TERMS.

The contracting party is TOMORIS GmbH, Saturnstraße 1, 4614 Marchtrenk, Austria, registered in the company register of the Regional Court of Wels under FN 547810d, VAT ID ATU76333317, phone +43 7243 53091, email contact@tomoris.com (“TOMORIS”, “we”). Further details are in the legal notice.

These General Terms and Conditions (“Terms”) apply to all contracts for services and deliveries by TOMORIS, in particular IT operations and managed services (GRID), projects, consulting and services (EXPERTS), training and courses (UNIVERSITY), software, apps and cloud services (NEXT, GRID modules and all other TOMORIS products), the delivery of hardware and the brokerage or sale of third-party licenses. They also apply to free services such as trial periods, free editions and check tools, unless stated otherwise there.

Our offering is directed exclusively at businesses within the meaning of Section 1 of the Austrian Consumer Protection Act (KSchG) and Section 1 of the Austrian Commercial Code (UGB) and at legal entities under public law (“customer”, “you”). We do not enter into contracts with consumers. By ordering, registering or accepting a quote, the customer confirms that it is acting as a business.

Deviating or supplementary terms of the customer, such as purchasing terms, do not become part of the contract, even if we do not object to them or perform in knowledge of them. They only apply if we expressly agree to them in text form.

The following order of precedence applies: (a) an individual quote confirmed by us, a separate contract, a service schedule or a service level agreement (SLA); (b) the product terms of a product, where the product directory lists any, and the associated data processing agreement; (c) the special terms by type of service in Part B; (d) the general provisions in Part A and the general data processing agreement in Part C; (e) the service description valid at the time the contract is concluded and the price list at tomoris.com/preise. For third-party products and licenses, their terms apply in addition (Section 5).

Quote: an individual quote prepared by TOMORIS in text form, including a quote from Microsoft Dynamics 365 Business Central or in a product’s customer portal.

Service schedule: the description of the scope, modules, quantities and, where applicable, service levels of an ongoing service, such as a GRID contract.

Subscription: a paid contract for software or a cloud service with a fixed term (such as one month or one year) that renews automatically unless cancelled.

One-off purchase: a contract for a one-off fee without automatic renewal, such as a pass, a setup or a perpetual purchase (lifetime).

Customer portal: the area of a product or of TOMORIS in which the customer signs in and manages orders, subscriptions, invoices and settings; this includes the customer portal of the payment service provider Stripe.

Text form: a legible declaration on a durable medium, in particular email.

Working days: Monday to Friday, excluding public holidays in Austria and 24 and 31 December.

The presentation of services, products and prices on our websites is not a binding offer but an invitation to submit an offer.

Online purchase. The customer selects the product, plan and quantity, enters company, country, VAT ID and billing email, accepts these Terms and, where the product processes personal data on its behalf, the data processing agreement, and is forwarded to the payment service provider Stripe. By completing payment, the customer submits a binding offer, which we accept by activating the service in the product or by confirmation by email, whichever occurs first. Online purchases are currently only open to customers based in Austria.

Order in the customer portal or on invoice. By submitting, the customer makes a binding offer. The contract is concluded when we approve the order or confirm it in text form. We may reject an order within ten working days without giving reasons.

Quote. For projects, IT operations, group training, hardware, licenses, larger quantities, customers outside Austria and public-sector customers, we prepare a quote. It is valid for 30 days unless it states otherwise. The contract is concluded when the quote is accepted in text form or signed; if we begin the service earlier at the customer’s request, the quote is deemed accepted together with these Terms.

Trial period and free use. For trial periods, free editions and check tools, a free usage contract is concluded as soon as the customer activates the service, installs the software or uses the tool. Whether and how a trial period turns into a subscription is stated in the ordering process and in the product directory.

Before submitting, the customer can review and correct its entries. The customer receives confirmation of receipt of its order by email or in the customer portal. The contract language is German.

We store the content of the contract (product, plan, quantity, price, company details) as well as the version of the accepted Terms and data processing agreement and the time of consent. Every version of these Terms can be retrieved, printed and saved with its version number; we will send earlier versions on request.

The scope of our services results from the quote, the service schedule or the service description valid at the time the contract is concluded. Features marked as “planned”, “in progress” or “preview” are announced but not owed.

We provide our services in accordance with the state of the art and with the diligence of a prudent businessperson. We only owe a specific economic result if this has been expressly agreed. No one can guarantee absolute security against attacks, malware or outages; we do not owe it.

