Terms and Conditions of Commerce Partner B.V.

General Terms and Conditions

Commerce Partner B.V.

General Section

including Attachments A to F

Commerce Partner B.V.

Registered at the Kamer van Koophandel, The Hague

As of: March 2026 | Version 1.1 (corrected)

GENERAL SECTION

§ 1 Definitions

In these General Terms and Conditions (hereinafter "T&Cs"), the following terms are used with the specified meanings:

Attachment(s):

Appendices to these T&Cs containing specific provisions for the respective types of services.

Client:

The natural or legal person who has entered into or will enter into a contract with Commerce Partner.

Commerce Partner:

Commerce Partner B.V., registered at the Kamer van Koophandel in The Hague, Netherlands.

Services:

All services and works provided by Commerce Partner to the client under the contract, including, but not limited to, consulting, strategy development, programming, online marketing, project management, training, and all supplementary and supporting activities.

Contract:

The complete agreement between Commerce Partner and the client for the provision of services, including the offer, these T&Cs, the applicable attachment(s), any data processing agreement, and all other documents containing agreements regarding the services to be provided.

Parties:

Commerce Partner and the client.

Personal Data:

Any data about an identified or identifiable natural person as defined in Art. 4 No. 1 GDPR.

Intellectual Property Rights (IP Rights):

All intellectual property rights and related rights, including, but not limited to, copyright, trademark rights, patent rights, design rights, trade name rights, rights to domain names, database rights, and know-how.

§ 2 Scope

These T&Cs form part of all contracts between Commerce Partner and the client. In addition to these T&Cs, the relevant attachments applicable that Commerce Partner has provided to the client shall apply.

Any deviations from these T&Cs are only effective if they have been expressly agreed upon by both parties in writing and apply only to the respective contract.

Any purchasing or other terms of the client do not apply unless the parties have agreed otherwise in writing.

If these T&Cs have already applied to a legal relationship between Commerce Partner and the client, the client is considered to have agreed in advance to the application of these T&Cs for subsequently concluded contracts.

Should any provision of these T&Cs be nullified or destroyed, the remaining provisions remain fully effective. In such a case, the parties shall agree on a new provision that corresponds as closely as possible to the purpose and intent of the nullified/destroyed provision.

In the event of conflicts between different parts of the contract, the following order of precedence applies, with the documents listed first taking precedence: (a) individual offer or agreement, (b) data processing agreement attachment, (c) Service Level Agreement, (d) attachments to the T&Cs, (e) these T&Cs, (f) other documents.

Electronic communication between the parties is considered received on the day it is sent unless proven otherwise.

§ 3 Offers and Contract Formation

All offers and other tenders from Commerce Partner are non-binding unless expressly stated otherwise.

Offers expire four weeks after the issue date, unless otherwise specified in writing.

The client guarantees the accuracy and completeness of the information provided by or on behalf of them to Commerce Partner, on the basis of which Commerce Partner has prepared its offer. If this information proves inaccurate or incomplete, Commerce Partner is entitled to adjust the offer or amend the already concluded contract accordingly.

A contract is concluded by the client accepting an unchanged valid offer from Commerce Partner in writing or otherwise. In the case of an oral acceptance, Commerce Partner may require written confirmation before commencing the contract execution. A contract concluded upon acceptance is binding on both parties.

§ 4 Execution of the Contract and Service Provision

Commerce Partner will execute the contract to the best of its knowledge and belief and in accordance with the requirements of good professional practice. Unless expressly otherwise specified in the contract or respective attachments, the contract has the character of a best-efforts obligation ("inspanningsverplichting"). Any agreements on service levels are always documented in a separate Service Level Agreement.

Delivery dates and deadlines are not to be regarded as fixed dates unless agreed otherwise in writing by the parties. In the event of an (impending) delay, the parties will promptly contact each other to discuss appropriate measures.

If it is agreed that the contract will be executed in phases, Commerce Partner is entitled to suspend the start of services for a subsequent phase until the client has approved the results of the previous phase in writing.

