General terms and conditions of business
In case of differences between the German and English version of this Agreement, only the German version shall be decisive and applicable.
1. Area of application
1.1 Unless expressly agreed otherwise in individual cases, the provisions of these General Terms and Conditions (hereinafter "GTC") apply to all contracts
-
on the provision and use of the campaign tool (hereinafter: "AutLay Campaign Tool" or "Software") of AutLay - Automatisches Layout GmbH, Unter Käster 14-16, 50667 Cologne (hereinafter: "AutLay") with those entrepreneurs who make use of AutLay's services (hereinafter: "Customer"; AutLay and Customer also individually "Party" or jointly "Parties"), as well as the implementation of printing services in the form of print mailings (hereinafter: "Print Mailing Campaign") (cf. Chapter A) and the provision of additional consulting and implementation services by AutLay (see Chapter C), and
-
on the provision of an AutLay print shop platform (hereinafter "AutLay print shop platform"), via which customers can create Printmail campaigns and transmit them to their and AutLay's cooperating print service providers (hereinafter "print service providers") (Chapter B).
1.2 The version of the GTC valid at the time the contract is concluded shall apply.
1.3 These GTC apply exclusively with regard to AutLay's services, even in the event that they are not mentioned in subsequent contracts. The validity of any general deviating contractual or business terms and conditions of the customer is expressly excluded. This also applies if AutLay has not expressly objected to the customer's terms and conditions and/or provides services without objection. There are no verbal or written ancillary agreements to these GTC.
1.4 These GTC apply exclusively to business transactions with entrepreneurs and with legal entities under public law and special funds under public law. No contract is concluded with consumers.
1.5 The contract between AutLay and the customer consists of these GTC and the annexes (together: "contract"). All annexes mentioned in these GTC are a binding part of the Contract.
1.6 The customers and print service providers using the AutLay print shop platform (hereinafter jointly referred to as "users") each conclude a user agreement with AutLay for the use of the technical infrastructure provided as part of the AutLay print shop platform.
1.7 AutLay may use third parties, in particular print service providers, to fulfill the obligations arising from this contract or to exercise rights. In the case of the AutLay print shop platform, the print service providers are not vicarious agents of AutLay. Rather, the customer and the print service provider conclude an independent contract for the provision of print services (possibly mediated by the AutLay print shop platform) from which the customer and the print service provider are directly bound themselves.
1.8 Rights to which AutLay is entitled by law over and above these GTC remain unaffected.
1.9 Terms shall have the meaning defined in these GTC unless the context requires otherwise.
A. AutLay campaign tool services
1. Subject matter of the contract, conclusion of the contract
1.1 The object of AutLay's services to the customer in connection with the provision of the Campaign Tool is the provision of the AutLay Campaign Tool, the execution of print mailing and trigger campaigns as well as consulting and implementation services (the latter see Chapter C) by AutLay (hereinafter jointly referred to as "Campaign Tool Services"). The provision of services is determined in detail in accordance with the following provisions.
1.2 The contract for the provision of the AutLay campaign tool is concluded when the customer registers in the AutLay campaign tool. Only entrepreneurs and legal entities under public law and special funds under public law are entitled to register. The customer is obliged to truthfully declare their authorization to register on the AutLay website.
1.3 On the basis of the contract concluded for the provision of the AutLay campaign tool, the customer can commission AutLay to carry out print mailing campaigns and trigger campaigns. To do this, the customer sends the respective individual order by clicking on the corresponding order button in the AutLay campaign tool. The contract for the implementation of a print mailing campaign or trigger campaign is only concluded once AutLay has confirmed the order.
1.4 The contract with regard to the provision of additional consulting and implementation services is concluded by the customer accepting an individual offer from AutLay.
2. Provision of the AutLay campaign tool
2.1 AutLay provides the customer with the AutLay campaign tool as Software-as-a-Service (hereinafter "SaaS") for contractual use via the Internet. Contractual use includes access to the AutLay campaign tool and the input, storage, processing and retrieval of data for the creation of campaign layouts (hereinafter: "layouts") via the AutLay campaign tool. The software is not handed over. The AutLay campaign tool is operated exclusively on AutLay's systems. Access to the AutLay campaign tool is via the customer's personal user account. Additional user access to the user account must be ordered separately. If AutLay expressly offers the customer the option of inviting additional users to its user account, such user accounts will be set up at no additional charge.
2.2 Customers are only entitled to use the AutLay campaign tool within the framework of the current state of the art. AutLay shall take all commercially reasonable and appropriate measures to enable and maintain the secure availability of the AutLay campaign tool in accordance with these GTC. Nevertheless, it may happen that the campaign tool is temporarily unavailable, e.g. due to a failure of the Internet connection, hardware problems or maintenance work. In such a case, AutLay will endeavor to restore availability as quickly as possible, provided that the cause of the unavailability is within its sphere of influence. Overall, AutLay guarantees an availability of the campaign tool service of 97% calculated as an annual average.
2.3 If the AutLay campaign tool is unavailable for the installation of updates and other maintenance measures, AutLay will carry out these measures at night or at weekends if possible, unless immediate action is required due to necessary updates at short notice (e.g. to close critical security gaps). Such unavailability shall not affect the availability pursuant to Section 2.2 above.
2.4 In addition, AutLay provides the customer with contact options (in particular e-mail) for support inquiries.
3. Implementation of trigger campaigns
If the customer commissions AutLay to carry out a trigger campaign, AutLay processes trigger events and creates automated orders on behalf of the customer for the execution of print mailing campaigns.
