General Terms and Conditions of CanMe GmbH

for the supply of software, the delivery of appliances and ancillary services

Version 2.0 · Effective August 2026 · Supersedes all previous versions

---

This document is a convenience translation of the German original. In the event of any discrepancy or dispute, the German version at https://www.canme.cloud/de/terms prevails.

---

Preamble

CanMe GmbH develops and distributes the Cloud Area Network (CAN) — an identity-first Zero Trust connectivity platform consisting of software components and, optionally, physical or virtual appliances.

CAN is not software-as-a-service. The Customer operates the Cloud Area Network on its own responsibility in its own infrastructure. CanMe supplies software, appliances, documentation and — where separately commissioned — supporting services. Building, connecting, securing and continuously operating the Customer's environment is the Customer's responsibility. This allocation of responsibility is a material element of the pricing and is set out in detail in Annex 2 (Responsibility Matrix).

The Customer may separately assign operation of some or all components to CanMe or to a CanMe partner. Such operation is not covered by these Terms and always requires a separate agreement (§ 10).

---

§ 1 Scope; business customers only

(1) These General Terms and Conditions ("Terms") apply to all contracts between CanMe GmbH, Albert-Einstein-Strasse 1, 95028 Hof, Germany ("CanMe") and its customers ("Customer") concerning the supply of software, the delivery of appliances and ancillary services.

(2) These Terms apply exclusively to entrepreneurs within the meaning of § 14 of the German Civil Code (BGB), to legal entities under public law and to special funds under public law. No contract is concluded with consumers within the meaning of § 13 BGB. The Customer warrants that it enters into the contract in the course of its commercial or independent professional activity.

(3) Deviating, conflicting or supplementary terms of the Customer do not become part of the contract, even if CanMe does not object to them separately or performs without reservation in knowledge of them. The Customer's purchasing terms do not apply.

(4) These Terms, in the version applicable at the time of conclusion, also apply to all future contracts of the same kind with the same Customer without further reference.

---

§ 2 Contract documents; order of precedence

(1) The contract consists of the following documents. In the event of conflict, the following order of precedence applies:

1. the individually signed order form, quotation or purchase order ("Order Form");
2. a separately concluded data processing agreement (DPA) and a separately agreed service level agreement (SLA);
3. a separately signed master or partner agreement;
4. these Terms;
5. the Annexes to these Terms, in the order of their numbering;
6. the End User Licence Agreement (EULA), to the extent it contains provisions going beyond these Terms;
7. the Documentation.

(2) Annexes to these Terms:

(3) Amendments and supplements to the contract require text form (§ 126b BGB). This also applies to any waiver of this text-form requirement. Individual agreements within the meaning of § 305b BGB remain unaffected.

---

§ 3 Definitions

---

§ 4 Formation of contract; sales through partners

(1) Product presentations on the website, in datasheets, price lists or marketing materials do not constitute a binding offer. A contract is formed by counter-signature of an Order Form, by order confirmation in text form, or by performance by CanMe.

(2) CanMe also distributes products through authorised sales partners. Where the Customer purchases through a sales partner, the purchase or subscription contract is concluded between the Customer and that partner. The right to use the Software is nevertheless granted to the Customer directly by CanMe under these Terms and the EULA. Sales partners are not authorised to make representations, warranties, service levels or deviating licence terms on behalf of CanMe.

(3) Warranties, guarantees and agreed specifications require express confirmation by CanMe in text form. Public statements, benchmarks, roadmaps and product announcements do not constitute an agreed specification.

(4) Authority of the person ordering. Whoever places an order for a Customer, registers a Tenant or concludes a Commitment Plan thereby declares (a) that they act for a business within the meaning of § 1(2) and not as a consumer, and (b) that they are authorised to represent that business for the transaction concerned. If the person ordering acts without authority and the business refuses ratification, that person is personally liable to CanMe under § 179 BGB. CanMe may request the business to declare whether it ratifies the order (§ 177(2) BGB). The parties agree that, in particular, use of the Tenant by the business (such as the creation of Usage Objects) and payment of an invoice constitute ratification of the order by conduct.

(5) CanMe may make orders — in particular Commitment Plans above a volume determined by CanMe — conditional on confirmation in text form by a further named contact or an authorised signatory of the Customer, and on a positive credit check.

---

§ 5 Service modules

The subject matter of the contract follows from the Order Form and may comprise one or more of the following modules:

• Module A — Software licence (§§ 6, 7)
• Module B — Appliances (§ 8)
• Module C — Professional Services (§ 9)
• Module D — Operation by CanMe or a partner (§ 10, separate agreement required)

Modules not expressly ordered are not owed.

---

§ 6 Module A — Grant of rights of use

(1) Subscription licence. Subject to payment of the agreed fees, CanMe grants the Customer, for the term of the contract, a non-exclusive, non-transferable, non-sublicensable right to install and use the Software within the agreed Licence Metric in the Customer Environment. Use is limited to the Customer's own internal business purposes and to use in accordance with the Documentation.

(2) Affiliates. Use by undertakings affiliated with the Customer within the meaning of §§ 15 et seq. of the German Stock Corporation Act is permitted where those undertakings are named in the Order Form. The Customer is liable for their compliance with this contract as for its own conduct.

(3) Scope. The right of use covers the reproductions necessary for intended use (installation, loading into memory, execution, display) and the making of a reasonable number of backup copies. There is no entitlement to the source code.

(4) Duration. The right of use is limited to the term of the relevant subscription or Commitment Plan (§ 19a) and ends on its termination or on expiry of the Licence Key. Perpetual licences are not offered.

