General Terms and Conditions

Note: The authoritative version of these General Terms and Conditions is the German language version. This English translation is provided for convenience only. In the event of any discrepancy, the German version shall prevail (see § 18(1)).

These General Terms and Conditions (GTC) apply to all contracts, and whenever we refer to them, between

Kopexa GmbH Schauenburgerstraße 116 24118 Kiel

Represented by the managing directors: Benjamin Schatter, Julian Köhn

Email: hello@kopexa.com Website: www.kopexa.com

Tax number: 20/294/00/897

Registry court: Amtsgericht Kiel Registration number: HRB 28912

(hereinafter "Kopexa", "we", "us")

and customers with entrepreneur status within the meaning of the German Civil Code (BGB), as well as public-law entities, institutes and institutions. We expressly and definitively exclude contracts with consumers.

Effective from: 01.01.2026

Preamble

These GTC are divided into a General Part, the provisions of which apply to all contracts between the customer and Kopexa (unless expressly deviated from in the Special Part), and a Special Part, which contains specific provisions for certain types of contracts that deviate from the General Part. Regardless of the specific contract, these GTC are always agreed in their entirety, even if certain contractual provisions are not relevant to a particular contract.

PART 1 – General Part

§ 1 Applicability of the General Terms and Conditions

(1) Kopexa GmbH, hereinafter referred to as Kopexa, offers a cloud-based software solutions platform for compliance management and related services. These General Terms and Conditions, hereinafter referred to as GTC, apply to all contracts concluded between Kopexa and customers, in particular for the rental of the Kopexa software, the provision of individual consulting services, the offering of training, and the acquisition of vouchers.

(2) These GTC apply to all current and future business and contracts concluded with you.

(3) The general provisions (Part 1 of these GTC) apply to all services listed in paragraph 1. In addition, the provisions of the respective contract type in the Special Part of these GTC apply, depending on the content of the agreed service.

§ 2 Customers of Kopexa

(1) Kopexa exclusively enters into contracts with entrepreneurs within the meaning of the German Civil Code. Should a consumer submit a contract proposal to Kopexa, Kopexa hereby expressly, seriously and definitively rejects such contract conclusion, regardless of further communication with the consumer.

(2) Entrepreneurs within the meaning of the German Civil Code are natural or legal persons or partnerships with legal capacity who act in the exercise of their commercial or independent professional activity when entering into a legal transaction. These GTC also apply to legal entities under public law or clients with special public-law assets. Consumers within the meaning of the German Civil Code are natural persons who enter into a legal transaction for purposes that are predominantly attributable neither to their commercial nor their independent professional activity.

(3) By placing an order, the customer implicitly declares that they are not a consumer.

§ 3 Deviating GTC

(1) These GTC apply in the version current at the time of contract conclusion.

(2) Kopexa expressly rejects conditions of the customer that conflict with or deviate from Kopexa's conditions.

(3) These GTC also apply if Kopexa performs services for the customer without reservation despite being aware of the customer's conflicting or deviating conditions.

(4) The agreement of deviating conditions requires an express agreement between the customer and Kopexa in at least electronic form.

§ 4 Contract Conclusion and Scope of Services

(1) The services offered on the Kopexa website do not constitute a legally binding offer, but merely an invitation to submit an offer (invitatio ad offerendum).

(2) For certain products, Kopexa enables ordering through direct booking on the Kopexa website. The selection is made by clicking on the respective products & services and clicking the "Checkout" button. There, the customer can review the order and must register with the complete data requested there and review and, if necessary, modify the order. The customer submits an offer to conclude a contract by clicking the "Buy Now" button. Kopexa then sends the customer an order and registration confirmation by email. The contract is concluded upon Kopexa's acceptance. In this email, the contract text is sent to the customer on a durable medium (contract confirmation). Kopexa stores the contract text.

(3) For contracts that Kopexa does not offer for direct conclusion on the website, the contract is concluded through an inquiry from the customer to Kopexa via any communication channel offered by Kopexa. Upon receipt of all required information from the customer, Kopexa sends the customer an individual offer by email. All services are individually listed in the offer. The customer can review their data during the offer review. The customer accepts the offer by notifying Kopexa. Kopexa then sends the customer an order confirmation by email and stores the contract text.

(4) The contract between the customer and Kopexa is concluded exclusively through the agreement between Kopexa and the customer. This contains the specific services owed by Kopexa.

