General Terms and Conditions for SaaSServices of VidLab7 GmbH

These terms and conditionsapply exclusively. Deviating, conflicting or supplementary terms and conditionsof the customer only become part of the contract if and insofar as VidLab7 hasexpressly agreed in writing. This applies in all cases, for example even if thecustomer refers to its own terms and conditions when concluding the contractand VidLab7 does not expressly object to this.

VidLab7's offer is aimed exclusively atbusinesses, i.e. natural or legal persons or partnerships with legal capacitywho conclude the contract with VidLab7 in the exercise of their trade, businessor profession (§ 14 BGB).

All offers includingservice and product descriptions of VidLab7 are subject to change andnon-binding, unless they are expressly marked as binding or contain a specificacceptance period. The Agreement is concluded by VidLab7 accepting thecustomer's order or countersigning the offer signed by the customer. Wherethere is any conflict or inconsistency between the offer and these terms andconditions, the provisions of the offer shall prevail.

Subject of this Agreementis the provision services as set out in the offer, usually including one ormore of the following functions:

- AI-based real-time conversational avatars with personalized interactions

- Real time avatar-based video AI chats that can be integrated as a widget into the customer’s website and/or in a customer-branded landing page hosted by VidLab7.

- The video chats may include functionality to evaluate and react to the end user’s video (“Avatar Vision”)

- Summarization and evaluation of conversational transcripts to assess and qualify leads or existing customers based on predefined criteria (e.g., MEDDPICC, BANT, or comparable frameworks).

- Content may be transformed, translated, or rendered into different modalities (such as text, audio, or interactive presentations) as required for the operation of the Service.

- Functionality to collect end-user data (e.g. name, email address, phone number, company information) and to obtain end-user consent (e.g. for marketing communication) via form fields, checkboxes, or conversational input within the chat widget or landing page.

- Enrichment of end user data through: Integration with customer CRM systems (HubSpot, Salesforce). Retrieval from connected third-party databases (via API)

- Sending emails to end users on behalf of the Customer, including double-opt-in confirmations, follow-up communications triggered by avatar interactions or other events, and marketing or other permitted communications.

The services are provided for thecustomer’s own use and internal business purposes via SaaS for the term of thisAgreement. The basic functionality of the service and the functions / moduleslicensed by the customer are described in the offer.

General conditions andlimitations for the use of the service (e.g. functions / modules provided,number of user accounts, maximum length of videos, resolution, maximum numberof videos that can be personalized, maximum number of variables for personalization,maximum duration of sessions, maximum number of personalized avatars,integration options etc.) are set out in the offer. The following applies:

User accounts (“creatoraccounts”) are “named user accounts” and may only be used by the respective named natural person. On request, a named person can be replaced by another.The joint use of a creator account by different persons is not permitted.

The service may include interfaces (“integrations”) that enable data exchange with third-party systems from third-party providers (for example the customer’s CRM). This requires that the customer has concluded a contract with the third-party provider for the use of the respective third-party system, which also allows the customer to use the interfaces of the third-party system.

VidLab7 may discontinue interfaces at its own discretion if and to the extent that

- the third-party provider does not make interface specifications available, or makes the specifications available under unacceptable terms or for additional fees; or

- the third-party provider does not permit use of the interface by third parties like VidLab7, or permits such use only under unacceptable terms or for additional fees; or

- an update of the interface would require an unreasonable effort.

VidLab7 continues to further develop the service. Its functionality may change and expand during the term of this Agreement provided that changes do not substantially reduce the functionality present at this Agreement’s effective date or the conditions described in Sec. 2.2.2 for discontinuing an existing interface are met.

VidLab7 provides the hardware and technical infrastructure necessary for the SaaS provision of the services and provides the technical operation of such infrastructure. VidLab7’s responsibility for hardware and technical infrastructure ends at the connection point of VidLab7’s data center to the public internet. For the avoidance of doubt, remote access to and utilization of the service is solely the customer’s responsibility.