The customer cooperates as far as necessary for the service: it appoints a contact person with decision-making authority, provides access, information, premises and rights in good time, makes decisions without delay and informs us of circumstances that may affect the service. Delays and additional effort resulting from a lack of cooperation are borne by the customer; agreed dates are postponed accordingly.

The customer is responsible for the lawfulness of the content and data it hands over to us or processes in our services, and for being authorized for the systems on which we work for it.

Data backup. Unless data backup is expressly part of our service, the customer backs up its data regularly and in a manner appropriate to the risk, in particular before changes, migrations and updates.

The customer keeps access credentials secret. If it notices misuse of its account or license, it informs us without delay.

We may use subcontractors. We remain responsible for their services as for our own. Part C applies to sub-processors of personal data.

Where we supply or broker third-party software, cloud services or licenses, for example from Microsoft, the manufacturer’s terms also apply to their use, in particular the Microsoft Customer Agreement. Where necessary, the customer concludes these terms directly with the manufacturer. We are not responsible for the content, availability and changes of the manufacturer’s services; we pass warranty claims on to the manufacturer or assign them to the customer.

Changes to the scope of services are agreed in text form. We only perform services outside the agreed scope after the customer has approved them and charge them at the agreed hourly rate or, if none has been agreed, at the hourly rate stated in the quote or price list.

The price according to the price list at tomoris.com/preise at the time of the order, or according to the accepted quote, applies. All prices are net prices in euros plus statutory VAT. Businesses based in another EU member state with a valid VAT ID receive an invoice without Austrian VAT (reverse charge).

Subscriptions are billed in advance for the respective term, one-off purchases with the order or activation, and ongoing services such as GRID monthly in advance. Projects, consulting and services charged by effort are billed monthly according to the hours worked, fixed prices according to the payment schedule agreed in the quote; travel time and expenses according to the quote.

For online purchases, the customer pays via the payment service provider Stripe, for example by credit card or SEPA direct debit; Stripe collects subsequent amounts on renewal. Customers receive invoices by email; the customer agrees to electronic invoices. Invoices are due without deduction within 14 days of the invoice date, unless the quote states otherwise.

The customer raises objections to an invoice in text form within 30 days of receipt; thereafter the invoice is deemed accepted. We point this out on the invoice. The customer’s statutory claims in the case of justified objections remain unaffected.

In the event of late payment, the statutory default interest for business transactions (Section 456 UGB) and the flat-rate amount under Section 458 UGB apply; the customer reimburses appropriate costs of collection, in particular dunning and debt collection costs. If a due payment has not been received despite a reminder with a 14-day deadline, we may suspend the affected service after notice until payment is made. We do not delete the customer’s data for this reason.

The customer may only set off undisputed claims or claims established by final judgment. It only has a right of retention on account of claims arising from the same contractual relationship.

Price changes for subscriptions only apply to future terms. We announce them in text form at least six weeks before renewal. If the customer does not agree, it may cancel the subscription at the end of the current term; until then the previous price applies.

If indexation has been agreed in a quote or service schedule, the fees change after the first term, and annually thereafter, in proportion to the Consumer Price Index 2020 published by Statistics Austria or the index replacing it. The base is the index value of the month in which the contract was concluded. The adjustment works in both directions; we notify it with the invoice or beforehand in text form.

We do not change fixed agreed prices, for example for a first term or as an introductory price, during the agreed period.

A subscription begins when the contract is concluded or on the activation stated in the ordering process. Its term (such as one month or one year) is stated in the ordering process; it renews for the same period unless the subscription is cancelled by the last day of the current term.

The customer may cancel a subscription at any time without giving reasons at the end of the current term, in the customer portal or in text form to contact@tomoris.com. Cancellation ends the next renewal; access remains until the end of the paid term. We confirm the cancellation in text form.

Ongoing services with a service schedule, such as GRID, run for the first term agreed in the quote and then renew for twelve months at a time unless either party cancels in text form three months before expiry; the quote may provide otherwise.

We may terminate a subscription or ongoing service with three months’ notice to the end of a term.

The right of both parties to terminate for good cause remains unaffected. Good cause for us exists in particular if the customer remains in default of a material payment despite a reminder with a 14-day deadline, or uses a service abusively or unlawfully. If the customer terminates for good cause for which we are responsible, we refund prepaid fees for the remaining term on a pro rata basis. Otherwise, we do not refund fees for partially used terms upon termination.