(5) Territory. The right of use applies worldwide, except in states and territories where use is unlawful under export, sanctions or other mandatory legal provisions (§ 28).

(6) Ownership. The Software is licensed, not sold. CanMe and its licensors retain all rights in the Software, the Documentation, updates, upgrades, patches and all derivative works.

(7) Legal classification; exclusion of strict liability. The time-limited provision of the Software against usage-based or recurring fees is governed by the German law of leases (§§ 535 et seq. BGB), even where the Software is operated in the Customer Environment. CanMe's no-fault (strict) liability for defects already existing at the time of contract conclusion under § 536a(1), 1st alternative, BGB is excluded. The Customer's right of self-remedy under § 536a(2) BGB is also excluded. §§ 536b and 536c BGB remain unaffected.

---

§ 7 Module A — Use restrictions

(1) The Customer shall not:

a) reproduce, adapt, translate or create derivative works of the Software beyond the agreed scope; b) reverse engineer, decompile or disassemble the Software; § 69e of the German Copyright Act (UrhG) remains unaffected. Before taking measures under § 69e UrhG, the Customer shall request the required interface information from CanMe, allowing a reasonable period for response; c) rent, lease, lend, sell, sublicense or otherwise make the Software or Licence Keys available to third parties; d) use the Software to provide services to third parties, in particular managed services, outsourcing, service bureau, hosting or SaaS offerings, unless expressly permitted in a separate partner agreement; e) circumvent, disable or manipulate Licence Keys, usage limits, licence validation, security functions or other technical protection measures; f) remove or alter copyright, trademark or other proprietary notices; g) use the Software for competitive analysis or benchmarking, or to develop a competing product, or publish the results of such analysis without CanMe's prior consent in text form; h) conduct penetration testing, security research or load testing against systems not operated within the Customer Environment. Security testing within the Customer's own environment is permitted; findings shall be reported to CanMe under § 15(4).

(2) Consequences of over-use. If the Customer uses the Software beyond the agreed Licence Metric, CanMe is entitled to charge for actual use retroactively from the date of first excess use (§ 17). Further claims remain unaffected.

(3) Attribution. The Customer shall ensure compliance with these restrictions by all Users, affiliates and third parties it engages, and is responsible for their conduct as for its own.

---

§ 8 Module B — Appliances

(1) Contract type. Appliances are supplied by way of sale (§§ 433 et seq. BGB) unless rental or leasing is expressly agreed in the Order Form. Software pre-installed on an Appliance is licensed under §§ 6 and 7; no title in the Software passes to the Customer.

(2) Delivery and passing of risk. Unless otherwise agreed, delivery is made by direct shipment from the warehouse of CanMe's upstream supplier to the delivery address named by the Customer (drop shipment). Risk of accidental loss and deterioration passes to the Customer on handover to the carrier, freight forwarder or other person designated to carry out the shipment (§ 447 BGB). Partial deliveries are permitted where reasonable for the Customer.

(3) Delivery dates. Stated delivery dates are non-binding unless expressly designated as binding in text form. CanMe does not warrant the availability of components from its own suppliers; § 26 (Force majeure) remains unaffected. CanMe will inform the Customer of foreseeable delays without undue delay.

(4) Inspection and notification. § 377 of the German Commercial Code (HGB) applies. The Customer shall inspect the Appliance without undue delay upon receipt for completeness, transport damage and obvious defects, and shall notify identified defects in text form without undue delay and in any event within seven (7) business days. Latent defects shall be notified without undue delay after discovery. Failure to notify in time means the goods are deemed approved in that respect.

(5) Changes. CanMe may change components, suppliers or manufacturing processes provided the agreed function, performance and security characteristics of the Appliance are not impaired.

(6) Returns. Returns require CanMe's prior consent in text form and an RMA number. Returns without an RMA number will not be processed.

(7) Disposal. CanMe complies with the obligations applicable to it in its respective role as distributor, manufacturer or importer under the German Electrical and Electronic Equipment Act (ElektroG) and the Packaging Act (VerpackG). The Customer shall dispose of or return delivered Appliances properly at end of use and shall securely erase storage media beforehand. Information on returning end-of-life equipment is available on request at hello@canme.cloud.

---

§ 9 Module C — Professional Services

(1) Professional Services (e.g. design workshops, migration support, training, installation and configuration support) are provided only where separately commissioned.

(2) Unless a specific result is expressly agreed, CanMe owes a service within the meaning of §§ 611 et seq. BGB, not a work result. Unless a fixed price is agreed, services are billed on a time-and-materials basis at the applicable rates plus travel, accommodation and incidental costs.

(3) Where a work result is exceptionally agreed, acceptance is deemed to have occurred if the Customer does not object in text form, specifying concrete defects, within ten (10) business days of provision, or if the Customer puts the result to productive use. CanMe will draw the Customer's attention to this consequence on provision.

(4) CanMe grants the Customer a non-exclusive, perpetual right to use work results from Professional Services (in particular configurations, scripts, concepts, documentation) for its internal business purposes. No right to pass on to third parties, to sublicense or to use for services to third parties is granted. CanMe remains entitled to reuse general know-how, methods, concepts and reusable building blocks without restriction.

(5) CanMe does not provide legal, tax or compliance advice. Statements on regulatory requirements (in particular NIS-2, KRITIS, IEC 62443, GDPR) are non-binding technical assessments and do not replace legal review by the Customer.

