General Terms and Conditions

These General Terms and Conditions (GTC) govern the use of the TrustTroiAI Platform and the associated browser extension TrustTroiAI Inspector (together, the "Platform"). They apply to all contracts between TrustTroiAI (hereinafter "we") and the customer.

1.1 Scope. These GTC apply to all contracts concluded between us and the customer for use of the Platform. Deviating, conflicting or supplementary terms and conditions of the customer become part of the contract only if and to the extent that we have expressly agreed to their applicability in text form. This applies also where we provide services without reservation despite being aware of the customer's deviating terms.

1.2 Contracting party.

TrustTroiAI
Grünewalder Straße 29–31
coworkit (SG-Grünewald)
42657 Solingen
Germany

Contact: hallo@trusttroiai.eu · Data protection: privacy@trusttroiai.eu

1.3 Customer base. The Platform is intended exclusively for businesses, in particular for legal professionals, compliance officers, information security officers, product and DevOps teams. On registration, the customer represents that they are acting in the exercise of their commercial or independent professional activity.

1.4 Individual agreements take precedence over these GTC. For the "Sovereign" usage tier (see Section 3), we additionally conclude an individual framework agreement with the customer which supplements these GTC and prevails in case of conflict.

2.1 Setting up the account. A user account on the Platform can be set up in two ways:

(a) Via the connection with Atlassian Jira. On first use of the TrustTroiAI Inspector browser extension, the user authorises, within their Atlassian account, the Platform's access to the information required for use — in particular email address, name and account identifier. On this basis, we automatically create a user account for the user; separate registration on our website is not required.

(b) Via web sign-in. If the user additionally wishes to sign in via the web interface of the Platform, we send them initial access credentials by email to the address on file on request. On first sign-in, the user is required to set their own password.

2.2 Truthful information and account security. The user represents that the information transmitted to us via the chosen access path — in particular their business email address and their affiliation with a business within the meaning of Section 14 BGB — is accurate. The user is required to keep their access credentials confidential and to notify us without undue delay of any indication of misuse.

2.3 Contract conclusion for the "Visible" tier. The contract for the free "Visible" usage tier comes into effect upon initial account setup pursuant to Section 2.1 (a) or (b).

2.4 Contract conclusion for the "Evidenced" tier. The presentation of the "Evidenced" usage tier on our website does not constitute a legally binding offer but an invitation to submit an order. By submitting the order, the customer makes a binding offer. The contract comes into effect once we send the customer an order confirmation by email or activate access to the "Evidenced" tier.

2.5 Contract conclusion for the "Sovereign" tier. The contract for the "Sovereign" usage tier comes into effect upon mutual signature of an individual framework agreement.

2.6 Contract language. The contract language is German. Translations of these GTC into other languages are for information only; in case of doubt, the German version prevails.

2.7 Contract documents. The version of these GTC, the privacy policy and the legal notice in force at any given time is available at any time on trusttroiai.eu. The customer receives the order confirmation for an "Evidenced" order by email and should retain it for their records.

3.1 Overview. The Platform is offered in three usage tiers:

• Visible ("Sichtbar") — free use with a limited functional and usage scope for individual users (hereinafter "Champions")
• Evidenced ("Belegt") — paid subscription use with an extended functional and usage scope, billed per Champion per month
• Sovereign ("Souverän") — individually agreed use with enterprise functions (including on-premise option, SSO, Immutable Ledger, custom DPA, dedicated contact person)

The specific functional and usage scope of the tiers is set out in the service description on our website at trusttroiai.eu/pricing in the version in force at the time of contract conclusion.

3.2 Champion model. The usage scope and price of the "Evidenced" tier are determined by the number of authorised users ("Champions"). Each Champion is a named natural person; sharing of access credentials with other persons is not permitted. Reviewer roles and other secondary roles are counted in the contractually agreed scope.

3.3 Team pricing tiers for "Evidenced". From three Champions and from ten Champions onwards, reduced prices per Champion apply in accordance with the price list in force. On annual advance payment, we grant a discount of 15 % on the annual price.