4. Implementation of print mailing campaigns
4.1 If the customer commissions AutLay to carry out a print mailing campaign, AutLay will print the layouts created with the AutLay campaign tool and hand over the print mailings to the mailing service provider. The service is provided as a service in accordance with §§ 611 ff. BGB (German Civil Code).
4.2 Once AutLay has confirmed the order, AutLay will immediately forward the order to its print service provider, whereby AutLay will be granted a reasonable period of time for manual quality assurance. Therefore, the customer can no longer cancel the contract. If the customer cancels a confirmed order, he must pay the full amount of the remuneration. The customer is at liberty to prove that AutLay has incurred no or only minor damage as a result of the cancellation.
4.3 AutLay hands over the print mailings created by the print service provider to the mailing service provider Deutsche Post AG. Upon handover, AutLay's performance is complete. AutLay is not a contractual partner of the shipping service provider.
4.4 Upon conclusion of the contract, the customer authorizes AutLay to conclude a contract with Deutsche Post AG for and on behalf of the customer for the dispatch of print mailings. The contract between the customer and Deutsche Post AG is governed by Deutsche Post AG's GTC BRIEF NATIONAL, available at https://www.deutschepost.de/content/dam/dpag/images/A_a/AGB/dp-agb-brief-national-2021.pdf. AutLay undertakes - after proper payment of the remuneration in accordance with Section 6 of these GTC by the customer - to pay Deutsche Post AG the costs incurred by the customer as a result of commissioning Deutsche Post AG.
4.5 Campaigns of less than 500 advertising materials are sent at standard Deutsche Post conditions. For campaigns of 500 advertising materials or more, mailings are sent as Dialogpost. Dialogpost can be used to send items that are intended to address customers. Only advertising items are permitted. When sending items by Dialogpost, the customer is responsible for ensuring that all content of the advertising material complies with the Dialogpost requirements and guidelines of Deutsche Post.
4.6 Mailings to international countries outside Germany are sent via Dialogpost International. When sending via Dialogpost International, the customer is responsible for ensuring that all content of the advertising material complies with the Dialogpost International requirements and guidelines of Deutsche Post.
5. Obligations of the customer to cooperate
5.1 In order for AutLay to provide the campaign tool services properly, the customer must perform all necessary duties to cooperate in a timely and proper manner. As soon as the customer realizes that it will not be able to meet its obligations to cooperate, it shall inform AutLay of this without delay. If the customer fails to properly fulfill its obligations to cooperate or is otherwise responsible for causes that delay, restrict or hinder AutLay's performance, AutLay shall be released from its obligation to provide the campaign tool services for as long as the causes persist. If the cause ceases to exist, AutLay will begin to provide the campaign tool services again within a reasonable period of time. AutLay may charge the customer for additional expenses if the customer is responsible for the cause. The customer is not entitled to claim damages for delay in such cases. Further rights on the part of AutLay remain unaffected by the above provisions.
-
The customer is obliged to use the AutLay campaign tool exclusively within the scope of the functions provided.
-
The customer is obliged to establish an Internet connection when using the AutLay campaign tool and to maintain it during use. The Internet connection must allow sufficient data throughput.
-
The customer is obliged to take appropriate measures to ensure that unauthorized third parties cannot access the AutLay campaign tool and that the software is not damaged by viruses or other malware. This includes, in particular, keeping the access data for the AutLay campaign tool secret and only accessing the AutLay campaign tool via secure IT systems and secure Internet connections. You must refrain from any actions that are likely to cause an excessive load on the AutLay campaign tool or otherwise impair the functionality of the infrastructure or jeopardize the integrity, stability or availability of the AutLay campaign tool.
-
The customer is obliged to regularly carry out comprehensive backups of the data to be processed with the AutLay campaign tool. The performance of data backups is not part of the campaign tool services to be provided by AutLay.
-
In the event of inaccuracies or changes in the contact details, the customer is obliged to inform AutLay immediately by correcting the contact details in their user profile. In the event that the customer ceases to be an entrepreneur, the customer is obliged to inform AutLay of this immediately in text form.
-
The customer shall not use any racist, discriminatory, pornographic, politically extreme or otherwise unlawful data or data that violates official regulations or requirements to create layouts.
-
The customer is obliged to provide all documents and information required for the provision of consulting and implementation services in good time and in full and to ensure that suitable contact persons with the necessary specialist knowledge are available on the customer's side for this purpose. The customer shall create the necessary technical conditions for the proper provision of services by AutLay (e.g. by maintaining an Internet connection).
5.2 In particular, the customer is obliged to provide AutLay with all information required for the execution of the print mailing campaign (in particular address data of the recipients) correctly and completely in a suitable format (e.g. Excel) and in German, so that the mailing can be carried out correctly. At the customer's request, AutLay will roughly check the plausibility of the address data provided by the customer (e.g. zip code) before handing over the print mailings to the shipping service provider. In such a case, the customer is given the opportunity to check the address data for completeness before sending the order; AutLay accepts no liability for the completeness of the address data. AutLay accepts no liability for delays in delivery or undeliverability resulting from incorrect information provided by the customer. The customer is solely responsible for ensuring that the legal requirements for contacting the addressees of the print mailings are met, in particular in accordance with data protection law and the German Act Against Unfair Competition (UWG), and explicitly confirms this to AutLay for each addressee before each print mailing is commissioned. Damages and additional costs resulting from incorrect information provided to AutLay must be reimbursed by the customer.
6. Remuneration
6.1 The AutLay campaign tool is provided free of charge for the customer.
6.2 The customer pays AutLay the amount shown in the AutLay campaign tool during the checkout process for the print mailing campaign. The price includes a basic fee for carrying out the print mailing campaign as well as the costs incurred for production and commissioning the mailing service provider. Price lists available on the AutLay website are not binding.