---

§ 10 Module D — Operation by CanMe or a partner

(1) Operation of CAN components by CanMe or a CanMe partner ("Managed Operation") is not covered by these Terms.

(2) Managed Operation requires a separate agreement governing in particular scope, availability commitments, response and restoration times, processing locations, escalation paths, access rights, fees and a supplementary data processing agreement.

(3) Until such an agreement is concluded, operational responsibility remains entirely with the Customer (§ 11). Support activities, remote access in the course of support, or recommendations by CanMe do not constitute an assumption of operational responsibility.

---

§ 11 Customer's operational responsibility

(1) The Customer builds and operates the CAN on its own responsibility. The allocation of responsibilities is set out conclusively in Annex 2 (Responsibility Matrix). In addition:

(2) The following fall within the Customer's sole responsibility:

a) provision, security and maintenance of the Customer Environment including servers, virtualisation, operating systems, storage and networks; b) provision and maintenance of internet connectivity, required bandwidth and the firewall, NAT and routing permissions necessary for operation as set out in the Documentation; c) power supply, cooling, physical security and access control at sites where Appliances are operated; d) time synchronisation (NTP), name resolution (DNS) and certificate management, unless provided by the Software; e) connection and operation of the identity provider and administration of identities, groups, roles and access policies; f) configuration, testing and approval of access policies and their substantive correctness; g) data backup, recovery concepts and contingency planning, in particular backup of configurations, key material and certificates; h) logging, monitoring, alerting and integration with SIEM or SOC systems; i) timely testing and application of updates and security patches provided by CanMe; j) capacity planning, high-availability and redundancy concepts; k) compliance with all regulatory requirements applicable to the Customer, in particular under NIS-2/BSIG, KRITIS law, the GDPR and sectoral or supervisory law.

(3) Key material. The Customer is responsible for the secure custody, backup and recoverability of all key material, all identities and all recovery secrets. By design, CanMe has no ability to recover the Customer's lost key material. Loss of key material may result in complete and permanent loss of access to the CAN. CanMe is not liable for damage arising from the loss of key material unless CanMe is responsible for that loss.

(4) If the Customer fails to meet its obligations under this § 11, CanMe's corresponding obligations are suspended to the extent performance is thereby impeded. CanMe may charge for resulting additional effort at the applicable rates.

---

§ 12 Further duties of cooperation

(1) The Customer shall provide CanMe, in good time and at no charge, with the information, access, contacts and system environments required for performance.

(2) The Customer shall nominate a qualified contact with decision-making authority and a technical contact for the operation of the CAN.

(3) The Customer shall report defects, faults and security-relevant incidents without undue delay in the form provided for in Annex 3, and shall supply the information required for diagnosis (in particular version levels, configuration extracts, log data).

(4) Remote access by CanMe to the Customer's systems takes place solely at the Customer's instigation and under its control, via channels approved by the Customer and only to the extent required to remedy the fault.

---

§ 13 Availability

(1) CanMe does not owe availability of the CAN. The CAN is operated by the Customer; availability, performance, latency and fault tolerance depend substantially on the Customer Environment, the Customer's internet connectivity and third-party services outside CanMe's control.

(2) Availability commitments exist only where expressly agreed in a separate SLA for components operated by CanMe.

(3) Ancillary services operated by CanMe (e.g. licence validation, update or registration services) are provided with industry-standard care. CanMe will design the Software such that temporary unavailability of these services does not interrupt ongoing operation of the CAN; details and grace periods are set out in Annex 4.

---

§ 14 Support, maintenance, updates and product lifecycle

(1) Updates. During an active, paid subscription of a Tenant (consumption billing or Commitment Plan, with or without an additional support package), CanMe continuously provides updates to the Software, including security updates and functional updates. Installation is the Customer's responsibility (paragraph 5; § 11(2)(i)).

(1a) Support. The handling of fault reports and enquiries (support) is governed by the support package applicable to the Tenant in accordance with Annex 3. Support requires an active, paid subscription and operation of the Software in accordance with the Documentation.

(2) Unless otherwise agreed, CanMe supports the current major version (N) and the immediately preceding major version (N-1).

(3) Support does not cover, in particular: the Customer Environment; third-party software and services; unapproved modifications to the Software; faults resulting from failure to apply updates; and faults resulting from use outside the Documentation.

(4) Security update period (product lifecycle). Independently of the support package selected and of its response times, CanMe provides security updates for each product for a period of at least five (5) years from the placing on the market of the relevant product version (statutorily mandated product maintenance, in particular under Regulation (EU) 2024/2847). The applicable period is published per product in Annex 3; its end is announced at least twelve (12) months in advance. Commercial support packages (ticket handling, response times) are governed exclusively by Annex 3.

(5) The Customer shall apply security updates provided by CanMe within a period appropriate to their criticality and, for updates classified as critical, within thirty (30) days. If the Customer fails to do so, warranty and support claims lapse in respect of faults thereby caused.

(6) CanMe may further develop and adapt the Software. Material functions forming part of the service description may not be discontinued without replacement during the term of a subscription. In the event of a material adverse change, the Customer has a right of extraordinary termination under § 34(3).

---

§ 15 Security; vulnerability management

(1) CanMe develops and maintains the Software under a documented secure development process and operates a vulnerability handling procedure.

(2) CanMe operates a coordinated vulnerability disclosure process. Reports are to be sent to security@canme.cloud; details and key material are published at https://www.canme.cloud/en/security.

