General Terms and Conditions of Business of D-Trust GmbH

1 General Information

1.1 Scope

These General Terms and Conditions of Business (the “Terms and Conditions”) shall apply for all present and future business relationships of D-Trust GmbH (“D-Trust”) in connection with the offered trust services and other certification services (collectively, the “Certification and Trust Services”) as well as for any support or advisory services associated with the acquisition and use of such services.

1.2 Exclusivity

These Terms and Conditions of Business shall apply exclusively for the Certification and Trust Services of D-Trust offered.

1.3 Conflicting Terms and Conditions of Business

Any deviating, conflicting or additional terms and conditions of business of the customer shall not become a part of the contract, even in the case of any knowledge thereof, unless their validity has been expressly agreed in writing. This shall also apply if D-Trust does not separately object to the conflicting terms and conditions in the individual case or if reference is made to correspondence, which contains or refers to the terms and conditions of the customer or a third party. D-Trust particularly hereby rejects any terms and conditions of the customer, which would involve D-Trust in a boycott that exceeds the applicable statutory EU and UN penalty provisions or would cause D-Trust to make any declarations in this regard.

1.4 Amendment of the Terms and Conditions

D-Trust shall notify the customer of any amendment of these Terms and Conditions in writing, text form (Textform) or in a form containing a qualified electronic signature. Such amendments shall be deemed approved if the customer does not object in writing or in a form containing a qualified electronic signature within 6 weeks of receipt. Otherwise the amended Terms and Conditions shall be deemed approved. D-Trust shall specifically inform the customer in this regard in such notification. In the case of any amendment of these Terms and Conditions, the customer shall have the right to terminate the contract in writing or in a form containing a qualified electronic signature in observance of a notice period of two weeks as of the effective date of the amendment.

2 Object of Agreement

2.1 Provision of Certification and Trust Services of D-Trust

D-Trust markets trust services and other certification services in accordance with Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 June 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC (the “eIDAS Regulation”). The details of the Certification and Trust Services as well as the additional services are specified on the order form or contained in the other contractual documents.

2.2 Delivery of Signature-creation Devices

Depending on the selected product, D-Trust shall deliver to the customer a certificate storage medium with a private and the associated public signature key or a suitable medium for generating the signature. The customer shall receive personal identification data (PIN) for using the certificate storage medium. D-Trust offers hardware and software for using the certificate storage medium for sale. Any impairment of the functioning of the certificate storage medium, which results from using unsuitable hardware or software, shall fall within the customer’s sphere of risk.

2.3 Certificate Repository

D-Trust shall make an up-to-date certificate repository available on the Internet for access by third parties for private or business purposes.

2.4 Revocation Service

A revocation service for certificates required by law is established and operated by D-Trust.

2.5 Services to Third Parties abroad

Unless otherwise agreed in writing between the parties, D-Trust shall provide services directly to the customer. If it is agreed that services are to be provided to third parties in countries outside Germany on behalf of the customer, the customer is the recipient of the services.

3 Individual Rights and Duties of D-Trust

3.1 Specification of Services

The details concerning the type and extent of the Certification and Trust Services beyond the provisions of these Terms and Conditions are set out in the Certificate Policy (the “CP”) and the Certification Practice Statement of D-Trust (the “CPS”), which are available under https://www.bundesdruckerei.de/de/2833-repository. D-Trust shall notify the customer in writing, text form (Textform) or via email containing a qualified signature of any amendment of the CP or the CPS, which results in substantive changes to the customer’s contractual relationship. The provisions concerning the notification of an amendment of these Terms and Conditions under clause 1.4 shall apply accordingly.

3.2 Identification

Depending on the selected product, the Identification of the customer is required prior to using the Certification and Trust Services. D-Trust shall perform the identification itself or through external bodies.

3.3 Acceptance of Contractual Offers

D-Trust shall decide whether to accept the customer’s contractual offer within two weeks. The acceptance may be declared with respect to the customer either expressly or by implication, or at the latest by providing the certificates.

3.4 Additional Information in Certificates

Additional information may only be included in the certificate if the existence of the legal relationship referenced has been reliably verified in terms of the standard processes established at the issuer. D-Trust does not verify the accuracy of the content.

