Status: August 24, 2026
USE OF SERVICES AND WEBSITE AND CONCLUSION OF SUBSCRIPTION AGREEMENT:
The use of this Website and the Services provided by Secfix GmbH is subject to the following Terms and Conditions ("T&Cs").
The Contract is effective as of the effective date of the respective signed order form (such form being an "Order Form" and such date being the "Effective Date") and is entered into between Secfix GmbH ("Secfix") with its registered office at c/o St. Oberholz, Erika-Mann-Straße 25, 80636 Munich, Germany, registered in the Commercial Register of the Local Court of Munich under file number HRB 280059, and the customer ("Customer") specified on the Order Form (each a "Party" and together the "Parties").
1) DEFINITIONS
"Contract" means the entire contractual relationship between Secfix and the respective Customer.
"Secfix", "Secfix GmbH ", "we", "us" and "our" are references to Secfix.
"Customer", "You" and "your" are references to the Customer.
"Authorized User" means any individual who is authorized by the Customer to access and use the Website or the Services on the Customer's behalf, subject to the terms of this Contract and the applicable Order Form.
"Order Form" means an order form, quotation or similar documentation that describes the Services, including in particular the scope of Services, term and fees, and is executed jointly by the Parties.
"Services" means all products and services to be provided by Secfix to the Customer under an Order Form, including, where applicable, the Contractual Software, the provision of the Website, support services and any other related services.
"Website" means the domains secfix.com and app.secfix.com, the underlying web application, and any successor website of Secfix or any of its affiliates.
These T&Cs form an integral part of the Contract. In the event of any inconsistency or contradiction between the terms of the T&Cs and the terms of an Order Form, the terms of the Order Form shall prevail.
These T&Cs exclusively govern the use of the Website and the Services provided by Secfix. Any general terms and conditions of the Customer shall not apply. These T&Cs do not apply to contracts with consumers within the meaning of § 13 of the German Civil Code (BGB).
2) CONSENT AND ACCEPTANCE
Contracts with Secfix are concluded by an offer from Secfix ("Offer") and the unconditional acceptance by the Customer by signing the Order Form. Offers made by Secfix are non-binding and may be revoked at any time prior to acceptance by the Customer, unless the Offer is expressly designated as binding.
3) SCOPE OF SERVICES
The Services are intended to support the management and documentation of IT security and compliance measures. The specific scope of performance and functionality of the Services is set out in the Order Form.
Where the Services consist of software ("Contractual Software"), it is provided as a cloud application ("SaaS"). The Contractual Software does not include the procurement or provision of third-party software, including licences for operating systems or standard software from third-party vendors, or the further development or new development, including patches, updates and upgrades of third-party software.
Secfix shall make the Contractual Software available to the Customer in its current version via the internet and shall carry out any necessary maintenance work. Secfix reserves the right to continuously develop the Services and to extend, adapt or reasonably restrict the scope of functionality.
Unless expressly agreed otherwise, the Services shall only have those characteristics that have been expressly agreed upon. Such characteristics shall only constitute guarantees if Secfix has expressly assumed liability irrespective of fault or has expressly designated them as guarantees. Any guarantee must be made in writing to be valid.
Quality requirements or other performance criteria (such as IT security, compliance, programming, or documentation requirements) shall only form part of the Contract if they are expressly included at the time the Contract is concluded and have been expressly and unconditionally confirmed by Secfix.
Brochures, advertising materials or information provided on websites by Secfix shall only become part of the Contract if this is expressly agreed.
4) SUBSCRIPTION
Fees. Customer shall pay the fees specified in the Order Form (the "Fees").
Payment and Taxes. Secfix will invoice the Customer for the Fees within thirty (30) days of the Effective Date. The Customer shall pay all invoiced Fees in full within thirty (30) days of the invoice date ("Due Date"). Fees do not include VAT; VAT is specified on the invoices and charged as part of the total invoice amount, where applicable.
