General Terms and Conditions

1. Scope of application

The following GTC apply to all contracts between ACM Consultants GmbH (‘ACM’) and a customer (‘Client’) - hereinafter jointly referred to as the ‘Parties’ - unless otherwise expressly agreed in writing or prescribed by law.

The inclusion of the Client's General Terms and Conditions is hereby rejected.

2. Definitions of terms

ACM Consultants GmbH is part of -DIE TOP BERATER-, a group of companies which also includes the following companies:

• msa-b GmbH
• SUMECO GmbH
• DTB Service GmbH

Services:

• Organisation and management consulting
• Management system consulting
• Audit services
• Project and process management
• Training services
• Maintenance services
• Appointment of an information security officer
• Managed security services
• Penetration testing and vulnerability analysis
• other services of a similar nature related to those listed.

Certification standards: Are all standards according to which a recognised certification is possible.

Work results: all consulting services, communications, reports, protocols, information, documents, data or other content that ACM makes available to the client in fulfilment of its service.

Daily work: A daily work is 8 hours and is performed by one person at a time.

3. Conclusion of contract

A service contract is concluded by the acceptance of an offer.

ACM's service description to the client does not constitute a binding offer. The client submits an offer to ACM with his declaration of confirmation of ACM's service description, unless otherwise stated.

ACM may accept the Client's offer within 10 working days,

• by sending the client a written confirmation or a confirmation in text form (fax or e-mail), or
• by commencing the service with the client.

Delayed acceptance shall be deemed to be a new offer, which can be accepted within 10 working days.

4. Subject matter of the contract, provision of services

a. The object of the contract is the agreed service (activity), not a specific economic success.

b. ACM does not provide legal advice. In the event of legal questions, we refer you to a specialised lawyer or tax consultant.
Compliance with legal obligations, deadlines and dates is the sole responsibility of the client.
There is no obligation to provide information or advice in this regard.

c. The services are provided by ACM with reasonable care and to the best of its knowledge and belief.

d. ACM shall, at its discretion, deploy qualified employees to fulfil the contract.

e. ACM may use the services of another company of -DIE TOP BERATER- or a third party (each a ‘Service Provider’) to fulfil the contract. No contractual relationship shall arise between the service provider and the client as a result of the provision of services by the service provider. ACM shall remain responsible to the client for the proper fulfilment of the contractual services.

f. If a specific number of days' work has been agreed, this must be accepted by the client.

5. Time and place of performance

ACM is free to choose the time and place of performance; the service can also be performed in mobile teleworking, unless the parties agree otherwise.

If it is necessary to visit the client's premises in order to provide the service, the parties must agree on a time and date for this; the provisions in sections 6 and 7 apply.

6 Obligations of the client

The client is obliged to co-operate insofar as this is necessary for the proper performance of the activity:

a. The client shall agree on dates with ACM in good time and cancel appointments in good time:

• Cancellations up to 10 working days before the start of the respective activity, will be charged at 50% of the fee amount.
• Cancellations between 5 working days and the start of the respective activity will be charged at 100% of the fee.

b. The Client must provide ACM with all documents and information necessary and required for the fulfilment of the contract in full and in good time without being requested to do so. The documents are to be handed over in good time so that ACM still has a reasonable amount of time to process them. The same applies to informing ACM of all processes and circumstances that may be of significance for the fulfilment of the contract.

c. The client must take note of all written, verbal or electronically transmitted communications from ACM. In principle, ACM is free to choose the method of transmission. If the client has any questions about the messages or is unable to understand their relevance, he must consult ACM immediately.

d. The client will only make the results of ACM's work accessible to third parties with written consent, unless this consent already results from the content of the contract. Even a minor modification of the work results by the client requires the consent of ACM for disclosure to third parties.

e. The Client undertakes to comply with the statutory provisions of data protection, in particular the GDPR, and will also oblige its employees to comply with data protection. If special circumstances within the scope of the cooperation require further agreements in accordance with the GDPR, the client shall regulate these on an ad hoc basis.

f. In particular, the Client shall create, free of charge, all the conditions in its sphere of operations that are necessary for the proper fulfilment of the contract.

Waiting times of ACM at the client's premises are deemed to be working hours.