Commerce Partner is entitled to let third parties execute the contract entirely or partially or to involve third parties in the execution. Commerce Partner remains responsible to the client for the proper and timely execution of the contract.

Unless otherwise specified in the respective attachments, services are considered accepted if the client does not provide written, detailed reasoning within five (5) working days after delivery, explaining why the services are not accepted. If not accepted, Commerce Partner will adjust the services within a reasonable timeframe. This procedure is repeated with another justified rejection.

If one of the parties determines after a reasonable number of attempts (at least two) that further adjustments are no longer relevant, the respective party is entitled to terminate the contract. Any services already provided will be charged proportionately, provided they have an independent value.

§ 5 Prices and Payment Terms

Unless otherwise specified, all prices are stated in euros, exclusive of statutory VAT and other government levies.

Price indications, estimates, and budgets from Commerce Partner are indicative only and do not create any rights or expectations unless fixed prices have been expressly agreed upon.

Invoices are payable by the client within thirty (30) days of the invoice date. In the absence of a specific arrangement, the payment term stated on the invoice applies.

For one-off projects, Commerce Partner invoices half of the fee in advance. For ongoing contracts (with a duration of three months or more), billing is done monthly in advance.

If the client does not pay the amounts due in a timely manner, they owe statutory interest at the rate prescribed by Art. 6:119a BW on the outstanding amount from the due date. No separate reminder or notice of default is required. If the client remains in default after a reminder, Commerce Partner is entitled to reimbursement of all extrajudicial and judicial collection costs.

Commerce Partner is entitled to suspend the execution of the contract wholly or in part if the client has not fully paid the due amounts within the payment term. Any ongoing fees remain payable during the suspension.

Commerce Partner is entitled to adjust the prices for its services annually, effective January 1, by a maximum of the service price index (CPI) of the Centraal Bureau voor de Statistiek plus up to fifteen percent (15%).

Objections to invoices must be communicated in writing within fourteen (14) days of receipt; otherwise, they are deemed accepted. Objections do not suspend the payment obligation.

The client agrees to electronic invoicing by Commerce Partner.

The offsetting of counterclaims by the client is only permissible if the counterclaim has been acknowledged by Commerce Partner or legally established. This also applies to the exercise of a right of retention by the client.

§ 6 Client Cooperation Obligations

The client ensures that all information, data, and materials that Commerce Partner identifies as necessary or that the client can reasonably be expected to recognize as necessary are provided timely and completely.

If data required for contract execution is not provided timely, Commerce Partner is entitled to suspend execution and charge the client for the resulting additional costs.

The client guarantees that the information and materials provided to Commerce Partner are accurate and complete. Commerce Partner has the right, but not the obligation, to check them for accuracy and completeness.

If the contract execution depends on third parties engaged by the client (e.g., access to external accounts like Google Ads, Shopware Backend, hosting systems), the client ensures that Commerce Partner receives timely and complete access. If not, Commerce Partner is entitled to suspend its service obligations without being in default.

The client is solely responsible for the legal compliance of their website, online shop, and any advertising materials (including imprint and privacy policy).

Delays or additional costs resulting from a breach of cooperation obligations by the client shall be borne by them. The client indemnifies Commerce Partner from all third-party claims arising from a breach of this article.

§ 7 Contract Duration and Termination

The contract term is determined in the respective contract. If no term is specified, the contract is deemed concluded for an initial term of one (1) year.

If the contract is not terminated in writing at least three (3) months before the end of the initial term, it will be extended indefinitely. After extension to an indefinite period, the contract can be terminated at any time with a notice period of three (3) months to the end of the month.

Ordinary termination during the initial contract term is excluded unless otherwise expressly provided in the contract. § 15 para. 2 (termination right in case of material T&Cs changes) remains unaffected.

Terminations must be in writing to be effective.

The right to extraordinary termination for good cause remains unaffected. A good cause exists, in particular, in case of insolvency, suspension of payment, liquidation, or a significant change of control at the client.

