General Terms and Conditions for IT Services, Software Development and Hosting

Version: 2024-06-01

These General Terms and Conditions (“Terms”) apply to services provided by:

rootprompt GmbH Leopold-Finster-Straße 3, 4060 Leonding Commercial Register No.: FN 584026 m VAT ID: ATU78419016 Email: info@rootprompt.at (“Provider”)

to its business customers (“Customer”).

1. Scope and Application

1.1. These Terms apply to all contracts between the Provider and the Customer concerning information technology services, including in particular:

• IT consulting and technical advisory services;
• custom software and application development;
• website and web application development;
• software maintenance and support;
• system administration;
• application, website, server and infrastructure hosting;
• managed services;
• email hosting and related email services;
• domain, DNS and certificate management;
• integrations and interfaces;
• migration services;
• monitoring, backup and recovery services where expressly agreed; and
• related technical and professional services.

1.2. These Terms apply exclusively to Customers acting in the course of their business or professional activity. They are not intended for contracts with consumers.

1.3. The precise scope of the Provider’s obligations is determined by the applicable offer, order confirmation, statement of work, service description, project agreement, service level agreement (“SLA”) or other individual agreement (collectively, an “Order”).

1.4. In case of conflict, the following order of precedence applies:

1. the applicable Order or individually negotiated agreement;
2. any applicable SLA;
3. any applicable data processing agreement;
4. these Terms; and
5. other service descriptions or documentation supplied by the Provider.

Individual agreements expressly made between the parties prevail over these Terms.

2. Formation of Contracts and Offers

2.1. Unless expressly stated otherwise, quotations and estimates issued by the Provider are non-binding.

2.2. A contract is formed when the Provider accepts an Order, confirms the Customer’s instruction, commences performance at the Customer’s request, or otherwise expressly agrees to provide the relevant services.

2.3. Estimates are based on the information and requirements available when they are prepared. Unless expressly agreed as a fixed price, an estimate does not constitute a maximum price.

2.4. Additional work caused by incomplete, incorrect or subsequently changed Customer requirements is chargeable separately.

3. Customer Cooperation

3.1. The Customer shall provide all information, decisions, content, credentials, access rights, infrastructure, documentation, test data and other cooperation reasonably required for the Provider to perform the services.

3.2. The Customer shall designate suitably authorised contacts who can make technical and commercial decisions within reasonable time.

3.3. The Customer is responsible for the accuracy and completeness of information, specifications and materials supplied by it.

3.4. Deadlines shall be extended appropriately where performance is delayed by:

• missing or delayed Customer cooperation;
• changes requested by the Customer;
• third-party systems outside the Provider’s control;
• delayed approvals or decisions;
• unavailable access or credentials; or
• other circumstances for which the Provider is not responsible.

3.5. Any additional effort resulting from such circumstances may be charged at the applicable hourly rates.

4. Changes to Scope

4.1. Either party may propose changes to an agreed project or service.

4.2. The Provider may assess the impact of a requested change on price, timing, technical feasibility, operating costs and other agreed requirements before implementing it.

4.3. Unless otherwise agreed, changes are performed on a time-and-materials basis at the applicable rates.

4.4. The Provider is not required to implement a requested change where it would create an unreasonable technical, security, legal or operational risk.

5. Performance and Project Delivery

5.1. The Provider shall perform the agreed services with reasonable professional care and in accordance with the applicable Order.

5.2. Unless expressly agreed as binding, delivery dates and project schedules are estimates.

5.3. Development may be carried out iteratively. Specifications, prototypes, tickets, mock-ups, backlog items, acceptance criteria and similar project materials may form part of the agreed requirements where confirmed by the parties.

5.4. The Provider may use appropriate development tools, libraries, frameworks, open-source software, cloud services and third-party components unless the Order provides otherwise.

6. Acceptance of Development Work

6.1. Where an Order provides for formal acceptance, the Customer shall test the relevant deliverable within 10 business days after it is made available for acceptance, unless another period is agreed.

6.2. The Customer may reject acceptance only because of material deviations from expressly agreed requirements that substantially impair the agreed use of the deliverable.

6.3. Minor defects that do not materially impair use do not prevent acceptance and shall be remedied within a reasonable period.

6.4. The Customer shall identify alleged defects with sufficient detail to permit reproduction and investigation.

6.5. Unless otherwise agreed, a deliverable shall be deemed accepted if:

• the Customer expressly accepts it;
• the Customer puts it into productive use; or
• the acceptance period expires without the Customer identifying a material defect preventing acceptance.