(3) CanMe informs the Customer of security-relevant vulnerabilities in the Software affecting the Customer's installation and of available remediation, via the channels set out in Annex 3. The Customer shall ensure that the security contacts it nominates are reachable.

(4) The Customer shall inform CanMe without undue delay of vulnerabilities or security incidents affecting the Software or Appliances of which it becomes aware, and shall treat such information as confidential until coordinated publication.

(5) CanMe provides a software bill of materials (SBOM) in a common machine-readable format on request. The SBOM constitutes Confidential Information under § 29.

---

§ 16 Telemetry, licence validation and product data

(1) The Software may communicate with CanMe systems to validate licences, verify subscription status, deliver security notices and updates, and transmit aggregated usage and error data.

(2) CanMe does not collect the content of the Customer's network traffic through Telemetry. The nature, scope, purpose, retention period and transmission frequency of Telemetry data, and the options for restricting it, are set out in Annex 4. Annex 4 also serves as information on the data generated by the product and its accessibility.

(3) Connectivity requirement. The Core requires an internet connection to the CanMe services named in Annex 4 for licence validation, updates and operation; providing this connection is the Customer's responsibility (§ 11(2)(b)). Operation in air-gapped environments is not covered by these Terms and requires a separate agreement. The Customer may not disable or circumvent licence validation functions unless expressly permitted by CanMe.

(4) Where Telemetry data or support activities involve personal data, § 30 and the DPA (Annex 6) apply.

(5) CanMe is entitled to use aggregated and anonymised analyses derived from Telemetry data, which permit no inference as to the Customer or any individual, without time limit for product improvement, capacity planning and statistics.

---

§ 17 Licence records and verification

(1) The Customer shall keep records of actual use of the Software relative to the agreed Licence Metric and retain them for the term of the contract plus two (2) years.

(2) CanMe may verify compliance with the licence terms no more than once in any twelve-month period. CanMe will first request a written self-certification from the Customer. Any further verification takes place on at least thirty (30) days' notice, during normal business hours and with the least possible disruption to the Customer's business.

(3) If verification reveals use in excess of the Licence Metric, the Customer shall promptly acquire the additional licences required at the list prices applicable at the time of the excess use, retroactive to the date of first excess use.

(4) If the excess use exceeds five per cent (5 %) of the licensed quantity, the Customer shall bear the reasonable costs of the verification.

(5) Verification is carried out subject to confidentiality (§ 29) and the Customer's security requirements. No access to the Customer's productive data takes place.

---

§ 18 Trials and proof of concept

(1) Trial licences are provided via the CanMe portal (myCanMe). The term is thirty (30) days from provision. Extension of the trial, and a repeat trial for the same Tenant, are excluded. Deviating proof-of-concept arrangements require CanMe's express confirmation in text form.

(2) During a Trial, use is permitted solely for internal evaluation. Any productive, commercial or third-party-facing use is prohibited.

(3) For services provided free of charge: the Software is provided without warranty and without any availability or support commitment. CanMe's liability is limited to § 25(1) and to intent and gross negligence.

(4) A Trial may be terminated by either party at any time on one (1) day's notice in text form. On expiry, the Customer shall cease use and delete all copies; it shall confirm this in text form on request.

(5) Where a Trial is provided by, or operated in the infrastructure of, a CanMe partner, that partner's terms apply in addition for the infrastructure it provides; the right to use the Software is governed exclusively by this § 18.

---

§ 19 Fees, billing models, payment

(1) The prices agreed in the Order Form apply, otherwise the current price list accessible in myCanMe (Annex 7). All prices are net in euro plus applicable statutory value added tax and plus shipping, packaging and incidental costs.

(2) Billing models. Use of the Software is remunerated under one of the following models; the models may be combined per Order Form:

a) Consumption billing (pay-as-you-go). Fees are calculated on actual use in the relevant billing month at the list prices in force at the beginning of that month, billed monthly in arrears. Usage measurement is governed by § 19b.

b) Commitment Plan. The Customer commits, for a term of one (1), three (3) or five (5) years, to a usage volume per billing period specified in the Order Form, at a discounted price. Details are governed by § 19a.

(3) Payment mode. Fees under Commitment Plans are payable, at the Customer's choice in the Order Form, either in advance for the full term or per year, or monthly. Consumption billing is due monthly in arrears. Hardware is invoiced on delivery.

(4) Unless otherwise agreed, the payment term is twenty-one (21) days from the invoice date without deduction. In the event of late payment, the Customer owes default interest of nine percentage points above the base rate (§ 288(2) BGB) and the flat charge under § 288(5) BGB. CanMe reserves the right to claim further damages caused by default.

(5) Objections to invoices, including objections to usage measurement, must be raised in text form within six (6) weeks of receipt. The Customer's rights after expiry of this period remain unaffected; the period does not create a deemed approval.

(6) If the Customer is more than thirty (30) days in default with a not insignificant part of the fees, CanMe may — following prior notice and an unsuccessful grace period of fourteen (14) days — suspend support and update services and refuse to extend the Licence Key. Suspension must not render already installed and activated components inoperable during the current, paid licence period.

(7) Price adjustment — consumption billing only. CanMe may adjust the list prices for consumption billing with effect for future billing months. Adjustments must be notified in text form at least two (2) months before taking effect. The Customer may terminate consumption billing at any time under § 32(1)(a). Commitment Plans are governed exclusively by the price guarantee in § 19a(2); no price adjustment takes place during the commitment term.

(8) The Customer may set off only against undisputed or finally adjudicated claims. Rights of retention are available only in respect of undisputed or finally adjudicated counterclaims arising under the same contractual relationship.

