General terms and conditions (GTC)

for services and products of PREVENCY GmbH

PREVENCY GmbH | Version 28 October 2026

These General Terms and Conditions govern the provision of the PREVENCY platform and consulting, project, training and simulation services to businesses and public-sector customers. The type and scope of the services owed are determined primarily by the individual offer.

1 Scope and formation of contract

1.1 These General Terms and Conditions apply to contracts between PREVENCY GmbH, Güterstraße 20, 42117 Wuppertal, Germany, registered with the Commercial Register of the Local Court of Wuppertal under HRB 30230, represented by its Managing Director Lars Niggemann, hereinafter PREVENCY, and its customers. They apply exclusively to entrepreneurs within the meaning of section 14 of the German Civil Code, legal entities under public law and special funds under public law. Consumers are excluded from entering into a contract.

1.2 PREVENCY may be contacted at office@prevency.com, telephone +49 202 52 74 84 84 and https://prevency.com. VAT identification number: DE327215925.

1.3 A contract is formed upon acceptance of the offer, confirmation of the order by PREVENCY or commencement of performance at the customer’s request. Offers are non-binding unless a binding period is stated in the offer.

1.4 The following documents form part of the contract in descending order of precedence: the individual offer including the service description, expressly agreed service schedules, the Data Processing Agreement including its annexes where PREVENCY processes personal data on behalf of the customer, and these General Terms and Conditions. For matters of commissioned data processing, the Data Processing Agreement prevails over these General Terms and Conditions. Individual agreements between the parties take precedence.

1.5 Conflicting or additional terms of the customer apply only if PREVENCY has expressly agreed to their inclusion in text form. Performance without reservation does not constitute consent.

1.6 Where these General Terms and Conditions are validly incorporated into an existing contractual relationship, they replace PREVENCY’s terms previously applicable to that contractual relationship from the agreed effective date. Individual agreements and claims accrued before that date remain unaffected.

1.7 Legally relevant notices may be sent to the business email addresses stated in the contract unless a stricter form is required by law or contract. Each party must notify the other without undue delay of changes to its contact details.

2 Services and scope of performance

2.1 Depending on the offer, PREVENCY provides services including software and platform operation, crisis and communication simulations, training, consulting, design, support, professional services and supplementary quotas or add-on services. Only the services agreed in the respective offer are binding.

2.2 Information in presentations, product descriptions, demonstrations or websites is provided for general descriptive purposes. It becomes part of the contract only where the offer expressly refers to it.

2.3 PREVENCY may further develop the technical implementation, user interface and individual functions provided that the agreed purpose of use and the material scope of performance are maintained. Changes required for security, legal compliance or continued operation may be implemented at short notice.

2.4 PREVENCY may use suitable personnel and subcontractors to perform the services. Sub-processors for data-protection purposes are governed exclusively by the Data Processing Agreement.

2.5 PREVENCY does not provide legal, tax or audit services and does not owe legal approval of scenarios, communications, assessments or decisions unless expressly and lawfully agreed.

3 Consulting, projects, simulations and training

3.1 Consulting, design, training, simulation, analysis and support are services unless the offer expressly identifies a specific deliverable subject to acceptance. For services, PREVENCY owes professional performance but not any particular commercial, organisational or communications outcome.

3.2 Where a deliverable subject to acceptance has expressly been agreed, the customer shall review it within ten business days after delivery. Acceptance may be refused only for material defects described in a verifiable manner. The deliverable is deemed accepted if the customer uses it productively or, after having been informed of this consequence, neither declares acceptance nor reports material defects in text form within the review period.

3.3 The customer shall provide the required information, contacts, approvals, access, premises and technical prerequisites in due time. Delays or additional effort caused by late or incomplete cooperation extend agreed deadlines appropriately and may be charged at the agreed rates.

3.4 If an agreed appointment cannot take place due to illness, force majeure or another circumstance beyond PREVENCY’s control, PREVENCY shall offer a reasonable alternative date or equivalent substitute service. The customer’s statutory rights remain unaffected where PREVENCY is definitively unable to perform within a reasonable time.

