Conditions of use and care

Terms of use and maintenance for the product RiskPlus („Software“) of Disy Informationssysteme GmbH („Disy“), Ludwig-Erhard-Allee 6, 76131 Karlsruhe, Germany:

§ 1 Scope of application and subject matter

(1) Disy shall make the Software available to the Customer during the term of the contract for use against payment on the basis of the following provisions. The functional scope of the current version of the software can be found in the service description on Disy's website at www.riskplus.info.

(2) Only water suppliers (operators of a water extraction system within the meaning of the TrinkwEGV or a drinking water supply system within the meaning of the TrinkwV, hereinafter referred to as „operator“) and the engineering offices or operators commissioned by them with the risk documentation are eligible as customers.

(3) The Customer shall use RiskPlus on its own responsibility. RiskPlus provides the Customer with technical support in the implementation of risk management, but does not replace the expertise required in accordance with § 13 TrinkwEGV or § 35 TrinkwV, nor does it release the Customer from its general operator obligations.

(4) Deviating terms and conditions of the customer shall not apply unless Disy has expressly agreed to them.

§ 2 Services

(1) The customer shall receive from Disy the necessary access data for the use of the software as an executable programme. The source code of the software is not part of the contract.

(2) Among other things, the software allows the customer to access various basic data and suggestion lists for risk assessment provided by Disy. Disy has created and implemented the technical content and categorisations in RiskPlus to the best of its knowledge and belief in accordance with the relevant rules of technology, technical literature and practical experience. Disy accepts no liability for the completeness, correctness and accuracy of this content and the documentation created by RiskPlus on the basis of this content.

(3) Disy shall provide the following accompanying services during the term of the contract (§ 13):

(a) Hosting of the software (§ 4)

(b) Support (§ 5)

(d) Updates (§ 7)

(e) Consultancy services and training (§ 8)

(4) At the customer's request, Disy shall provide additional services for a separate fee (§ 8).

(5) All information provided by Disy about the expected time and costs of a commissioned service are estimates based on the conditions specified by the customer and are non-binding. The same applies to information on delivery and performance dates, unless they are designated as binding.

(6) Disy shall be entitled to have individual services performed by third parties, in particular the TZW: DVGW-Technologiezentrum Wasser. To the extent necessary for the proper fulfilment of the contractual obligations, these third parties may be given access to documents, information and data of the customer within the framework of the data protection regulations. Even if third parties are used, Disy shall remain responsible for the performance and any promised success of the service.

(7) At the start of the contract, the customer shall name persons who are authorised to call up services and whom Disy can contact in the event of queries. Changes to the contact details shall be updated by the customer in a timely manner. If the customer fails to do so, Disy shall not be liable for any delays in performance and reserves the right to charge the customer for its own additional expenses.

(8) Both parties shall be released from their respective performance obligations if they are unable to fulfil them due to force majeure. Force majeure refers to circumstances that are beyond the control of the affected party, such as strikes, epidemics, natural disasters, failures of the energy supply or technical infrastructure as well as unrest, terrorist attacks or acts of war.

§ 3 Copyright and right of use

§ 3.1 Software

(1) The software is subject to the copyright of Disy. Disy grants the customer the non-exclusive and non-transferable right to use the software as intended during the term of the contract.

(2) The customer requires one licence per operator, regardless of whether he himself is a water supplier or an engineering office or operator working on his behalf. Each licence is assigned to a specific operator and is not transferable.

(3) The customer is not entitled to make the software available to third parties for a fee or free of charge and must take suitable precautions to prevent unauthorised access. The customer shall inform Disy immediately if it becomes aware of any such access attempts.

(4) The customer shall be liable for all damages incurred by Disy as a result of a breach of the right of use.

§ 3.2 Documents

(1) All documents created for the customer or otherwise provided to the customer, even temporarily, are subject to the copyright of Disy.

(2) Insofar as the documents have been created by Disy specifically for the customer, the customer shall be granted the irrevocable right to use and utilise the documents and the information contained therein as it wishes.

(3) The customer shall only be entitled to a non-exclusive right of use for his own use to all other documents that have been permanently provided to him, which in particular does not permit any duplication, distribution or other utilisation.

(4) Geodata provided from Bavaria are subject to separate terms of use. The use of data provided with a geographical reference to Bavaria is permitted exclusively for the fulfilment of reporting obligations under the aforementioned regulations. This includes the forwarding of the data to the relevant authority. Any other use, storage after fulfilment of the purpose or forwarding of the data is expressly prohibited. This applies in particular to the disclosure of personal data to third parties.

§ 4 Hosting of the software

(1) Disy shall provide the customer with the software including storage space for its own data on a server for use of the software via the Internet.