In the event of contract termination, the usage rights granted to the client in the service results remain beyond the contract end only if the agreed remuneration has been fully paid. If remuneration is not fully paid, the usage right expires at the end of the contract.

§ 8 Intellectual Property

All IP rights in the services provided under the contract and all materials made available by Commerce Partner are exclusively held by Commerce Partner and/or its licensors, unless otherwise expressly agreed in the contract.

The contract implies no transfer of IP rights. The client receives only a non-exclusive, non-transferable usage right to the service results for the purposes specified in the contract and under the contract's specified conditions. The usage right is valid worldwide. For the continuation of the usage right after the contract end, see § 7 para. 6.

The dissemination of service results to third parties (including affiliated companies) is excluded without prior written consent from Commerce Partner.

Commerce Partner does not expressly waive its moral rights under Art. 25 of the Dutch Copyright Act (Auteurswet).

Commerce Partner is entitled to use the service results and materials used during contract execution for its own advertising and reference purposes, unless otherwise specified in the contract.

All data and information entered by the client regarding the services (client data) remain the property of the client. Commerce Partner receives only a non-exclusive license to use the client data for the contract duration, as necessary for providing the services.

§ 9 Confidentiality and Non-Solicitation

The parties will treat all information they receive from each other as strictly confidential and keep it secret. This applies to software, source code, customer data, know-how, technical specifications, documentation, and all other information considered confidential.

The parties will only use confidential information for the purposes for which it was provided and will only disclose it to employees as necessary for contract performance.

The confidentiality obligation does not apply to information that was already publicly known at the time of disclosure, has become publicly known without fault of the recipient, or was lawfully received from a third party.

The confidentiality obligation applies during the contract term and for a period of two (2) years after its end.

Each party will not hire employees of the other party during the contract term and for a period of twelve (12) months after its termination, or otherwise directly or indirectly employ them, unless the other party has consented in writing beforehand.

§ 10 Data Protection and Data Processing

If Commerce Partner processes personal data of the client or its customers in the course of providing the services, Commerce Partner is considered a processor and the client a controller under the GDPR.

Commerce Partner will process this personal data exclusively in accordance with the provisions of Attachment F (Data Processing Agreement).

Both parties commit to complying with all applicable data protection regulations, in particular the GDPR and the Dutch GDPR Implementation Act (Uitvoeringswet AVG).

§ 11 Cybersecurity

Commerce Partner takes appropriate technical and organizational measures to protect the data processed in the provision of services. The client is responsible for the security of their own systems, networks, and access control.

In the event of a security incident affecting the service provision or client data, the parties will immediately inform each other and jointly take appropriate measures.

Commerce Partner is not liable for damages resulting from security incidents involving third parties engaged by the client (e.g., hosting providers, payment service providers).

§ 12 Use of Artificial Intelligence

Commerce Partner may use AI-powered tools and systems in the provision of services. Commerce Partner will inform the client upon request which AI tools are used.

The client remains always responsible for the content review and approval of results created using AI.

Commerce Partner does not guarantee the accuracy, completeness, or suitability of AI-generated results. These are always subject to the client's review and acceptance obligation.

§ 13 Liability

Commerce Partner is liable to the client only for direct damages resulting from an attributable breach of contract, tortious act, or other legal grounds. Direct damage includes exclusively: property damage, costs to prevent or limit data loss, reasonable costs to determine the cause and extent of damage, and reasonable costs incurred by the client to obtain performance in accordance with the contract.

Commerce Partner's liability for indirect damages, including but not limited to lost profits, missed savings, business interruption, loss of goodwill, or loss/damage to (business) data, is excluded.

The total liability of Commerce Partner per damage event (where a series of related events counts as one event) is limited to the amount of the remuneration agreed for the execution of the respective contract, excluding VAT. For continuing obligations, a remuneration period of six (6) months is used as a basis. Commerce Partner's total liability shall in no case exceed one hundred thousand euros (EUR 100,000).