(5) The contract start date stated in the specific agreement, which may also be set forth in the offer by Kopexa, applies as the start of a contract.

(6) Side agreements, amendments and supplements to the contractual agreement are only valid if expressly agreed between the customer and Kopexa in at least text form.

(7) The validity of these GTC remains unaffected.

§ 5 Fees, Default of Payment

(1) The fee payable by the customer for the services offered by Kopexa results from the respective offer to the customer or from the contractual communication in the ongoing contractual relationship between Kopexa and the customer. Price information on the website and in public communication by Kopexa merely represents non-binding calculation examples and does not establish a claim to the provision of the respective products and services at the publicly communicated amounts. The prices specifically agreed between Kopexa and the customer are always authoritative.

(2) All prices from Kopexa are net prices plus the applicable statutory value-added tax at the time of service provision.

(3) The deduction of cash discount is not permitted.

(4) Invoices are due immediately upon receipt. In individual cases, Kopexa may bilaterally agree with the customer on an individual payment deadline as part of a separate agreement.

(5) The customer authorizes Kopexa to collect the agreed fees via SEPA direct debit. The customer undertakes to grant Kopexa a SEPA direct debit mandate. The fees for the services provided by Kopexa are collected at the end of each month. The period for advance notification (pre-notification) is reduced to 5 banking days. The authorization also extends to processing fees from Kopexa for unauthorized reversals.

(6) Notwithstanding any agreed payment deadline, the customer is in default of payment no later than thirty days after invoicing or receipt of the service, without the need for a separate reminder from Kopexa.

(7) Kopexa charges processing fees of EUR 35 for each unauthorized reversal.

(8) In the event of default of payment, the outstanding amount bears interest. The interest provision of § 288(2) of the German Civil Code applies.

(9) If the customer is in default of payment of a due fee by more than 14 calendar days, Kopexa is entitled, after prior notification in text form and setting a reasonable grace period, to suspend access to the software. Kopexa's entitlement to payment remains unaffected by the suspension. Access to the software will be restored immediately upon full settlement of outstanding amounts.

§ 6 Set-off, Rights of Retention

(1) The customer may only set off against claims of Kopexa with undisputed or legally established claims.

(2) The customer may only assert a right of retention or right to refuse performance based on undisputed or legally established counterclaims arising from the same contractual relationship from which Kopexa's payment claims originate.

§ 7 Service Character of the Customer Relationship

(1) All products and services offered by Kopexa are to be understood as services and are offered exclusively as services. This also applies to customer-specific adaptations of the products and services offered by Kopexa.

(2) Deviating agreements for the conclusion of other types of contracts require an express written agreement.

§ 8 Use of Vicarious Agents and Representatives, Minimum Wage

(1) Kopexa is entitled to have parts of the owed services performed by external service providers and vicarious agents and to change or terminate these service providers at its own discretion, provided that this does not result in disadvantages for the customer.

(2) Kopexa undertakes to pay its employees at least the statutory minimum wages.

§ 9 Data Protection, Priority of the Data Processing Agreement

(1) Kopexa provides its services according to the instructions and on behalf of the customer. To the extent that the service, but not the contract conclusion itself, requires the processing of personal data, Kopexa processes this data as the customer's processor.

(2) Kopexa concludes a data processing agreement with the customer pursuant to Art. 28 GDPR, provided that Kopexa's service requires the processing of personal data. The provisions of the data processing agreement take precedence over these GTC to the extent and only to the extent that contradictions or gaps exist between these GTC and the data processing agreement.

(3) Kopexa points out that the processing of the customer's and its employees' personal data for the purpose of contract conclusion, contract performance, and advertising is not carried out as processing on the customer's instructions, but by Kopexa as controller based on Art. 6(1)(b), (c) & (f) GDPR. The legitimate interest pursued by Kopexa is customer communication & direct advertising.

§ 10 Customer's Cooperation Obligations

(1) Kopexa's service provision is subject to the customer's cooperation.

(2) The customer provides all contractually required information, data and other material necessary for Kopexa to perform the agreed services in a timely manner. Any deadlines to Kopexa's detriment only begin when the customer has performed the required cooperation.

(3) The customer is obligated to maintain the contact details of a qualified contact person and their deputy in Kopexa. These persons are authorized to make or promptly bring about all necessary decisions required for the performance of the contractually agreed service.