7. Fees, Time Recording and Expenses

7.1. Fees are determined by the applicable Order. Unless a fixed price has expressly been agreed, services are charged according to actual time spent at the agreed hourly or daily rates.

7.2. Unless otherwise stated, prices are exclusive of VAT and other applicable taxes.

7.3. Necessary and reasonable third-party expenses, licences, travel expenses, cloud charges, domain fees, certificate fees and similar external costs may be charged separately where they are not expressly included in the agreed price.

7.4. Work requested outside the agreed scope is charged according to the Provider’s applicable rates.

7.5. The Provider may require advance payments, recurring payments or reasonable payment milestones for projects and recurring services.

8. Invoicing and Payment

8.1. Invoices are payable within 14 days from the invoice date without deduction unless otherwise agreed.

8.2. The Customer shall raise reasonable objections to an invoice promptly and identify the disputed amount and basis of the objection. Undisputed amounts remain payable.

8.3. In case of late payment, the Provider may charge statutory default interest and legally recoverable collection costs.

8.4. If the Customer is materially overdue despite reminder and a reasonable grace period, the Provider may suspend affected services to the extent reasonable, provided that the suspension does not create a disproportionate security or data-loss risk.

9. Hosting and Managed Services

9.1. Hosting and managed services are provided in accordance with the applicable Order and any applicable SLA.

9.2. No particular uptime, response time, recovery time, recovery point, support availability or other service level is guaranteed unless expressly agreed in an SLA or Order.

9.3. The Provider may perform planned maintenance where reasonably necessary for security, stability, updates, capacity management or technical operation. Where practicable, potentially disruptive planned maintenance will be announced in advance.

9.4. Temporary interruptions may occur as a result of maintenance, security measures, infrastructure failures, telecommunications failures, third-party services, attacks, force majeure or other technical circumstances.

9.5. The Provider may implement urgent maintenance without prior notice where reasonably necessary to prevent or mitigate a security incident, service failure, data loss or material risk.

10. Backups and Recovery

10.1. Backup, replication, disaster recovery and archival services are provided only to the extent expressly included in the applicable Order or service description.

10.2. Unless an SLA expressly specifies otherwise, no particular recovery point objective (“RPO”) or recovery time objective (“RTO”) is guaranteed.

10.3. Unless the Provider has expressly assumed responsibility for backup under an Order, the Customer remains responsible for maintaining an appropriate independent backup of Customer data.

10.4. A backup service is not an archival service unless expressly agreed.

10.5. Where restoration work becomes necessary because of Customer actions, Customer systems, deleted or corrupted Customer data, unauthorised third-party access not attributable to the Provider, or other circumstances outside the Provider’s responsibility, restoration work may be charged separately.

11. Email Services

11.1. Where the Provider supplies or manages email services, its responsibility is limited to the systems and configuration within its agreed scope of control.

11.2. The Provider does not guarantee delivery or receipt of individual email messages where delivery depends on external networks, recipient systems, reputation systems, spam filters, blocklists, DNS infrastructure or other third-party systems.

11.3. The Customer shall not use email services for unsolicited bulk messaging, unlawful communications, phishing, malware distribution or conduct reasonably likely to damage the reputation or deliverability of the Provider’s infrastructure.

11.4. The Provider may take reasonable measures to protect its mail infrastructure, other customers and third parties, including temporarily restricting sending where abuse, compromise or abnormal traffic is reasonably suspected.

12. Domains, Certificates and Third-Party Services

12.1. Where the Provider procures domains, certificates, cloud infrastructure, software licences or other third-party services on behalf of the Customer, those services may additionally be subject to the relevant third party’s terms.

12.2. Unless otherwise agreed, the Provider acts only as a technical or administrative intermediary in relation to domain registration and similar third-party services.

12.3. The Provider is not responsible for a third party discontinuing, changing or restricting its service except to the extent the Provider itself caused the relevant problem or expressly assumed that risk.

12.4. Where commercially reasonable, the Provider will assist the Customer in addressing third-party failures. Such assistance may be chargeable unless included in an SLA or other agreed support service.

13. Support and Emergencies

13.1. Normal support is provided during the Provider’s business hours:

Business Hours: Monday to Friday, 09:00–17:00 Central European local time, excluding Austrian public holidays, unless otherwise agreed.

