Terms and conditions Last updated: 6 October 2026 This English translation is provided for convenience. Only the German version is legally binding. These terms govern the use of ProAuditMap between Florian Stemmer, ProAuditMap, Huttengrundstraße 22, 36396 Steinau an der Straße, Germany (the provider), and the customer. § 1 Scope and customers (1) ProAuditMap is offered exclusively to entrepreneurs within the meaning of Section 14 of the German Civil Code (BGB), legal entities under public law and special funds under public law. By registering, the customer confirms that it acts in the course of its trade, business or profession. The provider may request proof. There is no consumer right of withdrawal. (2) These terms apply exclusively. Deviating terms of the customer apply only if the provider agrees to them in text form. Individual agreements, in particular an Enterprise contract, take precedence. (3) The customer expressly accepts these terms and the data processing agreement (DPA) at registration. Both apply from registration, that is already to the free account, and to every subsequent contract for ProAuditMap; the DPA forms part of each of them. § 2 Subject matter (1) The provider makes ProAuditMap available as software over the internet for use in a browser. The customer can have audit packages created from its inputs (including audit plan, audit programme, document request list, interview guides, organisation planning, communication drafts and report template), edit, release, export and archive them, and carry out, review and close audits with working papers, evidence and samples, and record findings and track their implementation, request documents, invite audited units to a portal, obtain their statements and prepare and release audit reports. The scope of functions is described on the product pages and the pricing page at the time the contract is concluded. (2) The content of audit packages is generated automatically as drafts, also using services of third parties that are named as sub-processors in the DPA. Drafts may be incomplete or contain professional errors. ProAuditMap does not replace the customer’s professional judgement or legal, tax or audit advice. (3) The provider develops ProAuditMap further. It may change functions provided the agreed core of the service is preserved and the change is reasonable for the customer. It announces material restrictions at least six weeks in advance in text form; the customer may then terminate the contract with effect from the change. § 3 Registration, account without allowance and trial by invitation (1) The customer registers with a business e-mail address. One account is available per organisation, determined by the registrable domain of the e-mail address including its subdomains. (2) Registration is free of charge and requires no payment method. The account contains no allowance for audit packages and partial revisions; these become available with a booked plan. Export in the application is not available without a plan; it becomes available once the first payment has been received, then also for audit packages created before. The customer may request the complete export on request under § 11(4) also without a plan. (3) The period of use without a plan is 7 days; it does not automatically turn into a paid contract. The account then remains read-only for 30 days. If the customer does not book a plan during this time, the provider deletes the account with all content. (4) The provider may grant the customer a trial with an allowance by invitation. The invitation states the duration and allowance; sentences 2 and 3 of paragraph 3 then apply accordingly. There is no entitlement to a trial. § 4 Conclusion of contract (1) When the registration is confirmed, a free contract for the account is concluded, to which these terms and the DPA apply. (2) The presentation of plans on the website is not a binding offer. The customer makes an offer by booking a plan in the application and completing checkout. The paid contract is concluded when the plan is activated; the provider confirms this by e-mail. (3) Enterprise contracts are concluded by separate agreement. § 5 Plans, users and allowances (1) Scope, number of users, monthly allowances (audit packages and partial edits), storage space for evidence and the maximum size per file depend on the plan booked and the pricing page. Withdrawn evidence takes up storage space until it is deleted. Unused allowances expire at the end of the month. In addition to the allowances, technical limits apply to prevent abuse and overload, in particular rate limits and a monthly cap on processing effort per account. (2) A user account is assigned to one named individual and may not be shared. The customer may only set up its own staff and persons it has engaged as users and is responsible for their actions. (3) Persons whom the customer invites to the portal as an audited unit are not users within the meaning of the booked number of users and paragraph 2 and incur no additional fee. They receive only the functions of the portal. Their number is limited per account; the application shows how many have been created and how many are possible. In addition, the number of invitations per day is limited. Uploads by audited units count towards the customer’s storage. § 6 Availability and maintenance (1) The provider makes ProAuditMap available with 98 % availability on a monthly average, measured at the point where its data centre connects to the internet. Announced maintenance, where possible outside usual business hours, and disruptions outside the provider’s control, for example on the internet or at the customer, are not counted. (2) Further commitments on availability, response times or location apply only if agreed separately. § 7 Customer obligations The customer - keeps passwords and the one-time codes of its authenticator