(4) If the customer fails to adequately fulfill their cooperation obligations, they are in default of acceptance without the need for a separate deadline. Kopexa is released from its obligation to perform to the extent that the specific performance obligation requires a cooperation action by the customer.

(5) Kopexa's entitlement to payment remains unaffected by any failure of the customer to cooperate.

§ 10a Indemnification

(1) The customer indemnifies Kopexa against all claims by third parties asserted against Kopexa due to unlawful acts or omissions by the customer or users authorized by the customer in connection with the use of the software. This includes the reimbursement of reasonable costs of legal defense including statutory attorney fees.

(2) The customer is obligated to support Kopexa in defending against such claims and to provide all necessary information immediately and completely.

(3) Kopexa will inform the customer immediately of any claim and, to the extent legally possible, give the customer the opportunity to defend against the asserted claim.

(4) Further claims for damages by Kopexa remain unaffected.

§ 11 Contract Communication, Marketing Emails

(1) Kopexa points out that the primary communication channel for contract communication will be electronic transmission. Only in exceptional cases will Kopexa communicate in written form. This does not affect telephone support.

(2) The customer is obligated to provide an email address to which Kopexa can send declarations of intent and other legal and/or quasi-legal declarations. If the customer does not provide a separate email address, Kopexa sends these declarations to the administrator account email address and/or the email address used for contract conclusion.

(3) Kopexa points out that other declarations relating to the contractual relationship (e.g., about new or improved software features) are distributed within the software in the "News" section. These notifications are deemed received six weeks after the start of their publication.

(4) Kopexa uses email addresses communicated in the course of the contractual relationship for direct advertising for its own similar goods or services, provided that the customer has not objected to this use. Objections can be declared free of charge at datenschutz@kopexa.com.

§ 12 Contract Term for Continuing Obligations, Termination, Deadlines

(1) The term of the contract between the customer and Kopexa is determined by the chosen subscription model (monthly or annual). The contract is automatically renewed for the respective subscription period unless terminated in a timely manner.

(2) The customer may cancel their subscription with 1 (one) day's notice before the end of the respective term. For monthly subscriptions, cancellation is possible at the end of the current month; for annual subscriptions, at the end of the current year.

(3) Kopexa may terminate a continuing obligation with 1 (one) day's notice before the end of the term.

(4) Cancellation can be made by the customer directly through their account on the Kopexa platform or in the payment portal (Stripe). Alternatively, cancellation in electronic form to Kopexa is possible. For a cancellation by Kopexa, sending the electronic message to the electronic mailbox of the registered administrator is sufficient.

(5) For customers with individually agreed payment arrangements outside the Stripe payment system, different cancellation arrangements may be agreed in writing.

(6) The right to extraordinary termination without notice remains unaffected. Such an important reason exists in particular if the respective other party violates material provisions of this contract and has not remedied the situation within a reasonable period after being requested to do so in at least electronic form. Furthermore, such an important reason exists in particular if:

• a party, despite prior warning, violates a material obligation (cardinal obligation),
• the customer endangers the security of Kopexa's products & services,
• the conditions of the products and services change materially for Kopexa,
• one of the parties completely ceases business operations,
• the financial circumstances of a party have deteriorated compared to the contract conclusion such that this party cannot fulfill its obligations in full or in part, in particular if this party ceases its payments or services, enforcement is conducted against its assets, or insolvency proceedings or other judicial or extrajudicial debt settlement proceedings have been or are being initiated against its assets, or the opening of insolvency proceedings is rejected for lack of assets.

(7) If the customer is responsible for the reason for termination, the customer is obligated to pay Kopexa the agreed remuneration, less expenses saved by Kopexa, until the date on which the contract would have ended at the earliest in the event of ordinary termination.

§ 13 Withdrawal from Time-Bound Services

(1) In the event of cancellation of time-bound services by Kopexa due to events not foreseeable at the time of contract conclusion (force majeure, operational disruptions of any kind, or labor shortages) for which Kopexa is not responsible, Kopexa is only entitled to withdraw from the contract if these events substantially hinder or make impossible the performance of the individual consulting service and the impediment is not merely of a temporary nature. In the case of temporary impediments, the originally agreed date for the individual consulting service is postponed by the period of the impediment plus a reasonable start-up period. To the extent that the customer or their employees cannot reasonably be expected to use the individual consulting service as a result of the delay, the customer may withdraw from the contract.