13.2. Support outside Business Hours is available only where expressly agreed or where the Provider voluntarily accepts an emergency request. Unless an SLA states otherwise, the Provider does not guarantee out-of-hours availability or response times.

13.3. An “Emergency” means an incident that causes or imminently threatens a material interruption of a business-critical service, significant data loss, or a material information-security incident and which reasonably requires intervention before the next Business Hours period.

13.4. Out-of-Hours Emergency Rate

Work performed outside Business Hours in response to an Emergency is charged at twice (2×) the otherwise applicable hourly rate where the Emergency was caused wholly or predominantly by circumstances outside the Provider’s reasonable responsibility or control.

This includes, in particular, emergencies caused by:

• errors, actions or omissions of the Customer or its users;
• incorrect configuration by the Customer or a third party;
• Customer-owned or Customer-managed hardware, software, networks or infrastructure;
• credentials disclosed, lost or compromised by the Customer or its users;
• unauthorised modifications made outside the Provider’s agreed scope;
• third-party systems or service providers selected or contracted directly by the Customer;
• Customer-supplied software, plugins, integrations or dependencies;
• use contrary to documentation or the Provider’s reasonable technical instructions; or
• comparable circumstances for which the Provider is not responsible.

13.5. The 2× rate applies only to time actually spent responding to, diagnosing, containing, mitigating or resolving the Emergency outside Business Hours.

13.6. The 2× rate does not apply merely because an incident occurs outside Business Hours. In particular, it does not apply to the extent the Emergency is attributable to:

• a breach by the Provider of an applicable contractual obligation;
• a defect introduced by the Provider and within the Provider’s agreed responsibility;
• failure of infrastructure which the Provider has expressly undertaken to operate and for which the Provider is contractually responsible; or
• failure by the Provider to perform expressly agreed maintenance or security measures.

13.7. Where responsibility cannot reasonably be determined at the beginning of an incident, the Provider may first perform the work necessary to stabilise the situation. The applicable rate may be determined after reasonable technical investigation based on the predominant cause of the incident.

13.8. Any specific emergency-support pricing, included support hours, on-call arrangements, service credits or incident-response obligations contained in an SLA take precedence over this section.

14. Customer Systems and Security Responsibilities

14.1. Unless included in the Provider’s agreed scope, the Customer remains responsible for:

• its endpoints and local networks;
• user administration and access permissions;
• password and credential security;
• installation of updates on Customer-managed systems;
• appropriate endpoint protection;
• its own personnel and contractors;
• lawful configuration and use of the services; and
• appropriate business-continuity arrangements.

14.2. The Customer shall notify the Provider without undue delay if it becomes aware of a security incident relevant to services operated by the Provider.

14.3. The Provider may take reasonable emergency measures where necessary to protect systems, data or third parties, including temporarily disabling an account, interface or affected service.

15. Customer Content and Acceptable Use

15.1. The Customer remains responsible for data, content, applications and communications placed on or transmitted through the services by or on behalf of the Customer.

15.2. The Customer shall not knowingly use the services:

• unlawfully;
• to infringe intellectual-property or other third-party rights;
• to distribute malware;
• for phishing or fraudulent activity;
• to send unlawful unsolicited communications;
• to unlawfully access third-party systems; or
• in a manner that creates a material and unreasonable risk to the Provider’s systems or other customers.

15.3. Where immediate action is reasonably required for legal, security or infrastructure-protection reasons, the Provider may restrict affected services. Where reasonably possible, the Provider shall inform the Customer and permit remediation before suspension.

16. Intellectual Property and Software Rights

16.1. Each party retains all rights in materials, software, documentation, know-how, methods, trademarks and other intellectual property owned or developed by it independently of the relevant Order.

16.2. Unless an Order provides otherwise, the Provider retains ownership of reusable components, libraries, frameworks, tools, generic modules, templates, development methods, know-how and other material that is not uniquely created for the Customer (“Provider Materials”).

16.3. Upon full payment of the relevant fees, the Customer receives a perpetual, non-exclusive right to use deliverables created specifically for the Customer for the Customer’s own business purposes, including the right to operate, reproduce, maintain and modify those deliverables and to engage third-party service providers to do so on the Customer’s behalf.

16.4. Any broader transfer, exclusivity, resale right, sublicensing right, source-code ownership or assignment of intellectual-property rights must be expressly agreed in the applicable Order.