Trial periods, passes and other time-limited services end when their period expires without the need for cancellation, unless stated otherwise in the ordering process.

At the end of the contract, at the customer’s request, we hand over documentation, access credentials and configurations that we managed for it in an orderly manner and support a transition; we charge for this effort by time spent unless it is included in the contract. The customer can export its data in our services until the end of the contract; its deletion is governed by Part C and the product terms.

Where we owe a result (work), we report completion in text form. The customer tests the work within 14 days and declares acceptance or notifies us of the material defects in text form. Immaterial defects do not prevent acceptance; we remedy them under the warranty.

The work is deemed accepted if the customer does not report any material defects within the deadline or uses it productively. We point this out in the completion notice.

We may submit self-contained parts for acceptance separately.

We warrant that our services have the agreed characteristics. Insignificant deviations are not a defect. The customer is aware that, according to the state of the art, software cannot be created completely free of errors.

The customer reports defects in text form without delay after discovery, with a comprehensible description. We remedy reported defects at our discretion by improvement, replacement, an update or a reasonable workaround within a reasonable period. If this also fails at the second attempt or is unreasonable for the customer, the customer may reduce the fee appropriately or, in the case of defects that are not merely minor, withdraw from the contract or terminate a subscription for good cause.

The warranty period is twelve months from handover or acceptance. For subscriptions, the warranty applies for the duration of the term. The presumption of defectiveness under Section 924 of the Austrian Civil Code (ABGB) is excluded. Section 924 ABGB does not apply to hardware either; manufacturer guarantees remain unaffected. Otherwise, Sections 922 et seq. ABGB apply to the extent that they are not excluded for business transactions.

There is no defect if the error is due to use contrary to the documentation or these Terms, to changes by the customer or third parties, to unsupported systems, to third-party products or to a lack of cooperation by the customer.

We provide trial periods, free editions, check tools and preview versions free of charge and as they are. We assume no warranty for them, except for defects we have fraudulently concealed.

We are liable without limitation for damage caused by intent and gross negligence, for damage resulting from injury to life, body or health, under the Product Liability Act, under an expressly assumed guarantee and in other cases of mandatory statutory liability, in particular under Art. 82 GDPR.

We are not liable for slight negligence, except in the case of personal injury.

Insofar as we are liable beyond paragraph 1, our liability is limited to the damage typically foreseeable under the contract, excludes lost profit, indirect damage, consequential damage and third-party claims, and is limited in total per contract year to the fee paid by the customer for the affected service in the twelve months before the damaging event (for one-off purchases and projects, the fee for the affected service).

Data loss. Except in the case of intent, we are liable for the loss or alteration of data only to the extent of the restoration effort that would have been incurred with proper data backup by the customer appropriate to the risk (Section 4(5)). This does not apply where data backup is expressly part of our service.

Claims for damages become time-barred twelve months after knowledge of the damage and the party causing it, and at the latest three years after the damaging event, unless paragraph 1 applies.

For free services, we are only liable under paragraph 1. The liability rules also apply to our employees, representatives and vicarious agents.

Neither party is liable for non-performance or delayed performance to the extent that it is due to circumstances beyond its reasonable control, such as natural events, pandemics, war, official orders, strikes, widespread failures of power supply, the internet or third-party data centers, and disruptions or changes at Microsoft, Cloudflare or other providers whose services the customer or the service requires. Deadlines are extended by the duration of the event and a reasonable start-up period.

If such an event lasts longer than two months, either party may terminate the affected contract in text form. We refund prepaid fees for services not provided on a pro rata basis.

Insofar as we process personal data on behalf of the customer under a contract, the data processing agreement under Art. 28 GDPR applies. This is the product’s data processing agreement, where the product directory lists one, otherwise the general data processing agreement in Part C. It forms part of every contract that includes such processing.

For the customer account, contract handling, quotes, invoices and payments, we process personal data as controller. Details are in the privacy policy and in the privacy information of the respective product. Payments via Stripe are processed by Stripe Payments Europe, Limited as an independent controller.

Both parties treat non-public information of the other party that is marked as confidential or is recognizably confidential (in particular details of the IT environment, access credentials, security findings and prices from quotes) as confidential and only use it to perform the contract. They oblige their employees and subcontractors accordingly.