(2) Withdrawal requires text form. In the event of withdrawal, the fee already paid by the customer will be refunded.

§ 14 General Exclusion & Limitation of Liability

(1) Kopexa is liable for damages arising from injury to life, body or health based on a negligent breach of duty by Kopexa or an intentional or negligent breach of duty by a legal representative or vicarious agent of Kopexa.

(2) Furthermore, Kopexa is liable for other damages based on a grossly negligent breach of duty by Kopexa or an intentional or grossly negligent breach of duty by a legal representative or vicarious agent of Kopexa, or under a mandatory statutory liability provision, such as the Product Liability Act.

(3) For slight negligence, Kopexa is only liable in the event of a breach of a material contractual obligation (cardinal obligation). Cardinal obligations are contractual obligations whose fulfillment is essential for the proper performance of the contract and on whose compliance the customer may regularly rely. In this case, however, liability is limited to the replacement of the foreseeable, typically occurring damage.

(4) Otherwise, Kopexa's liability is excluded. This does not apply to the extent that Kopexa has assumed a guarantee or fraudulently concealed a defect. The liability provisions above remain unaffected by the exclusion of liability.

(5) The limitations of liability resulting from paragraph 4 also apply to breaches of duty by persons whose fault Kopexa is responsible for under statutory provisions, such as legal representatives, senior employees, corporate bodies and vicarious agents, as well as agents of Kopexa.

(6) Kopexa's total liability, regardless of the legal basis, is limited to the following amounts per calendar year: (a) for Free and Lite plans, EUR 10,000 or the annual contract fee, whichever is higher; (b) for Pro plans, EUR 50,000 or the annual contract fee, whichever is higher; (c) for Enterprise plans, EUR 500,000. This limitation does not apply to the cases referred to in paragraphs 1 and 2.

(7) If the customer's damages result from the loss of data, Kopexa is not liable for this to the extent that the damages would have been avoided by regular and complete backup of all relevant data by the customer.

(8) Kopexa recommends that the customer take out their own insurance against data loss and business interruptions.

(9) A limitation period of one year from the customer's knowledge of the facts giving rise to the claim applies to damage claims. This does not apply to the cases referred to in paragraphs 1 and 2.

(10) The customer is obligated to take reasonable measures to mitigate damage and to inform Kopexa immediately of potential damages to give Kopexa the opportunity to limit the damage.

§ 15 Liability in Connection with Data Transfers at Interfaces

(1) Kopexa offers the integration of products & services into the customer's system landscape via interfaces (so-called integration). Programs that access Kopexa's interfaces are programs of external companies.

(2) The customer's use of the interfaces to integrate Kopexa's products & services into an existing system landscape does not under any circumstances establish a contractual, quasi-contractual or other legal relationship between the third party and Kopexa.

(3) The scope of functions, prices, term and other terms of use for the provision of integrations, including support, are governed by the contractual provisions between the customer and the third-party provider. To use an integration, the customer must have the right to use the third-party system to be connected.

(4) Kopexa assumes no liability or warranty for the functioning and/or integrity of the interfaces.

(5) In the event of integration of its products & services into an existing system landscape using interfaces, Kopexa only assumes liability for data integrity up to the handover point at the interface and the time of data handover at the interface. In no event does Kopexa assume liability or responsibility for data integrity from the time the data is made available at the interface for acceptance by third-party software.

(6) This also applies if Kopexa specifically optimizes its products & services for interfaces of certain third-party providers. Despite optimization for the interfaces, the third-party provider determines the specification of its software and Kopexa cannot guarantee compatibility with third-party software.

§ 16 Data Transmission on the Internet, Availability & Maintenance

(1) Kopexa offers products & services including as cloud-based services over the internet. The functionality of these services depends on the availability of the internet connection, over which Kopexa has no direct influence. Therefore, Kopexa is not liable for incorrect or incomplete data transmission on the internet due to faulty operation of internet software, browsers or internet infrastructure, in particular not for connection failures on the customer's side. The software is made available at the router exit of the data center (handover point). From this point, responsibility for data transmission lies outside Kopexa's sphere of influence.