3.5 If the customer cancels a binding date for a simulation, exercise, training course or other scheduled service, or requests that it be postponed, PREVENCY may charge the following flat cancellation fee: 50 per cent of the agreed remuneration attributable to the affected date where notice is received 30 to 15 calendar days before the date, 75 per cent where notice is received 14 to 8 calendar days before the date, and 100 per cent where notice is received 7 or fewer calendar days before the date or in the event of non-attendance. No cancellation fee is charged where notice is received at least 31 calendar days before the date. The flat fees take account of expenses typically saved; remuneration earned through alternative use of the released capacity shall be credited. The customer may demonstrate that no claim or a materially lower claim arose. Any non-cancellable third-party, travel and accommodation costs already incurred must be reimbursed in addition to the extent they are not already included in the cancellation fee or the agreed remuneration. Section 14 remains unaffected. A postponement is treated as a cancellation unless PREVENCY agrees otherwise in text form.

3.6 Hours, support or service quotas not used within the agreed period expire at the end of that period unless the offer states otherwise. No refund is due.

4 Platform, user accounts and support

4.1 PREVENCY makes the platform available via the internet at the agreed delivery point. The customer’s internet connection, end devices and browsers required for access are not part of the services.

4.2 For the term of the contract, the customer receives a non-exclusive, non-transferable right to use the platform within the agreed scope for its own business purposes. Use for affiliated companies or third parties is permitted only where provided for in the offer or approved by PREVENCY.

4.3 Authorised users may include the customer’s employees and governing-body members, administrators authorised by the customer, invited exercise participants and expressly included service providers or affiliated companies. User accounts are personal and may not be shared or transferred. The customer is responsible for users created or invited by it and for their contractual use.

4.4 Booked user numbers, participant seats, simulations, terms, AI credits, storage, support or other quotas are set out in the offer. Unused quotas are non-transferable and non-refundable unless the offer states otherwise. Add-on services extend the main contract only where expressly agreed.

4.5 The scope and hours of support and any agreed response times are set out in the offer. Response times are not restoration times. Individual consulting, training, content work or adaptations are not included in technical support unless expressly commissioned.

4.6 PREVENCY ensures technical availability appropriate to the contractual purpose. A specific percentage availability is owed only where expressly agreed in the offer or a service schedule. Announced maintenance, necessary emergency maintenance, force majeure and disruptions within the customer’s area of responsibility, the public internet or telecommunications networks outside PREVENCY’s control are excluded from the calculation.

4.7 PREVENCY may temporarily suspend access where necessary to avert a security risk, prevent unlawful use or address a material breach of contract. Where urgency permits, PREVENCY shall notify the customer in advance and provide an opportunity to remedy the issue.

5 Rights of use and protection of the platform

5.1 All rights in the platform, its software, documentation, design, architecture, assessment logic, general scenarios and other components supplied by PREVENCY remain with PREVENCY or the respective rights holders. The customer receives only the rights of use expressly agreed.

5.2 Upon full payment, the customer receives a non-exclusive right, unlimited in time and territory, to use work products individually created for it for internal business purposes unless the offer states otherwise. PREVENCY’s methodology, templates, libraries, general know-how and pre-existing components remain unaffected.

5.3 Documents and work products may be copied within the customer’s organisation for the agreed purpose and shared with authorised internal persons. Publication, disclosure to external third parties, commercial exploitation or modification for commercial purposes requires PREVENCY’s prior consent in text form.

5.4 The customer may not, itself or through third parties, reverse engineer, decompile, disassemble, translate or modify the platform, the underlying software or any non-public component, or otherwise attempt to determine source code, architecture, data models, algorithms, system or assessment logic, prompts, security mechanisms or other internal functionality.

5.5 In particular, the platform or its user interfaces, documentation, interfaces or outputs may not be examined, extracted or reproduced using automated methods. This includes AI systems, AI agents, language models, bots, crawlers, scraping tools and comparable technologies where used to reconstruct the structure or operation, systematically extract content outside provided export functions, develop, train, improve or market a competing or materially comparable product, or circumvent access, volume or security restrictions.

5.6 Without PREVENCY’s prior consent, the platform, its documentation and content or outputs not supplied by the customer may not be used as training, testing, evaluation or reference material for external AI models or automated systems where this may allow platform functions, content, structures or protected components to be adopted, reproduced or used for a competing offering. Contractual use of provided AI functions and analysis of the customer’s own data remain permitted provided the platform is not technically reconstructed.