The above liability limitations do not apply when the damage is due to intent or conscious recklessness ("bewuste roekeloosheid") of Commerce Partner or its management.

The client uses the services at their own responsibility and risk. The client indemnifies Commerce Partner against all third-party claims arising from the use of the services by the client.

Any claim for damages against Commerce Partner expires twelve (12) months after the client becomes aware of the damage or should have become aware of it with reasonable diligence.

§ 14 Force Majeure

None of the parties is regarded as having committed an attributable contract breach in case of force majeure. Force majeure includes particularly: power outages, strikes, government actions, natural disasters, pandemics, internet connection disruptions, hardware failures, disruptions in telecommunications networks, and other unforeseeable circumstances.

If force majeure lasts more than thirty (30) days, both parties are entitled to terminate the contract without liability for damages.

§ 15 Changes to the T&Cs

Commerce Partner reserves the right to unilaterally change or supplement these T&Cs. Changes will be communicated to the client in writing and will take effect at the earliest thirty (30) days after notification.

If a change demonstrably negatively affects the position of the client significantly, the client has the right to terminate the contract in writing no later than fourteen (14) days before the change comes into effect. This termination right exists independently of any initial contract term as per § 7 para. 3.

Minor changes or changes required by law can be made at any time with immediate effect.

§ 16 Dispute Resolution and Mediation

If a dispute between the parties cannot be settled amicably, it will initially be submitted to authorized representatives of the parties to explore resolution options. If this fails, either party may propose engaging an independent mediator.

The initiation of a mediation procedure does not suspend the right of a party to apply for interim relief.

§ 17 Applicable Law and Jurisdiction

These T&Cs and all contracts between Commerce Partner and the client are exclusively governed by Dutch law.

The application of the Vienna Convention on the International Sale of Goods (CISG) is excluded.

All disputes arising between Commerce Partner and the client in connection with the contract are exclusively submitted to the competent court in the seat of Commerce Partner (The Hague, Netherlands).

These T&Cs are filed with the Kamer van Koophandel in The Hague. The latest filed version always applies.

The German version of these T&Cs is decisive for their interpretation. Upon request, Commerce Partner also provides a Dutch and English version.

§ 18 Transfer of Rights and Obligations

The rights and obligations from the contract may only be transferred to third parties by the parties with prior written consent from the other party.

Notwithstanding para. 1, Commerce Partner is entitled to transfer its rights and obligations from the contract without the client's consent to a parent, subsidiary, or sister company or to a third party that takes over the relevant business activities of Commerce Partner.

§ 19 Handover and Transition at Contract End

Upon termination of the contract, Commerce Partner will provide the client with all work results created as part of the service provision, access data to accounts set up on behalf of the client, and project data within thirty (30) days upon written request, provided this is technically feasible and reasonable.

For personal data, only Attachment F Art. F.7 applies.

Commerce Partner is entitled to charge for efforts going beyond routine handovers, such as onboarding a successor service provider, based on the hourly rates applicable at the time of termination.

The obligation to hand over does not exist if the client has not fully settled outstanding payments. In this case, Commerce Partner is entitled to withhold the handover until full payment.

ANNEX A: Consulting

Article A.1 Scope

(1) The provisions of this annex apply in addition to the General Section when the client uses consulting services, including but not limited to: B2B e-commerce strategy development, e-commerce advisory board, and general consulting.

(2) For separately bookable training, workshops, and seminars that are not part of an ongoing consulting mandate, only Annex E applies. Workshops provided as part of a consulting mandate as an integral part of the consulting service are subject to this Annex A.

Article A.2 Service Provision

(1) All consulting services are provided as best efforts obligations. Commerce Partner is not obliged to achieve certain business results, sales figures, or market positions for the client.

(2) Commerce Partner is independent in providing consulting services. However, it is open to the client to provide Commerce Partner with professional instructions.

(3) Commerce Partner is entitled to replace the person deployed for the consulting with one or more equally qualified persons.