These prerequisites include, among other things

• that the client provides sufficient working space for ACM's employees, including all necessary work equipment, as required;
• that the Client appoints a contact person who is available to ACM's employees during the agreed performance time, whereby the contact person is authorised to make statements which are necessary as interim decisions in the context of the continuation of the contract. If the contact person is unavailable, the client must provide a suitable replacement.

g. ACM's services do not release the client from his responsibility to implement and check the requirements of certification standards and all legal and official obligations and the client must ensure this independently.

h. The client is obliged to inform ACM immediately of any changes to his communication data and, at ACM's request, to reconfirm the current accuracy within 14 days of receipt.
This includes in particular changes to

• name/company
• managing director/board of directors
• postal address
• e-mail address and telephone

i. The obligations under section 6 d., e., g. shall continue to apply after termination of the contract, to the extent permitted by law.

7. Obligations of the client with regard to penetration tests and vulnerability analyses and general activities on the client's IT system (test)

a. By concluding the contract, the customer confirms that the test will or should be carried out on the customer's own system. If the test is not carried out on the customer's own system, the customer confirms by using the services that he has the full and unrestricted right to carry out the test on the specified system. At the request of ACM, the customer must prove that he has the unrestricted right to commission ACM to carry out the test and the rights to access the system.

b. Before using ACM's services, the customer undertakes to back up all systems to be tested by ACM and the associated data in full. In addition, the customer must take all necessary security measures, including those that go beyond a backup, before using the service in order to be able to restore the systems and data to their original state after the test if necessary. ACM points out that access regulations and authorisations in particular must also be checked by the customer following the activities.

c. Before using the services of ACM, the customer shall inform any third parties possibly affected by the test about the test to be carried out, as third party systems are also used in a test and it is not possible to exclude with sufficient certainty that the proper operation of these systems will be impaired.

d. The customer is expressly advised that the test may cause damage to the existing system. In particular, the test may result in impairments and changes to the websites to be tested, e.g. in the form of layout changes and impairments to the customer's server. These impairments can usually only be rectified by the customer by restoring backups or restarting the systems. In addition, the customer is informed that the customer's system may not be usable during the test.

8. Failure of the client to fulfil his duty to cooperate

If the client does not fulfil his obligation to cooperate in good time or at all, ACM shall be entitled to the agreed remuneration for the services not rendered for this reason, without ACM being obliged to render subsequent performance.

9. Default of acceptance by the client

If the client has prevented, delayed or made impossible the fulfilment of services for reasons for which he is responsible, ACM shall be entitled to the agreed remuneration for the services not rendered for this reason, without ACM being obliged to render subsequent performance.

10. Duty of confidentiality

The parties undertake to treat all confidential information and business secrets of the other party that become known in the course of the service (so-called confidential information) as strictly confidential, even beyond the duration of the business relationship, and to maintain secrecy about them. In particular, the parties also undertake not to make the confidential information accessible to third parties or to pass it on. The parties' duty of confidentiality shall not extend to information - which is already generally accessible or known at the time of its disclosure by the other party without this being due to a breach of this duty of confidentiality by one party; - if the other party has previously given its written consent to the disclosure of this information; - or if this is legally required due to an official or court order or an obligation to provide information to an authority. In the event that this condition is met, the party concerned shall inform the other party of this to the extent legally permissible.

11. Data protection

ACM undertakes to comply with the statutory provisions of data protection, in particular the GDPR, and will also oblige its employees to comply with data protection. If special circumstances within the scope of the cooperation require further agreements in accordance with the GDPR, ACM will regulate these on an ad hoc basis.

12. Copyright protection

The services and work results of ACM are subject to intellectual property protection. The client receives the written work results for the agreed (intended) use. ACM's copyright to the work results remains in force even if the client makes minor changes to the work results.

13. Impediment to performance, force majeure

a. If an employee is absent during an ongoing project, ACM is entitled to deploy a suitably qualified replacement. If the client objects to the deployment of a replacement, ACM is entitled to postpone the fulfilment of its contractual obligations. The prerequisite for a permissible objection is the existence of an objectively important reason.

b. If delays become unreasonable for the client due to obstacles within the meaning of Section 13 a., the client may set ACM a reasonable deadline for continuing the contractual activities. ACM may then appoint another qualified replacement. If ACM fails to appoint a replacement, the Client may terminate the contract without notice if this period expires without result. ACM's claim to remuneration for services already provided remains unaffected by this.

c. In the event of force majeure or other events unforeseeable at the time the contract was concluded, which make it temporarily impossible or unreasonably difficult for ACM to provide the agreed services in whole or in part, ACM shall be released from its obligation to perform. Strikes, lockouts, pandemics and similar circumstances that affect ACM directly or indirectly are deemed equivalent to force majeure, provided that ACM is unable to remedy them. ACM's claim to remuneration for services already rendered remains unaffected.