6.3 If a trigger campaign is commissioned, the customer accepts the price overview displayed in the AutLay campaign tool during the checkout process. The print mailing campaigns that are automatically commissioned by the trigger campaign are billed according to this price overview.
6.4 AutLay will inform customers who have active trigger campaigns about adjustments to the pricing model by email at least four weeks in advance. If the customer does not agree with the new pricing model, it is their responsibility to deactivate the affected trigger campaigns by the cut-off date on which the new pricing model comes into effect. After the cut-off date on which the new pricing model becomes valid, the print campaigns automatically commissioned by trigger campaigns will be billed at the new pricing model.
6.5 AutLay accepts the payment methods specified during the checkout process. AutLay will only execute the order for the implementation of a print mailing campaign after full payment of the fee. AutLay is not obliged to perform until the payment has been made in full.
6.6 In individual cases, the remuneration is payable on account. In such cases, payment must be made to the account specified in the invoice within 14 days of receipt of the invoice by the customer. If the payment deadline is exceeded, AutLay is entitled to charge interest on arrears at a rate of 9 percentage points above the applicable prime rate of the European Central Bank. The assertion of further damages is not affected by this. If the customer defaults on payment, AutLay is entitled to demand immediate cash payment for all due and undisputed claims arising from the business relationship.
6.7 Payment shall be deemed to have been made when AutLay can dispose of the amount at the place of its registered office. In the event that AutLay accepts non-cash means of payment, only the unconditional crediting of the account or the ability to dispose of the amount owed shall also be deemed to be fulfillment.
6.8 Invoices must be checked carefully by the customer. Any corrections to invoices must be notified to AutLay within 14 days of receipt of the invoice.
6.9 All prices are subject to the applicable value added tax.
6.10 The amount to be paid to AutLay is regularly based on a price and discount scale, measured by the quantity of print mailings to be produced. If AutLay establishes before handover to the mailing service provider that the customer has not fulfilled its obligation to provide address data correctly to the extent that the quantity of layouts to be produced is based on the higher price and discount scale after sorting out the incorrect address data, the customer is obliged to pay the corresponding amount according to this price and discount scale. This also applies in particular if the total price according to the price and discount scale above is higher than would be the case according to the price displayed during the checkout process.
6.11 The customer will be reimbursed for any services not rendered (e.g. due to incorrect address data provided to AutLay). If a refund is required due to incorrect information provided by the customer, AutLay may incur damages and additional costs which must be borne by the customer. Such claims for damages will be offset against the refund. The basic fee will not be refunded, not even pro rata. The refund will be made in the following month as a credit note.
6.12 The customer shall only be entitled to offset counterclaims and assert a right of retention if they have been legally established or are undisputed.
B. AutLay print shop platform
1. Subject matter of the contract, conclusion of the contract
1.1 The object of AutLay's services to the customer in connection with the AutLay print shop platform is the provision of the AutLay print shop platform for use by the customer if and insofar as the customer has been authorized to use it by a print service provider. The object of AutLay's services to the print service provider is the provision of the AutLay print shop platform for use and authorization by customers of the print service provider. As part of the provision of the AutLay print shop platform, AutLay offers users the option of carrying out automated layouting of print mail campaigns and making the results (i.e. print files) available to the customer's print service provider. The services provided by AutLay within the AutLay print shop platform do not include the printing and dispatch of print mailings. The provision of services is determined in detail in accordance with the following provisions.
1.2 The contract regarding the provision of the AutLay print shop platform is concluded:
1.2.1 In relation to the print service provider, by the print service provider registering on the AutLay print shop platform using the registration tool.
1.2.1.1 Only entrepreneurs and legal entities under public law and special funds under public law are entitled to register.
1.2.1.2 AutLay requires a number of details for registration, such as the first and last name of the print service provider, company name and, if applicable, information that the registration is to be made as a print service provider. The print service provider can later enter their invoice data in their profile on the AutLay print shop platform.
1.2.1.3 The print service provider must also define a password. In this way, AutLay ensures that only registered users have access to the services and functionalities of the print shop platform.
1.2.1.4 A print service provider is not entitled to register on the AutLay print shop platform.
1.2.1.5 AutLay may deactivate the accounts created if it transpires that false or inadequate information has been provided during the registration process or that the registration of a company is not genuine. The print service provider is obliged to truthfully declare its authorization to register.
1.2.2 In relation to the customer, by the customer receiving a registration link from their print service provider and registering on the AutLay print shop platform using the registration tool.
1.2.2.1 AutLay requires a number of details for registration, such as the customer's first and last name, company name and, if applicable, information that the registration is to be made as an "advertiser". The invoice data can be entered later in the customer profile on the AutLay print shop platform.
1.2.2.2 Only entrepreneurs and legal entities under public law and special funds under public law are entitled to register. The customer is obliged to truthfully declare their authorization to register.
1.3 The contract between AutLay and the users does not cover the provision of printing services. In this respect, contractual relationships arise exclusively between the print service providers and customers. AutLay is neither an agent nor does AutLay itself become a contractual partner.
1.4 Before the print service provider can offer services to customers, they book a package in the AutLay web interface. The services and remuneration are specified individually for each package and can be viewed by the print service provider before booking. After booking a package, the print service provider receives an e-mail confirming the package they have booked, including the respective prices. They can then create registration links for customers and send them to them.