(2) The availability of the server is 97% per month. Periods in which access to the server is only possible to a limited extent due to maintenance work or disruptions not attributable to Disy shall not be counted towards this value and shall therefore not constitute downtime. If possible, Disy shall inform the customer of planned maintenance work 14 calendar days in advance by e-mail to the named contact persons.

(3) The measurement of the downtime begins from the time at which the hosting service is no longer accessible or no longer responds to requests. The downtime ends as soon as Disy has rectified the fault and the hosting service is available to the customer again. There is no explicit notification of the fault rectification.

(4) For each month in which the availability pursuant to para. 2 is not achieved, the customer shall be credited an amount equal to 5% of the annual remuneration upon request. Other claims for compensation are excluded in this respect.

(5) Insofar as this is necessary to fulfil the contractual obligations, the customer shall allow Disy to manage its data in a technical and organisational manner.

(6) Input, maintenance and backup of the data required to use the software is the sole responsibility of the customer. Disy shall therefore only be liable for any damage to the customer's data to the extent that this is demonstrably due to its fault. Disy assumes no liability for the accuracy of the data entered by the customer.

§ 5 Support

(1) Disy shall keep qualified personnel available from Monday to Friday from 9:00 a.m. to 5:00 p.m. - with the exception of public holidays in Baden-Württemberg - to assist the Customer in the event of malfunctions and questions regarding the operation of the Software. Support by a specific Disy employee cannot be demanded.

(2) All enquiries should be sent to the e-mail address support@riskplus.info to address.

(3) Disy shall specify a list of code words in the documentation which must be used in the subject of the email to categorise the content of the customer's enquiries. Disy reserves the right to make the final categorisation of the support request and will provide appropriate feedback if required.

(4) The enquiry can also be answered by referring to user manuals, FAQ lists or comparable documentation.

(5) Disy is not obliged to answer the customer's enquiries,

(a) which are obviously based on the fact that the minimum system requirements specified in the software documentation are not met,

(b) that relate to products or malfunctions that are obviously not connected with the software and the requirements necessary for its operation, e.g. virus scanners or other security software,

(c) the content of which is the customer's wish to realise additional functions or design options not available in the software and not promised in the software documentation, e.g. application developments or user configurations,

(d) relating to the support of third-party systems (software and hardware), unless Disy has contractually assumed responsibility for them,

(e) which do not relate to the scope of RiskPlus pursuant to § 1

(f) which relate to the technical background and content of RiskPlus, irrespective of the operation,

(g) resulting from the fact that the data to be imported by the customer does not fulfil the requirements specified in RiskPlus.

(6) In addition to the professional support referred to in paragraphs (1) to (4), the professional support provided at the www.riskplus.info contact options can be requested individually as a chargeable service.

(7) In the absence of a special agreement, Disy or its authorised agent shall not be obliged to rectify application problems that are attributable to improper operation of the software by the customer, the customer's systems, force majeure or third-party intervention.

§ 6 Troubleshooting

(1) Disy shall eliminate malfunctions in connection with the software that occur during the term of the contract, taking into account their severity, whereby the simultaneous occurrence of several malfunctions may justify a malfunction of the next higher category:

(a) Critical fault (highest priority): Fault that causes the software or essential parts of it to fail, making it completely or almost completely impossible to use - example: the software does not start or crashes.

(b) Major malfunction (medium priority): Malfunction that impairs the use of the software to such an extent that reasonable work with it is no longer possible or only possible with disproportionate effort - example: the software runs slower than usual or with interruptions or recurring error messages are complained about.

(c) Other malfunction (lowest priority): Fault that is annoying but does not affect the use of the software or only affects it insignificantly - example: display problems in the user interface

(2) A designated contact person of the customer shall report disruptions by e-mail to the address specified in Section 5 (2). In doing so, he shall endeavour to achieve a preliminary classification of the fault in accordance with para. 1 with regard to the feared effects on the customer's business operations. The report must be so precise that Disy can begin to rectify the fault in a targeted manner and must therefore include the following in particular:

• Description of the error symptoms

• Time of the error

• Steps for reproducing the error

• Screenshots of the application and the error message

• Description of the customer's IT systems

• Description of third-party software used

• If necessary, access data to the customer's systems

(3) Depending on the content of the written notification, Disy shall make a final categorisation of the fault in accordance with para. 1 and provide initial feedback. This shall take place within the service times pursuant to § 5 (1) at the latest as follows (response times):

(a) Critical fault: 2 hours

(b) Significant disruption: 4 hours

(4) The elimination of a disruption within a certain period of time cannot be promised. Insofar as it is foreseeable for Disy that a critical or significant disruption cannot be eliminated within a reasonable period of time, it shall immediately endeavour to find a temporary workaround solution and then eliminate the disruption as quickly as possible.

(5) If the alleged fault is not verifiable, reproducible or not attributable to Disy, Disy reserves the right to charge the customer for the expenses incurred.