This does not apply to information that is or becomes publicly known without the receiving party being responsible for this, that was already known to it, that it lawfully received from third parties or that it must disclose due to a legal or official obligation.

The obligation applies during the contract and for three years after its end, and without time limit for access credentials and security findings.

All rights to our software, documentation, templates, tools and the trademarks “TOMORIS”, “GRID”, “NEXT”, “EXPERTS”, “UNIVERSITY” and the product names remain with TOMORIS, unless we expressly grant the customer rights of use.

For software and cloud services, the customer receives, for the duration of the contract, the non-exclusive, non-transferable and non-sublicensable right to use them to the agreed extent for its own purposes. The customer may not make them available to third parties, offer them as a service to third parties or reverse engineer them, unless the law (Sections 40d and 40e of the Austrian Copyright Act) mandatorily permits this.

For results we create specifically for the customer (such as concepts, documentation, configurations, scripts and custom software), the customer receives, upon full payment, a non-exclusive, perpetual and transferable right to use them for its own purposes. We may continue to use our general know-how and reusable building blocks without disclosing confidential information of the customer.

Reports, exports and analyses that the customer creates with our products about its own data belong to the customer, including after the end of the contract.

We only name the customer as a reference with its prior consent.

We only carry out security tests such as penetration tests, vulnerability scans, phishing simulations or tests of security controls after the customer’s written approval stating scope, period and target systems. The customer warrants that it is entitled to control the approved systems or has obtained the consent of their operators, such as hosting or cloud providers, and indemnifies us against third-party claims arising from a lack of authorization.

Tests and monitoring may trigger alerts in security products or put load on systems. The customer informs its security team and service providers in advance. Such alerts or blocks are not a defect.

Findings, assessments, scores and recommendations are based on the information available at the time of the test. They are a technical aid, not a legal, audit or certification service, and guarantee neither completeness nor a particular state of security.

The customer complies with the applicable export control and sanctions regulations, in particular those of the European Union and Austria. It does not use our services in countries, for persons or for purposes for which this is prohibited, and does not pass them on there.

The customer warrants that neither it nor its owners or managing directors are on a sanctions list of the EU, the United Nations or Austria. If this is the case or if the customer breaches paragraph 1, we may refuse performance and terminate the contract for good cause.

We may change these Terms for the future, for example due to new services or products, or changes in the law or case law. Each version bears a version number and a date and can be retrieved at tomoris.com/terms.

We notify changes for ongoing subscriptions and ongoing services in text form to the billing email or the customer administrators at least six weeks before they take effect; the notice states the changes. They take effect at the earliest with the next renewal. If the customer does not object in text form before that time, the new version applies from the renewal; we point this out in the notice. If it objects, the contract ends at the end of the current term, and the previous version applies until then.

New orders, quotes, trial periods and renewals after the effective date are subject to the new version. The version the customer has accepted is stored with the order.

Austrian law applies, excluding the conflict-of-law rules of private international law and the UN Convention on Contracts for the International Sale of Goods (CISG).

The place of jurisdiction for all disputes arising from or in connection with a contract with TOMORIS is the court in Wels that has subject-matter jurisdiction for the registered office of TOMORIS GmbH (4614 Marchtrenk). We may also sue the customer at its general place of jurisdiction.

Declarations under these Terms may be made in text form, in particular by email, unless expressly stated otherwise. There are no oral side agreements.

The customer may only transfer rights and obligations under the contract to third parties with our consent in text form; we will not refuse consent without objective reason in the case of a business transfer or reorganization of the customer. We may transfer the contract to a legal successor as part of a reorganization or transfer of our business.

If a provision of these Terms is wholly or partly invalid, the remaining provisions remain valid. The invalid provision is replaced by a valid provision that comes closest to its economic purpose.

The contract language is German. We provide an English translation for information; in the event of discrepancies, only the German version applies.

We provide cloud services over the internet and operate them on our own servers in Austria or with the providers named in the data processing agreement. We supply installable software for download. The customer ensures the technical requirements according to the service description, such as a Microsoft 365 tenant and the necessary consents.

We strive for high availability. Excluded are announced maintenance, which we carry out outside normal business hours where possible, and disruptions beyond our control (Section 12). Binding availability, response or resolution times only apply with a separate agreement (SLA).