2. Provision of the AutLay print shop platform
Users are only entitled to use the AutLay print shop platform within the framework of the current state of the art. AutLay shall take all commercially reasonable and appropriate measures to ensure the availability and functionality of the AutLay print shop platform. AutLay does not guarantee the availability and functionality of the AutLay print shop platform at all times, and in particular does not guarantee that the platform will be accessible to users at all times and will function without disruption. AutLay temporarily restricts its services if this is necessary due to capacity limits, the security or integrity of the servers or to carry out technical measures. These measures serve the proper or improved provision of the services (e.g. maintenance work, repair work). In such a case, AutLay will endeavor to restore availability as quickly as possible, provided that the cause of the unavailability is within its sphere of influence.
3. Implementation of an automated layout on the AutLay print shop platform
3.1 The customer can order a print mailing campaign with individual layouts by providing the necessary information. The customer determines the content of the print mailing campaign and the layout themselves and approves the final print mailing campaign.
3.2 After approval by the customer, AutLay makes the finished layouts available to the print service providers (e.g. as a download, file server).
3.3 There is no further check of the layout result or confirmation from AutLay. Once the print mailing campaign has been ordered, it is immediately forwarded to the print service provider and can no longer be adjusted or canceled in the AutLay print shop platform.
4. Commissioning the print service provider to perform printing services
4.1 The print service provider may provide its own GTC in the course of providing its own services to the customer. If it does not provide its own GTC, the law shall apply unless otherwise provided below.
4.2 The print service provider is obliged to retrieve the customer's layouts provided by AutLay and to process them in accordance with its agreement with the customer. If the print service provider does not retrieve the customer's layouts, it shall nevertheless remain obliged to pay AutLay.
4.3 The print service provider shall ensure that its service offers and service content are correct and lawful and comply with statutory regulations and third-party rights.
5. Obligations of the user to cooperate
5.1 The print service provider is obliged to regularly check whether ready-made layouts have been provided by AutLay.
5.2 The user is obliged to handle the log-in data or access data with care. In particular, the user is prohibited from disclosing the log-in data to third parties and/or enabling third parties to access the profile by circumventing the log-in data.
5.3 If the user breaches his obligations pursuant to Section 5.2 above and his user account is used by third parties, the user shall be liable for all activities that take place using his user account. The user shall not be liable if he is not responsible for the misuse of his user account.
5.4 The user warrants that the data used to create his/her profile is correct and complete.
5.5 The user undertakes vis-à-vis AutLay not to upload any content to the AutLay print shop platform that violates applicable law or morality due to its content, form or design or in any other way. When uploading content, the user undertakes to comply with applicable law (in particular criminal law, competition law and youth protection law) and not to violate the rights of third parties (e.g. name, trademark, copyright, image and data protection rights). In particular, the dissemination of content that is anti-constitutional, racist, glorifies violence and extremism of any kind is not permitted, nor are calls and incitement to criminal offenses and violations of the law; threats to life, limb or property; incitement against persons or companies; defamatory statements, libel, slander and defamation of third parties; violations of fair trading laws; content that infringes copyright or other intellectual property rights; sexual harassment of third parties; pornography; offensive, sexist, obscene, vulgar, vile or disgusting material.
5.6 The use of the AutLay print shop platform may not involve any activity that could impair the operation of the AutLay print shop platform or the underlying technical infrastructure. This includes, in particular, the use of software, scripts or databases in connection with the use of the AutLay print shop platform as well as the automatic reading, blocking, overwriting, modification or copying of data and/or other content, unless this is necessary for the proper use of the AutLay print shop platform.
5.7 If disruptions occur during the use of the AutLay print shop platform, the user is obliged to inform AutLay immediately of the disruption. The user must also inform AutLay immediately if he/she receives information about content published by third parties that obviously violates applicable law or the rights of third parties.
5.8 In order for AutLay to be able to properly provide the AutLay print shop platform, the customer must perform all necessary duties to cooperate in a timely and proper manner.
6. Remuneration
6.1 The print service provider shall pay AutLay the agreed remuneration for the use of the AutLay print shop platform by customers to whom it has provided a registration link and who have created layouts for print mailing campaigns using the registration link via the AutLay print shop platform. The remuneration is determined by the package booked.
6.2 Invoicing for a month takes place at the beginning of the following month. At the request of the print service provider, AutLay can charge the customer's credit card when the customer commissions a print mailing campaign and forward the payment to the print service provider. We use the payment service provider Stripe Payments Europe, Limited (SPEL, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland) for this purpose.
6.3 Payment must be made by the print service provider within 14 days of receipt of the invoice to the account specified in the invoice. If the payment deadline is exceeded, AutLay is entitled to charge interest on arrears at a rate of 9 percentage points above the applicable prime rate of the European Central Bank. This shall not affect the right to claim further damages. If the print service provider is in default of payment, AutLay is entitled to demand immediate cash payment for all due and undisputed claims arising from the business relationship.
6.4 The print service provider shall only be entitled to offset counterclaims and assert a right of retention if they have been legally established or are undisputed.
C. General provisions
The following provisions apply in their entirety to all services offered by AutLay, unless expressly stated otherwise below.
1. Other services
1.1 AutLay shall only provide additional consulting and implementation services if and insofar as expressly agreed between the parties. This includes, for example, customized onboarding to the AutLay campaign tool or AutLay SaaS, employee training and the activation of additional user access. The type, content and scope of the consulting and implementation services are defined individually by the parties in an offer.
1.2 Consulting and implementation services are generally provided from Monday to Friday between 9.00 a.m. and 6.00 p.m., excluding public holidays. If the customer or the print service provider wishes the services to be provided outside the aforementioned times, AutLay will comply with this request within the scope of its operational possibilities.