5.7 Mandatory statutory rights remain unaffected, in particular legally permitted acts required to achieve interoperability of an independently created computer program. Information obtained in this way may be used solely for the purpose permitted by law.

5.8 PREVENCY may use voluntarily submitted feedback to further develop its own services without separate remuneration, provided no confidential information or customer rights are disclosed.

6 Customer data and permitted use

6.1 The customer retains its rights in data and content supplied by it or its users. For the term of the contract, it grants PREVENCY the non-exclusive rights required to store, process, display, transmit and secure them within the agreed services.

6.2 The customer shall ensure that supplied data, content, instructions and use are lawful and do not infringe third-party rights. This includes copyright, trade mark, personality, data-protection, confidentiality and competition rights and any required notices and consents concerning exercise participants and other data subjects.

6.3 Prohibited uses include unlawful content, malware, attacks on systems, unauthorised security testing, circumvention of technical safeguards, excessive automated requests and uses that may impair operation or other customers.

6.4 PREVENCY does not generally pre-screen customer content. Where there are specific indications of an infringement or security risk, PREVENCY may, after balancing the interests involved, temporarily block or remove affected content and request a statement or remedy from the customer.

6.5 The customer shall indemnify PREVENCY against justified third-party claims arising from a culpable breach by the customer of this section. PREVENCY shall notify the customer without undue delay, allow it to conduct the defence where appropriate and not enter into a settlement obliging the customer without its consent. Non-transferable regulatory penalties and breaches attributable to PREVENCY itself are excluded.

7 AI-assisted functions

7.1 Where the agreed services include AI-assisted functions, their results may be incomplete, inaccurate or unsuitable despite reasonable technical measures. They must be reviewed by a competent person before any business, legal, security-related or personnel decision.

7.2 The customer may use AI functions only for lawful purposes and with data it is authorised to process and transmit. Unless expressly agreed, the functions are not intended for solely automated decisions producing legal or similarly significant effects.

7.3 Where PREVENCY uses external providers for AI functions and processes personal data on behalf of the customer, those providers and the relevant data-protection safeguards are set out in the Data Processing Agreement.

7.4 PREVENCY may use only anonymised and aggregated information derived from customer data to analyse, improve and develop its own systems and AI-assisted functions where identification of data subjects and attribution to the customer are permanently excluded. Personal data, merely pseudonymised data, confidential content and customer-identifiable content are not used for these purposes.

8 Data protection and confidentiality

8.1 Each party processes personal data as an independent controller where it determines the purposes and essential means of processing. Where PREVENCY processes personal data on the customer’s behalf, the Data Processing Agreement incorporated as a contractual schedule applies.

8.2 The parties shall treat all non-public commercial, organisational, technical and other information of the other party as confidential and use it only to perform the contract. Access shall be limited to persons who require it for contractual performance and are appropriately bound to confidentiality.

8.3 The confidentiality obligation does not apply to information demonstrably already lawfully known, becoming public without breach, lawfully obtained from a third party or independently developed. Statutory disclosure obligations remain unaffected; the other party shall be informed in advance where permitted.

8.4 Confidentiality obligations continue for five years after the end of the contract. For trade secrets and personal data, they continue for as long as protection is required or a legal obligation applies.

8.5 The customer may be publicly named as a reference only with its prior consent in text form.

9 Data export and switching

9.1 Where the PREVENCY platform constitutes a data processing service within the meaning of Regulation (EU) 2023/2854, the following provisions apply to switching provider or transferring to the customer’s own infrastructure.

9.2 The customer may request in text form that PREVENCY initiate a switching process, transfer exportable data and digital assets to its own infrastructure, or delete them after termination. The maximum notice period for initiating the switching process is two months unless the contract provides for a shorter termination period.

9.3 PREVENCY shall support switching in good faith, maintain security and business continuity during transition, inform the customer of known risks to the continuity of the agreed functions and provide information required for exit planning. The transition period is generally no more than 30 calendar days. If technically unfeasible, PREVENCY shall inform the customer within 14 business days after receipt of the switching request, explain the reasons and specify an alternative transition period not exceeding seven months. The customer may extend the transition period once by a period it considers more appropriate for its own purposes and shall notify PREVENCY in text form no later than the end of the current transition period.