app secret and reports suspected misuse without delay; if the device for one-time codes is lost, support helps after verifying authorisation, - reviews all generated content professionally before releasing or using it; release in the application documents this review, - does not enter names of individuals in the wizard, enters personal data only to the extent necessary and only with a legal basis, and uploads evidence and populations only to the extent necessary for the audit purpose, as an extract or redacted where required, - does not enter content that infringes third-party rights or the law and does not interfere with operation, for example through automated mass requests or attempts to bypass security measures, - invites persons as an audited unit only if there is a legal basis for this, in particular for persons who are not employed by it; before the first invitation it stores its contact details for data protection so that the privacy notice can be displayed in full, and supplements the notice where its processing deviates from it, - checks its own obligations before use with employees, for example the involvement of an employee representative body or a data protection impact assessment, and points out to persons of other companies that they need their company’s consent to pass on its documents, - obliges invited persons to observe the rules for using the portal provided by the provider, and removes them as soon as their involvement ends, - checks before each release of evidence or a final report whether the receiving person may receive the content, in particular if a final report contains findings on other areas or if several persons of different companies are assigned to the same item, who then see each other’s names and uploads, - fulfils its own retention and documentation duties, in particular by exporting in good time before the contract ends. § 8 Rights to content (1) For the term of the contract the customer receives the simple, non-transferable right to use ProAuditMap as contractually agreed. (2) Inputs, audit packages and exports belong to the customer. The provider uses them only to provide the service. The provider grants the customer all rights it holds in generated drafts, unlimited in time and territory. § 9 Prices and payment (1) The prices stated on the pricing page or at checkout when the contract is concluded apply. All prices are exclusive of statutory VAT. For customers established in another EU member state with a valid VAT number, the customer owes the tax (reverse charge). For customers in Switzerland, Swiss VAT rules apply. (2) Fees are payable in advance for each billing period. Payment is by card or SEPA direct debit, for annual billing also by invoice. Invoices are sent electronically. (3) If a payment remains outstanding after the dunning process has ended, the provider switches the account to read-only. The customer can still read its content; if it has paid at least once before, it can also export it itself. If the arrears are not settled within 90 days of the switch, the contract ends and the provider deletes the account with all content. No further period under § 11(1) follows; the account therefore remains read-only for no more than 90 days in total. The provider gives notice by e-mail 14 and 3 days before deletion. The customer may in any case request the complete export on request under § 11(4), even if it has never paid. (4) The provider may change the prices of existing contracts no more than once within twelve months and only with effect from the next renewal. An increase may not exceed 10 % of the previous price per change. The provider announces the change at least six weeks before it takes effect in text form. The customer may terminate the contract with effect from the date the change takes effect; the provider points this out in the announcement. § 10 Term and termination (1) Contracts with monthly billing run for one month, contracts with annual billing for one year. They renew for the same period unless terminated by the end of the current period. Termination is possible at any time up to the end of the current period, in the customer portal or in text form. (2) The right to terminate for good cause remains unaffected. § 11 End of contract, return and deletion of data (1) ProAuditMap can be used fully until the contract ends. The account then remains read-only for 90 days; during this time the customer can view all content and, if it has paid at least once, export it itself, and archived audits also as an archive export (ZIP with documents, version history, log extract and checksums). § 9(3) applies to payment default. (2) After the 90 days the provider deletes the account with all content, even if retention periods set in the application are still running. A booked archive plan under § 12 is excepted. The provider points out the export and the customer’s own retention duties at cancellation and 14 and 3 days before deletion. It keeps a deletion log without the deleted content. The data disappear from backups no later than 40 days after deletion. (3) If the customer wishes to switch to another provider or to its own environment (Articles 23 ff. of Regulation (EU) 2023/2854, Data Act), it may request this in text form with a notice period of no more than two months. A transitional period of 30 days follows, during which ProAuditMap remains usable and the provider supports the export; the contract ends when it expires. All of the customer’s data and metadata can be exported: audit packages with all versions, wizard inputs, audit objects, the change log, the list of users with their roles, the retention settings and archived audits. The export is provided in the application’s formats (Excel, Word, ZIP with archive export) and additionally as a structured, machine-readable export in JSON format; as long as the application does not offer this