3 The Customer must not examine models, platforms or safeguards through reverse engineering, automated scraping, model extraction or comparable methods, insofar as such a prohibition is permitted under applicable law.

12.4 Where there is reasonable suspicion, the Provider may investigate and temporarily restrict the affected use and may terminate for a material or repeated breach. Statutory reporting obligations remain unaffected.

12.5 The Customer shall comply with applicable sanctions, export-control, anti-corruption, anti-money-laundering and improper-benefit rules. It must not use services for sanctioned persons or territories or to circumvent such rules. The Provider may conduct required checks and reject, suspend or terminate a service where there is a substantiated compliance risk.

13 Customer Obligations

13.1 The Customer shall provide suitably qualified contacts, accurate requirements, appropriate test data, system access, decisions and approvals in due time.

13.2 The Customer represents that it holds all necessary rights and legal bases concerning data, content, trade marks, systems and interfaces supplied by it. It shall comply with the information, co-determination, professional, supervisory and documentation obligations applicable to its field of activity.

13.3 The Customer shall assess whether a data protection impact assessment, fundamental rights impact assessment, conformity assessment, medical-device assessment, security assessment or other regulatory or internal approval is required and shall inform the Provider in due time.

14 Personal and Confidential Data

14.1 Where the Provider processes personal data on the Customer's behalf, the Parties shall enter into an agreement pursuant to Article 28 GDPR before processing begins. Where either Party acts as an independent controller or the Parties act as joint controllers, they shall make the separate arrangements respectively required.

14.2 The Customer shall transmit only data required for the agreed purpose. Special categories of personal data and personal data relating to criminal convictions and offences may be processed only if expressly provided for in the Order and the Parties have documented the legal basis and safeguards.

14.3 The Provider processes Customer and usage data to perform the Contract, ensure security, analyse errors and comply with legal obligations. Any further use to improve its own services shall occur only with data anonymised so that a data subject is not identifiable by means reasonably likely to be used.

14.4 Personal or confidential Customer Data shall not be used to train publicly available models or improve a third party's models without an express agreement.

15 Subcontractors and International Transfers

15.1 The Provider may engage suitable cloud, hosting, communications, analytics and AI service providers as subcontractors. The list current when the Contract is concluded shall be provided as a Contract Schedule.

15.2 In the case of processing on behalf of the Customer, approval, notification of changes and rights to object are governed by the agreement pursuant to Article 28 GDPR.

15.3 Transfers of personal data outside the European Economic Area shall take place only on a lawful basis and subject to the required safeguards. The Provider shall provide information on material storage and processing locations.

16 Confidentiality

16.1 Each Party shall protect the other Party's Confidential Information with at least the same degree of care it uses for its own comparable information and shall use it solely for Contract purposes.

16.2 Information is not Confidential Information if, without breach of the Contract, it is publicly known, was demonstrably and lawfully known to the receiving Party already, is lawfully obtained from a third party, or is independently developed.

16.3 Disclosures required by law are permitted. Where permitted, the disclosing Party shall inform the other Party in advance and limit disclosure to what is required.

16.4 The confidentiality obligation continues for five years after the Contract ends; for trade secrets, it continues for as long as the information is protected by law as a trade secret.

17 Information Security and Incidents

17.1 The Provider shall maintain appropriate technical and organisational measures having regard to risk, the state of the art and the agreed scope of services. Details may be set out in a security schedule.

17.2 Each Party shall notify the other without undue delay of security incidents affecting the joint services or data and shall cooperate in containment, investigation and legally required notifications.

17.3 The Provider may temporarily disable access, integrations or automations in the event of an acute threat. It shall restore the service as soon as reasonably practicable.

18 Rights in Customer Materials

18.1 The Customer retains all rights in its data, content, documents, trade marks and other materials. For the term of the Contract, it grants the Provider the non-exclusive rights required to perform, secure and troubleshoot the services.

18.2 The Customer shall defend the Provider against third-party claims arising from unlawful or Contract-breaching provision of Customer Materials and reimburse reasonable costs and damages finally awarded or agreed with the Customer's consent. This does not apply to the extent the Provider caused the claim.

19 Rights in Developments and Outputs

19.1 Upon full payment, the Customer receives the custom Deliverables identified in the Order and the exclusive or non-exclusive rights of use agreed there. Scope, territory, duration, modification rights, sublicensing and delivery of source code shall be determined for each project.