1.3 The provision of further consulting and implementation services is subject to payment of a fee, which is calculated according to the time spent on the basis of a daily rate. The amount of the daily rate and the billing modalities are set out in AutLay's individual offer. Material costs, travel costs and other expenses shall be remunerated separately in the amount actually incurred.
2. Contract term, termination
2.1 The contract for the provision of the AutLay print shop platform is concluded for an indefinite period. The customer can terminate the contract at any time by removing their user account.
2.2 If compatible with the type of service and unless otherwise agreed in individual contracts, the contract for the provision of consulting and implementation services may be terminated with six weeks' notice to the end of the month. Notice of termination must be given in writing.
2.3 The contract for the provision of the AutLay print shop platform with the customer is concluded for an indefinite period. The customer may terminate the contract at any time by removing his user account. AutLay may terminate the contract with a notice period of two (2) weeks to the end of the month.
2.4 The contract for the use of the AutLay print shop platform by a print service provider is concluded for an indefinite period. The respective notice period is determined individually by the package booked by the print service provider. The right of the parties to extraordinary termination without notice for good cause remains unaffected. The extraordinary termination must be in writing to be effective.
2.5 Access to the AutLay print shop platform is deactivated at the end of the contractual relationship between the user and AutLay.
3. Rights of use
3.1 Upon conclusion of the contract, AutLay grants the customer the non-exclusive, non-transferable, non-sublicensable right, limited in time to the term of the contract and unlimited in terms of location, to use the AutLay campaign tool to the extent specified in the contract.
3.2 The customer has no right to reproduce, decompile or make a backup copy of the software, unless this is permitted by law. The Customer is also not entitled to transfer the documentation or other accompanying materials to third parties without the prior consent of AutLay.
3.3 The customer shall grant AutLay the rights of use to the layouts created by it that are necessary for the performance of the services. This includes in particular the printing of the print mailings and the necessary forwarding of the layouts to the print service provider.
3.4 The customer warrants that all layouts created by it for the performance of the services (in particular the images and texts contained therein) are free from third-party property rights and that it is entitled to make these layouts available to AutLay for this purpose. The customer shall indemnify AutLay against all third-party claims arising from the use of the layouts created by the customer for the fulfillment of the contract.
3.5 The user grants AutLay an irrevocable, non-exclusive, free-of-charge right to use the posted content, unlimited in terms of territory, time and content, transferable to third parties, insofar as this is required by AutLay to provide the AutLay print shop platform. AutLay is entitled to use, edit and exploit the content at any time, including the right of reproduction, the right of distribution and the right of public reproduction, in particular the right of making available to the public.
4. Liability
4.1 AutLay shall have unlimited liability in the following cases:
-
for damages, reimbursement of expenses and compensation for value due to intentional or grossly negligent behavior on the part of AutLay, a legal representative or AutLay's vicarious agents,
-
for damages, reimbursement of expenses and compensation for value resulting from injury to life, limb or health caused by negligent conduct on the part of AutLay, a legal representative or a vicarious agent of AutLay,
-
to the extent of an expressly assumed guarantee,
-
in the event of liability under the Product Liability Act.
4.2 Furthermore, AutLay is liable for damages, reimbursement of expenses and compensation for value due to the breach of a cardinal obligation, i.e. an obligation which is essential for the fulfillment of the contract and on the observance of which the customer and print service provider may justifiably rely, by AutLay, its legal representatives or a vicarious agent, limited to the typically foreseeable damage.
4.3 Any further liability on the part of AutLay, its representatives and vicarious agents is excluded. Claims for loss of profit are excluded.
4.4 If AutLay is unable to perform the services or other obligations under this contract due to circumstances for which AutLay is not responsible, AutLay shall be released from its obligation to perform for the period during which the circumstance preventing performance of the services exists, as well as for a reasonable start-up period, without being obliged to pay compensation to the customer. The same applies if AutLay or its vicarious agents find it unreasonably difficult or temporarily impossible to fulfill their obligations due to unforeseeable circumstances for which they are not responsible, in particular severe weather, continuous rain, storms, droughts, floods, pandemics, official measures or significant operational disruptions. The same applies in the event of industrial action, such as strikes or similar, which affect AutLay or its vicarious agents. If the impeding circumstances last longer than 10 working days, both the customer and the print service provider and AutLay may withdraw from the contract without either party being able to assert any claims for damages against the other party as a result of the withdrawal. At the request of one party, the other party shall declare after expiry of the deadline whether it will exercise its right of termination or whether it insists on the provision of the service.
4.5 AutLay accepts no liability for faults within the Internet network for which AutLay is not responsible.
4.6 AutLay shall only be liable for the loss of data in accordance with the above provisions if such a loss could not have been avoided by appropriate data backup measures on the part of the user.
4.7 AutLay accepts no liability for the accessibility, existence or security of databases, websites or services of third parties that can be accessed via links or hyperlinks on the AutLay printing platform. Similarly, AutLay is not liable for the content of these databases or services, including their legality, accuracy, completeness or timeliness.
5. Data protection
5.1 The parties shall comply with the applicable data protection regulations.
5.2 AutLay and the parties each conclude the agreement on commissioned processing pursuant to Art. 28 GDPR attached as Annex 1.
6. Confidentiality
6.1 AutLay's servers are secured in accordance with the state of the art, in particular by firewalls and other IT security measures.
6.2 The parties are obliged to treat the Confidential Information of the other party as confidential and not to disclose it to third parties, unless this is expressly permitted or necessary for the fulfillment of the obligations and exercise of the rights arising from this contract. Each party may share the Confidential Information of the other party with its employees, agents or contractors, provided that they have a legitimate interest in knowing the Confidential Information and are themselves bound to confidentiality to a reasonable extent.