14. Liability

a. ACM is liable for its own culpability and for the culpability of its vicarious agents and legal representatives.

b. ACM is liable without limitation on any legal grounds

• wilful intent or gross negligence
• wilful or negligent injury to life, limb or health
• for any claims arising from a guarantee promise or the Product Liability Act

c. If ACM negligently breaches a material contractual obligation, liability is limited to the foreseeable damage typical of the contract, unless unlimited liability applies in accordance with Section 14 b.. Essential contractual obligations are obligations which the contract imposes on ACM according to its content in order to achieve the purpose of the contract, the fulfilment of which makes the proper execution of the contract possible in the first place and on the observance of which the client may regularly rely. The upper limit of the foreseeable damage typical for the contract is the order value. The contract value is the contractually agreed remuneration, excluding VAT and ancillary costs.

d. Any further liability on the part of ACM is excluded. This is particularly the case if the client has not fulfilled his obligations in accordance with Clauses 6, 7.

e. ACM is also not liable for the fault of third parties commissioned by the client in its own name.

15. Remuneration, default of payment, right of retention, assignment, set-off

a. The remuneration is based on the written agreement between the parties, always plus the legally applicable value added tax.
If the parties have not agreed anything separately, ACM is entitled to the usual remuneration in accordance with Section 612 (2) BGB, plus VAT.

b. Ancillary costs such as cash expenses, out-of-pocket expenses, travelling expenses such as travel, train, flight and accommodation costs and similar costs incurred as a result of the contract are to be reimbursed by the Client in addition to ACM's invoice, unless otherwise agreed.

c. Payment shall be made within 10 days of invoicing, without deductions.

d. ACM is also authorised to send invoices to the client in electronic form.

e. In the event of late payment by the client, ACM is entitled to demand statutory interest on arrears. Default occurs 30 days after invoicing, § 286 Para. 3 BGB.

f. ACM may refuse to hand over work results until its claims have been met.

g. The assignment or transfer of rights, obligations or claims arising from a service contract is not permitted.

h. If the Client is not a consumer within the meaning of Section 13 BGB, offsetting against ACM's claims for remuneration and reimbursement of expenses is only permitted with undisputed or legally established claims.

i. The remuneration shall be paid by the client in one sum, unless otherwise agreed.

16. Termination of contract and return of documents

a. The contract shall end upon fulfilment of the contract, expiry of the agreed term or termination. It shall not end in the event of dissolution of the company.

b. Immediately after termination of the co-operation between the parties, each party shall return or destroy all confidential information received from the other party at the request of the other party. At the option of the transmitting party, all records, copies and other physical and electronic records of the Confidential Information received shall also be returned or destroyed immediately. However, the obligations arising from this shall only apply insofar as this does not conflict with statutory or official retention obligations, insofar as copies of electronically exchanged documents that exist due to routinely created backups of the computer system are not affected and/or insofar as a copy of the confidential information does not have to be kept in order to be able to trace and prove compliance with the provisions of this confidentiality agreement if necessary. In the event of destruction, it must be confirmed and, at the request of the transmitting party, proven that all records, copies and other physical and electronic recordings have been completely destroyed.

17 Compliance

In exercising their respective rights and obligations under the Service Agreement, the Parties shall comply with all applicable bribery and corruption regulations.

18. Formal requirement

Amendments and supplements to a contract must be made in text form to be effective.

19. Place of jurisdiction

The place of jurisdiction is Warendorf if the client is a merchant, a legal entity under public law or a special fund under public law. Irrespective of this, ACM is entitled to sue the client at the client's general place of jurisdiction.

20. Applicable law

The law of the Federal Republic of Germany shall apply exclusively to the contract, the performance of the contract and the claims of the parties arising therefrom.

21. Severability clause

Should individual GTC be or become invalid in whole or in part, the other provisions shall remain valid.

22. Alternative dispute resolution

The EU Commission provides a platform for online dispute resolution at the following link: http://ec.europa.eu/consumers/odr

This platform serves as a contact point for the out-of-court settlement of disputes arising from online purchase or service contracts in which a consumer is involved.

ACM does not participate in dispute resolution proceedings before a consumer arbitration board.

23. Other

For reasons of better readability, the simultaneous use of the language forms male, female and diverse (m/f/d) is omitted. All personal designations apply equally to all genders.

Status: February 2025