Availability

VidLab7 provides and makes the service available for use by the customer with an availability of 98% per contract year during service hours. Service hours are Monday to Friday 8:00am to 6:00pm CET with the exception of public holidays in Germany. Availability means that the service is ready to use at the connection point of VidLab7’s data center via the Internet.

Regardless of the agreed availability, the service will usually not be shut down outside of service hours and therefore will usually be accessible on a 24/7 basis. However, VidLab7 is not obliged to make the service available outside service hours.

VidLab7 will notify the customer in advance about scheduled downtimes outside the service hours (start and estimated length of downtime).

VidLab7 will undertake commercially reasonable efforts to operate the service outside service hours and to minimize interference of maintenance with customer’s system usage. If maintenance needs to be performed during service hours due to technical or organizational reasons, the parties will coordinate such maintenance. Downtimes due to planned and announced maintenance are not to be deemed non-availability.

2.6
Additional Terms. VidLab7 engages third-party subcontractors, in particular to integrate various third party LLMs and other AI models, which may be triggered depending on the functionalities chosen by the customer. The additional terms and conditions of these third party providers set out in Appendix 2 to this Agreement apply.

VidLab7 reserves the right to check the generated videos manually for quality control purposes before making them available to the customer (moderation loop). This moderation loop can take up to one working day. Nevertheless, it is expressly pointed out that the personalized videos must also be checked manually by the customer, as for technical reasons it cannot be ruled out that the AI-based personalization may deliver incorrect or unclear results in some cases.

The customer may only use the service and the output generated with the service for its own business purposes. In particular, the customer may not use the service and the output generated with the service for or on behalf of third parties or make them available to third parties (e.g. personalization of videos on behalf of or for third parties; provision of services for third parties; advertising of third-party products or services – however, the intended access to and use of the chatbot widget or the landing pages by third parties, e.g. customers or website visitors of the customer, is permitted). Third parties also include companies that are affiliated with the customer, unless an explicit agreement on group-wide use has been made.

The customer shall be responsible for its use of the service and its use of output generated with the service. VidLab7 has no influence on the completeness and accuracy of the AI generated output and assumes no warranty in that respect. The customer shall evaluate the output and content generated by “data enrichment” features for accuracy and appropriateness for the customer’s use case, including by utilizing human review as appropriate. Output that superficially appears correct may nevertheless contain material inaccuracies. In particular, and without limitation:

3.3.1
The service may allow the customer to provide its own data as context and/or its own prompts for the generation of output. The customer shall be responsible and liable for the lawfulness and appropriateness of its own data, context and prompts and the output generated with it.

3.3.2.
In particular since VidLab7 operates in multiple jurisdictions, the lawfulness and the requirements for the lawful use of the services might differ from customer to customer. VidLab7 assumes no responsibility for the lawfulness of the customer’s use of VidLab7 services.

The customer shall be responsible for the lawfulness of its own use, deployment and integration of the services. If the customer deems the use of certain functionalities unlawful under applicable law, the customer shall refrain from using such functionality.

In particular, and without limitation the customer shall verify and ensure that the integration of the services into its own website, the design of the landing page, the customer’s use of service functionalities and the customer’s collection and processing of end user data via the services (including without limitation data enrichment, Avatar Vision, e-mail communication, as the case may be) is permitted and lawful. If necessary, the customer shall collect the end users’ consent, for example by using the customer’s consent manager and/or consent checkboxes provided by the services. The customer shall provide end users with appropriate privacy notices. To assist the customer in this regard, the services can be customized, for example with customer-specific texts, notices and links to customer privacy notices and customer terms and conditions.

The customer may not use the service for the following purposes:

- for unlawful purposes, including purposes that violate the rights of third parties or applicable laws or regulations (including without limitation privacy and advertising laws);

- for the generation of output that contains unlawful content, serves to incite hatred, incites crime or glorifies or trivializes violence, is sexually offensive or pornographic, is likely to seriously endanger the morals of children or adolescents or impair their well-being, or is offensive or degrading to third parties;

- for political campaigning, including the fabrication of personalized political messages, or lobbying purposes;

- for spamming or unsolicited advertising;

- to develop a similar product or service;

- to develop or train an AI model;

- to generate output that is likely to jeopardize the image, reputation or credibility of VidLab7.