---

§ 19a Commitment Plans

(1) Subject matter. Under a Commitment Plan, the Customer bindingly commits to the usage volume specified in the Order Form for the chosen term (1, 3 or 5 years). In return, CanMe grants the discounted prices stated in the Order Form.

(2) Price guarantee. The prices agreed in the Order Form for a Commitment Plan are fixed for the entire term of the Commitment Plan. Price adjustments, changes to the price list and changes to the Licence Metric have no effect on running Commitment Plans.

(3) Overage. Where a Tenant's actual use exceeds the committed volume assigned to that Tenant, the excess is billed monthly in arrears at the then-current pay-as-you-go list prices (§ 19b). The Customer may increase the committed volume at any time with effect for the future; the increase is agreed at the commitment conditions then offered for the remaining term. A reduction during the term is excluded.

(4) Under-use. Committed volume not consumed expires without replacement at the end of the relevant billing period. There is no entitlement to refund, credit or set-off. The obligation to pay for the committed volume exists irrespective of actual use; it is the consideration for the price guarantee and the discount under paragraph 2.

(5) Tenant binding; combination. Commitment Plans are assigned in the Order Form to a specific Tenant and apply to that Tenant only. Transfer of Commitment Plans to other Tenants, other customers or legal successors requires a separate agreement in text form. Multiple Commitment Plans with different terms per Tenant, and combination with consumption billing, are permitted; allocation is governed by § 19b(3).

(6) Binding effect. Commitment Plans cannot be terminated for convenience during their term. The right to extraordinary termination for cause (§ 32(3)) and the special termination rights under §§ 14(6), 26(3) and 34(3) remain unaffected; in those cases, prepaid fees attributable to the period after termination takes effect will be refunded pro rata.

(7) End of term. On expiry of a Commitment Plan, continued use proceeds as consumption billing under § 19(2)(a) at the then-current list prices, unless the parties agree a successor Commitment Plan beforehand. The Customer will be reminded of the upcoming expiry no later than three (3) months before the end of the term.

---

§ 19b Usage measurement and allocation

(1) Measurement. Usage is recorded by the Software daily per Tenant and reported to CanMe. The measured usage is visible to the Customer in real time in CANSOLE; the usage measurement is logged there, and these logs serve as evidence of the billed usage. Prices, commitment balances and invoices are accessible in myCanMe to the Customer and — where agreed — to the supporting partner. Usage Objects are the units defined in Annex 1 (in particular Identities and Gates).

(2) Billing principle. A Usage Object counts as used for a billing month, and is billed, if it was created or present in the Tenant at any point during that month, regardless of duration (created = used = billed). A Usage Object no longer present in the following month is not billed for that following month. Changes in usage therefore take effect on billing automatically, without any contract amendment.

(3) Order of allocation. The monthly usage measured per Tenant is allocated first to the committed volumes assigned to that Tenant (where several plans exist, starting with the plan ending earliest); the remaining usage is billed as consumption billing under § 19(2)(a). Example: 1,000 Identities used against a commitment of 600 Identities results in 600 Identities at commitment conditions (paid in advance or monthly per the Order Form) and 400 Identities at pay-as-you-go list prices, monthly in arrears.

(4a) Counting rules. Subject to deviating provisions in Annex 1, the following applies to usage measurement: a) Every Identity and every Gate deployed in the Tenant during the billing month is billed; activity, logins or data traffic are irrelevant (paragraph 2). b) A Gate operated as a high-availability pair (HA pair) is billed as one (1) Gate. c) A Link connected to the Tenant is billed as one (1) Device Identity; the purchase of the Link hardware itself is governed by Module B (§ 8). d) Groups are not billed. e) Mesh components are currently not billed. CanMe reserves the right to introduce fees for Mesh components or other currently free components in the future; such introduction is treated as a price adjustment under § 19(7) (notice at least two (2) months in advance, effective only for consumption billing of future billing months). Running Commitment Plans remain unaffected as regards their committed Usage Objects and prices.

(4b) No technical capping. CanMe does not technically limit or cap usage. All usage initiated by the Customer or its Users is billed under the above principles, including unintended usage (e.g. caused by faulty automation or scripts). In return, CanMe provides the Customer with the real-time usage overview in CANSOLE under paragraph 1; monitoring its own usage and configuring its own controls is the Customer's responsibility. Evident measurement errors of the Software remain unaffected by this paragraph and are to be raised under § 19(5).

---

§ 20 Retention of title

(1) Delivered Appliances remain the property of CanMe until all claims arising from the business relationship have been paid in full.

(2) The Customer shall handle goods subject to retention of title with care and insure them adequately. The Customer shall inform CanMe without undue delay of any third-party access to such goods.

(3) The Customer may resell goods subject to retention of title in the ordinary course of business; it hereby assigns to CanMe the resulting claims up to the invoice value. CanMe accepts the assignment.

(4) If the realisable value of the securities exceeds CanMe's claims by more than twenty per cent (20 %), CanMe will release securities of its choice at the Customer's request.

---

§ 21 Warranty — Software

(1) CanMe warrants that, on delivery, the Software materially conforms to the service description and the Documentation. The agreed specification is decisive; fitness for the Customer's purposes beyond that is not owed.

(2) Insignificant deviations and only insignificant impairments of usability do not give rise to warranty claims. The Customer acknowledges that, according to the state of the art, software cannot be produced entirely free of errors.