Price Adjustment. Secfix may adjust the Fees once per Contract year to reflect documented changes in its actual cost of providing the Services to the Customer. The relevant cost basis comprises the following objectively determinable categories: (a) personnel costs directly attributable to the provision, operation and support of the Services; (b) costs for third-party licences and subscriptions required for the Services (including, without limitation, software, APIs and integrations); (c) cloud infrastructure, hosting and data storage costs; and (d) regulatory, legal and compliance-related costs directly connected to the Services. Secfix may increase the Fees only if and to the extent the aggregate of these costs for providing the Services to the Customer has increased by more than five percent (5%) compared to the corresponding aggregate cost basis at the Effective Date or, if a price adjustment has already been made, compared to the aggregate cost basis at the time of the last price adjustment. Any adjustment shall be made by notice to the Customer. Upon Customer's request, Secfix shall provide reasonable supporting explanations evidencing the cost changes.
Blocking in Case of Late Payment. Secfix may immediately block access to the Services if the Customer has not paid the Fees at least fifteen (15) days after the Due Date until payment is received in full. All of our other statutory rights remain unaffected, especially regarding claims for damages or interest due to late payment.
Late Payment Interest. In the event of late payment, Secfix shall be entitled to charge interest on the overdue amount at the statutory default interest rate applicable to business-to-business transactions under German law (currently nine (9) percentage points above the applicable base interest rate) from the day following the Due Date until full payment is received. Secfix reserves the right to claim further damages for late payment.
5) TERM AND CANCELLATION
Term. This Contract shall commence on the Effective Date and continue for the initial term and any renewal terms as specified in the Order Form, unless terminated in accordance with this clause (the initial term and all renewal terms together: the "Term"). If not specified in the Order Form, the initial term shall be one year and shall automatically renew for successive one-year Terms unless the Customer gives Secfix forty-five (45) days' notice of termination prior to the expiration of the current Term.
Termination for Cause. Either Party may terminate this Contract for cause without notice. Good cause shall exist in particular: (a) if a Party has notified the other Party of a material breach and such breach has not been remedied within fifteen (15) days from the date of receipt of notice by the breaching Party; or (b) if the other Party becomes the subject of bankruptcy, insolvency, receivership, liquidation, or assignment proceedings for the benefit of creditors. Customer's failure to pay any Fees after ninety (90) days from the date of invoice, or any Prohibited Use (as defined below), shall be deemed a material breach of the Contract.
Ordinary Termination. Either Party may terminate the Contract by giving written notice to the other Party forty-five (45) days prior to the expiration of the current Term.
Effects of termination. In the event of termination of the Contract, the following applies:
6) LICENCE AND USE OF THE SERVICE
Secfix grants Customer a revocable, non-transferable and non-exclusive right to use the Contractual Software and Services during the Term in accordance with the Contract. Customer may make the Services available to its Authorized Users and may enable corresponding access where necessary. This licence is not sub-licensable to third parties unless expressly permitted in the Order Form.
Secfix may provide Customer with certain information and materials resulting from the use of the Services, including but not limited to documentation, data or information developed by Secfix ("Materials"). Secfix grants Customer a revocable, non-transferable, non-sub-licensable and non-exclusive right to use such Materials solely in connection with its internal use of the Services for its own business purposes. The Materials may not be used for any other purpose, including, without limitation, for providing services to third parties, for incorporating them into products or services offered to third parties, or for developing, operating or offering any competing product or service. All intellectual property rights in and to the Materials remain exclusively with Secfix, and Customer acquires no ownership rights in the Materials.
Notwithstanding the rights granted herein, Secfix retains all rights in and to the Services, Materials and Contractual Software.
Customer grants Secfix the right to store data generated through the use of the Services on Secfix's servers for the purpose of fulfilling its contractual obligations, and to replicate such data on a backup server for data retention purposes.
Feedback. Customer may from time to time provide Secfix with recommendations or comments for improvements or changes to the Services, new features or functionality, or other feedback ("Feedback"). Secfix will independently decide whether to incorporate any requested improvements, new features or functionality. Secfix shall have the unrestricted right to use, incorporate and otherwise fully exercise and exploit any such Feedback in connection with its products and services without any obligation to compensate or reimburse Customer.