(2) Kopexa strives to achieve server availability of 99.0% as an annual average. Excluded are times during which Kopexa performs maintenance or troubleshooting work. Kopexa strives to perform maintenance outside of times with high server utilization. Where possible, Kopexa announces scheduled maintenance by electronic notification to the customer in advance.

(3) Kopexa uses SSL certificates to encrypt data transmission to protect data during transmission from third-party access. Data storage is also encrypted. To the extent that new security standards become established in the future that optimize the protection of data from third-party access, Kopexa strives to implement these security standards.

§ 16a Service Level Agreement (SLA)

(1) For customers with Pro and Enterprise plans, Kopexa may provide a Service Level Agreement (SLA) containing detailed agreements on availability, response times for incidents and support services.

(2) If an SLA has been agreed between Kopexa and the customer, it applies in addition to these GTC. In the event of conflicts between the SLA and these GTC, the SLA prevails to the extent it contains provisions on software availability and support services.

(3) The SLA contains in particular provisions on:

• Guaranteed system availability
• Maintenance windows and their announcement
• Definition of incident classes and corresponding response times
• Scope and availability of technical support
• Escalation paths for serious incidents
• Possible refunds or credits in the event of non-compliance with the agreed service levels

(4) Enterprise customers with "8/5 Dedicated Support" receive guaranteed response times and a named contact for support requests. The specific conditions are set out in the individual SLA.

(5) The customer acknowledges that despite all efforts by Kopexa, technical problems and service interruptions cannot be completely excluded. The conditions set out in the SLA exclusively define the customer's rights in the event of disruptions or failures of the software.

§ 17 Changes to the GTC, Price Adjustments

(1) Kopexa informs the customer of changes to the GTC by sending the new General Terms and Conditions in electronic form and a notification of the changeover date. The amended version of the GTC becomes part of the contract if the customer does not object within six weeks of receipt by termination in text form.

(2) After the initial term, Kopexa may adjust prices in line with general price developments. Kopexa informs the customer of price adjustments in electronic form, announcing a changeover date. If the price increase exceeds 6% of the previous fee, the customer receives a special right of termination effective as of the date the price adjustment takes effect.

(3) Continued use of Kopexa's software after the notification, after the respective changeover date and without a notice of termination is deemed implicit consent to the price adjustment or the amendment of the General Terms and Conditions. Kopexa expressly informs the customer of the legal consequence of continued use of the service in the respective notification.

§ 18 Language Version, Choice of Law, Jurisdiction & Miscellaneous

(1) The authoritative version for the use of these General Terms and Conditions is the German language version. Any translations into other languages are merely a convenience offering by Kopexa. In the event of a discrepancy between the German version and a translation, the German version prevails.

(2) All contracts are subject to the law of the Federal Republic of Germany, excluding private international law and the United Nations Convention on Contracts for the International Sale of Goods (CISG).

(3) The exclusive place of jurisdiction for disputes arising from or in connection with this contract is Kiel (Schleswig-Holstein), to the extent that the contracting parties are merchants, legal entities under public law or special public-law assets and no legally exclusive place of jurisdiction applies.

(4) There are no side agreements.

(5) Side agreements, amendments and supplements as well as cancellations require written form. This also applies to changes to this written form requirement.

(6) The parties are not entitled to transfer rights and obligations under this contract to third parties without the prior written consent of the other party.

(7) Kopexa is entitled to name the customer as a reference customer and to use their name, logo or other business designation for marketing purposes, in particular on the website, in presentations and in advertising materials. The customer may object to this use at any time informally by email to hello@kopexa.com. In the event of an objection, Kopexa will remove the corresponding references within 14 business days.

(8) If a party does not exercise its rights in the course of the business relationship, whether arising from contract, from a breach of contract by the other party or from law, this does not constitute a waiver of the enforcement of these rights or any other rights under this agreement in relation to the other party.

(9) Any General Terms and Conditions of the customer do not apply, even if they have not been expressly objected to.

(10) Should individual or multiple provisions be or become wholly or partially invalid or unenforceable, this shall not affect the validity of the remaining provisions. The same applies in the event of a gap. The parties are aware of the case law of the Federal Court of Justice according to which a salvatory clause merely reverses the burden of proof. However, it is the express will of the parties to maintain the validity of the remaining contractual provisions under all circumstances and thus to exclude § 139 BGB entirely.

(11) A gap is to be replaced by a provision that comes as close as legally possible to what the parties economically intended.