3.4 Beta phase. For registrations during the ongoing beta phase, the following applies in addition: the customer uses, for twelve months from the date of their registration, the functional scope of the "Evidenced" tier at the price of the "Visible" tier (i.e. free of charge, without depositing a payment method). After the expiry of these twelve months, access is automatically reset to the "Visible" tier. We inform the customer at least 30 days before expiry by email and offer them the opportunity to switch to a regular "Evidenced" subscription; no automatic conversion into a paid subscription takes place. The customer's signed evidence remains archived after the fallback and is retrievable as an export bundle.

3.5 Usage limits. Within the individual usage tiers, quotas apply that are set out in the service description (e.g. number of signed evidence items, number of chat turns per day, number of draft generations). Upon reaching a quota, the affected function is blocked until the next billing period or an upgrade. No automatic additional charging takes place without the customer's express consent.

3.6 Changes to services. We reserve the right to extend or adapt the functional scope of the Platform, in particular to implement new regulatory requirements. We notify the customer of material restrictions of existing functions at least 30 days before they take effect in text form. In this case, the customer has an extraordinary right to terminate with effect from the date the restriction takes effect.

4.1 Prices. The prices set out in the service description on our website at the time of contract conclusion apply. All prices are net prices exclusive of any statutory value added tax.

4.2 Reverse charge. For customers domiciled in another Member State of the European Union who provide us with a valid VAT identification number before contract conclusion, the reverse charge procedure under Section 13b UStG (German VAT Act) applies to taxable services. The invoice will state "Reverse charge — recipient liable for VAT".

4.3 Method and time of payment. The remuneration for the "Evidenced" tier is billed by invoice, payable by SEPA direct debit or bank transfer. On monthly payment, billing occurs monthly in advance; on annual payment, annually in advance. The remuneration is due for payment without deduction within 14 days of the invoice date.

4.4 Default of payment. If the customer is in default of payment, we are entitled to charge default interest at 9 percentage points above the applicable base rate (Section 288(2) BGB). Assertion of a higher default loss and of the flat-rate compensation under Section 288(5) BGB remains reserved. Following prior warning in text form with a reasonable additional period of at least seven days, we are further entitled to block access to the Platform. During the block, the customer's data is preserved but not accessible.

4.5 Set-off and retention. The customer is only entitled to set off against claims that have been finally adjudicated or that are undisputed by us. The customer may exercise a right of retention only insofar as the counterclaim is based on the same contractual relationship.

As these GTC apply exclusively to businesses (see Section 1.3), no statutory right of withdrawal applies.

Should we exceptionally conclude a contract with a consumer (Section 13 BGB) in an individual case, that consumer receives a separate withdrawal instruction under Section 355 BGB in conjunction with Article 246a EGBGB (Introductory Act to the German Civil Code) prior to contract conclusion.

6.1 "Visible" tier. The contract for the "Visible" tier is concluded for an indefinite period and can be terminated by either party at any time without a notice period. Termination by the customer takes place via the user account or by email to hallo@trusttroiai.eu.

6.2 "Evidenced" tier. The contract for the "Evidenced" tier is concluded for an indefinite period. On monthly payment, the contract can be terminated by either party with a notice period of one month to the end of a billing period. On annual payment, the contract can be terminated with a notice period of three months to the end of the respective annual term. Termination is made in text form to hallo@trusttroiai.eu with the subject "Cancellation Evidenced". We confirm receipt of the termination within three business days.

6.3 "Sovereign" tier. For the "Sovereign" tier, the termination provisions of the individual framework agreement apply.

6.4 Beta phase. For the "Evidenced" access issued during the beta phase, Section 3.4 additionally applies. The customer can end the beta usage at any time via their user account or by email, without any payment obligation arising.

6.5 Extraordinary termination. The right to extraordinary termination for good cause remains unaffected for both contracting parties. Good cause exists for us in particular where the customer is in default of payment of two consecutive monthly fees, materially breaches contractual obligations repeatedly despite a warning, uses the Platform for unlawful purposes, or where a material deterioration in the customer's financial situation occurs that jeopardises the fulfilment of their payment obligations.