16.5. Rights in third-party and open-source components remain governed by their respective licence terms.

16.6. The Provider remains free to use general skills, concepts, experience, ideas and know-how acquired in the course of providing the services, provided that it does not disclose the Customer’s confidential information or reproduce Customer-specific protected material.

17. Open-Source and Third-Party Software

17.1. Deliverables may incorporate open-source or third-party components where technically appropriate.

17.2. Such components remain subject to their applicable licence terms.

17.3. The Provider shall not knowingly incorporate components whose licence terms materially conflict with an expressly agreed licensing requirement of the Customer.

17.4. The Provider is not responsible for defects or vulnerabilities subsequently discovered in third-party software except to the extent that maintenance, patching or remediation of that software is expressly included in the Provider’s services.

18. Confidentiality

18.1. Each party shall keep confidential non-public commercial, technical and organisational information received from the other party and shall use such information only for purposes connected with the contractual relationship.

18.2. Confidentiality obligations do not apply to information that the receiving party can demonstrate:

• was already lawfully known to it;
• is or becomes public without breach of confidentiality;
• was lawfully received from a third party;
• was independently developed without use of the confidential information; or
• must be disclosed by law or binding authority.

18.3. The Provider may disclose confidential information to employees, subcontractors and professional advisers who require it for contractual purposes and are subject to appropriate confidentiality obligations.

18.4. These confidentiality obligations survive termination of the contractual relationship.

19. Data Protection

19.1. Each party shall comply with the data-protection obligations applicable to it.

19.2. To the extent the Provider processes personal data on behalf of the Customer as a processor, the parties shall enter into an appropriate data processing agreement where required.

19.3. The applicable data processing agreement governs matters including processing instructions, confidentiality, security measures, subprocessors, assistance obligations, deletion or return of data and other processor obligations.

19.4. Where there is a conflict concerning processing of personal data, the applicable data processing agreement takes precedence over these Terms.

20. Defects and Warranty

20.1. The Customer shall notify the Provider of defects without undue delay after discovery and provide sufficient information to permit reproduction and diagnosis.

20.2. The Provider shall have a reasonable opportunity to investigate and remedy a substantiated defect before the Customer engages a third party to remedy it at the Provider’s expense, except where immediate action is reasonably necessary.

20.3. A defect does not exist merely because software:

• contains minor imperfections that do not materially impair agreed use;
• does not operate with systems or configurations not included in the agreed requirements;
• ceases to operate correctly because the Customer or a third party modifies it;
• is affected by changes to third-party APIs, platforms or services occurring after delivery; or
• does not provide functionality that was not expressly or reasonably included in the agreed scope.

20.4. The Provider does not warrant that software will be entirely error-free or that every technical service will operate without interruption. This does not limit any expressly agreed functionality, warranty obligation or SLA.

21. Liability

21.1. The Provider is liable without limitation for damage caused intentionally and in other cases where liability cannot legally be limited.

21.2. For gross negligence, the Provider is liable in accordance with applicable law, subject to any individually agreed limitation that is legally permissible.

21.3. For slight negligence, the Provider is liable only for breach of material contractual obligations whose performance is necessary for proper performance of the contract and on which the Customer may reasonably rely. In such cases, liability is limited to foreseeable damage typical for the relevant contract.

21.4. To the extent legally permissible, the Provider is not liable for indirect or consequential losses, loss of profit, loss of anticipated savings or loss of business opportunity resulting from slight negligence.

21.5. Unless otherwise agreed in an Order, the Provider’s aggregate liability arising from slight negligence under a particular Order shall not exceed the fees paid or payable under that Order during the preceding 12 months.

21.6. Where loss or corruption of data is caused by slight negligence, liability is limited to the reasonable cost of restoring the data from a proper backup, provided that maintaining such backup was within the Customer’s responsibility. This limitation does not apply where the Provider had expressly undertaken responsibility for the relevant backup.

21.7. Liability limitations do not apply to personal injury to the extent such limitation is prohibited by law.

21.8. SLA service credits, where agreed, do not exclude further claims unless the applicable SLA expressly provides that a particular service credit constitutes the exclusive remedy for the relevant breach to the extent legally permissible.

22. Third-Party Dependencies

22.1. Many IT services depend on telecommunications providers, cloud providers, registries, certificate authorities, internet infrastructure, software vendors and other third parties.

22.2. The Provider is responsible for selecting and managing subcontractors within its contractual scope with reasonable care but does not guarantee uninterrupted performance of independent third-party systems.