3.5 Replacement of Signature-creation Devices

D-Trust reserves the right to replace signature-creation devices before the end of the respective period of use if this is necessary in order to comply with applicable laws or safeguard the legitimate interests of D-Trust or is otherwise required for an important reason, especially if a replacement becomes necessary for security reasons. D-Trust shall thereby duly take the interests of the customer into consideration.

3.6 Revocation of Certificates

D-Trust shall be entitled to revoke the certificates for the reasons specified in clause 5.4.

3.7 Support and Advice

To the extent that support and advisory services are provided according to clause 1.1, D-Trust shall select the employees assigned in this regard and offer support and advice during normal business hours on Monday through Friday, 7:00 a.m. to 6:00 p.m., except on national holidays, by way of first-level support through contact via the Internet or telephone, unless otherwise agreed. Where required for providing support and advisory services, D-Trust shall be allowed to inspect the corresponding documents or data, or the required information shall be provided.

4 Rights and Duties of the Customer

4.1 Protection against Misuse

The customer shall be obligated to

(a) keep the identification data (PIN) provided for generating signatures confidential and protect such data against the access of third parties,

(b) use the signature-creation device or the medium for generating the signature solely in accordance with the requirements of the operational environment, in particular, using secure hardware and software,

(c) use the products solely in accordance with the guidelines of D-Trust; the customer’s use of hardware or software, which is not subject to this contract, shall fall within the customer’s scope of risk.

4.2 Duty to Provide Notification of Changes to Customer Information

The customer shall immediately notify D-Trust of any changes in its sphere of influence, which could affect the administration and execution of the contractual relationship, in particular, any revocation of a power of attorney.

4.3 Revocation of Certificates.

The customer shall be obligated to immediately arrange for the revocation of certificates if

(a) the information contained therein does not or no longer corresponds to the factual circumstances,

(b) the customer has lost its private key, authorization media and/or associated identification data (PIN), a third party has gained unauthorized access, or

(c) there are reasonable grounds for suspecting that a third party has gained authorized access to the identification data (PIN),

(d) other facts justify the assumption that the certificate is no longer secure.

5 Revocation of Certificates, Reissuing

5.1 Provision of a Revocation Service

The issued certificate will be revoked by D-Trust at the request of the customer authorized to revoke or of an authorized representative.

5.2 Revocation by Third Parties

If a certificate contains official, professional or other information about a person, then the third party, who has consented to the inclusion of such information in the certificate, or the body responsible for the official, professional or other information about the person, may also demand its revocation if the power of representation or the conditions for the official, professional or other information about the person should cease to exist after inclusion in the certificate.

5.3 Submission of the Revocation Request

The request for a revocation may be submitted in writing directly to D-Trust GmbH, Kommandantenstraße 15, 10969 Berlin or via the website www.bundesdruckerei.de/sperrung.

5.4 Revocation

D-Trust will revoke the issued certificate if

(a) the person who has been issued the certificate demands its revocation,

(b) knowledge has been obtained that a certificate was issued on the basis of false information; in this case, the reason for the revocation may also be identified,

(d) there are reasonable grounds to suspect that a certificate is being misused,

(e) the signature key certificate of the certification body or of the competent authority has been revoked,

(f) facts justify the assumption that the certificate was forged or is not sufficiently forgery-proof or the electronic signature-creation devices used have safety defects,

(g) D-Trust as the Certification and Trust Services provider is otherwise obligated by law to revoke the certificate,

(h) the customer is in default of payment for more than 30 days. 5.5 Consequences of Revocation. A revoked certificate cannot be reactivated. A revoked certificate shall not be replaced. The issuing of a new certificate is to be agreed separately.

5.5 Consequences of Revocation

A revoked certificate cannot be reactivated. A revoked certificate will not be replaced. New issues must be agreed separately.

6 Terms of Payment

6.1 Prices

The agreed prices shall be invoiced for the contractual services. The customer shall be invoiced the fee after the certificate has been provided and the identification data has been transmitted. The prices of D-Trust are subject to the statutory amount of value-added tax.

6.2 Customers outside of Germany

A customer based outside Germany is obliged to provide valid proof of his entrepreneurial status (e.g. official entrepreneur certificate or valid VAT ID) when ordering the contractual service and no later than 10 days before the end of the service period. Otherwise, German VAT will be charged additionally for the contractual services, insofar as this is required by German VAT regulations. A subsequent calculation of German VAT can also be made retrospectively.