7) CONFIDENTIALITY
If the Parties have entered into a separate mutual confidentiality agreement, that agreement shall take precedence over this Section 7.
"Confidential Information" shall mean any information or material provided to the receiving Party by the disclosing Party, whether orally, in writing or in electronic form, that is confidential, proprietary or otherwise not available to the public or that the receiving Party should reasonably believe to be confidential based on the nature of the information or the circumstances of its disclosure. For the avoidance of doubt, the Parties recognise that Confidential Information includes the terms of this Contract.
Except as expressly permitted in this Contract, the receiving Party shall not disclose, reproduce, publish, distribute or otherwise make available in any form to any person, entity or organisation without prior written consent. The receiving Party may use the disclosing Party's Confidential Information only to fulfil its obligations under this Contract, which in the case of Secfix includes the provision of the Services. The confidentiality obligation shall not apply to information that: (a) is or becomes publicly available through no breach of this Contract by the receiving Party; (b) was already known to the receiving Party at the time of disclosure, as evidenced by written records predating the disclosure; (c) is independently developed by the receiving Party without use of or reference to the disclosing Party's Confidential Information; (d) is lawfully received from a third party without restriction on disclosure or use; or (e) is required to be disclosed by applicable law, regulation, or by a final and binding order of a competent court or authority, provided that the receiving Party, to the extent legally permissible, gives the disclosing Party prompt prior written notice and cooperates with the disclosing Party in seeking a protective order or other appropriate remedy.
The Customer undertakes to ensure that its Authorized Users and subcontractors are bound by confidentiality obligations that are at least as strict as those set out in this Section 7. Each Party shall implement appropriate technical and organisational measures to prevent unauthorized access to the other Party's Confidential Information. Access credentials (usernames and passwords) must not be shared with third parties.
Reference and Marketing. Secfix may use the existence of the customer relationship for marketing purposes, including publicly identifying Customer as a customer and using Customer's logo on Secfix's website and social media channels.
8) DATA PROCESSING
Secfix will comply with applicable data protection law, in particular the GDPR and the Federal Data Protection Act (BDSG), when processing personal data in connection with the provision of the Services.
The Customer is the controller within the meaning of Art. 4(7) GDPR with respect to the processing of personal data in connection with the use of the Services. The Customer is solely responsible for ensuring that its use of the Services complies with applicable data protection law, in particular the GDPR, the BDSG and, where applicable, the TDDDG. Secfix assumes no responsibility for the permissibility of processing operations initiated or carried out by the Customer.
To the extent Secfix processes personal data on behalf of the Customer in connection with the provision of the Services, Secfix acts as a processor within the meaning of Art. 4(8) GDPR. The Data Processing Agreement forms an integral part of these T&Cs. In the event of any conflict between the Data Processing Agreement and these T&Cs, the provisions of the Data Processing Agreement shall prevail.
Further details on the processing of personal data in connection with the Services are to be found in the Privacy Policy.
9) CUSTOMER OBLIGATIONS
Customer registration for the Website or Services requires selection of a user ID (typically an email address or similar identifier) and a password. The Customer is responsible for the accuracy of all information provided by its Authorized Users. If credentials or personal information are compromised, the Authorized Users must notify Secfix immediately. The Customer is responsible for maintaining the security and accuracy of personal information and for notifying Secfix of any changes.
Where specific system requirements are specified for the use of the Services, Customer shall ensure at its own responsibility that its systems meet those requirements.
10) PROHIBITED USE OF THE SERVICES
Customer shall ensure that the following prohibitions are observed by its Authorized Users.