(3) The Customer shall notify defects in text form without undue delay after discovery, providing the information required for diagnosis, in particular a description of symptoms, version levels and reproduction steps. Late notification does not result in loss of warranty rights; however, CanMe may claim additional effort caused by the delay and is not responsible for resulting delays in remedy.

(4) Remedy is effected at CanMe's option by rectification or replacement. Provision of a reasonable workaround or of a new program release also constitutes remedy, provided the change is reasonable for the Customer.

(5) There are no warranty claims to the extent that the defect is based on: a) use outside the Documentation or outside the specified system requirements; b) modifications or interventions by the Customer or third parties not approved by CanMe; c) third-party software, hardware or services; d) failure to apply updates provided by CanMe (§ 14(5)); e) faults in the Customer Environment, in internet connectivity or in third-party inputs.

(6) If remedy fails after two attempts, the Customer may, after setting a reasonable grace period, reduce the fee or — in the case of a material defect — withdraw from the contract or terminate extraordinarily. Claims for damages are governed exclusively by § 25.

(6a) Reservation of reclaim. The Customer is not entitled to assert a rent reduction under § 536 BGB by unilateral deduction from the ongoing fees. It remains obliged to pay in full and may reclaim a justified reduction under the rules on unjust enrichment (§ 812 BGB). The Customer's right to assert the reduction by way of reclaim is neither excluded nor impeded hereby.

(7) Duty to maintain. CanMe's obligation to maintain the contractual condition of the Software continues throughout the relevant contract term; it is discharged by the provision of updates and fixes in accordance with Annex 3. Claims arising from fraudulently concealed defects, claims under a guarantee and claims for damages under § 25(1) remain unaffected; the statutory periods apply to them.

(8) If CanMe has performed services in response to a defect notification and no defect for which CanMe is responsible existed, CanMe may charge for the effort at the applicable rates where the Customer is responsible for the notification.

---

§ 22 Warranty — Appliances

(1) The statutory warranty rights under sales law apply to delivered Appliances, subject to the following.

(2) The limitation period for warranty claims is twelve (12) months from the passing of risk. This does not affect claims arising from fraudulently concealed defects, from a guarantee, for injury to life, body or health, under the Product Liability Act, claims under §§ 445a, 445b BGB, or claims for damages under § 25(1).

(3) There are no warranty claims for normal wear and tear, damage caused by improper handling, storage, installation or commissioning, external influences (in particular overvoltage, moisture, mechanical damage), unapproved interventions, or operation outside the specified environmental conditions.

(4) Remedy is effected at CanMe's option by rectification or replacement. CanMe may also supply equivalent refurbished equipment. Replaced parts become the property of CanMe.

(5) CanMe bears the expenses necessary for remedy only to the extent that they are not increased by the Appliance having been moved after delivery to a location other than the agreed destination.

---

§ 23 Defects in title; third-party rights

(1) CanMe warrants that contractual use of the Software and Appliances within the Federal Republic of Germany and the other Member States of the European Economic Area does not infringe third-party intellectual property rights.

(2) If a third party asserts a claim against the Customer for infringement of an intellectual property right through contractual use, CanMe will indemnify the Customer against justified claims and bear the reasonable costs of defence, provided the Customer:

a) notifies CanMe without undue delay in text form; b) leaves the conduct of the dispute, including any settlement negotiations, to CanMe and provides reasonable support; c) makes no admissions or settlements without CanMe's consent; d) has not caused the infringement through unauthorised modifications, through combination with products not supplied by CanMe, or through non-contractual use.

(3) In the event of an infringement, CanMe may at its option procure the right of use for the Customer or modify or replace the deliverable so that the infringement ceases while the agreed functionality is substantially preserved. If neither is possible on commercially reasonable terms, either party may terminate the affected part of the contract; CanMe will in that case refund prepaid fees attributable to the unused period.

(4) This § 23 is exhaustive in respect of defects in title. Claims for damages are governed by § 25 and are subject to the limitations set out there.

---

§ 24 Open source and third-party components

(1) The Software contains third-party components licensed under open source or other third-party licences. The applicable licence texts, copyright notices and attributions are delivered with the product and additionally accessible to customers in myCanMe (Annex 5).

(2) Where the terms of an open source licence take precedence over these Terms, the terms of that open source licence prevail for the component concerned. Third-party licences do not extend the Customer's rights in the proprietary components of the Software.

(3) For third-party components supplied free of charge and without warranty, CanMe's warranty applies only under § 21 in respect of the integration produced by CanMe.

---

§ 25 Liability

(1) Unlimited liability. CanMe is liable without limitation: a) for intent and gross negligence; b) for injury to life, body or health; c) for fraudulent concealment of a defect; d) to the extent of any guarantee or procurement risk assumed; e) under the Product Liability Act and other mandatory statutory liability regimes.

(2) Simple negligence. In the case of simple negligence, CanMe is liable only for breach of a material contractual obligation, i.e. an obligation whose fulfilment makes proper performance of the contract possible in the first place and on whose observance the Customer may regularly rely. In such cases liability is limited to the foreseeable damage typical for this type of contract.

(3) Cap. Liability under paragraph 2 is limited to 100 % of the fees paid by the Customer for the affected deliverable in the twelve (12) months preceding the event giving rise to liability, but not less than EUR 50,000 and not more than EUR 500,000 per incident, and to twice that amount for all incidents in a contract year.

(4) Loss of data. For loss of data, CanMe's liability under paragraphs 2 and 3 is limited to the effort that would have been required for restoration had the Customer maintained proper and regular backups. § 11(3) (key material) remains unaffected.