6.3 Hardware and Software

If the acquisition or temporary loan of hardware or software, especially card readers, has been agreed, this shall be deemed compensated by payment of the agreed prices, including the required simple user license.

6.4 Offsetting, Retention

The customer shall only be entitled to offset against claims that are uncontested or have been recognized by final judgment. The customer shall only be entitled to exercise a right of retention due to counterclaims resulting from this contractual relationship.

6.5 Payment of Costs for Correcting Customer Information

To the extent that the customer requests any correction of the information specified in its order, the customer shall be obligated to bear the thereby resulting costs according to the agreed prices if the customer is responsible for the inclusion of the incorrect information on the order form, for example, in the case of incorrect transmission at the fault of the customer.

6.6 Payment of Costs for Extended Periods of Validity

Certificates shall be issued for the agreed time period for security reasons. If a certificate is issued for a time period of more than 2 years at the customer’s request, the customer shall subsequently bear the risk of an encryption that can no longer be considered secure and the thereby resulting costs of any necessary revocation.

7 Contract Term, Termination

The contract shall be entered into for the length of the certificate’s regular period of validity. The right to terminate the contract for an important reason (wichtiger Grund) shall remain unaffected. The further use of the private signature key shall no longer be permitted after the termination of the contract.

8 Reissuing of Certificates

Upon expiration of a certificate’s period of validity, a new certificate shall be issued for the customer using the information that D-Trust has received and sent to the customer if an automatic extension has been agreed. Any changes to the information, which should be taken into consideration when reissuing the certificate, must be notified to D-Trust no later than six weeks prior to the expiration of the certificate’s validity.

9 Warranty

9.1 Warranty for Certification and Trust Services

D-Trust warrants that the Certification and Trust Services shall be provided to the extent selected by the customer in the order and confirmed by D-Trust upon entering into the contract in accordance with the respectively applicable statutory or contractually agreed provisions, such as, for example, the eIDAS Regulation, the CP or the CPS.

9.2 Warranty for Hardware and Software

(a) Quality and Functionality. The quality and functionality of hardware and software shall be solely defined in the license certificate or contractual documents. The contractual scope of services as confirmed by D-Trust in writing as final and binding shall be decisive. The information contained in the contractual documents is to be understood as a description of services and not as a guarantee (Garantie). A guarantee shall only be given if expressly designated as such. If the customer is an entrepreneur, only the product description of the manufacturer shall principally be deemed agreed as the quality of the goods. Public statements, promotions or advertisements of the manufacturer shall not be considered additional contractual indications of the quality of the goods.

(b) Supplementary Performance vis-à-vis Entrepreneurs. If the customer is an entrepreneur, the warranty for the hardware and software delivered by D-Trust shall be limited to subsequent improvement or substitute delivery at the option of D-Trust.

(c) Supplementary Performance vis-à-vis Consumers. If the customer is a consumer, the customer may initially choose whether supplementary performance with regard to faulty hardware or software shall take place by way of subsequent improvement or substitute delivery. D-Trust, however, shall be entitled to refuse the form chosen by the customer if such form would result in unreasonable costs and if the other form of performance would result in no significant disadvantages for the consumer.

(d) Failed Supplementary Performance. If the supplementary performance fails, the customer may principally demand at its discretion that the remuneration be reduced (reduction) or that the contract be rescinded (withdrawal). However, in the case of only minor breaches of contract, especially in the case of minor defects, the customer shall not have a right of withdrawal.

(e) Notification Duties of Entrepreneurs for Obvious Defects. Entrepreneurs shall be obliged to notify D-Trust in writing of any apparent defects of the product within a period of two weeks following receipt thereof; otherwise any guarantee claim shall be excluded. The timely dispatch shall be sufficient for observing this deadline. The entrepreneur shall have the full burden of proof for all prerequisites for any claims, especially for the defect itself, the date of determining the defect, and the timeliness of the notice of defects.

(f) Notification Duties of Consumers for Obvious Defects. Consumers must notify D-Trust in writing of any obvious defects in the goods within a period of two months from the date on which the non-contractual condition of the goods is determined. The time the report is received by D-Trust shall be decisive in determining whether the defect was reported on time. If the consumer fails to provide such notification, the warranty rights with respect to obvious defects shall lapse two months after the consumer has determined such defects This shall not apply in the case of any fraudulent intent of the seller. The consumer shall have the burden of proof with respect to the date of determining the obvious defect. If the consumer was persuaded to purchase the goods by inaccurate statements of the manufacturer, the consumer shall have the burden of proof with respect to its decision to purchase.

(g) Withdrawal from the Contract. If the customer chooses to withdraw from the contract due to a defect of title or material defect of the delivered goods after supplementary performance has failed, the customer shall not have any additional claims to compensation for damages in lieu of performance.

(h) Compensation for Damages. If the customer chooses compensation for damages after supplementary performance has failed, the goods shall remain with the customer if this is reasonable. The compensation for damages shall be limited to the difference between the purchase price and the value of the defective goods. This shall not apply to cases where D-Trust maliciously caused the breach of contract.

(i) Warranty Period. The warranty period for entrepreneurs shall be one year from the date of delivery of the goods. The warranty period for consumers shall be two years from the date of delivery of the goods. This shall not apply for obvious defects if the customer is an entrepreneur and the defect was not notified in due time (clause (e)).

(j) Special Provisions for Faulty Installation Instructions. If the customer receives faulty installation instructions, D-Trust shall only be obligated to deliver installation instructions that are free of defects if such defect prevents the proper installation.

10 Liability

10.1 Limitation of Liability

The liability of D-Trust for the products offered within the scope of the Certification and Trust Services shall be limited according to the information in the product description.

10.2 Liability for Slight Negligence

Notwithstanding clause 10.1, the liability of D-Trust in the case of slightly negligent breaches of duty shall be limited to the direct average damages that are foreseeable and typical for the type of goods and the Certification and Trust Services. This shall also apply in the case of any slightly negligent breaches of duty on the part of legal representatives or vicarious agents. D-Trust shall not be liable vis-à-vis entrepreneurs in the case of slightly negligent breaches of immaterial contractual duties.

10.3 No Limitation of Liability in Special Cases

The above limitations of liability shall not apply for any claims of the customer arising from product liability. Furthermore, the limitation of liability shall not apply to physical injury, damage to health or death of the customer caused by reasons for which D-Trust is responsible. Clause 10.1 shall remain unaffected.

10.4 Limitation Period

If the customer is an entrepreneur, any claims for damages due to a defect in the delivered goods shall become time-barred one year after the date of delivery of the goods. If the customer is a consumer, any claims for damages due to a defect in the delivered goods shall become timebarred two years after the date of delivery of the goods. This shall not apply if D-Trust may be held liable for gross negligence as well as in the case of bodily injury of damages to health attributable to D-Trust or the death of the customer.

10.5 Liability for Identification

The issuing of certificates only confirms that the required proof of identity or proof of legitimization was properly and verifiably submitted to D-Trust at the time of application in accordance with the applicable statutory regulations in Germany or the contractually agreed provisions. To the extent that the customer performs the required identification itself due to the concrete contractual relationship with D-Trust, the customer shall fulfil the requirements of D-Trust when performing such identification. If the customer does not comply with these requirements, the customer shall indemnify D-Trust against any thereby resulting claims of third parties.

10.6 Liability of the Customer

The customer shall be liable for any damages, which result for D-Trust due to the inclusion of incorrect information in the certificate caused by the customer or the incorrect use of electronic signatures that is the fault of the customer. The customer shall also be liable for any damages, which result from the authorized or unauthorized use of the services provided by D-Trust if and to the extent that the customer is responsible for such damages.

11 Discontinuation of the Certification or Trust Services

11.1 Notice of Discontinuation of the Certification or Trust Services

If D-Trust discontinues its operations as Certification or Trust Services provider, D-Trust shall inform its customers two months in advance. D-Trust shall be entitled to assign its rights and obligations under this contract to a different Certification and Trust Services provider in observance of the same notice period. The customer shall have the right to terminate the contract with effect from the date of transfer of the contractual relationship. D-Trust shall specifically notify the customer of its right of termination in the notification.