22.3. The Provider shall not be responsible for failures caused by third-party services selected or contracted directly by the Customer.

23. Subcontractors

23.1. The Provider may use qualified employees, affiliates and subcontractors to perform services.

23.2. Use of subprocessors handling personal data is additionally governed by the applicable data processing agreement.

24. Force Majeure

24.1. Neither party is responsible for delay or non-performance caused by circumstances beyond its reasonable control, including natural disasters, widespread telecommunications or power failures, war, terrorism, civil unrest, governmental measures, widespread cyberattacks, industrial disputes or comparable events, provided that the affected party takes reasonable measures to mitigate the effects.

24.2. Payment obligations for services already properly rendered remain unaffected.

24.3. Force majeure does not by itself create an obligation for the Provider to supply emergency support outside Business Hours. If the Customer nevertheless requests and the Provider performs such emergency assistance, Section 13 may apply.

25. Term and Termination of Recurring Services

25.1. The term and ordinary termination rights for recurring services are specified in the applicable Order.

25.2. Unless otherwise agreed, recurring services entered into for an indefinite period may be terminated by either party with three months’ notice to the end of a calendar month.

25.3. Either party may terminate a contract for material cause where continued performance cannot reasonably be expected, including material breach that remains unremedied after a reasonable cure period where remediation is possible.

25.4. Material cause may include, in particular:

• material non-payment;
• serious or repeated security violations;
• unlawful use of the services;
• deliberate interference with systems;
• insolvency-related circumstances to the extent termination is legally permitted; or
• serious and repeated breach of contractual cooperation obligations.

26. Consequences of Termination

26.1. Upon termination, outstanding fees for services already provided become due.

26.2. Unless otherwise agreed, the Customer is responsible for arranging migration and export of its data before termination takes effect.

26.3. The Provider shall provide reasonable migration assistance upon request. Unless included in the applicable Order, such assistance is chargeable at the applicable rates.

26.4. Following termination, Customer data may be deleted after expiration of 30 days, unless:

• another retention period is agreed;
• applicable law requires retention;
• the applicable data processing agreement requires earlier deletion; or
• technical backup cycles result in temporary residual copies.

26.5. The Customer should not rely on the Provider as a long-term archive after termination.

27. Suspension

27.1. The Provider may temporarily suspend all or part of a service where reasonably necessary because of:

• a material security threat;
• unlawful use;
• imminent risk to systems or third parties;
• a binding legal or regulatory requirement; or
• material overdue payment following appropriate notice.

27.2. The Provider shall limit a suspension to what is reasonably necessary and restore the service when the relevant grounds cease to exist.

28. Notices

28.1. Operational communications may be made through email, ticketing systems or other channels customarily used between the parties.

28.2. Notices concerning termination, material breach or other legally significant matters shall be made in text form to the contact details last notified by the parties, unless stricter form is required by law or individual agreement.

28.3. Each party is responsible for keeping its contact details current.

29. Amendments to These Terms

29.1. Amendments to an existing individual Order require agreement between the parties unless the Order expressly provides otherwise.

29.2. The Provider may issue revised versions of these Terms for future Orders.

29.3. Revised Terms shall apply to an existing continuing contractual relationship only where the Customer agrees to them or where a valid contractual mechanism for such amendment has separately been agreed.

30. Severability

30.1. If any provision of these Terms is or becomes invalid or unenforceable, the remaining provisions remain unaffected to the extent legally permissible.

30.2. The invalid provision shall be replaced by the applicable statutory rule. The parties may agree on a valid provision that most closely reflects the commercial purpose of the invalid provision.

31. Governing Law and Jurisdiction

31.1. The contractual relationship is governed exclusively by the laws of the Republic of Austria, excluding its conflict-of-law rules and excluding the United Nations Convention on Contracts for the International Sale of Goods (CISG).

31.2. To the extent legally permissible, the court having subject-matter jurisdiction at the Provider’s registered office shall have exclusive jurisdiction over disputes arising from or relating to the contractual relationship.

32. Entire Agreement

32.1. The applicable Order, any SLA, any applicable data processing agreement and these Terms constitute the contractual framework between the parties for the relevant services.

32.2. Statements in advertising, websites, presentations or informal communications do not constitute contractual guarantees unless expressly incorporated into an Order.

32.3. No failure or delay in exercising a contractual right constitutes a waiver of that right.