6.6 Consequences of termination. Upon end of contract, the right to use the Platform ends. The customer has 30 days after end of contract to export their data in a commonly used, machine-readable format. We provide a function within the Platform for this export or support the export on request. After the 30 days have elapsed, the customer's data is permanently deleted in accordance with the privacy policy; excluded is data for which statutory retention obligations apply.

7.1 Customer's right of use. We grant the customer, for the term of the contract, a simple, non-exclusive, non-transferable and non-sublicensable right to use the Platform in the contractually agreed scope for their internal business purposes.

7.2 Permitted use. The customer may in particular use the Platform to perform compliance analyses for their own business and for clients of their business, to use generated evidence records and reports within their organisation, and to store assessment results for internal purposes.

7.3 Prohibited use. The customer may in particular not make the Platform available for use by third parties outside their organisation, whether for consideration or free of charge, reverse-engineer, decompile or disassemble the source code of the Platform beyond the limits of Section 69e of the German Copyright Act (UrhG), specifically circumvent or disable security features of the Platform, or use the Platform for unlawful purposes.

7.4 Ownership of customer data. All content entered by the customer into the Platform, including project descriptions, assessment answers, recorded evidence and generated roadmaps, remains the property of the customer. We do not acquire any independent right of use in this content, save to the extent technically necessary for contractually agreed provision of the services (e.g. storage, display, transmission to the AI provider as part of an analysis initiated by the customer). We do not use the customer's content — including in anonymised or aggregated form — to improve our own products or to train AI models.

7.5 Intellectual property. All rights in the Platform, its software, its design, the curated legal texts, the templates, the skill definitions, and the marks "TrustTroiAI" and "TrustTroiAI Inspector" belong exclusively to us or our licensors. The contract does not create any rights of the customer beyond the rights of use under Section 7.1.

8.1 Availability. We endeavour to achieve high availability of the Platform. Availability means the time during which the central functions of the Platform are reachable over the internet, measured as a monthly average and outside planned maintenance windows.

8.2 Targeted availability per usage tier. We target the following monthly availabilities: "Visible" tier — best effort without any availability commitment; "Evidenced" tier — 99.5 %; "Sovereign" tier — 99.9 %.

8.3 Maintenance windows. We announce planned maintenance at least 48 hours in advance in text form and, where possible, carry it out outside customary business hours. We remedy unplanned outages as quickly as possible; for outages of more than one hour, we inform the customer by email.

8.4 Credit on shortfall. Where the targeted availability for the "Evidenced" or "Sovereign" tier is verifiably not achieved within a calendar month, we grant the customer, on written request, a credit on the next invoice at our reasonable discretion. No further claim for damages arising from an SLA shortfall exists.

8.5 Support. Support is provided in accordance with the service description in force at the time of contract conclusion (community support for "Visible", email support with 24-hour response time on business days for "Evidenced", individual SLA arrangement for "Sovereign").

9.1 Cure. If the Platform has a defect, we are initially entitled to cure by remedying the defect. The customer is required to notify defects without undue delay after discovery in text form and to describe the defect as precisely as possible.

9.2 Reduction and termination. If the cure fails, is unreasonable for the customer, or we seriously and finally refuse it, the customer may reduce the remuneration or terminate the contract extraordinarily.

9.3 Exclusion. Warranty rights do not exist for impairments that are based on improper use by the customer, on interventions by third parties or on an environment for which the customer is responsible (e.g. an incompatible browser).

9.4 Limitation period. Claims of the customer for defects become time-barred twelve months after the start of the contract or, in the case of continuous obligations, after knowledge of the defect. This does not apply to claims arising from liability for intent, gross negligence, injury to life, body or health, and in other cases where the law mandatorily provides otherwise.

10.1 Unlimited liability. We are liable without limitation for damages arising from injury to life, body or health that are based on a culpable breach of duty by us or by one of our legal representatives or vicarious agents, and for other damages that are based on an intentional or grossly negligent breach of duty. Liability under the Product Liability Act and arising from a guarantee remains unaffected.