(6) Without special agreement, Disy shall not be obliged to rectify faults that are attributable to improper operation of the software by the customer, force majeure or intervention by third parties.

§ 7 Updates

(1) Disy shall provide the customer with updates where possible.

(2) Updates are used to continuously improve the software and adapt it to general technical developments and user requirements. After an update, new functions of the software may therefore be available and previous functions may be presented differently, for example in their sequence or user guidance.

(3) The object of the services owed by Disy for support (§ 5) and troubleshooting (§ 6) is the current version of the software.

§ 8 Consultancy services and training

(1) Disy shall provide the Customer with video tutorials on the operation of the Software free of charge at the Internet address www.riskplus.info. The parties are free to agree further support services („individual services“) for the software against separate remuneration.

(2) Disy organises training courses in such a way that an attentive participant can achieve the intended objectives. A specific gain in knowledge or training success is not promised.

(3) Any recommendations made are made to the best of the knowledge and belief of the Disy employees in charge. Disy assumes no liability for the occurrence of the described effects and the achievement of the stated objectives.

§ 9 Obligations of the customer to co-operate

(1) The customer shall provide Disy with all information and data required for the services in a complete and accurate manner. In this respect, Disy is under no obligation to investigate.

(2) The customer shall ensure continuous training of those of its employees who handle the software. This applies in particular to the persons designated as contact persons.

(3) If the customer makes changes or additions to the suggestion lists provided by Disy (§ 2 para. 2), the customer authorises Disy to use these changes or additions to further develop the suggestion lists.

(4) The customer has the opportunity to submit fault reports and questions regarding operation to Disy via the channel specified in § 5 (1). In doing so, the customer shall endeavour to achieve a preliminary classification of his enquiry with regard to a technical characterisation of his enquiry or the operating step at which the problem occurs. The report must be sufficiently precise to enable Disy to provide targeted support and must include the following:

• Description of the problem encountered, if necessary with screenshots of the application (e.g. „Data cannot be imported“ or „Instructions for risk assessment step unclear“.

• Categorisation of the restrictions encountered into: Urgent („Further use of RiskPlus is not possible.“), Significant („Further use of RiskPlus is possible, but requires more time on the part of the user“) and Other („Further use of RiskPlus is possible without restrictions, but the customer would like to see improvements“).

• Statement whether the question could not be covered or solved by the instructions provided (e.g. FAQ, tutorial).

(5) The customer shall fulfil his obligations to cooperate in his own interest and may not demand any remuneration for this. If the customer does not fulfil its obligations to cooperate, any agreed service deadlines shall be extended accordingly. Disy reserves the right to temporarily suspend the services after the expiry of a reasonable period and to resume them at its own discretion.

§ 10 Remuneration and terms of payment

(1) The remuneration owed by the customer is set out in the price list. Unless otherwise agreed, the obligation to pay for the use of the software including data material and the accompanying services (§ 2 (1) to (3)) shall commence as soon as the customer receives the access data.

(2) The remuneration for the use of the software and for the accompanying services shall be paid annually in advance.

(3) Individual services provided by Disy (§ 8) shall be remunerated on a time and material basis and shall be invoiced at the end of the month. Together with the invoice, the customer shall receive proof of the services rendered. The customer must raise any objections in writing within a period of 14 calendar days. Once this period has expired, the activity report shall be deemed to have been approved.

(4) If the costs for the provision of services have increased significantly since the start of the contract or since the last price increase, Disy reserves the right to adjust the prices accordingly. A price increase shall take place no more than once per calendar year. Disy shall announce an intended price increase at least three months in advance. In this case, the customer may terminate the contract within a period of 30 calendar days from the announcement with effect from the date of the price increase.

(5) Payment shall be due 14 calendar days after a proper invoice has been sent by e-mail to the customer's specified address.

(6) If a due payment is not made for two months or longer, Disy shall be entitled to suspend operation of the software until it has been paid in full.

(7) The customer may only offset claims against Disy that are undisputed or have been recognised by declaratory judgement. Outside of § 354a HGB, the customer may only assign claims from this contract to third parties with the prior written consent of Disy. The customer shall only be entitled to a right of retention or the defence of non-performance of the contract within this contractual relationship.

§ 11 Contract term and cancellation

(1) The contract is initially concluded for 12 months. It begins upon completion of the order process.

(2) The contract shall be extended by a further 12 months in each case if it is not cancelled in writing by one of the parties with three months' notice to the end of the term.

(3) The mutual right to extraordinary cancellation for good cause remains unaffected. An important reason for Disy is in particular that the customer

(a) infringes the right to use the Software granted to it in § 3.1 or

(b) is more than two months in arrears with the remuneration owed pursuant to § 10.

An important reason for the customer is in particular that Disy

(a) does not grant the right of use promised to him in § 3 or

(b) the availability of the server promised in accordance with § 4 (2) is not achieved for more than two consecutive months.