(12) In place of a void or invalid provision, the parties hereby agree to enter into good-faith negotiations on a replacement provision that comes closest legally and economically to what the parties intended or would have intended given the purpose if they had considered this point at the time of conclusion. If the invalidity of a provision is based on a measure of performance or time (deadline or date) specified therein, the provision is to be agreed with the legally permissible measure closest to the original measure.

§ 18a Confidentiality

(1) The parties undertake to permanently keep confidential all information of the respective other party that became known to them in the course of the contractual relationship and is marked as confidential or is recognizable as trade or business secrets according to the circumstances, not to disclose it to third parties, record it or exploit it in any other way, unless the respective other party has expressly consented in writing to the disclosure or use.

(2) This obligation does not apply to information that:

• was already known to the other party before, without the information being subject to a confidentiality obligation,
• is generally known or becomes known without violation of the assumed confidentiality obligations,
• is disclosed to the other party by third parties without violation of a confidentiality obligation,
• must be disclosed due to statutory provisions, official or judicial orders.

(3) The confidentiality obligation continues to apply after termination of the contractual relationship.

PART 2 – Special Conditions for Individual Contracts

§ 19 Contract Content, License for the Kopexa Compliance Management Software

(1) Kopexa offers a comprehensive compliance management software (hereinafter "Software") as a service via an internet cloud solution, so-called Software-as-a-Service, in the form of a service by making the software available. The Software enables the customer to systematically structure their compliance management, identify, assess and monitor risks, track regulatory requirements, create and manage compliance documentation, and optimize compliance processes using AI-powered functions. The customer can also use the Software via web app on a smartphone or tablet. When used in this way, the customer has no claim that all functions otherwise available can also be used. Kopexa is not liable for a specific performance result.

(2) Upon contract conclusion, the customer receives a usage license in the form of a simple, non-exclusive, non-transferable usage right to the Software that is limited to the number of users agreed in the contract and the contract term. The customer is responsible for the technical setup and administration of all accounts.

(3) The customer is obligated to use the Software only in accordance with the contract and applicable legal provisions and not to infringe third-party rights when using it.

(4) Regarding the specific scope of functions, the content of Kopexa's offer applies, subject to any adjustments to the Software. Depending on the chosen plan (Free, Lite, Pro or Enterprise), the customer has access to different functions, such as:

• Management of compliance frameworks
• Management of assets, vendors and documents
• Various authentication methods (incl. MFA and SSO)
• AI-powered compliance functions
• Audit logs and history functions
• Integrations with third-party software (e.g., Slack, Teams, MS, Google, Personio)
• Webhooks
• Custom templates
• Custom workflows
• Custom dashboards and reports

(5) By acquiring the usage right, the customer is entitled to process and store their own data for their own purposes within the scope of the account set up for them or their employees and the functionalities of the Software.

(6) Kopexa offers the Software in its condition at the time of contract conclusion ("as is"). The customer may not and shall not make any changes to the Software. The customer has no claim to the adaptation of the Software by Kopexa. Kopexa remains the owner of the Software and the underlying source code. The source code is not part of the Software and is not made available by Kopexa.

(7) Kopexa guarantees that the provided Software is free from third-party intellectual property rights.

(8) Kopexa collects anonymized statistics, usage profiles and business metrics, evaluates these for server load distribution, performance optimization and security measures, and makes these available in anonymized form.

(9) The statutory provisions of rental law apply to the warranty with the following provisions: §§ 536b BGB (customer's knowledge of the defect at contract conclusion or acceptance) and 536c BGB (defects occurring during the rental period; defect notification by the customer) apply. The application of § 536a(2) BGB (tenant's self-remedy right) is excluded. § 536a(1) BGB (landlord's duty of damages) does not apply to the extent it provides for fault-independent liability.

§ 20 Fees, Availability, Updates and Invoicing

(1) The use of the Software is subject to the agreed monthly or annual fee corresponding to the customer's chosen plan (Free, Lite, Pro or Enterprise). Kopexa offers various plans with different service scopes, which are described in more detail on the Kopexa website or in the individual offer.

(2) The plans differ in particular with regard to the following features:

• Number of available users/spaces
• Number of available frameworks
• Scope of support (community, email, chat, dedicated support)
• Scope of functions (AI-powered compliance, audit logs, integrations, etc.)
• Additional features according to the current plan overview

(3) The fees for the various plans are available on the Kopexa website or are set out in the individual offer. An annual billing discount is granted compared to monthly billing.