6.3 These confidentiality obligations do not apply to information that: (i) is or becomes publicly known through no fault of the receiving party; (ii) was known to the receiving party prior to receipt of the Confidential Information; (iii) was rightfully received by the receiving party from a third party without breach of any confidentiality obligation; or (iv) is developed by the receiving party without using the disclosing party's Confidential Information. A party may also disclose the other party's Confidential Information to the extent required by law or court order, provided that it notifies the other party in advance (to the extent permitted by law).
7. Reference and press release
7.1 Each party is entitled to publicize the conclusion of the contract and the contractual cooperation between the parties in any form or to advertise it through the use of the company name, trademarks and other protected signs (e.g. in reference lists) if the other party has expressly agreed to this in advance. Print shops may also advertise their cooperation with AutLay on the AutLay print shop platform without prior consent. AutLay's legitimate interests must be protected in the external presentation of AutLay.
7.2 Each party is entitled to issue a press release reporting in general terms on the conclusion of the agreement and the cooperation between the parties. The draft for a planned press release must be agreed between the parties in advance.
8. Final provisions
8.1 Amendments and supplements to these GTC must be made in writing. This also applies to the amendment, supplementation or revocation of this clause 8.1.
8.2 The place of performance is the registered office of AutLay.
8.3 The law of the Federal Republic of Germany shall apply to this contract. The application of the UN Convention on Contracts for the International Sale of Goods (CISG) is excluded.
8.4 The exclusive place of jurisdiction for disputes arising from or in connection with this contract is Cologne.
8.5 Should a provision of these GTC or a provision included herein in the future be wholly or partially invalid or unenforceable or lose its legal validity or enforceability at a later date, this shall not affect the validity of the remaining provisions of these GTC. The same shall apply if it should transpire that the GTC contain a loophole. In place of the invalid or unenforceable provisions or to fill the gap, an appropriate provision shall apply which, as far as legally possible, comes closest to what the parties intended or would have intended according to the meaning and purpose of the contractual cooperation if they had considered the point when concluding or subsequently including the provision in question.
Order processing contract i. s.d. Art. 28 para. 3 General Data Protection Regulation
(GDPR) + technical and organizational measures
Preamble
This annex specifies the obligations of the contracting parties with regard to data protection. It shall apply to all activities which are connected with the contract and in which employees of the contractor or persons commissioned by the contractor process personal data ("data") of the customer.
1. Subject matter, duration and specification of the commissioned processing
The subject and duration of the order as well as the type and purpose of the processing result from the contract. In particular, the following data are part of the data processing:
Type of data
Nature and purpose of data processing
Categories of affected persons
Data of the client's customers (esp. names, address data, prefe-rence data) required for the print mailing campaign
Order fulfillment
Customers of the client
Contact information of the
client's employees
Order fulfillment
Employees of the client
Billing address of the client (incl. contact)
Order invoicing
Employees of the client
The term of this annex shall be governed by the term of the contract unless the provisions of this annex impose obligations in excess thereof.
2. Scope and responsibility
2.1. The contractor shall process personal data on behalf of the client. This includes activities that are specified in the contract and in the service description. Within the scope of this contract, the client shall be solely responsible for compliance with the statutory provisions of the data protection laws, in particular for the lawfulness of the transfer of data to the contractor as well as for the lawfulness of the data processing ("controller" within the meaning of article 4 No. 7 GDPR).
2.2. The instructions shall initially be stipulated by the contract and may thereafter be amended, supplemented, or replaced by individual instructions (individual instructions) by the customer in writing or in an electronic format (text form) to the place designated by the contractor. Instructions not provided for in the contract shall be treated as a request for a change in performance. Verbal instructions shall be confirmed immediately in writing or in text form.
3. Obligations of the contractor
3.1. The contractor may only process data of data subjects within the scope of the order and the client's instructions, unless there is an exceptional case within the meaning of article 28 (3) a) of the GDPR. The contractor shall inform the client without undue delay if it is of the opinion that an instruction violates applicable laws. The contractor may suspend the implementation of the instruction until it has been confirmed or amended by the client.
3.2. The contractor shall organize the internal organization in its area of responsibility in such a way that it meets the special requirements of data protection. It shall take technical and organizational measures for the adequate protection of the customer's data that meet the requirements of the data protection regulation (Art. 32 GDPR). The contractor shall take technical and organizational measures to ensure the confidentiality, integrity, availability and resilience of the systems and services in connection with the processing on a permanent basis. The customer is aware of these technical and organizational measures and is responsible for ensuring that they provide an appropriate level of protection for the risks associated with the data to be processed.
These technical and organizational measures are listed in the attached appendix "Technical and Organizational Measures". The contractor reserves the right to change the security measures taken, however, it must be ensured that the contractually agreed level of protection is not undercut.
3.3. The contractor shall support the client - to the extent agreed - within the scope of its possibilities in fulfilling the requests and claims of data subjects pursuant to chapter III of the GDPR and in complying with the obligations set forth in articles 33 to 36 of the GDPR.
3.4. The contractor warrants that the employees involved in the processing of the client's data and other persons working for the contractor are prohibited from processing the data outside the scope of the instruction. Furthermore, the contractor warrants that the persons authorized to process the personal data have committed themselves to confidentiality or are subject to an appropriate statutory duty of confidentiality. The confidentiality/confidentiality obligation shall continue to exist even after termination of the order.
3.5. The contractor shall inform the client without delay if it becomes aware of any violations of the client's personal data protection.
The contractor shall take the necessary measures to secure the data and to mitigate possible adverse consequences for the persons concerned and shall consult with the client on this without delay.