19.2 The Provider retains rights in pre-existing and generally reusable source code, models, libraries, connectors, frameworks, methods, prompt structures, templates, tools, technical know-how and improvements, hereinafter Base Components.

19.3 To the extent Base Components are included in custom Deliverables, the Customer receives a perpetual, worldwide, non-exclusive, transferable right to use them to the extent necessary for the Contract-compliant use of the Deliverables, unless the Order provides otherwise.

19.4 Rights in third-party and open-source components are governed by their licence terms. The Provider shall identify material restrictions insofar as relevant to the agreed use.

19.5 To the extent AI outputs are legally protectable and transferable, the agreed rights in them shall be allocated to the Customer. The Provider does not warrant that every AI output is protectable, exclusive or free of similarity to third-party content.

19.6 If the Contract-compliant use of a custom Deliverable created by the Provider is prohibited due to a third-party intellectual-property claim, or such a claim is reasonably likely, the Provider may, at its option, procure a right of use, modify or replace the affected component with one having substantially comparable functionality, or terminate the affected part of the service. In the event of termination, the Provider shall refund pro rata any fees prepaid for the remaining period during which the affected service is definitively unusable. To the extent permitted by law, these remedies are exclusive.

19.7 Clause 19.6 does not apply to the extent a claim results from Customer Materials, Customer instructions, modifications not made by the Provider, combination with unapproved components, use outside the agreed purpose, or compliance with mandatory Customer specifications.

20 Fees and Payment

20.1 Prices, currency, billing intervals and any advance payments are set out in the Order. Amounts are exclusive of legally payable value added tax or comparable charges.

20.2 Invoices are due without deduction within 7 calendar days. In the event of late payment, statutory rights apply, including default interest and reasonable recovery costs.

20.3 The Provider may change prices for a subsequent subscription period by giving at least 30 days' prior notice. If the Customer does not accept the change, it may terminate at the end of the current period.

20.4 Set-off and rights of retention are permitted only in respect of claims that are undisputed, acknowledged or finally adjudicated, unless mandatory law provides otherwise.

20.5 The Customer shall bear bank, currency, payment-service and transfer charges on its side. The Provider shall receive the full invoice amount in the agreed currency. The Customer may deduct withholding tax only where legally required and shall provide the Provider with suitable evidence.

20.6 The Customer shall dispute an invoice within ten Business Days after receipt, stating specific reasons. Failure to do so constitutes approval of its mathematical and usage-related particulars insofar as the Customer could have identified the inaccuracy upon reasonable review. Mandatory objections remain unaffected.

20.7 A dispute concerning part of an amount does not entitle the Customer to withhold undisputed amounts. Returned direct debits, unjustified chargebacks and other payment reversals caused by the Customer shall be reimbursed together with reasonable third-party and processing costs.

20.8 In the event of payment default, the Provider may suspend access and further services after giving notice. Prior notice is unnecessary if the Customer definitively refuses payment, a payment service reverses a charge, or there are specific indications of fraud. Recurring base and reservation fees continue to accrue during a suspension caused by the Customer.

20.9 Where there are reasonable doubts as to the Customer's ability to pay, the Provider may require advance payment or reasonable security for services not yet performed. It may suspend performance until receipt.

21 Availability Support and Maintenance

21.1 Specific availability levels, support hours and recovery objectives are owed only if agreed in a Service Level Agreement. Without a Service Level Agreement, there is no entitlement to any particular uninterrupted availability.

21.2 Planned maintenance will be announced in advance where possible. Emergency maintenance may be performed without prior notice where required for security or stability.

21.3 Disruptions of the internet, Customer Systems or third-party services are outside the Provider's responsibility unless the Provider has culpably breached its obligations concerning selection, integration or response.

22 Defects

22.1 A service is defective if it materially deviates from expressly agreed requirements. Mere deviations from subjective expectations, typical variance in AI outputs, or errors attributable to Customer Data, Customer Systems or unapproved changes are not Defects of the Provider.

22.2 The Customer shall report Defects with a comprehensible description, affected inputs, time and available logs. The Provider shall be given a reasonable opportunity to investigate and remedy the Defect.