Customer and Authorized users must not, and must not permit any third party to:
In the event of any intentional or grossly negligent breach of this Section 10 (Prohibited Use of the Services) that (i) involves the development, operation or offering of a competing product or service using the Services or the Materials, or (ii) is carried out under a false identity or with falsified or misleading company information in order to gain access to the Services or any Trial, Customer shall pay to Secfix a contractual penalty in an amount to be determined by Secfix at its reasonable discretion and, in case of dispute, to be reviewed by the competent court as to its appropriateness. The assertion of further damages remains unaffected; any contractual penalty payable shall be set off against damages claims arising from the same breach.
11) ASSUMPTION OF RISK
The Website and the Services are provided for communication purposes only. You acknowledge and agree that the information published on our Website is not intended as legal advice, medical advice or financial advice and that no fiduciary relationship has been created between you and us.
Secfix may use systems based on artificial intelligence ("AI Systems") in the provision of the Services. To the extent that results, recommendations, analyses or other outputs are generated by AI Systems in connection with the Services, Secfix does not assume any responsibility for the accuracy, freedom from third-party rights (including intellectual property rights) or compliance with data protection law of such outputs. The Services and any AI-based functionalities do not replace professional human advice or personal communication. They are provided solely to support simple, standardised processes. Secfix shall not be liable for any decisions made by Customer in reliance solely on AI-generated outputs or conversation content provided via the Services. To the extent that any deliveries or Services of Secfix include AI Systems that are subject to the EU Artificial Intelligence Act or other applicable AI regulation, Secfix will offer any legally required reasonable support services (such as documentation support or risk assessments) to assist Customer in meeting its legal obligations, subject to a separate agreement and additional remuneration.
Secfix does not review the content or technical accuracy of data entered by Customer into the Services. Customer is solely responsible for the accuracy and completeness of all data entered into the Services. Subject to Section 14, Secfix accepts no liability for errors, losses or damages resulting from inaccurate, incomplete or misleading information provided by Customer.
12) INDEMNIFICATION
Secfix is not responsible for any unlawful content stored or distributed by Customer through the Services. The Customer warrants that the content and data made available or used on the Website does not violate applicable law, official orders, third-party rights or agreements with third parties. The Customer shall indemnify, defend and hold harmless Secfix from and against any and all claims, damages, losses, liabilities, costs and reasonable legal fees arising out of or relating to a breach of this warranty.
13) WARRANTY
Secfix shall maintain the Services with the level of care generally exercised within the industry.
If the Services infringe third-party rights, the Secfix shall, at its own discretion and expense, either procure for the Customer the necessary right of use or modify the Services to eliminate the infringement. If Secfix is unable to remedy the situation, Secfix shall be entitled to terminate the Contract without notice. In determining any remedial action, Secfix shall give due consideration to the Customer's legitimate interests.
Warranty is excluded for defects resulting from use of the Contractual Software that is not in accordance with this Contract or the intended purpose.
Warranty claims expire after twelve (12) months.
Secfix is not liable for any initial defects regardless of fault; Section 536a para. 1, alternative 1 BGB shall not apply.
The Customer's right to terminate the Contract due to failure to grant contractual use under Section 543 para. 2 sentence 1 no. 1 BGB is excluded unless it can be deemed that Secfix has definitively failed to enable use.
14) LIABILITY
If Secfix is liable for damages caused by ordinary negligence, such liability shall be limited to the breach of essential contractual obligations. Essential contractual obligations shall mean obligations whose fulfilment is essential for the proper performance of the Contract and on which the Customer may reasonably rely. In such cases, liability is further limited to the typical, foreseeable damage at the time of the execution of the Contract, and in any event shall not exceed the amount of the license fees due for the relevant Contract year.
Regardless of any fault on the part of Secfix, liability for fraudulent concealment of defects, for the assumption of a guarantee, and liability under the German Product Liability Act (Produkthaftungsgesetz) remains unaffected.
Any exclusion or limitation of Secfix' liability for damages under the foregoing provisions shall also apply to the personal liability of the Secfix corporate bodies, employees, representatives, agents and shall extend as well to statutory liability in tort.
The limitations of liability set out in this section do not apply in cases of wilful misconduct, gross negligence, or injury to life, body, or health.