(4) If consulting services are provided on the client's premises, the client provides an appropriate and safe workplace.

Article A.3 E-Commerce Advisory Board

(1) Services as part of the e-commerce advisory board include strategic guidance to the client through regular advisory board meetings. The contents, frequency, and participants are set out in the respective contract.

(2) The recommendations made within the e-commerce advisory board are non-binding. Implementation decisions rest solely with the client.

(3) The client ensures that all information necessary for the advisory board's work (key figures, business data, market information) is provided completely and timely.

Article A.4 Rates and Costs

(1) Consulting services are invoiced based on the daily rates agreed in the contract. A consulting day comprises eight (8) hours, unless agreed otherwise.

(2) Commerce Partner is entitled to charge travel and accommodation costs separately. The amount of travel costs will be communicated to the client in writing beforehand.

(3) Commerce Partner is entitled to invoice consulting services on a retrospective calculation basis.

Article A.5 Cancellation

(1) The client may cancel agreed consulting appointments in writing. Depending on the cancellation time, the following fees apply:

a) Up to four (4) weeks before the agreed date: free of charge.

b) From four (4) weeks to two (2) weeks prior: 50% of the agreed fee.

c) Less than two (2) weeks prior: 100% of the agreed fee.

ANNEX B: CP-One (External E-Commerce Department)

Article B.1 Scope

(1) The provisions of this annex apply in addition to the General Section for the CP-One product, where Commerce Partner acts as an external e-commerce department for the client.

Article B.2 Service Scope

(1) CP-One includes an integrated package of strategic consulting, operational implementation, and ongoing support in the B2B e-commerce field. The exact service scope is defined in the respective contract (Onboarding Agreement and Continuous Support Agreement).

(2) Commerce Partner acts within CP-One as an extended workbench for the client, but always as an independent contractor and not as an employee or organ of the client.

(3) The service scope may include, in particular: strategy development, shop setup and optimization, content creation, performance marketing, SEO, conversion optimization, reporting, and KPI monitoring.

Article B.3 Onboarding and Continuous Support

(1) At the beginning of the cooperation, an onboarding phase takes place, during which the infrastructure, accesses, and processes are set up. The onboarding fee is due as a one-off payment.

(2) After onboarding, continuous support begins with a monthly flat rate to be specified in the contract.

(3) The service hours included in the monthly flat rate must be used within the respective month. Unused hours expire unless otherwise agreed in writing.

Article B.4 Advertising Budgets and Third-Party Costs

(1) Advertising budgets for third-party providers (e.g., Google Ads, Meta Ads, LinkedIn Ads) are not included in the CP-One flat rate and are borne by the client directly or billed separately.

(2) Commerce Partner has no influence if third-party providers terminate advertising campaigns without giving reasons. The entitlement to remuneration of Commerce Partner remains unaffected in such cases.

Article B.5 Minimum Term

(1) The CP-One contract has a minimum term of twelve (12) months from the completion of onboarding unless otherwise agreed in the contract. Ordinary termination during the minimum term is excluded.

(2) After the minimum term expires, the contract automatically renews indefinitely and can be terminated by either party with a notice period of three (3) months to the month's end.

Article B.6 Handover at Contract End

(1) For the handover at contract end, § 19 of the General Section applies. Given the special depth of cooperation with CP-One, Commerce Partner will additionally provide the client with structured handover documentation, which particularly includes: an overview of set up systems and accounts, ongoing campaigns and their status, accesses and permissions, and open tasks and recommendations.

ANNEX C: Programming and Development

Article C.1 Scope

(1) The provisions of this annex apply in addition to the General Section when Commerce Partner develops or delivers software, websites, online shops, plugins, interfaces, or other digital products (hereinafter materials) on behalf of the client.

(2) To the extent that the services under this annex concern the creation or delivery of a specific work, the provisions regarding the construction contract (Aanneming van werk, Art. 7:750 BW) apply additionally. To that extent, this annex deviates from the general classification as a best-efforts obligation per § 4 para. 1 of the General Section.