itself, the provider delivers it on request within 30 days. Passwords and one-time code secrets are excluded for security reasons. The period under paragraph 1 for retrieving the data then applies, followed by deletion under paragraph 2. The provider charges no switching charges. If the customer switches during a fixed term, the provider does not refund fees paid in advance for the remaining term; this is an early termination penalty within the meaning of Article 29(4) Data Act. This does not apply if the provider terminated the contract early without good cause or the law requires otherwise. The customer may prove that the provider suffered no loss or a substantially lower loss from the early termination; the provider then refunds the difference. (4) Every customer organisation may, until deletion, also during the trial and without any prior payment, request a complete export of its data in text form. The provider delivers it free of charge within 30 days and postpones deletion until then. This also applies without a plan, during a trial and in the case of payment default under § 9(3). On the customer’s instruction in text form, the provider also deletes the data before the periods under § 3(3), § 9(3) and paragraph 1 expire. § 12 Retention and archive plan (1) ProAuditMap keeps archived audits for 10 years from archiving by default; the customer can set the period from six years. Longer periods up to 30 years can be booked as a paid option. When a period expires, the application proposes deletion; data are deleted only after confirmation by an administrator of the customer. (2) Customers with the option of up to 30 years can book an archive plan. The archive plan must be booked before the contract ends. It is free during the term of the main contract; from the end of the contract the price on the pricing page applies. It keeps the account open for reading and export after the contract ends for as long as it runs. If the archive plan ends, § 11 applies with a period of 90 days from its end. (3) ProAuditMap is not a certified archiving system. The description of the audit-proof measures is not an assurance that the customer’s requirements are met; process documentation and suitability assessment remain with the customer. § 13 Defects (1) The provider keeps ProAuditMap in a condition suitable for contractual use during the term. The customer reports defects without delay with a comprehensible description in text form. The provider remedies them within a reasonable period. (2) Strict liability for defects that already existed when the contract was concluded (Section 536a(1), first alternative, BGB) is excluded. The fact that a draft is incomplete in content or needs to be changed is not in itself a defect as long as the application works as described. § 14 Liability (1) The provider is liable without limitation for intent, fraudulent concealment and gross negligence, for injury to life, body or health, under the German Product Liability Act and where it has given a guarantee. (2) In the case of slight negligence the provider is liable only for breach of essential contractual obligations, whose fulfilment makes proper performance of the contract possible in the first place and on whose observance the customer may regularly rely. In this case liability is limited to the typical, foreseeable damage. (3) Otherwise liability is excluded. The limitations also apply to the provider’s vicarious agents and staff. Article 82 GDPR remains unaffected. § 15 Data protection and confidentiality (1) Where the provider processes personal data on behalf of the customer, the data processing agreement applies. The privacy policy applies to the provider’s own processing. (2) Both parties treat non-public information of the other party obtained under the contract as confidential, also after the contract ends. (3) The customer alone is responsible for inviting audited units and processing their data. It indemnifies the provider against claims by these persons and against fines based on the customer having invited a person without a legal basis, not having informed them sufficiently or having released content to them without authorisation, insofar as the customer is responsible for this. The provider informs the customer without delay of any claims asserted and leaves their defence to the customer to the extent reasonable. The provider may temporarily block the access of an audited unit if there are specific indications of misuse or a security risk; it informs the customer without delay. § 16 Changes to these terms The provider may change these terms with effect for the future where this is necessary for legal or technical reasons, for example due to a change in legislation, case law or technical development, and does not shift the balance of performance and consideration to the customer’s disadvantage. Main performance obligations, prices and the term are excluded; prices change only under § 9(4). Changes to the data processing agreement require the customer’s consent in text form; § 5 of the DPA on sub-processors remains unaffected. The provider announces the change at least six weeks before it takes effect in text form. If the customer does not object before the change takes effect, the amended terms apply; the provider points out this consequence and the right to object in the notice. If the customer objects, either party may terminate the contract with effect from the change. § 17 Final provisions (1) The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods. (2) Where a choice of court is permitted under Section 38 of the German Code of Civil Procedure, the exclusive place of jurisdiction is the provider’s place of business. The provider may also sue at the customer’s place of business. (3) The German version of these terms is authoritative. If a provision is invalid, the remainder of the contract remains valid.