VidLab7 may offer functionality to generate avatars for use in customer videos, live chats and chatbots, including Real Time Avatars. The customer acknowledges that due to the nature of artificial intelligence tools, third parties may create and use avatars that are similar or even the same as the customer’s generated avatars (for example because the same or similar Input was provided). The customer shall not generate and use avatars, including Real Time Avatars, that resemble existing persons, e.g., by using prompts to generate a lookalike of an existing person, or that constitute an unauthorized, deceptive or harmful impersonation.

The customer shall indemnify VidLab7 on first demand against all costs, expenses and damages incurred by VidLab7 due to the assertion of third-party claims arising from or in connection with the customer’s use of the service and/or the generated output, unless and to the extent such third-party claims are the result of a default of VidLab7. The customer will cooperate to a reasonable extent in the defense of VidLab7 against such claims and support VidLab7’s defense.

Suspension of services and removal of data

3.7.1
VidLab7 may suspend access to or use of the service or remove any relevant data from the services, acting reasonably and taking into account the customer’s legitimate interests,  if

- such access or use, or any data

- poses a security risk to or may otherwise unduly and adversely impact the services, or

- infringes or otherwise violates the rights or other interests of a third party, entails illegal or otherwise prohibited content or activities, or otherwise subjects VidLab7 to a potential liability, or

- unreasonably impairs, degrades, or reduces the performance or security of the service and any related third-party software, services, or related technology, or

- VidLab7 is required to do so under any applicable laws, or any court’s or governmental body’s order.

3.7.2
Unless prohibited under the applicable laws and if reasonable under the circumstances (as determined by VidLab7 in its own discretion), VidLab7 shall provide customer with a notice prior to such suspension or removal, and an opportunity to take steps to avoid any such suspension or removal. Any suspension of customer's right to access or use the services or removal of data shall not release customer from any of its obligations under this Agreement if and to the extent the customer is responsible for the incident resulting in the suspension or removal.

The Agreement shall enter into force upon acceptance of the offer by the customer on the date set out in the offer or agreed otherwise (“effective date”). Unless agreed otherwise in the offer, it shall continue for a one-year period and shall continue thereafter for successive one-year periods, unless terminated by either party by giving three months written notice to the end of a contract year. All services rendered by VidLab7 up to the effective date of the termination shall be reimbursed.

Either party may terminate this Agreement by written notice to the other party if that other party commits a material breach of its obligations under this Agreement and, where such breach is capable of remedy, fails to remedy such breach within thirty (30) days after receipt of written notice from the party seeking to terminate the Agreement setting out details of the breach and requiring it to be remedied.

VidLab7 reserves the right to terminate specific services or functions by giving three months notice to the customer, in particular if VidLab7 engages the services of a third-party provider for the service or function in question and the third-party provider has terminated its agreement with VidLab7 or otherwise ceases to provide the service. In the event of such a partial termination, the fee payable under this Agreement shall be equitably reduced.

4.4
Upon the termination’s effective date the customer will no longer have access to the services. Customer data will be deleted by VidLab7 at the latest at the termination’s effective date. The customer can download and export all customer data via self-service functions at any time during the term of the Agreement.

Service

During the term of the Agreement, the customer shall have the non-perpetual, non-exclusive, non-transferable and non-sublicensable right to use the service provided in accordance with Sec. 1 by way of SaaS for its own business purposes in accordance with the Agreement. Any rental, leasing and any other temporary or permanent transfer or conveyance of the service to third parties and any making available of the service for use by third parties is expressly prohibited.