We provide support by email to contact@tomoris.com or via the channel stated in the product, in German (in English on request), on working days from 8 am to 5 pm Austrian time. We aim to give a first response within two working days, and within one working day for disruptions that prevent productive use or for security questions. These times are targets without guarantee. There is no entitlement to support for trial periods and free editions.

We continue to develop our products and may change them where this is reasonable for the customer. We do not restrict essential functions of a paid plan during a current term. If we nevertheless have to do so for legal or security reasons, the customer may terminate the subscription for good cause and receives a pro rata refund of prepaid fees for the remaining term.

Subscriptions, plans, terms, trial periods and quantities (such as per mailbox, house, resource or repository) result from the ordering process and the price list. If the customer increases the quantity during the term, the difference is charged pro rata for the remaining term; a reduction takes effect from the next renewal.

One-off purchases and perpetual purchases (lifetime) do not renew and do not need to be cancelled. A perpetual purchase entitles the customer to use the service for as long as we operate it; what applies to this is set out in the product terms.

If we discontinue a service altogether, we announce this in text form at least twelve months in advance. We refund fees already paid for the period after discontinuation on a pro rata basis.

Misuse, such as attacks on the service, circumventing license or quantity limits or unlawful content, is prohibited. In the event of a material breach, we may block access after notice, and immediately if there is a danger to the service or third parties.

Scope, modules, managed devices, users and locations as well as any service levels result from the service schedule. Service levels only apply if they are expressly agreed there or in an SLA; they begin when the report is received via the agreed channel within the agreed service hours.

The monthly fee is charged on the first day of each month for the current month, unless the quote provides otherwise. If quantities change permanently, we adjust the service schedule in consultation with the customer.

We only perform services outside the service schedule after the customer’s approval and charge them at the agreed hourly rate.

The customer grants us the access and permissions required for operations and does not withdraw them without consultation. The customer coordinates interventions by itself or third parties in the managed systems with us; the consequences of uncoordinated interventions are not covered by our services.

Insofar as data backup is part of the service schedule, we owe the agreed backup and restoration, not the integrity of data that was already damaged before the backup.

We charge services provided by time spent according to the hours actually worked in units of 15 minutes at the hourly rate in the quote, with a record of activities. Estimates in the quote are non-binding; if it becomes apparent that they will be exceeded by more than 15%, we inform the customer in advance.

Fixed prices apply to the scope described in the quote. We charge additional effort resulting from changes or a lack of cooperation by time spent in accordance with Section 5(3).

Dates and deadlines are only binding if they are expressly agreed as binding. We may charge on-site appointments cancelled by the customer at short notice, less than two working days in advance, with the planned effort, up to a maximum of half a day.

For work affecting productive operations, such as migrations, updates or changeovers, we agree the maintenance window with the customer. The customer ensures that a current data backup is available beforehand (Section 4(5)).

Delivered hardware remains our property until paid for in full. The risk passes upon handover to the customer or, in the case of shipping, upon handover to the carrier. The customer inspects the delivery without delay and reports visible defects and transport damage in text form within seven days (Sections 377 et seq. UGB).

The manufacturer’s warranty terms also apply to hardware. We support the customer in processing; the manufacturer provides warranty services.

Third-party licenses and subscriptions, in particular Microsoft 365, Microsoft Azure and other cloud subscriptions, are governed by the manufacturer’s terms with regard to term, renewal, change, cancellation and price. Annual and multi-year commitments of the manufacturer cannot be cancelled or reduced early, even if billed monthly. We pass on the manufacturer’s price changes when they take effect.

The customer is responsible for only using licenses to the permitted extent. We provide licensing advice to the best of our knowledge on the basis of the customer’s information and the manufacturer’s rules valid at the time of the advice.

The content, duration, location or online delivery and price of a training course result from the course description or the quote. Online courses and learning paths are available for the booked period; a subscription for them can be cancelled in accordance with Section 8.

The customer may name a substitute for a registered person at any time free of charge. If the customer cancels a course with a fixed date up to 14 days before the start, it is free of charge; after that we charge 50%, and from three working days before the start or in the event of non-attendance 100% of the fee, unless the quote provides otherwise.

We may postpone or cancel a course for good cause, such as illness of the trainer or too few registrations. We then refund fees already paid in full or, on request, credit them to another date; there are no further claims, except under Section 11(1).