22.3 If remediation fails within a reasonable period, the Customer may reasonably reduce the fees for the affected service or terminate the affected part of the service. Mandatory rights remain unaffected.

23 Liability

23.1 The Parties have unlimited liability for fraud, fraudulent misrepresentation, wilful misconduct, and death or personal injury, to the extent liability may not be excluded or limited under applicable law.

23.2 In all other respects, the Provider is not liable for indirect or consequential loss, loss of profits, loss of savings, business interruption or loss of business opportunity, insofar as such exclusion is permitted by applicable law.

23.3 To the extent permitted by law, the Provider's aggregate liability arising out of or in connection with a Contract is limited to the net fees paid or payable by the Customer for the affected service during the twelve months preceding the event giving rise to liability. For a one-off project without twelve months of fees, the net fees for the affected Order apply.

23.4 The limitations of liability do not apply where mandatory law, guarantees expressly assumed, or claims for infringement of data protection or intellectual-property rights mandatorily require greater liability. If a limitation is ineffective, the broadest effective limitation shall apply.

23.5 The Customer is responsible for decisions, approvals and actions it takes on the basis of reviewed AI outputs. The Provider remains responsible for its own breaches of obligation and tasks expressly assumed by it.

23.6 Multiple claims based on the same or economically connected event are treated as one event for the liability cap. The liability cap is not increased by the number of users, systems, integrations, claims or causes of action.

23.7 To the extent permitted by law, liability for loss of or damage to data is limited to the reasonable cost of restoration from properly created backups. The Customer shall create backups in accordance with Clause 8.2 unless the Order expressly assigns backup obligations to the Provider.

23.8 Customer claims must be brought before a court within the minimum period permitted by law. A shorter limitation or exclusion period applies only if expressly agreed in the Order and effective under applicable law.

24 Indemnity

24.1 The Customer shall indemnify the Provider against valid third-party claims arising from unlawful use, an unagreed change of purpose, Customer Data supplied without the required rights, or use contrary to documented restrictions.

24.2 The Provider shall notify the Customer without undue delay, allow it to conduct the defence where appropriate and provide reasonable assistance. Settlements imposing an obligation or admission of liability on the Provider require its consent.

24.3 The Customer's indemnity includes in particular reasonable defence costs, amounts imposed by a regulator or court, and settlements entered into with the Customer's consent, insofar as the claim is based on a circumstance for which the Customer is responsible.

24.4 The indemnity also applies to claims arising from automated messages, bookings or transactions initiated by the Customer; missing consents or information duties; employment, medical, financial, professional or regulatory decisions; and use outside the agreed risk classification, unless the Provider caused the claim through its own breach.

24.5 Without the Provider's consent, the Customer must not enter into a settlement that provides for an admission of liability, payment, injunction or other obligation of the Provider. The Provider may participate in the defence at its own expense with advisers of its choice.

25 Term Termination and Consequences

25.1 Project Contracts end upon complete performance unless terminated earlier. Subscriptions are governed by Clause 6 and the Order.

25.2 The right to terminate for cause remains unaffected. Cause includes in particular a serious or repeated breach of Contract, material security risk, prohibited use, insolvency subject to mandatory law, or payment default continuing despite notice.

25.3 When the Contract ends, the Customer shall cease use and pay outstanding amounts. Continuing usage rights, confidentiality, data protection, liability and data-return provisions survive.

25.4 Ordinary termination by the Customer does not eliminate the agreed minimum term or fees already accrued or payable for the minimum term. To the extent the Provider saves expenses or deploys resources elsewhere as a result, benefits required to be credited under mandatory law shall be taken into account.

25.5 If the Provider terminates for cause attributable to the Customer, no refund is due. The Provider's entitlement to agreed fees and damages remains, with saved expenses and alternative earnings credited as required by applicable law.

25.6 Additional services connected with handover, migration, data preparation or support for a successor provider shall be charged at the agreed rates unless mandatory law or Clause 26 requires them to be provided without additional charge.

26 Data Export Switching Provider and Deletion

26.1 To the extent the service constitutes a data processing service subject to the switching requirements of the EU Data Act, the Provider shall, upon request, support switching to another provider or to the Customer's own infrastructure to the extent required by law.