The customer acknowledges and agrees that all right, title and interest whatsoever, in and to the service, including the associated software and AI models, including all intellectual property rights therein is, and shall be, owned solely and exclusively by VidLab7 and/or VidLab7’s licensors. This Agreement does not grant the customer any ownership rights of any kind or permanent rights to use the service, including the associated software and the AI models used, beyond the term of the Agreement and the intended use defined therein. All rights remain with VidLab7. This also applies to any modifications, improvements, extensions or adaptations to and in connection with the service, including the AI models used, even if these were carried out by VidLab7 on behalf of the customer.

Input and Output

The customer remains the owner of its input data provided to the service (“Input”), including the videos uploaded and personalized by the customer and data provided by the customer as context, prompts or as chat input.

If and to the extent VidLab7 acquires rights to output generated by the service via AI (“Output”), including in particular personalized videos generated with the service, chat transcriptions and recordings, VidLab7 grants the customer the exclusive, perpetual, worldwide, sub-licensable and transferable rights upon full payment of the agreed remuneration. The service may offer pre-configured avatars to be used by the customer, e.g. as Real Time Avatars in chats. For the avoidance of doubt, no rights in and to the avatars themselves or their likeness are granted to the customer, and the same or a similar avatar may in particular be used by other customers of VidLab7. Only rights in and to the actual video generated as Output are granted to the customer.

By providing Input, the customer grants VidLab7 the royalty free rights to use the Input (1) to provide the services and (2) to debug and improve the service, including the training of AI models. This includes in particular the non-exclusive, worldwide, sublicensable and transferable right to reproduce, distribute and edit the Input for the aforementioned purposes.

The customer guarantees that the aforementioned use of Input by VidLab7 does not infringe any third-party rights, in particular copyrights or personal rights. This applies in particular, and without limitation, to the rights of the persons depicted in Input provided by the customer.

The customer shall indemnify VidLab7 on first demand against all costs, expenses and damages incurred by VidLab7 due to the assertion of third-party claims arising from or in connection with the use of Input for the aforementioned purposes. The customer will cooperate to a reasonable extent in the defense of VidLab7 against such claims and support VidLab7’s defense.

Support services (e.g. access to the support platform, documentation, e-mail support) are set out in the offer.

Faults in the service are prioritized by VidLab7 and corrected according to their priority. The no-fault liability of VidLab7 in accordance with § 536a (1) BGB for initial defects is excluded. The application of § 536a (2) BGB (right to self-remedy and reimbursement of expenses) is excluded.

For the provision of the services the customer shall pay the fees set out in the offer. The fees are due and payable annually in advance, starting with the effective date unless otherwise stated in the offer.

The fees and any other amounts payable under this Agreement exclude all applicable sales, goods and services, value added, use, or other like taxes, levies and charges, chargeable by or payable to any federal, provincial, state, local or municipal taxation authority and the customer shall pay and VidLab7 shall remit the same to all applicable taxing authorities as required by law.

The fees can be adjusted once a year with a notice period of three months by notification from VidLab7 in text form by a maximum of 15% in each case. If the customer does not agree with an increase in the fees, the customer can terminate the contract within one month of receipt of the notification of change with a notice period of three months. If the customer has terminated the contract in accordance with this provision, the original fee shall remain in effect until the termination becomes effective.

The customer may only retain monies due to VidLab7 or exercise a right of set off in respect of such sums, if they relate to an undisputed claim by the customer or to a claim awarded to the customer by a final and binding court judgment.

If the customer fails to pay fees or any other amounts payable within thirty (30) calendar days after its due date, such unpaid amount shall bear interest from the date that the amount is payable to the date of payment at the rate of 10% p.a. Furthermore, such failure shall be deemed to be a material breach of this Agreement and in addition to any other remedies available to VidLab7, VidLab7 shall be entitled to suspend the performance of this Agreement until the customer has paid all outstanding amounts in full.