3.6. The contractor shall inform the customer of the contact person for data protection issues arising within the scope of the contract.
3.7. The contractor shall ensure that it complies with its obligations under article 32 (1) d) of the GDPR to implement a procedure for the regular review of the effectiveness of the technical and organizational measures to ensure the security of the Processing.
3.8. The contractor shall correct or delete the contractual data if the client instructs it to do so and this is covered by the scope of the instructions. If deletion in compliance with data protection or a corresponding restriction of data processing is not possible, the contractor shall undertake the destruction of data carriers and other materials in compliance with data protection on the basis of an individual order by the customer or shall return these data carriers to the customer, unless already agreed in the contract.
In special cases to be determined by the client, storage or transfer shall take place. Protective measures for this are to be agreed separately, unless already agreed in the contract.
3.9. Data, data carriers and all other materials shall be either surrendered or deleted at the request of the client after the end of the order.
If additional costs are incurred due to deviating specifications for the return or deletion of the data, these shall be borne by the client.
3.10. In the event of a claim against the client by a data subject with regard to any claims pursuant to art. 82 of the GDPR, the contractor undertakes to support the client in defending the claim within the scope of its possibilities.
4. Obligations of the customer
4.1. The customer shall inform the contractor immediately and in full if it discovers errors or irregularities in the results of the order with regard to provisions of data protection law.
4.2. In the event of a claim against the client by a data subject with regard to any claims pursuant to art. 82 of the GDPR, section 3 (10) shall apply accordingly.
4.3. The customer shall inform the contractor of the contact person for data protection issues arising within the scope of the contract.
5. Requests from affected persons
If a data subject approaches the contractor with requests for correction, deletion or information, the contractor shall refer the data subject to the client, provided that an assignment to the client is possible according to the data subject's information. The contractor shall immediately forward the request of the data subject to the customer. The contractor shall support the client within the scope of its possibilities upon instruction to the extent agreed. The contractor shall not be liable if the request of the person concerned is not answered by the client, is not answered correctly, or is not answered in due time.
6. Verification possibilities
6.1. The contractor shall prove to the client compliance with the obligations set forth in this agreement by appropriate means.
6.2. If, in individual cases, inspections by the customer or an inspector commissioned by the customer are necessary, these shall be carried out during normal business hours without disrupting operations after notification and taking into account a reasonable lead time. The contractor may make such inspections dependent on prior notification with a reasonable lead time and on the signing of a confidentiality agreement with regard to the data of other customers and the technical and organizational measures implemented. If the auditor appointed by the customer is in a competitive relationship with the contractor, the contractor shall have a right of objection against him.
The customer agrees to the appointment of an independent external auditor by the contractor, provided that the contractor provides a copy of the audit report.
The expenditure of an inspection is generally limited to one day per calendar year for the contractor.
6.3. Should a data protection supervisory authority or another sovereign supervisory authority of the client carry out an inspection, paragraph 2 shall apply accordingly. It shall not be necessary to sign a confidentiality agreement if this supervisory authority is subject to a professional or statutory confidentiality obligation for which a violation is punishable under the German Criminal Code.
7. Subcontractors (other processors)
7.1. The processor shall inform the contractor prior to any intended change with regard to the use or replacement of a subcontractor. The contractor may object to the intended use or replacement of a subcontractor for good cause under data protection law. A subcontractor relationship subject to approval exists if the contractor commissions other contractors to perform all or part of the work agreed in the contract. The contractor shall conclude agreements with these third parties to the extent necessary to ensure appropriate data protection and information security measures.
The contractually agreed services or the partial services described below shall be performed with the involvement of the following subcontractors:
Name and address of the subcontractor
Description of partial services
DATEN_PARTNER
Gesellschaft für Direktmarketing und
Informations-Technologie mbH
Feldheider Str. 39 – 45
40699 Erkrath
Deutschland (EU)
Printing and shipping of personalized advertising materials
STRATO AG
Pascalstraße 10
10587 Berlin
Deutschland (EU)
The customer-specific advertising materials (including the above-mentioned customer data of the client) are calculated in data centers of STRATO AG.
QualityHosting AG
Uferweg 40-42
63571 Gelnhausen
Deutschland (EU)
Microsoft Ireland Operations Limited
Leopardstown, Dublin 18, D18 P521, Irland (EU)
Use of Microsoft Office 365:
-
Exchange
(communication with the client) -
Teams
(conference calls, web telephony) -
SharePoint, OneDrive (file storage and versioning)
SoftwareONE Deutschland GmbH
Blochstraße 1
04329 Leipzig
Deutschland (EU)
Leveraging Azure through SoftwareONE as an end-to-end software and cloud technology solution provider.
HubSpot, Inc.
25 1st Street
Cambridge
MA 0214
USA
Storage of the client's billing address for invoicing purposes
Before calling in further subcontractors or replacing listed subcontractors, the contractor shall obtain the consent of the client, which may not be refused without an important reason under data protection law.
7.2. If the contractor places orders with subcontractors, it shall be incumbent upon the contractor to transfer its obligations under data protection law from this agreement to the subcontractor.
8. Information obligations, written form clause, choice of law
8.1. If the customer's data at the contractor is endangered by attachment or seizure, by insolvency or composition proceedings or by other events or measures of third parties, the contractor shall inform the customer thereof without undue delay. The contractor shall immediately inform all persons responsible in this context that the sovereignty and ownership of the data lie exclusively with the client as the "responsible person" within the meaning of the general data protection regulation.
8.2. Amendments and supplements to this annex and all its components - including any assurances of the contractor - shall require a written agreement, which may also be in an electronic format (text form), and the express indication that it is an amendment or supplement to these terms and conditions. This shall also apply to the waiver of this formal requirement.