§ 12 Warranty for defects

(1) Disy warrants that the contractual services (software and individual services) have the agreed quality. They shall not have any defects that cancel or reduce the value or suitability for the normal use or the use assumed under the contract. The relevant point in time is the transfer of risk, i.e. in the case of software the transfer of the access data, in the case of individual services the completion.

(2) The customer must inspect the contractual services for defects immediately upon transfer of risk and notify Disy of these in writing within a period of 14 calendar days. If the customer fails to notify Disy in due time, the contractual services shall be deemed approved, unless the defect was not recognisable during the inspection. If such a defect is discovered later, the notification must be made immediately after discovery; otherwise the contractual services shall also be deemed approved in this respect.

(3) Disy shall remedy defects notified in due time without delay within the scope of technical possibilities. The specific type of defect rectification shall be at the discretion of Disy.

(4) The customer shall support Disy in the search for and rectification of defects in accordance with § 9 para. 1.

(5) Any warranty claims shall lapse within one year of the transfer of risk.

(6) If Disy provides services in the search for or rectification of defects without being obliged to do so, Disy reserves the right to charge the customer for the expenses incurred. This applies in particular if a defect cannot be proven, reproduced or is not attributable to Disy.

§ 13 Liability

(1) Both parties shall be liable for damages due to the breach of contractual obligations insofar as they are at fault.

(2) The amount of liability for simple negligence is limited to the damage typically foreseeable for the damaging party at the time of the breach of duty, but to a maximum amount of € 10,000 per damaging event.

(3) Non-contractual liability remains unaffected.

(4) Disy shall maintain sufficient insurance cover at all times to cover the liability pursuant to paragraphs 1 to 3 and shall provide evidence of this to the customer upon request.

(5) Liability is excluded

(a) if the customer himself is responsible for the damage (§ 254 BGB), in particular because he

• has not complied with the duty to co-operate (§ 9),

• services have not been used in accordance with the contract (e.g. operating errors; use of hardware or software that does not comply with the specification),

• has made unauthorised changes to the object of performance,

• has disregarded statutory or contractual provisions to minimise damage;

(b) for loss of profit;

(c) for cyber damage, i.e. data loss or damage due to network security breaches (e.g. hacker attacks, malware, denial of service), data breaches and cyber extortion by third parties;

(d) for the use of the specialised geodata provided by RiskPlus and the resulting documentation results. In particular, no guarantee can be given for the accuracy, up-to-dateness, completeness or availability of the data and its transmission. No liability is accepted for direct or indirect damage resulting from the use of the data or a lack of availability. The limitation of liability extends to the organisations providing the data, the authors of the data provided and their employees.

§ 14 Third-party rights

(1) If third parties assert claims against the customer due to alleged infringements of property rights by the software provided for use, Disy shall indemnify the customer against these claims. This presupposes that the customer informs Disy immediately of the claim and only takes any action against the third party in consultation with Disy.

(2) If third parties assert claims that prevent the customer from exercising the right to use the software granted to him, he shall inform Disy immediately in text form.

§ 15 Data protection

(1) Disy shall comply with the statutory provisions on data protection when processing the Customer's personal information. This also includes technical security measures adapted to the current state of the art (Art. 32 GDPR) and the obligation of employees to maintain data secrecy (Art. 28 para. 3 lit. b GDPR). If subcontractors of Disy (§ 2 para. 5) come into contact with personal data, an agreement on order processing (AVV) is concluded with them in advance, which can be viewed on request.

(2) Disy operates the necessary server infrastructure in a data centre in Europe, with the following certificates:

• BSI C5 certificate type 1

• BSI IT baseline protection

• ISO 27001

§ 16 Confidentiality

(1) The parties shall maintain secrecy about all confidential information that comes to their knowledge in the course of their business relationship, in particular business or trade secrets, and shall neither pass them on nor utilise them in any other way.

(2) The duty of confidentiality shall not apply if the information in question must be disclosed by order of a court, by order of a public authority or by law. The party so obliged shall immediately inform the other party of the disclosure and disclose the information in such a way that confidentiality is maintained as far as possible.

§ 17 Referencing

Unless the customer expressly objects, Disy or persons authorised by Disy to do so may list the customer as a reference in their sales and marketing documents. The customer's logo may be used and a link may be placed on the customer's website.

§ 18 Final provisions

(1) Unless otherwise agreed, declarations between the parties must be made in writing, whereby e-mail shall suffice.

(2) German law shall apply to the exclusion of the UN Convention on Contracts for the International Sale of Goods.

(3) The exclusive place of jurisdiction is Karlsruhe.

(4) Should one of the above provisions be or become invalid or should a necessary provision not be included, this shall not affect the validity of the remaining provisions. In this case, the parties shall endeavour to find an amicable solution.