(4) Billing occurs monthly or annually in advance, depending on the chosen billing cycle. Payment is generally made through the Stripe payment portal. For annual billing, the full annual amount is due at the beginning of the billing period. Billing periods that have begun must be paid in full.

(5) For Enterprise customers or customers with individually agreed payment arrangements, different payment conditions may be agreed in writing.

(6) The minimum contract term depends on the chosen plan:

• Free: No minimum term
• Lite: 1 month for monthly billing, 12 months for annual billing
• Pro: 1 month for monthly billing, 12 months for annual billing
• Enterprise: 12 months

(7) Should the customer wish to expand their usage scope (e.g., through more users/spaces or additional features), a switch to a higher-tier plan is required. The plan change can be made at any time and takes effect immediately. The difference to the higher plan is charged pro rata for the remainder of the current billing period.

(8) Additional one-time or recurring fees may apply for setup, onboarding, custom branding or individual development services, which are invoiced separately.

(9) The customer is obligated to keep the access data provided by Kopexa or their self-assigned access data confidential and to make them accessible only to those users who need access to the Software. If unauthorized use of the Software occurs, the customer is obligated to bear the fees that other persons have incurred through unauthorized use of their access credentials.

(10) The customer is responsible for compliance with statutory regulations. Kopexa neither provides legal advice nor guarantees the implementation of all compliance requirements or obligations. Nevertheless, Kopexa endeavors to implement legal changes and innovations within the Software within a reasonable period, e.g., through a software update. The customer may suggest such adjustments to the Software to Kopexa. The customer has no claim to such an update. Relevant changes of new versions can be viewed in the Software in the "News" section.

§ 21 System Requirements, Customer's Responsibility

(1) Which system landscapes, browsers and operating systems are supported by the Software in detail is determined by Kopexa. Kopexa informs the customer online about the supported browser versions. There is no claim to support for specific system landscapes, operating systems or browser versions.

(2) With regard to the data stored by the customer in the Software, the data processing agreement to be concluded between the parties applies. The customer is exclusively responsible for the content and data processed with the Software.

§ 22 Data Backup

(1) The data on Kopexa's servers is backed up daily (system backup). In addition, Kopexa provides the customer with a programming interface (API) that enables the export of customer-processed data in a standard format. The performance, verification and storage of own backups (content backup) is the customer's responsibility. In the event of a Software failure and any associated data loss, Kopexa will restore the last available backup. This may result in certain data not yet secured by the backup needing to be re-entered.

(2) After the end of the contract term, Kopexa deletes all stored customer data within three months at the latest, unless statutory retention obligations prevent this.

(3) The customer is obligated to save data such as reports, lists, etc. on their own data carriers if and to the extent they wish to prevent the loss of data after the end of the contract term. This also applies in the event of termination for cause.

§ 23 Contract Content for Individual Consulting Services

(1) Individual consulting services within the meaning of these GTC are any form of paid support for an individual customer in the introduction and/or use of the Software. Individual consulting services can be carried out by telephone and/or online via the Software at the customer's request. Individual consulting services also include the individually agreed consulting hours in the form of Kopexa Starters.

(2) The customer can use the remote desktop software specified in the data processing agreement as part of online support to make support more effective.

(3) If no date has been agreed for the individual consulting service, the customer's claim to use the individual consulting service becomes time-barred one year from the invoice date.

§ 24 Cancellation of Individual Consulting Services

The cancellation of booked but not yet utilized individual consulting services for a fixed date by the customer is permissible and must be in text form. In the event of cancellation by the customer, the following cancellation schedule applies:

• Cancellation up to 7 business days before the booked date: free cancellation
• Cancellation between 7 business days and 3 business days before the booked date: 50% of the agreed remuneration is payable
• Cancellation less than 3 business days before the booked date: 100% of the agreed remuneration is payable

§ 25 Training, Subject Matter

(1) Kopexa offers training sessions in which multiple customers/participants can participate. Training takes place in premises provided by Kopexa or remotely via a virtual meeting room.

(2) The content, timing and duration of the training result from the individual agreement between Kopexa and the customer or through the customer's booked training order in the Kopexa Online Shop. The agreement is binding for the specific date when the selection is confirmed by Kopexa.