VidLab7 shall be liable for willfulness and gross negligence, bodily harm or liability under the product liability law (“Produkthaftungsgesetz”) or to the extent of a guarantee assumed by VidLab7 in accordance with statutory provisions. In all other cases, VidLab7’s liability shall be limited as follows:

8.1.1
VidLab7 shall only be liable for the breach of fundamental contract obligations (i.e., obligations facilitating the proper fulfilment of the Agreement, whose observance the customer typically expects). In such cases the liability shall be limited to the typically predictable damage.

VidLab7 shall not be liable for consequential damages unless such damages are subject to a guarantee.

VidLab7’s liability for all damage claims shall, in the aggregate, be limited to € 25.000,-.

By using an interface (integration) to connect third-party systems, for example the customer’s CRM, the customer authorizes the exchange of data with the respective third-party providers (including any other providers that enable the integration). The service provided by VidLab7 consists solely of enabling data exchange with the third-party provider. The further use of the transmitted data by the third-party provider is based on the customer's agreement with the third-party provider. VidLab7 is not responsible for the actions and omissions of the third-party providers connected via interfaces, their services, applications, code, technology or products.

Each party shall use confidential information of the other party solely and exclusively as may be reasonably necessary for the performance of its duties or the exercise of its rights pursuant to this Agreement. Confidential information shall be kept secret and confidential and shall not be disclosed to anyone except, on a need-to-know basis, to affiliated companies and subcontractors. Such affiliated companies and subcontractors shall be subject to substantially similar obligations of confidentiality.

The provisions of this Section shall survive the termination or expiration of this Agreement.

Confidential Information shall not include information which was known to the receiving party prior to disclosure by the disclosing party; or which was lawfully received or independently developed by the receiving party outside of the scope of this Agreement.

Upon the written request of the disclosing party at any time, the receiving party shall return all hard copy documents which contain confidential information, shall destroy all electronic documents or files which contain confidential information and shall immediately cease all use of the confidential information.

Each party may name the other party and the project as a reference for marketing purposes. Each party may use the other party’s company logo for such purposes. Further uses and publications require prior agreement of the other party.

The parties enter into the attached data processing agreement pursuant to Art. 28 GDPR in addition to this Agreement.

This Agreement shall be governed and construed in accordance with the laws of Germany, excluding their rules governing conflicts of laws.

The courts of Munich, Germany shall have exclusive jurisdiction over disputes under this Agreement, and the Parties agree that jurisdiction and venue in such courts is appropriate and irrevocably submit to the exclusive jurisdiction of such courts.

VidLab7 reserves the right to amend or change these terms and conditions. The planned changes will be announced to the customer in text form at least four weeks before the planned entry into force. The customer is deemed to have consented to the changes if the customer does not object to the changes in text form before the deadline expires. Alternatively, the customer has the right to terminate the contractual relationship before the deadline expires. Such termination shall take effect within 14 days of receipt of the notice of termination. The terms and conditions shall continue to apply unchanged until the termination takes effect.

VidLab7 undertakes to expressly notify the customer of the possibility of objection or termination and the deadlines for objection and termination, the text form requirement for objections and the significance or consequences of failing to object.

If the customer objects to the change of the terms and conditions in due form and time, the Agreement will be continued under the previous conditions. In this case, VidLab7 is entitled to terminate the Agreement within a period of four weeks.

No amendment to, or change, waiver, or discharge of, any provision of this Agreement shall be valid unless in writing and signed by authorized representatives of each party, with the exception of changes pursuant to Sec. 10.3.

If any provision of this Agreement is held by a court of competent jurisdiction to be unenforceable or contrary to law, then the remaining provisions of this Agreement, and/or the application of such provisions to persons or circumstances other than those as to which it is invalid or unenforceable shall not be affected thereby, and each such provision of this Agreement shall be valid and enforceable to the extent granted by law. The parties hereby undertake to replace invalid or unenforceable provisions, and fill gaps, by agreeing on appropriate provisions which are as close as possible to the economic purpose of the invalid or missing.