Participants may use course materials for their own purposes, but may not copy, publish or use them for their own training courses. Manufacturer exams and certifications, for example from Microsoft, are subject to their terms; we do not owe success in an exam.

This agreement applies between the customer as controller and TOMORIS GmbH as processor for any processing of personal data that TOMORIS carries out on behalf of the customer under a contract governed by these Terms.

The subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects result from the main contract (quote, service schedule, service description). Typical are directory, contact and user data, log and device data, and content that TOMORIS must access during operations, troubleshooting or a migration, of employees, customers and business partners of the customer.

The agreement applies for the duration of the main contract and thereafter until the data has been returned or deleted in accordance with Section 30.

TOMORIS processes the data only on documented instructions from the customer, including with regard to transfers to a third country, unless TOMORIS is required to do so by Union law or Austrian law; in such a case, TOMORIS informs the customer of that legal requirement before processing, unless that law prohibits such information (Art. 28(3)(a) GDPR).

Instructions are this agreement, the main contract, the customer’s settings in our services and further instructions in text form to contact@tomoris.com. If TOMORIS considers that an instruction infringes data protection law, TOMORIS informs the customer without delay and may suspend execution until clarified.

TOMORIS ensures that persons authorized to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (point (b)).

TOMORIS takes all technical and organizational measures required under Art. 32 GDPR (point (c)), in particular: access only for named authorized persons with personal sign-in and multi-factor authentication on the principle of least privilege; encrypted transmission; separation of the data of different customers; logging of administrative access; regular security updates; backup of its own systems; a process for regularly testing the effectiveness of the measures.

The measures may be adapted to technical progress as long as the level of protection does not decrease. The customer receives a current description of the measures for its services on request.

The customer gives general authorization for the use of further processors (sub-processors). The sub-processors used when the contract is concluded are named in the main contract, the service description or the product’s privacy information; the customer receives the list on request. TOMORIS imposes the same data protection obligations on them (Art. 28(4) GDPR) (point (d)).

If TOMORIS intends to add or replace a sub-processor, TOMORIS informs the customer in text form at least 30 days in advance. The customer may object for an important reason under data protection law (Art. 28(2) GDPR). If it objects and the parties do not find a solution, it may terminate the affected contract for good cause.

Microsoft, as the provider of the customer’s Microsoft 365 tenant, is not a sub-processor of TOMORIS; this processing is governed by the customer’s contract with Microsoft.

Transfers to third countries outside the EEA only take place if the requirements of Art. 44 et seq. GDPR are met, for example by an adequacy decision such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses of the European Commission.

Taking into account the nature of the processing, TOMORIS assists the customer by appropriate technical and organizational measures, insofar as this is possible, in responding to requests from data subjects under Art. 12 to 23 GDPR (point (e)). TOMORIS forwards requests it receives to the customer without delay.

TOMORIS assists the customer in complying with the obligations under Art. 32 to 36 GDPR, taking into account the nature of the processing and the information available (point (f)).

TOMORIS notifies the customer of a personal data breach without undue delay, at the latest 48 hours after becoming aware of it, with the information under Art. 33(3) GDPR insofar as known, and takes the necessary containment measures. Product terms may provide for a shorter period.

TOMORIS may charge by time spent for assistance that is not based on a breach by TOMORIS and goes beyond the usual.

After the end of the services, TOMORIS returns or deletes all personal data at the customer’s choice, unless Union law or Austrian law requires storage (point (g)). If the customer does not make a choice, TOMORIS deletes the data no later than 90 days after the end of the contract; product terms may provide for other periods.

Copies in backups are overwritten as part of the usual rotation and are no longer used until then.

TOMORIS makes available to the customer all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and allows for and contributes to audits, including inspections, by the customer or an auditor mandated by it who is bound to confidentiality (point (h)).

An audit is possible once a year and is announced at least 30 days in advance, and at short notice in the event of a personal data breach or by order of a supervisory authority. It takes place during business hours, without disproportionately disrupting operations and without access to other customers’ data. The customer bears its costs.

TOMORIS has not appointed a data protection officer as long as there is no obligation to do so. Please send data protection enquiries to contact@tomoris.com.

Art. 82 GDPR applies to liability; otherwise Section 11 of these Terms applies.

In the event of conflicts between this agreement and other parts of the agreement, the provisions of this agreement take precedence on data protection matters. A product’s data processing agreement or a separately signed data processing agreement takes precedence over this agreement.