Article C.2 Development

(1) The parties will define in the contract before work begins, the methodology by which the work will be performed and the specifications to which the developed materials must comply.

(2) Commerce Partner may require written approval of a draft or concept before starting development.

(3) Commerce Partner will endeavor to develop the materials as error-free as possible but cannot guarantee that the materials are free of errors or will be error-free at all times.

(4) The client indemnifies Commerce Partner from all third-party claims related to the use of the materials developed by Commerce Partner by the client.

Article C.3 Usage Right to Materials

(1) Unless otherwise specified in the contract, Commerce Partner grants the client a non-exclusive, non-transferable, and non-sublicensable right to use the materials in accordance with the contract.

(2) The source code of the materials and any technical documentation used or created during development will not be provided to the client unless explicitly agreed otherwise.

(3) At the client's request, Commerce Partner may deposit the source code with an escrow service provider selected by Commerce Partner at the client's expense.

Article C.4 Acceptance

(1) The client must inspect and accept the delivered materials within thirty (30) days of delivery or reject them with specific reasons. If there is no response within this period, the materials are considered accepted. This period takes precedence over the general acceptance period per § 4 para. 5 of the General Section.

(2) Acceptance is also deemed to have occurred if the client uses the materials for production purposes.

(3) If rejected, Commerce Partner will endeavor to address the reasons within a reasonable timeframe. The client will then conduct another inspection (deadline: seven working days).

(4) Rejection is only permissible in the case of significant deviations from the agreed specifications. If objections concern only subordinate aspects, the materials are deemed accepted provided these aspects will be rectified.

(5) Commerce Partner is not obligated to correct errors if they result from changes not made by Commerce Partner, improper use, incorrect data provided by the client, or software/hardware from third parties.

Article C.5 Warranty

(1) Commerce Partner does not guarantee that the materials will function flawlessly with all software (including web browsers) and/or hardware.

(2) Commerce Partner is free to use open-source components in the development. Upon request, Commerce Partner will provide an overview of the open-source components used and the license conditions applicable to them.

(3) After acceptance of the materials, Commerce Partner's liability is limited to defects that were not detectable upon acceptance (latent defects). Liability for latent defects exists for a period of six (6) months after acceptance unless Commerce Partner has explicitly provided guarantees for a longer period.

ANNEX D: Online Marketing

Article D.1 Scope

(1) The provisions of this annex apply in addition to the General Section when the client uses online marketing services, including, but not limited to: search engine optimization (SEO), search engine advertising (SEA), social media marketing, content marketing, email marketing, conversion optimization, and performance marketing.

Article D.2 Forecasts and Results

(1) If Commerce Partner provides advance forecasts about potential results of marketing measures (e.g., in a media plan), these are merely estimates that do not bind Commerce Partner.

(2) Commerce Partner is not obligated to achieve specific rankings, click rates, conversion rates, or other metrics for the client.

Article D.3 Advertising Budgets

(1) Advertising budgets for external platforms (e.g., Google, Meta, LinkedIn, Amazon) are not included in Commerce Partner's remuneration and are borne separately by the client.

(2) Upon the client's request, Commerce Partner specifies within a reasonable timeframe which portion of the budget was spent on media purchasing and which on campaign management.

Article D.4 Promotional Materials and Legal Compliance

(1) If the client provides promotional materials to Commerce Partner, the client ensures these comply with applicable laws and do not infringe third-party rights.

(2) If Commerce Partner creates promotional materials on behalf of the client, Commerce Partner ensures their legal compliance, unless a legal violation is attributable to the client.

(3) The client is responsible for obtaining any necessary consents (e.g., cookie consent, advertising consents) themselves.

Article D.5 Access to Third-Party Accounts

(1) The client grants Commerce Partner ongoing access to all tools, accounts, and systems with third parties required for contract execution during the contract term.