9.4 Exportable data comprise customer content and related metadata supplied by the customer or its users or generated through contractual use, including user, role, project, exercise, simulation, communication, document, media, evaluation and report data, where technically available and attributable to the customer. The standard data export is provided in structured, machine-readable JSON format. Data types that cannot reasonably be represented in JSON shall, where technically available, be provided in their customary file format. PREVENCY shall provide the description required to use the export without a separate charge.

9.5 Only PREVENCY internal data and digital assets whose disclosure would impair rights, trade secrets or the security of PREVENCY or third parties are excluded, including source code, proprietary models, internal prompts, algorithms, security configurations, internal system and staff audit data, general telemetry, internal operating data and anonymised or aggregated data. These exclusions may not prevent or unreasonably delay switching.

9.6 After the transition period, the customer may retrieve exportable data for at least 30 calendar days. PREVENCY shall then delete the exportable data and digital assets unless a statutory retention duty, a permitted longer agreement or a different provision in the Data Processing Agreement applies. The contract ends upon successful completion of switching or, if no switching is requested, upon expiry of the applicable termination period. PREVENCY shall confirm completion of the switching process and termination of the contract to the customer in text form.

9.7 Until and including 11 January 2027, switching charges may not exceed the costs directly incurred through switching and must have been disclosed before conclusion of the contract. From 12 January 2027 PREVENCY shall not charge switching fees. Agreed charges for regular services until the end of the contract and separately commissioned services outside statutory switching obligations remain unaffected.

9.8 Current information on switching and porting procedures, export formats, known technical limitations, data structures and applicable standards, as well as information on infrastructure jurisdictions and safeguards against unlawful international governmental access, is available at https://prevency.com/data-act/.

10 Fees and payment

10.1 Fees are set out in the offer. All prices are net plus applicable VAT. Invoices may be issued electronically and are due without deduction within 14 calendar days after receipt unless the offer states otherwise.

10.2 Time-based services are billed in 15-minute units. At the customer’s request, services performed at weekends, on statutory public holidays or between 18:00 and 09:00 may be charged with a 50 per cent surcharge if the customer was informed in advance.

10.3 Travel time is charged at 50 per cent of the agreed regular hourly rate. Necessary and reasonable travel, accommodation and incidental expenses are charged against receipts or at a flat rate agreed in the offer.

10.4 PREVENCY may adjust recurring fees no earlier than the beginning of a renewal period to reflect changes since conclusion of the contract in personnel, hosting, energy, licence and other directly service-related costs. Cost reductions shall be taken into account. The change shall be announced in text form at least six weeks before the renewal period. The customer may terminate before the renewal period begins if the increase exceeds five per cent.

10.5 In the event of default, statutory default interest applies. For payment claims, the rate is nine percentage points above the base rate. PREVENCY may additionally claim the statutory EUR 40 default lump sum and any further default loss.

10.6 If payment arrears are more than insignificant, PREVENCY may, after reminder and a reasonable grace period, suspend further services and platform access until payment. No prior warning is required where the customer seriously and finally refuses payment or immediate suspension is required to mitigate loss.

10.7 The customer may set off only undisputed, finally adjudicated or decision-ready claims. Rights of retention may be exercised only for claims arising from the same contractual relationship.

11 Term and termination

11.1 The term and service commencement are set out in the offer. Project and service agreements end when the agreed services have been performed. Expressly agreed work contracts end upon acceptance where no further services are owed.

11.2 If the offer contains no different provision for a subscription, the initial term is twelve months. It renews for successive twelve-month periods unless terminated in text form no later than eight weeks before expiry of the respective term.

11.3 Add-on services and additional quotas are tied to the active subscription. They do not extend its term unless expressly agreed. Unused services are not refunded when the contract ends.

11.4 The right to terminate for good cause remains unaffected. Good cause for PREVENCY includes a material breach of use or payment obligations despite warning, endangerment of the platform, or serious infringement of PREVENCY’s or third-party rights. No warning is required where it would clearly be unsuccessful or immediate termination is justified after weighing the interests involved.