(5) Services free of charge. For services provided free of charge, in particular Trials under § 18, CanMe is liable outside paragraph 1 only for intent and gross negligence.

(6) Exclusions. Any further liability of CanMe is excluded. In particular, outside paragraph 1, CanMe is not liable for lost profit, lost savings, business interruption, reputational damage, third-party claims or indirect damage, unless such damage qualifies as foreseeable damage typical for this type of contract under paragraph 2.

(7) Contributory fault. Contributory fault on the part of the Customer, in particular breach of its obligations under §§ 11, 12 and 14(5) (backup, operational responsibility, application of security updates), shall be taken into account.

(8) Third-party attacks. CanMe is not liable for damage caused by unlawful acts of third parties (in particular attacks on the Customer Environment, phishing, compromise of the Customer's credentials, malware), unless CanMe is culpably responsible for enabling the attack.

(9) The above limitations also apply for the benefit of CanMe's legal representatives, employees and vicarious agents.

(10) The above provisions do not entail any change in the burden of proof to the Customer's detriment.

---

§ 26 Force majeure

(1) Neither party is liable for non-performance of contractual obligations to the extent caused by force majeure. Force majeure includes in particular natural disasters, war, civil war, acts of terrorism, epidemics and pandemics, acts of public authorities, shortages of energy and raw materials, large-scale failures of telecommunications or power networks, cyberattacks on critical upstream suppliers, and industrial action not occurring within the affected party's own business.

(2) The affected party shall inform the other party without undue delay in text form of the occurrence, expected duration and effects of the event, and shall make reasonable efforts to resume performance.

(3) If the event lasts longer than two (2) months, either party may terminate the affected part of the contract in text form. Services already rendered shall be paid for; prepaid, unused fees will be refunded pro rata.

---

§ 27 Prohibited use; high-risk applications

(1) The Customer shall not use the products in a manner that violates applicable law or infringes third-party rights. Within its sphere of responsibility it shall take the measures necessary to prevent unlawful use by Users or third parties.

(2) High-risk applications. The products are not designed, tested or approved for applications in which a malfunction may directly cause death, personal injury or severe environmental damage, in particular not for the operation of nuclear facilities, air traffic control and flight guidance systems, life-support systems, emergency response infrastructure or weapons systems. Use in such environments is entirely at the Customer's own risk; CanMe is not liable in this respect outside § 25(1).

(3) Security functions. The products are one security component among several. They replace neither a security concept nor the Customer's obligation to implement appropriate technical and organisational measures. CanMe does not warrant that use of the products prevents attacks or achieves compliance with the Customer's regulatory obligations.

(4) In the event of a material breach of this § 27, CanMe may suspend services and terminate the contract extraordinarily following a grace period and an unsuccessful warning. Where material damage to CanMe, the Customer or third parties is imminent, suspension may take place without a prior grace period; CanMe will inform the Customer without undue delay and restore service promptly once the breach has been remedied.

---

§ 28 Export control and sanctions

(1) The products contain encryption technology and are subject to the export, transfer and sanctions rules of the European Union, the Federal Republic of Germany and, where applicable, other states.

(2) The Customer shall comply with these rules. Export, re-export or transfer to persons, organisations or countries subject to embargoes or sanctions, or for armaments, nuclear, chemical or biotechnology purposes, is prohibited.

(3) The Customer warrants that neither it nor any recipient it designates is listed on applicable sanctions lists.

(4) Performance is subject to the absence of impediments under foreign trade law. CanMe is not responsible for delays caused by required authorisations.

---

§ 29 Confidentiality

(1) The parties shall treat each other's confidential information as confidential, use it solely for the purposes of the contract and not disclose it to third parties. Confidential information is information marked as confidential or whose confidentiality follows from its nature or the circumstances of disclosure; this includes in particular source code, configurations, security architectures, SBOMs, vulnerability information, prices and contract contents.

(2) Access is limited to persons who require the information for performance of the contract and who are subject to a corresponding confidentiality obligation. The parties shall protect confidential information with the same care they apply to their own confidential information, and in any event with reasonable care.

(3) The obligation does not apply to information which: a) is generally known or becomes so without breach of this agreement; b) was lawfully known to the receiving party before disclosure without a confidentiality obligation; c) was lawfully obtained from a third party without a confidentiality obligation; d) was independently developed; or e) must be disclosed under mandatory legal or official order; in that case the obliged party shall inform the other party in advance where legally permissible.

(4) The obligations survive for the term of the contract and three (3) years thereafter; for trade secrets within the meaning of the German Trade Secrets Act, they apply without time limit.

(5) An existing separate non-disclosure agreement takes precedence over this § 29.

---

§ 30 Data protection

(1) Each party is independently responsible for compliance with the data protection provisions applicable to it.

(2) Allocation of roles. The Customer is the controller within the meaning of Art. 4(7) GDPR for the processing of personal data within the CAN it operates. By design, CanMe has no access to that processing unless CanMe is expressly commissioned to provide an operational or support service.

(3) CanMe is the controller for the processing of data for the establishment, performance and billing of the contractual relationship, for licence validation and for product and security improvement. Details are set out in the Product Privacy Notice at https://www.canme.cloud/en/privacy. This notice governs use of the products and is separate from the website privacy policy (https://www.canme.cloud/en/web-privacy).

(4) To the extent CanMe processes personal data on the Customer's behalf — in particular in the course of support involving remote access, when analysing transmitted log data, or in a Managed Operation under § 10 — the Data Processing Agreement (Annex 6) applies and becomes part of the contract on its conclusion.