26.2 Exportable data comprises Customer Data and directly Customer-associated digital assets identified in the Order or technical Documentation, in the formats specified there. Internal operational data, security information and Base Components are excluded insofar as their exclusion does not unlawfully impede switching.

26.3 The maximum notice period for initiating a switching process covered by law is two months. The standard transitional period is up to 30 calendar days, insofar as technically feasible. Extensions permitted by law and a one-time extension requested by the Customer remain possible.

26.4 After completion of the transitional period, the Provider shall keep exportable data available for retrieval for at least 30 calendar days unless a longer period is agreed. Thereafter, the relevant data shall be deleted unless a statutory retention obligation or documented instruction requires otherwise.

26.5 Procedures, formats, technical limitations, switching assistance and any charges permitted by law shall be described in the Order as necessary.

27 Changes to Terms and Services

27.1 The Provider may amend these Terms for future services and, for ongoing continuing obligations, for an objective reason, in particular due to changes in law, security requirements, technical developments or changes to third-party providers used.

27.2 Material changes to ongoing Contracts shall be announced in Text Form at least 30 days in advance. If a change materially disadvantages the Customer, it may terminate the affected continuing service before the change takes effect. Changes immediately required by mandatory law may take effect earlier.

28 Force Majeure

28.1 Neither Party is liable for delays or failures beyond its reasonable control, including natural events, war, government action, widespread telecommunications or energy outages, and uncontrollable cyber events. The affected Party shall inform the other and mitigate the consequences insofar as reasonably practicable.

28.2 If the event lasts longer than 60 days and materially impairs the principal service, either Party may terminate the affected part of the service.

29 Notices

29.1 Contract-related notices shall be sent to the contact addresses specified in the Order. Terminations, security notifications and legally significant declarations must be transmitted in Text Form.

29.2 The Customer shall keep its contact and billing details current. Notices sent by email are deemed received on the next Business Day unless a non-delivery message is received.

30 Governing Law and Dispute Resolution

30.1 The Contract is governed by the laws of the Republic of Cyprus, excluding its conflict-of-laws rules and the United Nations Convention on Contracts for the International Sale of Goods, insofar as its exclusion is permitted.

30.2 Before commencing court proceedings, the Parties shall attempt to resolve a dispute through negotiations between representatives authorised to make decisions within 30 days. Applications for interim relief and statutory time bars remain unaffected.

30.3 The courts of competent subject-matter jurisdiction in the Republic of Cyprus have exclusive jurisdiction over disputes, insofar as such jurisdiction agreement is effective.

31 Final Provisions

31.1 The Customer may assign rights and obligations only with the Provider's prior consent, which shall not be unreasonably withheld. The Provider may assign the Contract as part of a restructuring or transfer of the relevant business operations, provided the Customer's rights are not materially impaired.

31.2 The Parties are independent contractors. The Contract creates no partnership, authority to represent, employment or fiduciary relationship.

31.3 If any provision is wholly or partly ineffective, the remaining provisions remain effective. Applicable law shall apply in place of the ineffective provision; reduction to preserve validity shall occur only insofar as permitted by applicable law.

31.4 The English version prevails. The German version and any other translations are provided for information only, unless the Order provides otherwise.

31.5 A Party's failure or delay in exercising a right does not constitute a waiver. A waiver applies only to the specific case and only if declared in Text Form.

31.6 The Contract, including the documents referred to in Clause 2, constitutes the entire agreement concerning its subject matter and supersedes prior statements and agreements concerning that subject matter. This does not limit liability for fraud or fraudulent misrepresentation.

31.7 The Provider's rights and remedies are cumulative unless the Contract or mandatory law expressly provides otherwise.

Schedule 1 Permissions and Approval Matrix

For each integration, the relevant Order must specify exactly one initial level and, where applicable, additional individual permissions. Permissions not selected are deemed not granted.

Required Information for Each Integration

• Target system account and technical interface
• Permitted data categories and actions
• Recipient amount volume and frequency limits
• Persons authorised to approve and approval procedure
• Logging retention and review intervals
• Test environment production deployment and rollback procedure
• Emergency shutdown and incident contacts
• Professional and regulatory risk classification

Schedule 2 Minimum Information for Sensitive Applications

For applications in human resources, medicine, legal or compliance, finance and critical infrastructure, a supplementary specification of services is required before production use. It must define at least the following matters.