(2) The client is responsible for the correct setup, permissions, valid licenses, and technical availability of these accounts. Commerce Partner is not liable for damages resulting from incorrect settings, missing licenses, or disruptions on the third-party provider's side.

ANNEX E: Training and Workshops

Article E.1 Scope

(1) The provisions of this annex apply in addition to the General Section when Commerce Partner conducts independently bookable training, workshops, or seminars. A distinction is made between open training and in-house format events.

(2) For workshops provided as an integral part of an ongoing consulting mandate, Annex A applies.

Article E.2 Conduct

(1) For in-house training, the client is responsible for providing appropriate facilities, technical equipment (computers, projectors, internet access), and catering for participants and trainers.

(2) Commerce Partner is entitled to change the content, location, and times of training. Commerce Partner will inform the client of this in good time.

(3) Commerce Partner is entitled to cancel training up to the beginning, especially if the minimum number of participants is not reached or the trainer is ill. Amounts already paid will be refunded if no replacement date is agreed upon.

Article E.3 Cancellation by the Client

(1) The client can cancel training in writing at any time. The following cancellation fees apply depending on the cancellation time:

a) Up to four (4) weeks prior to the start: free of charge.

b) From four (4) weeks to two (2) weeks prior: 50% of the agreed fee.

c) Less than two (2) weeks prior: 100% of the agreed fee.

(2) The fee for training is due in advance unless otherwise agreed.

ANNEX F: Data Processing Agreement

(Agreement in accordance with Art. 28 para. 3 GDPR)

Article F.1 Subject and Duration

(1) This annex specifies the data protection obligations of the parties in connection with the processing of personal data by Commerce Partner on behalf of the client.

(2) Commerce Partner processes personal data exclusively on behalf of and according to the documented instructions of the client, unless Commerce Partner is obliged to process data under Union or national member state law.

(3) The duration of processing corresponds to the term of the underlying contract.

Article F.2 Nature and Purpose of Processing

(1) The type and purpose of processing, the categories of data subjects, and the type of personal data are derived from the respective contract and, if necessary, specified in a separate appendix.

Article F.3 Technical and Organizational Measures

(1) Commerce Partner takes appropriate technical and organizational measures to ensure a level of security appropriate to the risk. These measures include, amongst others: pseudonymization and encryption of personal data, ensuring the confidentiality, integrity, and availability of systems, the ability to quickly recover after an incident, and procedures for regularly reviewing the effectiveness of these measures.

(2) Commerce Partner documents the measures taken and makes them available to the client upon request.

Article F.4 Sub-Processors

(1) Commerce Partner may only engage sub-processors with the client's prior general or specific written consent.

(2) In the event of a general consent, Commerce Partner informs the client of any intended changes regarding the involvement or replacement of sub-processors, and the client has the opportunity to object within fourteen (14) days.

(3) Commerce Partner imposes the same data protection obligations as those stipulated in this annex on the sub-processor by means of a contract. Commerce Partner is liable to the client for the fulfillment of the sub-processor's obligations.

Article F.5 Data Subject Rights

(1) Commerce Partner assists the client, as far as possible, in fulfilling their obligation to process requests from data subjects to exercise their rights according to Chapter III GDPR.

Article F.6 Notification of Data Protection Incidents

(1) Commerce Partner notifies the client of any breach of personal data protection immediately, but no later than within forty-eight (48) hours of becoming aware of it.

(2) The notification includes at least: a description of the nature of the breach, the categories and approximate number of affected data subjects and data records, the likely consequences, and the measures taken or proposed.

Article F.7 Deletion and Return

(1) Upon termination of processing, Commerce Partner deletes all personal data or returns it to the client unless Union or national law requires storage.

Article F.8 Audits

(1) Commerce Partner provides the client with all necessary information to demonstrate compliance with obligations laid down in Art. 28 GDPR and enables and supports audits, including inspections by the client or an auditor appointed by them.

(2) The costs of an audit are borne by the client, provided it goes beyond routine compliance documentation.