Liability for loss of data is limited to the typical costs of restoration that would have arisen had the Customer performed proper and regular data backups, without prejudice to any further limitations set out in this section. Secfix shall not be liable for any loss of data to the extent that such loss results from the Customer’s failure to perform appropriate data backups.
15) AMENDMENTS AND DEVIATION
These T&Cs may be amended in accordance with the following provisions. In particular, amendments may be made to reflect technical or legislative changes or changes in the product. Secfix shall notify Customer at least ten (10) days prior to the effective date of such changes. If Customer does not agree with the amendments or additions to the T&Cs, Customer may object to the amendments with a notice period of one (1) week prior to the intended effective date of the amendments or additions. The objection must be in text form. If Customer does not object, Customer shall be deemed to have accepted the amendments or additions to the T&Cs.
You acknowledge that Secfix may modify, deprecate or republish the Secfix APIs for the Secfix Services or features of the Secfix Services from time to time and that it is your responsibility to ensure that your calls or requests to the Secfix Services are compatible with the then-current Secfix APIs for the Secfix Services.
16) SERVICE AVAILABILITY
Availability. Secfix does not guarantee uninterrupted or error-free availability of the Services and is not responsible for minor disruptions or interruptions.
Maintenance. Maintenance services are included in the Fees and comprise regular checks of the Services to ensure contractual performance and security, including error corrections, updates, patches, and releases. Secfix will reasonably consider Customer's legitimate interests and inform Customer of necessary maintenance in advance.
Updates. Secfix is entitled to update and extend the content and functionality of the Services at any time in order to maintain its high quality standard ("Update"). During the Term, Secfix will provide Updates required to maintain the contractual conformity of the Services. If an Update must be installed or activated by Customer and Customer fails to do so despite being requested by Secfix, Secfix shall bear no responsibility for any defect of the Services that is directly attributable to the absence of such Update.
Upgrades. Improvements, new features, or material extensions of the functionality of the Services ("Upgrades") are not covered by the contractually owed maintenance. Upgrades shall be provided for separate remuneration on the basis of a separate agreement. Secfix reserves the right to make Upgrades available to Customer at no additional charge at its discretion.
Defect Reporting. Customer shall notify Secfix of any errors or defects in the Services without undue delay by email to the designated support address. Secfix will use reasonable efforts to minimise downtime and remediation time. Defects will be categorised according to their severity, and Secfix will prioritise the remediation of critical defects.
Customer-Caused Defects. To the extent that reported defects are caused by improper or non-contractual use of the Services by Customer or its Authorized Users, the costs incurred in remedying such defects shall be borne by Customer at standard market rates.
Support Services. Support services and general advisory services (e.g. user training) shall be provided by Secfix subject to separate agreement and for separate remuneration. Secfix reserves the right to provide such services at no charge at its discretion.
17) TRIAL PERIOD
Secfix may, at its sole discretion, offer free trial periods (each a "Trial"). Trials are requested and initiated exclusively via the online trial request form currently provided at https://secfix.typeform.com/trial-en (or any successor online form made available by Secfix), and the Trial phase starts only after the trial terms and conditions referenced in that form have been accepted by Customer by clicking on "accept" before the start of the Trial. Each Customer (including its affiliates within the same corporate group) is only entitled to one Trial, which may be used solely for Customer’s own internal evaluation of the Services and not for productive use. Secfix may modify or discontinue Trials at any time and may terminate, suspend or block access to a Trial with immediate effect in the event of misuse, violation of these T&Cs or the applicable trial terms, or if Secfix reasonably suspects that a (direct or indirect) competitor is accessing the Services. During a Trial, the Services are provided without any warranty or guarantee as to availability, functionality or freedom from defects. Unless expressly agreed otherwise, the provisions of these T&Cs shall also apply during the Trial. After the Trial is concluded, Secfix will delete Customer’s trial data within thirty (30) days, unless a paid Contract is concluded or longer retention is required by law.
18) GENERAL PROVISIONS: