General Terms and Conditions

Status: 25.06.2026

Language version notice: This German version is the legally binding and authoritative version. Any English translations are provided for information only; in the event of inconsistencies, the German version prevails.

Provider/contractual partner: Etzensperger Informatik AG, Kirchweg 24, CH‑3366 Bettenhausen, Switzerland UID: CHE‑107.413.131 Contact: support@edoobox.com (or according to published contact details)

1. Scope and contract structure

1.1 These General Terms and Conditions regulate the use of the software-as-a-service platform “edoobox” (“Service”) by customers (“Customer”) and their users (“Users”).

1.2 These General Terms and Conditions apply to all services related to edoobox, including web app, mobile access, APIs, integrations, support and documentation, unless expressly agreed otherwise in writing.

1.3 Differing or supplementary conditions of the customer only apply if the provider expressly agrees to them in writing.

1.4 Order of precedence in the event of contradictions: (1) order form/offer, (2) any special terms (e.g. SLA), (3) digitally accepted or signed data processing agreement (DPA), where applicable, (4) these Terms and Conditions.

2. Definitions

2.1 Order form: the order/offer/online booking or other agreement that determines, among other things, the plan, duration, scope of services and prices.

2.2 Customer data: all data/content that the customer and/or user enters, uploads, creates or processes into the service (e.g. course data, participant data, communication content, documents, payment/booking data if provided by the customer).

2.3 Provider data: Data that the provider processes as the person responsible (e.g. account data, billing, support tickets, security and operational logs).

2.4 Third Party Services: Third-party services that are used or integrated via edoobox (e.g. payment providers, email providers, SMS, analysis, hosting, maps, single sign-on).

2.5 Documentation: technical/product-related descriptions, instructions and specifications provided by the provider.

3. Conclusion of contract, account, authorization to represent

3.1 The contract is concluded by (i) signing an order form, (ii) online ordering with acceptance of these General Terms and Conditions or (iii) activation/performance by the provider.

3.2 The customer confirms that the person placing the order is authorized to represent him.

3.3 The customer is obliged to keep all information current and correct and to communicate any changes immediately.

4. Scope of services and right of use

4.1 The provider provides the customer with the service to the agreed extent during the term of the contract. The specific scope of functions results from the order form and/or the current plan.

4.2 The Service is standard software (SaaS). A specific suitability, a specific economic success or the achievement of specific goals are not owed unless this is expressly agreed in writing.

4.3 The provider can further develop the service, adapt or change functions, as long as this does not significantly affect the contractually agreed core functionality or an equivalent solution is provided.

4.4 The customer receives a non-exclusive, non-transferable right, limited to the duration of the contract, to use the service in accordance with the contract (license to use). Further licensing, rental or making available to third parties outside the contractually intended user group is prohibited.

5. Availability, Maintenance, Support

5.1 Verfügbarkeit/SLA: A binding service level (e.g. availability guarantee, response times, service credits) only exists if expressly agreed in the order form or an SLA. If no SLA has been agreed, the provider does not owe a specific minimum availability, but will endeavor to operate in accordance with the state of the art.

5.2 Maintenance: The provider is entitled to carry out planned maintenance work. Where reasonable, planned maintenance will be announced in advance. Emergency maintenance may occur without notice.

5.3 Support: The scope and channels of support (e.g. email, telephone, ticket) can be found in the order form or the published support model.

6. User management, access and security

6.1 The customer is responsible for managing user accounts, roles and permissions within the service.

6.2 Access data must be treated confidentially. The customer ensures that users keep passwords safe and use appropriate security measures (e.g. MFA, where available).

6.3 If misuse or compromise is suspected, the customer informs the provider immediately and takes immediate measures (e.g. changing the password, blocking affected access).

7. Customer Obligations

7.1 The customer is responsible for (i) the accuracy of the content of the customer data, (ii) the legal permissibility of processing and use (including necessary information/consent), and (iii) compliance with any industry-specific regulations.

7.2 The customer ensures that only authorized users use the service and that usage is carried out in accordance with the documentation.

7.3 The customer is responsible for the local IT environment (internet connection, browser, devices, internal security). The provider is not liable for disruptions that lie outside of its area of ​​responsibility.

8. Prohibited Uses and Abuse

8.1 It is prohibited to use the Service for: a) unlawful content or actions; b) Violation of third party rights (in particular copyright, trademark and personal rights); c) Processing particularly sensitive data without an appropriate legal basis and protective measures; d) Malware, phishing, spam, unauthorized mass communications; e) Scans, penetration tests or load tests without the prior written consent of the provider; f) Circumvention of security mechanisms, rate limits or access restrictions; g) Reverse engineering, decompiling, or analysis of the source code, unless mandatory law permits this.

8.2 If misuse, security risks or serious breaches of contract are suspected, the provider is entitled to temporarily restrict or block access (suspension) in order to prevent damage and to inform the customer about this, to the extent legally and technically reasonable.

9. Customer data, content and responsibility

9.1 The customer remains the owner of the rights to his customer data. The customer grants the provider the right to store, process and transmit customer data for the duration of the contract to the extent this is necessary for contract fulfillment, support, troubleshooting, security, or as instructed by the customer.

9.2 The customer warrants that he has all necessary rights and authorizations to the customer data.

9.3 The provider is not obliged to check the content of customer data unless this is necessary to resolve technical problems, for security or due to mandatory legal obligations.

10. Third Party Services, Integrations and API

10.1 The customer can use or integrate third-party services. Third-party services are not controlled by the provider; their conditions apply additionally. The provider is not liable for third-party service availability or malfunctions.

10.2 APIs may only be used in accordance with documentation and agreed limits. The provider can throttle or block API access in the event of a security risk, misuse or excessive load.

10.3 Changes to third-party services or their interfaces may affect the functionality of integrations; The provider assumes no liability for this, unless expressly agreed.

11. Data protection and privacy – roles, security, transfers, deletion

11.1 Roles (DSG/GDPR): a) If the customer processes personal data in edoobox (e.g. participant and booking data), the customer is generally Responsible person and the provider Order processor. b) The provider is usually responsible for provider data (account, billing, support, security logs).

11.2 Data processing / DPA: Where edoobox processes personal data on behalf of the customer, the data processing agreement (DPA) is made available digitally in the edoobox account and, where required, digitally accepted or signed. The accepted DPA governs in particular the subject matter, duration, nature and purpose of processing, categories of data subjects and data, technical and organisational measures, subprocessors, international transfers, support obligations, deletion/return and evidence/audits. In the event of contradictions, the data protection and data processing provisions of the accepted DPA take precedence over these Terms and Conditions.

11.3 Subcontractor/Sub-Processor: The provider may use subcontractors. The provider lists sub-processors (directly or via a published list) and informs the customer of any significant changes (replacement/addition), so that the customer can object within a reasonable period of time. If there is a justified objection, the parties will look for a reasonable alternative; andernfalls kann die Anbieterin oder der Kunde den betroffenen Teil ausserordentlich beenden.

11.4 International data transfers: The customer acknowledges that the service can be used globally and that cross-border data processing may take place as part of the operation (hosting, support, third-party services). The provider ensures that international transfers are permissible in accordance with applicable data protection law (e.g. appropriateness, protective clauses, suitable guarantees).

11.5 Data security: The provider takes appropriate technical and organizational measures depending on the risk situation (e.g. access controls, encryption, logging, backup/restore, monitoring). Details may be described in security documentation/SLA.

11.6 Logs and monitoring: The provider may collect technical protocols (logs) to ensure operation, security, misuse detection, error analysis and performance optimization. Logs can also be used to provide evidence of contractual and security events.

11.7 Storage, export, deletion: a) During the term of the contract, the customer can export customer data within the scope of the functions provided. b) After the end of the contract, the provider keeps customer data available for data collection for a follow-up period (if agreed; otherwise: reasonable period, typically 30 days); Afterwards, customer data will be deleted or anonymized, provided there are no legal retention requirements or technical backup cycles to the contrary. c) Backup data can be overwritten with a delay for technical reasons; they are not used productively during the backup lifetime.

11.8 Reporting Data Security Incidents: The provider informs the customer of relevant security incidents to the extent that these affect customer data and the provider becomes aware of them. If the GDPR applies, at least the following applies: Processor informs controller immediately after becoming aware of it.

11.9 Audit/proof rights: Upon request, the Provider makes appropriate evidence of data security and data protection measures available (e.g. policies, technical descriptions, summaries of audits). Customer-specific audits, security questionnaires, additional evidence, DPA support and extraordinary reviews are carried out only by prior agreement, during business hours, under confidentiality and against separate remuneration, unless they are legally mandatory or triggered by a relevant security incident caused by the Provider. On-site audits are possible only in exceptional cases and must not endanger security or operations.

12. Confidentiality

12.1 Confidential information means all non-public information that is designated as confidential or should be considered confidential under the circumstances.

12.2 Both parties undertake to maintain confidentiality. The obligation does not apply to information that (i) is public without infringement, (ii) was lawfully obtained from third parties, or (iii) must be disclosed due to a compelling legal obligation (with notice to the counterparty, where permitted).

13. Pricing, Subscription, Payment, Taxes

13.1 Prices: Fees can be found in the order form/price list. Unspecified services (e.g. additional storage, additional modules, professional services) will be charged according to expenses or a separate agreement.

13.2 Invoicing: Periodically according to the order form (monthly/yearly or similar). Payment deadline: according to invoice or order form.

13.3 Delay: In the event of late payment, the provider may (i) charge reminder fees/default interest to the extent permitted by law, (ii) suspend services, and/or (iii) terminate the contract for good cause.

13.4 Taxes: Prices are exclusive of VAT unless otherwise stated. The customer is responsible for any applicable taxes, duties or withholding taxes, if permitted by law.

13.5 Price changes: Price adjustments for extension periods are permitted provided that the provider informs the customer in good time before the start of the new period and the customer can cancel up to the start of the period in the event of significant changes.

14. Trial period, upgrade/downgrade, refunds

14.1 Test phase (trial): A test phase can be offered. Duration and scope are as per the offer/order form. Unless otherwise agreed, the test phase ends automatically without any charge; Paid use requires an express order.

14.2 Change of plan: Upgrades/downgrades are possible according to plan rules. Billing and effectiveness depend on the order form/price logic.

14.3 Refunds: Unless mandatory law provides otherwise or the order form, an SLA or a written individual agreement expressly provides otherwise, fees already paid are non-refundable. Any service credits or credits exist only if expressly agreed or required by mandatory law.

14.4 Consumer withdrawal in the event of immediate service commencement: If a customer acting as a consumer has a right of withdrawal under mandatory consumer law, that right remains unaffected. However, if the customer expressly requests that edoobox begin providing the paid service before the expiry of a statutory withdrawal period and confirms that they are aware of the consequences for their right of withdrawal, edoobox will begin providing the service immediately. If the contract is fully performed during the withdrawal period, the right of withdrawal may expire in accordance with the mandatory applicable law; if withdrawal occurs before full performance, edoobox may claim compensation for value or a pro rata fee for services already provided, to the extent permitted by law.

15. Intellectual Property, Feedback

15.1 All rights to the service, software, documentation, trademarks, designs and know-how remain with the provider or its licensors.

15.2 The customer only receives the usage rights expressly granted in these General Terms and Conditions.

15.3 The provider may use customer feedback (ideas, suggestions) free of charge, for an unlimited period of time and without restriction to improve the service, provided that no customer secrets are affected.

16. Warranty

16.1 Die Anbieterin erbringt den Service mit branchenüblicher Sorgfalt.

16.2 The Service is provided on an “as available” basis. The provider does not guarantee that the service will be available uninterrupted or error-free at all times, in particular not in the event of third-party services, internet disruptions or force majeure.

16.3 The customer is obliged to report faults or defects immediately and to provide appropriate assistance in limiting/resolving them.

17. Liability

17.1 The provider has unlimited liability in the event of intent and gross negligence as well as mandatory statutory liability.

17.2 In the event of slight negligence, the Provider is liable, to the extent permitted by law, only for direct damages arising from the breach of material contractual obligations and only on a limited basis.

17.3 Liability cover (cap): Unless expressly agreed otherwise in the order form, an SLA or an individual agreement and to the extent permitted by law, the Provider's total liability arising out of or in connection with the agreement (regardless of legal basis) is limited to the fees paid by the customer for the service in the last 12 months fees paid before the damaging event. If the contract period is shorter, the amount paid up to that point applies.

17.4 The provider is not liable - to the extent permitted by law - for indirect damages, consequential damages, lost profits, loss of data (if avoidable through backups/export) or claims from third parties, unless Section 17.1 applies.

17.5 The customer is obliged to carry out appropriate data backups/exports.

18. Indemnity in favor of the provider

18.1 The customer releases the provider (including bodies, employees, auxiliary persons) from all third-party claims that arise from the use of the service by the customer/user, in particular due to: a) illegality of the customer data or lack of legal basis/information; b) Violation of IP or personal rights; c) Violations of data protection, communications or competition law due to customer content/communication; d) Misuse, security incidents, unauthorized access or API misuse by the customer.

18.2 The provider informs the customer about such claims, to the extent legally permissible, and enables the customer to participate appropriately in the defense.

19. Contract duration, termination, suspension

19.1 Duration: According to the order form (e.g. monthly/yearly). It is automatically extended by the agreed period unless properly terminated.

19.2 Ordinary termination: Unless otherwise agreed, the customer can do so at the latest 30 days before the end of the respective contract period cancel. For monthly plans, a shorter cancellation logic may apply if specified in the order form.

19.3 Extraordinary termination for good cause: Both parties can terminate without notice if there is an important reason (e.g. serious breach of contract, late payment despite a reminder, serious security/compliance violations). To the extent that this is reasonable, a reasonable grace period must be granted for rectification.

19.4 Suspension: The provider can suspend the service in the event of (i) late payment, (ii) security/abuse risk, (iii) violation of Section 8, (iv) sanctions/export controls (Section 21).

19.5 Effects of termination: The right of use ends when the contract ends. Data export/deletion takes place in accordance with Section 11.7. Obligations that by their nature continue (e.g. confidentiality, liability rules, IP, open payments) remain in effect.

20. Force Majeure

20.1 Neither party is liable for non-performance due to events beyond its reasonable control (e.g. natural events, war, terrorism, strikes, major network/cloud disruptions), provided that notice is given immediately and appropriate measures are taken to mitigate damages.

21. Export controls, sanctions, compliance

21.1 The customer warrants that he will not use the service in violation of any applicable export control or sanctions regulations.

21.2 The provider may refuse, restrict or terminate services if this is necessary to comply with sanctions/embargoes or official orders.

22. Changes to these Terms and Conditions

22.1 The provider can change these terms and conditions, in particular in the event of (i) legal changes, (ii) security requirements, (iii) product developments, (iv) adjustments to business processes.

22.2 Significant changes will be communicated to the customer in an appropriate form (e.g. email or in-app notification) at least 30 days communicated before entry into force. If the customer does not object within this period and continues to use the service, the changes are deemed to have been accepted. If the objection is lodged in a timely manner, the provider can terminate the contract at the end of the current period.

23. Notices

23.1 Legally relevant notifications are made in writing (including email) to the most recently announced contact addresses.

24. Assignment / Contract Transfer

24.1 The customer may only assign/transfer rights and obligations under the contract with the provider’s prior written consent.

24.2 The provider may transfer the contract as part of a restructuring, an asset deal or a transfer of the service to a group company if this does not significantly affect the rights of the customer; the customer is informed.

25. Severability clause

25.1 If a provision is wholly or partially invalid, the rest of the contract remains valid. The parties replace the invalid provision with an effective provision that comes closest to the economic purpose.

26. Applicable Law and Place of Jurisdiction

26.1 Substantive Swiss law applies, excluding the conflict of laws and the UN Convention on Contracts for the International Sale of Goods (CISG), to the extent permissible.

26.2 For customers acting as businesses, the exclusive place of jurisdiction is the registered office of the Provider. Mandatory statutory places of jurisdiction and mandatory consumer law remain reserved.

---