Version: November 2025

The customer has commissioned VidLab7 GmbH, Rosental 7, 80331 Munich, Germany („VidLab7“) with the provision of SaaS services for AI-supported video chats using Real Time Avatars. Performance of the services may require access to personal data of the customer. The General Data Protection Regulation sets out certain requirements for such processing of personal data on behalf of the customer. To comply with the statutory requirements, the parties agree as follows.

Definitions; Subject of this DPA

"Personal data", "special categories of data", "process/processing", "controller", "processor" and "data subject" shall have the meaning as in the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "General Data Protection Regulation" or "GDPR").

The parties enter into this Data Processing Agreement (“DPA”) to specify the rights and obligations related to privacy law. The scope and term of the services to be provided by VidLab7 are set out in the agreement on the provision of SaaS services based on VidLab7’s offer and the General Terms and Conditions for SaaS Services (the “Main Agreement”). This DPA complements the Main Agreement in respect of data protection. In the event of conflicts, the terms and conditions of this DPA shall prevail.

Scope, Purpose, and Provision of Data Processing; Categories of Data and Data Subjects

VidLab7 provides  services for the provision of SaaS services for AI-supported video chats using Real Time Avatar. Further details on the scope and purpose of data processing by VidLab7 can be found in the Main Agreement and the associated service description.

VidLab7 has potential access to the following categories of personal data:
‍

VidLab7 may process the customer's personal data solely for the purpose of fulfilling the Main Agreement or in observance of the customer's instructions. In addition to the provision of services by VidLab7, the fulfillment of the Main Agreement also includes the training of VidLab7's AI models as well as debugging and improvement of the service. If VidLab7 processes personal data based on a legal obligation pursuant to Art. 28 (3)(a) GDPR, VidLab7 shall notify the customer in advance, unless prohibited by law.

VidLab7 shall observe the customer's instructions regarding the collection, processing, or use of personal data. The customer may give such instructions at any time and at its own discretion, including instructions regarding the correction, deletion and blocking of data. VidLab7 shall immediately notify the customer if, in VidLab7’s opinion, an instruction infringes applicable data protection law or regulations. The customer shall reimburse VidLab7 for executing its instructions on a time and material basis, based on the agreed hourly rates. The customer is responsible for the consequences of its instructions (e.g. inconsistent data). Instructions shall be given in writing.

As the data controller under data protection law, the customer is responsible for assessing the permissibility of data processing, in particular the permissibility of using VidLab7's services. The customer will ensure that itsuse of the services of VidLab7 does not infringe the rights of third parties and is lawful under data protection law. If necessary, the customer will obtain any necessary consents from data subjects.

Sub-Processors
‍
3.1
VidLab7 may engage sub-processors ("Subcontractors"). VidLab7 has currently engaged the following Subcontractors:

- ElevenLabs Inc., 169 Madison Ave #2484 New York, NY 10016 NYC, US

- Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, US

- Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland

- Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, United States

- Clerk, Inc., 2261 Market Street, 10607, San Francisco, CA 94114 US

- Cartesia AI, Inc., 1766 18th Street, San Francisco, CA 94017 US

- PLUS FIVE FIVE INC., 2261 Market Street #5039 San Francisco, CA 94114, US

- Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855, Luxembourg

- OpenAI Ireland Ltd., The One Building, Lower Grand Canal Street, Dublin 2, D02 H538, Ireland

- Raintank Inc., d/b/a Grafana Labs, 165 Broadway, 23rd Floor, New York, NY 10006 United States

- Gladia SAS, 38 rue de la Tremblaie, 35510 Cesson-Sévigné France

- Theai, Inc. dba Inworld AI,  1975 West El Camino Real Suite 300. Mountain View CA 94040 United States

Contractual agreements with Subcontractors shall be substantially in accordance with the terms of this agreement and GDPR requirements.