(5) The Customer shall ensure that it has the legal basis required for use and that it properly informs the data subjects, in particular its employees. CanMe will provide the Customer with an information module for this purpose on request. Assessment of co-determination requirements (in particular § 87(1) no. 6 of the German Works Constitution Act) is the Customer's responsibility.

---

§ 31 References and feedback

(1) CanMe may use the Customer's name and logo to identify it as a customer on the website and in sales materials. The Customer may object to such use at any time with effect for the future in text form. Further reference activities (in particular case studies, quotations, press releases) require the Customer's prior consent in text form.

(2) Where the Customer submits suggestions, ideas or improvement proposals ("Feedback"), CanMe may use and exploit these free of charge and without limitation in time or territory. The Customer is not obliged to provide Feedback. This does not release any of the Customer's confidential information.

---

§ 32 Term and termination

(1) Terms.

a) Consumption billing (§ 19(2)(a)) runs indefinitely and may be terminated by either party in text form with one (1) month's notice to the end of a month. No termination is required merely to reduce or cease usage; billing follows measurement under § 19b.

b) Commitment Plans (§ 19a) run for the agreed term of 1, 3 or 5 years and cannot be terminated for convenience during that term (§ 19a(6)). § 19a(7) applies after expiry.

§ 545 BGB (tacit extension of a lease through continued use) does not apply. Continued use of the Software after the end of the term does not create a contractual relationship; CanMe may claim compensation for such continued use at the rate of the fees last agreed. Continuation as consumption billing under § 19a(7) remains unaffected.

(2) Purchase contracts for Appliances are performed upon complete delivery and payment; no term applies.

(3) The right to extraordinary termination for cause remains unaffected for both parties. Cause exists for CanMe in particular in the event of material breaches of §§ 7, 27 or 28, material payment default despite a grace period, and the opening of insolvency proceedings over the Customer's assets, to the extent legally permissible. Where cause consists in a breach of contract, termination is permitted only after an unsuccessful warning and grace period, unless dispensable under § 314(2) BGB.

(4) Terminations require text form (§ 126b BGB).

---

§ 33 Consequences of termination

(1) The right to use the Software ends on termination. The Customer shall cease use, uninstall the Software and delete or destroy all copies including backup copies; it shall confirm this in text form on request.

(2) Prepaid fees under Commitment Plans are refunded pro rata only in the cases set out in § 19a(6).

(3) The Customer is itself responsible for backing up its configurations, policies and log data. As this data remains in the Customer Environment, CanMe owes no data return or data migration; assistance may be commissioned as a Professional Service.

(4) Title to delivered Appliances is unaffected by termination of a subscription contract. Without a valid licence, however, Appliances may be functionally restricted.

(5) §§ 7, 17, 23, 24, 25, 28, 29, 30, 31(2), 33 and 35 survive termination.

---

§ 34 Changes to these Terms and to the services

(1) CanMe may amend these Terms with effect for the future where necessary to reflect changes in law, supreme court case law, regulatory requirements, technical developments or a changed product architecture, and provided the Customer is not thereby unreasonably disadvantaged. Amendments do not affect the balance of consideration.

(2) Amendments will be notified to the Customer in text form at least six (6) weeks before they take effect. If the Customer does not object in text form within six (6) weeks of receipt, the amendments are deemed accepted; the notification will draw specific attention to this consequence and to the right to object.

(3) If the Customer objects, either party may terminate the affected contract with effect from the date the amendment was to take effect. Until then, the existing terms continue to apply. Prepaid, unused fees will be refunded pro rata.

(4) § 14(6) applies to changes in the service description.

---

§ 35 Final provisions

(1) The Customer may assign rights and obligations under this contract only with CanMe's prior consent in text form. Assignment to an affiliate or to a successor in the context of universal succession or an acquisition of substantially all assets is permitted where the assignee assumes all obligations and CanMe is informed without undue delay.

(2) CanMe may engage subcontractors and remains responsible for their performance.

(3) The laws of the Federal Republic of Germany apply, excluding the UN Convention on Contracts for the International Sale of Goods (CISG) and conflict-of-law rules.

(4) The exclusive place of jurisdiction for all disputes arising out of or in connection with this contract is Hof, Germany, where the Customer is a merchant, a legal entity under public law or a special fund under public law. CanMe is also entitled to sue at the Customer's general place of jurisdiction. The place of performance is Hof.

(5) Should any provision of these Terms be or become invalid or unenforceable, the validity of the remaining provisions is unaffected. The statutory provision applies in place of the invalid provision.

(6) Where these Terms require written form, text form under § 126b BGB is sufficient unless expressly provided otherwise.

---

CanMe GmbH Albert-Einstein-Strasse 1, 95028 Hof, Germany Managing Director: Frederik Schmidt · Local court of Hof, HRB 6912 · VAT ID DE367881093 hello@canme.cloud · legal@canme.cloud · +49 30 520041516

---

Contract documents

• CanMe End User Licence Agreement (EULA)
• Annex 1 — Service and product description including Licence Metric (German)
• Annex 2 — Responsibility Matrix (Shared Responsibility) (German)
• Annex 3 — Support, maintenance and lifecycle policy (German)
• Annex 4 — Telemetry and product data overview (German)
• Annex 5 — Open source and third-party notices (German)
• Annex 6 — Data processing agreement (DPA) (German)

Annex 7 (price list) is available to customers in myCanMe. The annexes are currently provided in German; the German versions are authoritative.