11.5 Termination notices must at least be made in text form.

12 Defect rights

12.1 Statutory provisions apply to defects subject to the agreed type of service and the following provisions.

12.2 The customer shall report defects without undue delay in a verifiable form and assist in isolating them. PREVENCY shall first be given a reasonable opportunity to remedy. For software services, remedy may also be provided through a reasonable workaround or update.

12.3 Strict liability for defects already existing at conclusion of the contract under section 536a(1), first alternative, of the German Civil Code is excluded. Section 13 remains unaffected.

12.4 Claims for defects become time-barred twelve months after the statutory limitation period begins. This does not apply to intent, gross negligence, fraudulent concealment, guarantees, injury to life, body or health, or other cases of mandatory liability.

13 Liability

13.1 PREVENCY is liable without limitation for intent and gross negligence, culpable injury to life, body or health, fraudulent concealment, an expressly assumed guarantee, liability under the German Product Liability Act and other mandatory statutory liability.

13.2 For a slightly negligent breach of a material contractual obligation, PREVENCY is liable only for the foreseeable loss typical of the contract. Material obligations are those whose performance is essential to proper performance and on whose observance the customer may regularly rely.

13.3 In the cases under section 13.2, total liability per contractual year is limited to the net fees paid or payable for the affected service during the twelve months preceding the event giving rise to loss. For one-off projects, the agreed net project fee is the cap. If a higher typical loss was recognisable when the contract was entered into, that higher amount is the cap.

13.4 For indirect loss, loss of profit and other consequential loss, PREVENCY is liable in cases of slight negligence only where such loss was foreseeable as a typical consequence when the contract was entered into. For loss of data within the customer’s responsibility, liability is limited to the typical restoration effort assuming proper backups. PREVENCY’s duties to back up platform data hosted by PREVENCY remain unaffected.

13.5 The limitations of liability apply accordingly in favour of PREVENCY’s legal representatives, employees and vicarious agents.

13.6 Statutory liability under the General Data Protection Regulation, including claims by data subjects, remains unaffected. As between the parties, liability shall follow their respective contribution to responsibility where legally permissible.

14 Force majeure

14.1 Neither party is liable for delay or non-performance caused by an event outside its reasonable control that was not foreseeable when the contract was entered into and cannot be avoided through reasonable measures. This may include natural events, war, terrorism, governmental action, industrial disputes, pandemics, major energy or telecommunications failures and serious cyberattacks.

14.2 The affected party shall notify the other without undue delay, mitigate the effects to the best of its ability and resume performance as soon as reasonably possible. If the impediment lasts more than 60 calendar days, either party may terminate the affected part of the services in text form. Services properly performed remain payable.

15 Amendments to the contractual terms

15.1 PREVENCY may amend these General Terms and Conditions for future contracts at any time. For existing contracts, amendments become effective only with the customer’s consent or where the requirements of the following subsection are met.

15.2 PREVENCY may adapt provisions of an existing contract to mandatory changes in law, final decisions of the highest courts or mandatory security requirements where required to close a regulatory gap arising after conclusion, the economic balance is not materially shifted and the amendment is reasonable for the customer. PREVENCY shall give at least six weeks’ notice unless urgent legal or security implementation is required.

15.3 Changes to prices, principal performance obligations, liability, term or termination rights require express consent or apply only to a new renewal period under a validly agreed price or renewal provision. Silence does not constitute consent.

16 Final provisions

16.1 The laws of the Federal Republic of Germany apply, excluding the UN Convention on Contracts for the International Sale of Goods and conflict-of-laws rules to the extent their exclusion is permitted. In the event of translations, the German version prevails.

16.2 Amendments, supplements and ancillary agreements must at least be made in text form unless a stricter form is required by law or agreement. Individual agreements take precedence irrespective of this form clause.

16.3 The customer may transfer rights and obligations under the contract only with PREVENCY’s prior consent. Section 354a of the German Commercial Code and transfers by universal succession remain unaffected.

16.4 The exclusive place of jurisdiction is Wuppertal where the customer is a merchant, a legal entity under public law, a special fund under public law or has no general place of jurisdiction in Germany. PREVENCY may also sue at the customer’s general place of jurisdiction. Mandatory exclusive places of jurisdiction remain unaffected.

16.5 If a provision is wholly or partly invalid or unenforceable, the remaining provisions remain effective. The statutory rule takes the place of the invalid or unenforceable provision.