10.2 Limited liability for simple negligence. In cases of simple negligence, we are liable only for the breach of a material contractual obligation (cardinal obligation) whose fulfilment enables the proper performance of the contract in the first place and on whose observance the customer regularly relies. In such cases, liability is limited to the loss foreseeable at the time of contract conclusion and typical for the contract, but not more than the amount paid by the customer to us in the twelve months preceding the event giving rise to the loss.

10.3 Further exclusion of liability. Any further liability — in particular for loss of profit, missed savings, indirect losses and consequential losses — is excluded.

10.4 Personal liability. Insofar as our liability is excluded or limited, this also applies to the personal liability of our employees, representatives and vicarious agents.

10.5 Loss of data. For loss of data we are liable, in accordance with the preceding provisions, only to the extent that the loss of data would have been unavoidable even with adequate data backup by the customer. The customer is required to regularly export and locally save results that are material to them.

11.1 No legal advice. The Platform is a tool for supporting compliance work. It does not replace legal or other professional advice. The classifications, assessments, templates and text suggestions delivered by the Platform are proposals, not binding legal statements. Substantive responsibility for any compliance decision taken by the customer lies with the customer.

11.2 Human in the loop. Every analysis produced by the Platform is shown to the customer with a confidence value and the underlying legal source and must be confirmed by a human before it may be used as evidence. No automated decision-making within the meaning of Article 22 GDPR takes place.

11.3 Limits of AI. AI-generated content may be incorrect, incomplete or inappropriate. The customer is required to review results substantively before use. We are not liable for damages arising because the customer takes over an AI result without review; liability under Section 10 remains unaffected.

11.4 AI provider and pseudonymization. For AI-assisted functions we use language models from Mistral AI SAS (Paris, France). Before content is transmitted to the language model, detected personal identifiers are replaced with placeholders. Details, including the exception for the dialogue-based assistant, are set out in the privacy policy.

Insofar as the customer processes personal data of their employees, customers or third parties when using the Platform, the customer is the controller in that respect within the meaning of the GDPR and we are the processor.

We provide the customer with a data processing agreement under Article 28 GDPR on request. For the "Sovereign" tier, the conclusion of an individually negotiated data processing agreement is a condition of use.

Both contracting parties undertake to keep confidential all information of the other party marked as confidential or confidential by its nature — in particular trade and business secrets — and to use it only for contractual purposes. This obligation continues after the end of contract for a period of five years. It does not apply to information that is publicly known, that was demonstrably already known to the recipient before receipt, or that was lawfully disclosed to them by third parties.

We are entitled to amend these GTC insofar as this is necessary due to changes in the law, court decisions or a material further development of the Platform. We notify the customer of amendments at least 30 days before they take effect by email, drawing separate attention to the amendments and to the right to object.

If the customer does not object within 30 days of receipt of the notification, the amended GTC are deemed accepted. If the customer objects, we are entitled to terminate the contractual relationship with a notice period of 30 days to the end of the month; until then, the previous GTC continue to apply.

15.1 Applicable law. German law applies exclusively, to the exclusion of the UN Convention on Contracts for the International Sale of Goods (CISG).

15.2 Place of jurisdiction. The exclusive place of jurisdiction for all disputes arising out of or in connection with these GTC and the contracts concluded on their basis is our place of business in Solingen, provided that the customer is a merchant, a legal person under public law or a special fund under public law. We are also entitled to bring proceedings against the customer at their general place of jurisdiction.

15.3 Dispute resolution. We do not participate in a dispute resolution procedure before a consumer arbitration board and are not obliged to do so.

15.4 Text form. Declarations and notices to be given to us under this contract require text form (Section 126b BGB). An email to hallo@trusttroiai.eu suffices.

15.5 Severability. Should individual provisions of these GTC be or become invalid or unenforceable, the validity of the remaining provisions remains unaffected. The invalid or unenforceable provision is replaced by such a valid and enforceable provision as most closely reflects the economic purpose of the original provision.