(3) The number of participants per training is limited. Registrations are processed in the order received.

§ 26 Withdrawal and Cancellation

(1) If fewer registrations than the specified minimum number of participants are received for a training session, Kopexa is entitled to withdraw from the contract.

(2) The customer can cancel training sessions free of charge up to 10 business days before the start of the training. Cancellation of participation in training must be in text form.

(3) If the customer cancels a training session 10 business days or less before the start of the training, the agreed training fee is owed as a cancellation fee. In the event of a paid cancellation, the customer is entitled to nominate a substitute participant.

(4) In the event of a paid cancellation without nominating a substitute participant, the customer may book a new training session, for which Kopexa will, as a gesture of goodwill, credit the already paid fee from the cancelled training. If the credited amount is less than the new training fee, the customer must pay the difference. If the credited amount exceeds the new training fee, the remaining credit is retained and can be used within the goodwill period. This goodwill credit is time-limited to exactly two years. Deviating from statutory provisions, the customer's claim to use the training becomes time-barred two years from the invoice date on Kopexa's invoice.

(5) Cash payment of the goodwill training credit is excluded.

(6) Full payment is due if a participant does not appear for the agreed training date without cancellation.

§ 27 Compliance-Specific Provisions

(1) With its Software, Kopexa offers a platform for the management, documentation and monitoring of compliance-relevant processes and regulations. The Software merely represents a tool and does not relieve the customer of their responsibility for compliance with all relevant legal and regulatory requirements.

(2) The customer is solely responsible for the entry, accuracy and completeness of all data and information stored in the Software. Kopexa assumes no liability for the accuracy, completeness or timeliness of the data entered by the customer or the resulting compliance measures and decisions.

(3) The Software may contain standardized templates and processes for typical compliance requirements. These templates serve only as guidance and must be adapted by the customer to their specific requirements and applicable regulatory provisions. Kopexa makes no warranty that the templates and processes in the Software cover all legal requirements that may be relevant to the customer.

(4) Kopexa is not responsible for the legal assessment of the compliance processes and measures managed by the customer in the Software. The use of the Software does not replace advice from a lawyer or compliance consultant.

§ 28 AI-Powered Functions

(1) The Kopexa Software offers AI-powered functions in certain plans to support compliance management. These functions may include suggestions for compliance documentation, risk analyses, text generation, summaries of regulations and rules, or the automated creation of process documentation.

(2) The customer acknowledges that the AI-powered functions are technologies based on machine learning and statistical models. The results and suggestions of the AI are therefore to be understood as tools and do not replace:

• legal assessment by qualified professionals or legal advisors
• independent review and decision-making by the customer
• professional expertise in compliance matters
• regulatory approvals or official confirmations

(3) Kopexa assumes no liability for the accuracy, completeness, timeliness or applicability of content, recommendations or analyses generated by AI-powered functions. The responsibility for reviewing and using this content lies exclusively with the customer. In particular, Kopexa makes no warranty that the results generated by the AI functions are suitable for the customer's specific requirements or comply with all applicable legal or regulatory requirements.

(4) The customer undertakes not to use the AI-powered functions to:

• create illegal or ethically questionable content
• circumvent regulatory provisions
• generate false or misleading compliance documentation
• train the AI with sensitive personal data whose processing is not covered by a legal basis
• use the AI functions beyond the contractually agreed scope

(5) Content generated by the AI may constitute copyrighted works. The usage rights to this content are available to the customer exclusively for their internal compliance purposes. Sharing the content with third parties is only permissible in the context of fulfilling regulatory requirements or in the course of the customer's normal business activities.

(6) When using the AI-powered functions, the customer may not input data that violates legal provisions, infringes third-party rights or offends public morals. The customer indemnifies Kopexa against all claims by third parties arising from unlawful use of the AI functions by the customer or with their approval.

(7) Kopexa is entitled to use the data and information entered by the customer within the scope of statutory provisions to improve the AI models, provided that the data is not marked as confidential or contains personal data. Details on data usage for AI training are set out in the separate data processing agreement.

(8) Kopexa reserves the right to regularly update or modify the AI-powered functions to improve performance or adapt to legal requirements. Should material AI functions be discontinued, Kopexa will inform the customer in a timely manner and grant a special right of termination if the changes lead to a material impairment of the contractually agreed services.