11.2 Right of Termination of D-Trust

If another Certification and Trust Services provider does not assume responsibility for the certificates, D-Trust shall be entitled to terminate the contract and revoke the certificates with effect from the date of discontinuation of the operations. In case D-Trust revokes the certificate, the customer shall be entitled to a reasonable reimbursement of remuneration.

12 Export Control

12.1 Right to Refuse Performance, Termination, Withdrawal, Exclusion of Liability

If the deliveries or services to be rendered by D-Trust require prior export or import authorization of any government and/or state authority, or if the delivery or service is otherwise restricted or prohibited due to national or international laws, D-Trust shall be entitled to suspend performance of its obligation to render such deliveries or services or to make payments until such authorization has been granted or such restriction or prohibition has been cancelled. If the delivery or service depends on the granting of export or import authorization and such authorization is not granted, D-Trust shall be entitled to terminate or withdraw from the contract at any time. D-Trust shall not be liable for any delays in delivery, which result for the reasons specified in this clause 12.1 and shall not be liable in the event that a delivery cannot be performed at all due to export regulations unless D-Trust acted intentionally or with gross negligence. The same shall apply in the case of any justified withdrawal or termination of the contract according to this clause 12.1.

12.2 Guarantee

By accepting the offer, or at the latest by accepting the delivery or service, the customer guarantees that it shall not conduct any business with the goods, which breaches applicable statutory export regulations, and shall especially execute any further deliveries, transfers or exports of the delivered goods solely in compliance with the applicable statutory export control regulations. The customer undertakes to also impose the above regulations on its customers.

12.3 Exclusion of Participants

The customer shall be obligated to ensure that no persons, entities or bodies are involved in the execution of the contract or are thereby supported, which are listed on the sanctions lists of the European Community and the United Nations (in particular Regulation (EC) No 881/2002; Regulation (EC) No 2580/2001; Regulation (EC) No 753/2011). This shall also apply with respect to any persons, entities or bodies that are listed on the sanctions lists of other governments (in particular the US Denied Persons List, US Entity List, US Specially Designated Nationals List, US Debarred List), provided that these do not unilaterally exceed UN or EU sanctions. The customer further guarantees that neither it nor any of its shareholders are listed on such a list, and that it is not under the control of or a partner of any person or corporate body found on such lists. If the customer or any of its shareholders, or a person or corporate body that the customer is a partner of, is added to a sanctions list during the term of this contract, the customer shall be obligated to immediately notify D-Trust in this regard. In such a case, D-Trust shall be entitled to terminate or withdraw from the contract at any time without the customer being able to assert any claims in this regard.

12.4 Breaches of Export Control Regulations

D-Trust and the customer agree that the effective export control on the part of the customer is an essential prerequisite for the execution of this contract. D-Trust and the customer shall therefore always consider a breach of export control regulations in connection with D-Trust products to be a severe violation of the interests of D-Trust. This shall also apply in the case of any violations committed by third parties. In this case, D-Trust shall be entitled to extraordinarily terminate or withdraw from the contract. The customer shall be obligated to indemnify D-Trust against any thereby resulting claims for damages of third parties. The customer shall be obligated to compensate D-Trust for any expenses or damages, whether material or immaterial, especially for any fines or penalties, which result due to the noncompliance with any of the obligations specified under clauses 12.1 to 12.3.

13 Miscellaneous

13.1 Compliance

Compliance is a top priority for the Bundesdruckerei Group and is something that we also expect of business partners. Therefore, the Bundesdruckerei Group does not tolerate any illegal or non-compliant behaviour. The customer hereby declares that this standard is also applicable to its actions.

13.2 Applicable Law

German law shall apply for all legal relationships existing between D-Trust and the customer. The applicability of the United Nations Convention on Contracts for the International Sale of Goods shall be excluded.

13.3 Legal Venue

The legal venue for any legal disputes shall be Berlin as far as the customer is a merchant, a legal entity under public law or a special fund under public law, or if the customer does not have a place of general jurisdiction in the Federal Republic of Germany. D-Trust may also assert its rights at the customer’s place of general jurisdiction. An exclusive place of jurisdiction, if any, shall not be affected by the foregoing provision.

13.4 Place of Performance

The place of performance for D-Trust and the customer shall be Berlin.

13.5 Invalid Provisions

The invalidity of one or more provisions shall not affect the validity of the remaining provisions.

These Terms and Conditions are current as of August 2024.