VidLab7 shall notify the customer in advance of changes concerning the engagement or replacement of Subcontractors. If the customer has reasonable objections to the engagement of a new Subcontractor, to the effect that the new Subcontractor is not compliant with GDPR requirements, the customer may object to the new Subcontractor within 14 days after receipt of VidLab7’s notice. If VidLab7 declares that it will not forgo the new Subcontractor despite a justified objection on the part of the customer, the customer may terminate the Main Agreement by giving written notice within four weeks of receipt of the objection to the engagement of the Subcontractor.

For the purpose of this DPA, Subcontracts shall be deemed to be services directly related to the main services provided VidLab7. Not included are ancillary services utilized by VidLab7, for example telecommunication services, mail or transport services, maintenance and support or the disposal of data carriers. Nevertheless, VidLab7 shall ensure an adequate level of data protection for ancillary services, e.g., by entering into appropriate agreements and undertaking appropriate inspections.

Confidentiality

VidLab7 undertakes to commit all staff and personnel that process personal data to confidentiality unless they are already under an appropriate statutory obligation of confidentiality.

Data protection measures and audits

VidLab7 implements appropriate technical and organizational measures pursuant to Article 32 GDPR. VidLab7 may change and modify the technical and organizational measures provided that the initial level of security will not be reduced.

Upon request VidLab7 shall make available to the customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR, e.g., by providing appropriate documentation. VidLab7 shall allow for and contribute to audits, including inspections, conducted by the customer or a third-party auditor mandated by the customer. For that purpose, VidLab7 shall allow the auditor, upon reasonable prior notification, during normal business hours and without unreasonable disruption to VidLab7's operations, to verify VidLab7's compliance with the applicable obligations. The customer shall reimburse VidLab7's costs related to an audit on a time and material basis, based on the agreed hourly rates.

The customer agrees to keep all information, documents, data, and findings disclosed by VidLab7 or otherwise gathered in connection with an audit, inspection, or disclosure pursuant to Sec. 5 strictly confidential and to use such information, documents, data, and findings solely for the purpose of the privacy audit. The customer shall ensure that all personnel or third parties with access to the aforementioned information are subject to a substantially similar obligation of confidentiality, unless they are, by reason of their occupation, already subject to an obligation of confidentiality.

Notification and support obligations

VidLab7 shall promptly notify the customer of any personal data breach related to the personal data of the customer. VidLab7 will, in consultation with the customer, undertake reasonable measures to secure the data and mitigate potential negative consequences for the data subjects.

VidLab7 shall assist the customer in ensuring compliance with the obligations pursuant to Articles 32 to 36 GDPR, taking into account the nature of processing and the information available to VidLab7. The reasonable costs of VidLab7’s assistance shall be reimbursed by the customer in accordance with the agreed hourly rates, unless the assistance becomes necessary due to a default of VidLab7.

Deletion and return of data

VidLab7 will delete all personal data of the customer after completion of the services, at the latest upon termination of the Main Agreement. A separate return of data is not necessary, as all customer data can be downloaded by the customer via self-service functions as part of the service.

Data subject rights

If a data subject contacts VidLab7 for the purpose of exercising their rights as a data subject (e.g., regarding access to, erasure or rectification of personal data), VidLab7 shall promptly forward this request to the customer.

VidLab7 will, upon request, assist the customer to comply with its obligations with respect to the rights laid down in Chapter III of the GDPR. The customer shall reimburse VidLab7's assistance on a time and material basis, based on the agreed hourly rates.

Term and final provisions

This DPA automatically terminates upon termination or expiration of the Main Agreement. However, this DPA shall remain in force as long as VidLab7 possesses or otherwise has access to personal data of the Customer.

The limitation of liability agreed in the Main Agreement also applies to this DPA.

This DPA shall be governed by and construed in accordance with the laws of the Federal Republic of Germany, excluding their rules governing conflicts of laws. The parties agree that the courts of Munich, Germany shall have exclusive jurisdiction to settle any disputes which may arise in connection with this DPA.

Version: November 2025

Appendix 2 to the General Terms and Conditions for SaaS ServicesAdditional third party terms and conditions

The following terms and conditions apply in addition to the General Terms and Conditions for SaaS Services:
‍