8.3. In the event of any contradictions, the provisions of this annex on data protection shall take precedence over the provisions of the agreement. Should individual parts of this annex be invalid, this shall not affect the validity of the rest of the annex.
8.4. German law shall apply.
9. Liability and compensation
The client and the contractor shall be liable vis-à-vis data subjects in accordance with the provision set out in article 82 of the GDPR.
10. Costs and expenses
10.1. Insofar as data protection obligations incumbent upon the client are fulfilled by the contractor on the client's instructions, the client shall remunerate these services.
10.2. The contractor may also demand reimbursement from the client for costs and expenses incurred for checks or inspections by the client, in particular costs for checks not related to the cause. The above provision in sentence 1 shall not apply to inspections carried out by the client in the course of fulfilling its statutory inspection obligations.
10.3. The amount of the remuneration and the settlement modalities result from the price list sent with the offer.
TECHNICAL AND ORGANIZATIONAL MEASURES
In case of differences between the German and English version of this Agreement, only the German version shall be decisive and applicable.
1. Introduction
1.1. Responsible
The responsible party pursuant to article 4 (7) of the EU General Data Protection Regulation (GDPR) is AutLay - Automatisches Layout GmbH, Unter Käster 14-16, 50667 Cologne, Germany, e-mail: mail@autlay.com. We are legally represented by Dr. David Schölgens, Sven Müller.
1.2. Data protection officer
Our data protection officer is heyData GmbH, Schützenstraße. 5, 10117 Berlin, www.heydata.eu, e-mail: datenschutz@heydata.eu.
1.3. Subject of the document
This document summarizes the technical and organizational measures taken by the controller within the meaning of article 32 (1) of the GDPR. These are measures with which the controller protects personal data. The purpose of the document is to support the controller in fulfilling its accountability obligations under article 5 (2) of the GDPR.
2. Confidentiality (Art. 32 para. 1 lit. b GDPR)
2.1. Entry control
The following implemented measures prevent unauthorized persons from gaining access to the data processing facilities:
-
Manual locking system (e.g., key)
-
Security locks
-
Key regulation / key book
-
Careful selection of cleaning personnel.
2.2. Access control
The following implemented measures prevent unauthorized persons from accessing the data processing systems:
-
Authentication with user and password
-
Authentication with biometric data
-
Use of mobile device management
-
Encryption of data carriers
-
Encryption of notebooks / tablets
-
Management of user authorizations
-
Creation of user profiles
-
Central password rules
-
Use of 2-factor authentication
-
Key regulation / key book
2.3. Control of data retrieval
The following implemented measures ensure that unauthorized persons do not have access to personal data:
-
Use of document shredders (with cross cut function).
-
Logging of accesses to applications (especially when entering, changing, and deleting data)
-
Use of an authorization concept
-
Number of administrators is kept as small as possible
-
Management of user rights by system administrators.
2.4. Separation control
The following measures ensure that personal data collected for different purposes are processed separately:
-
Separation of productive and test system
-
Logical client separation (on the software side)
-
Creation of an authorization concept
-
Definition of database rights
3. Integrity (Art. 32 para. 1 lit. b GDPR)
3.1. Transfer control
It is ensured that personal data cannot be read, copied, changed or removed without authorization during transfer or storage on data carriers and that it is possible to check which persons or bodies have received personal data. The following measures have been implemented to ensure this:
-
WLAN encryption (WPA2 with strong password)
3.2. Input control
The following measures ensure that it is possible to check who has processed personal data in data processing systems and at what time:
-
Logging of the entry, modification, and deletion of data
-
Traceability of data entry, modification, and deletion through individual usernames (not user groups)
-
Allocation of rights for entering, changing, and deleting data based on an authorization concept.
4. Availability and resilience (Art. 32 para. 1 lit. b GDPR)
The following measures ensure that personal data is protected against accidental destruction or loss and is always available to the client:
-
Hosting (at least of the most important data) with a professional hoster
5. Procedures for regular review, assessment, and evaluation (Art. 32(1)(d) GDPR; Art. 25(1) GDPR)
5.1. Data protection management
The following measures are intended to ensure that an organization that meets the basic requirements of data protection law is in place:
-
Use of the heyData platform for data protection management
-
Designation of the data protection officer heyData
-
Obligation of employees to maintain data secrecy
-
Regular training of employees in data protection
-
Maintaining an overview of processing activities (Art. 30 GDPR).
5.2. Incident-Response-Management
The following measures are intended to ensure that notification processes are triggered in the event of data protection breaches:
-
Notification process for data protection breaches pursuant to Art. 4 No. 12 GDPR towards supervisory authorities (Art. 33 GDPR)
-
Notification process for data protection breaches pursuant to Art. 4 No. 12 of the GDPR towards the data subjects (Art. 34 of the GDPR)
-
Involvement of the data protection officer in security incidents and data breaches
5.3. Privacy-friendly default settings (Art. 25 (2) GDPR)
The following implemented measures consider the requirements of the "Privacy by de-sign" and "Privacy by default" principles:
-
Training of employees in "Privacy by design" and "Privacy by default".
-
No more personal data is collected than is necessary for the respective purpose.
5.4. Order control
The following measures ensure that personal data can only be processed in accordance with instructions:
-
Written instructions to the contractor or instructions in text form (e.g., by order processing contract).
-
Ensuring the destruction of data after completion of the order, e.g., by requesting corresponding confirmations.
-
Confirmation by contractors that they obligate their own employees to maintain data secrecy (typically in the order processing contract)
-
Careful selection of contractors (especially regarding data security).